Privacy principles
DipIn is designed to collect only the information needed to operate the service, help people find relevant nearby activity, keep the community safe, and meet legal obligations.
Controller and contact
The controller for personal data processed through DipIn is Bas Heuver in the Netherlands. Privacy questions and requests to exercise data-protection rights can be sent to dipinhelp@outlook.com.
Purposes and legal bases
Providing the service (contract): DipIn processes account, authentication, profile, discovery, Meetup, Availability, messaging, Saved/Blocked, private-note, account-setting, and account-deletion data where necessary to provide the features a user requests and operate the DipIn service.
Safety, security, and service integrity (legitimate interests): DipIn processes limited data where necessary to prevent abuse and fraud, secure the service, moderate public-facing content before publication, investigate reports, enforce safety rules, maintain reliable backups and recovery, and prevent deleted accounts from being accidentally restored. These interests are keeping DipIn safe, trustworthy, resilient, and resistant to misuse. This includes the narrowly scoped OpenAI pre-publication moderation described below.
Optional location and notification features (consent): Where DipIn asks the user to enable optional device-location or notification processing on the basis of consent, the user can refuse or later withdraw that consent or device permission. Withdrawal does not affect processing that was lawful before withdrawal. Some location information entered or selected manually may instead be processed as part of providing the feature the user requested.
Legal obligations: DipIn may process or retain limited information where necessary to comply with an applicable legal obligation. Where more than one basis could apply, DipIn uses the basis appropriate to the specific processing purpose rather than treating acceptance of the Terms as blanket privacy consent.
Profile information and photos
Profile information you choose to provide can include your public Handle (@handle), display name, age, interests, bio, traits, profile message, how-you-connect text, visibility preferences, and profile photo. DipIn stores the profile fields it needs on the server so it can show your profile in the contexts allowed by your settings and operate discovery, requests, chats, safety, and moderation features.
Ordinary profile text is not end-to-end encrypted: the backend must be able to read the fields that it is responsible for showing, filtering, deleting, and moderating. DipIn does not make a blanket claim that ordinary profile text has a separate application-level encryption layer. Access is instead limited through backend authorization and profile-visibility rules.
Profile photos are handled differently from ordinary text. The backend re-encodes uploaded images, removes EXIF and GPS metadata, creates a normalized full image and a blurred privacy preview, and stores them in private media storage. Normal clients receive profile images through authenticated DipIn API responses rather than direct private-storage object URLs.
When an account is deleted, editable profile fields are cleared or replaced with neutral tombstone values, and ordinary profile-photo references are removed so the associated media can be deleted. Discover does not retain an account-level exact device location. Limited report-time profile evidence may remain only under the separate moderation-retention rules described below.
Chats and encrypted request content
DipIn conversations are intentionally short-lived. A normal ended or closed chat can remain available as read-only history for its lifecycle retention window and is later deleted by lifecycle cleanup. DipIn avoids promising an exact deletion second because cleanup runs as maintenance work rather than at the instant a timer expires.
Where DipIn marks private 1:1 chat messages, Meetup join-request text, Availability-response text, or private invite/agreement text as end-to-end encrypted, the service normally stores ciphertext and device-specific encrypted key material rather than readable plaintext. Device access can differ: a device that retains an older key may still read historical ciphertext that a newly registered device cannot, and DipIn cannot restore plaintext when no remaining authorized device has the required key.
Current group chats are different: their message content is stored in server-readable form and is not end-to-end encrypted. This does not change the end-to-end encryption described above for supported private 1:1 chats and request/invite text.
Reporting content is different from ordinary chat retention. A report may preserve a limited immutable snapshot of the relevant content so a later edit or deletion cannot erase what was actually reported. For supported end-to-end encrypted content, the reporting client may submit the plaintext and limited context the user is reporting so moderators can review that report; this does not give DipIn a general ability to decrypt unrelated end-to-end encrypted content.
Location and Meetup location sharing
DipIn uses location information for location features the user chooses, including nearby discovery and selecting a location for a Meetup or Availability post. DipIn does not maintain an account-level record of a user's latest exact device location merely because the user browses the map.
For Meetup discovery, people who are only browsing receive an approximate public area rather than the exact Meetup pin. DipIn stores the exact Meetup location on the server so it can operate the Meetup and apply the correct access rules. This stored Meetup location is server-readable and is not protected by DipIn's private-chat end-to-end encryption.
Exact Meetup-location sharing is off by default. A Meetup host can choose Share exact location after joining. While that setting is enabled, eligible joined participants can receive the exact saved Meetup pin. Turning this setting on does not create continuous live-location tracking and does not continuously share the host's changing device location; it shares the saved location of that Meetup.
If exact Meetup-location sharing is turned off, participants no longer receive the exact pin through that access path. When DipIn's Meetup lifecycle cleanup closes the Meetup, DipIn reduces the stored location to an approximate public location and disables exact-location sharing before later record cleanup.
Availability posts do not have the Meetup exact-location-sharing option: their server-side post location is reduced to the configured approximate area before storage.
Separately, when a viewer opens a shared Nearby-only Meetup, the app may send the viewer's current location to DipIn solely to determine whether that shared Meetup is available to that viewer. That shared-link check does not make the viewer's exact current location part of the public Meetup.
Automated pre-publication moderation
Before selected user-supplied content is published, DipIn sends limited content to OpenAI's moderation service for automated pre-publication safety screening. Depending on the action, this can include a signup Handle and display name; relevant changed profile text; normalized profile-photo image bytes; Meetup title, intro, and cost text; and Availability title and intro text.
DipIn does not add the account email address, DipIn account or user ID, coordinates, push or device identifiers, ordinary private end-to-end encrypted messages, or reporter-disclosed end-to-end encrypted plaintext to these OpenAI pre-publication moderation requests. Reporter-disclosed report evidence follows the separate reporting path described above.
DipIn uses OpenAI as a technical service provider for this screening. DipIn does not claim that this processing is confined to the European Union.
Moderation evidence
Limited moderation and security records are kept only as long as necessary. The ordinary purge target is 12 months from collection once a record is eligible for deletion, but unresolved or non-terminal records and cleanup backlogs can remain longer. A specific legal hold or legal duty can also override normal expiry.
When retained profile-photo evidence reaches its deletion deadline, DipIn records durable cleanup work so the separate stored image is also removed instead of leaving an orphaned file.
Saved People, Blocked, and private notes
Saved and Blocked are independent owner-side relationships. A person may be Saved, Blocked, both, or neither. Saved People is private and one-way: the person you save is not notified that you saved them. Blocking does not automatically add or remove Saved, and Saved does not cancel a Block.
There is at most one owner-private note for a given person. A new private note may be created while the person is Saved or while the person is Blocked; being Blocked does not require saving the person first. The note may remain while either relationship exists, and both surfaces refer to the same note when both relationships exist. Removing only one relationship preserves the note while the other relationship remains. If a note exists and the user deliberately removes the final Saved/Blocked relationship, DipIn requires explicit confirmation that the note will also be deleted from the service. Once deleted, the note is no longer available through DipIn, although encrypted backup copies may temporarily remain under normal backup-retention and recovery rules. Explicitly deleting the note removes only the note and does not change Saved or Blocked relationship state.
Private-note plaintext is end-to-end encrypted before upload. DipIn stores the note ciphertext plus device-specific wrapped/encrypted key envelopes so authorized devices can receive the note key; DipIn cannot normally decrypt the note plaintext. Losing or revoking every device that still has the required key can therefore make old note plaintext unrecoverable by DipIn.
Current account-deletion cleanup removes Saved/Blocked relationship state and private notes owned by or about the deleted account. Other historical product records that are permitted to remain after account deletion use an anonymized Deleted account lifecycle identity rather than the deleted person's former Handle or display name. Normal backups may temporarily retain earlier copies under the service's backup-retention and recovery process. DipIn also keeps a minimal deletion-ledger record outside active account data so restored backups can be reconciled and a deleted account is not accidentally brought back.
Your privacy rights
Depending on the processing and applicable law, you may have rights to access, correct, erase, or restrict processing of your personal data, to object to certain processing, and to receive portable data where the portability right applies. Where a specific processing activity relies on consent, you may withdraw that consent without affecting processing that was lawful before withdrawal.
You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (AP), the Dutch data-protection supervisory authority. You may contact DipIn first at dipinhelp@outlook.com if you want DipIn to address a privacy concern directly.
Service providers and transfers
DipIn uses Hetzner for production hosting and private media storage in Germany; Resend for transactional email delivery; OpenAI for the pre-publication moderation screening described above; Google Maps SDK for maps and location user-interface features; and push-notification infrastructure to deliver notifications to registered devices.
Resend currently sends DipIn email through its Ireland sending region, while provider-side customer-data storage can remain in the United States. Email delivery can involve the recipient email address, sender, subject, plaintext message body, and action links or tokens. DipIn has open and click tracking disabled and does not add its own tracking pixels.
Current DipIn push notifications use generic notification content and do not include chat text, Meetup titles, user names, or coordinates. Google Maps SDK processing is separate from DipIn's backend storage and can involve technical network, device, request, and map-interaction data under Google's service terms. DipIn does not present this section as a promise that all processing by every provider stays inside the EEA.
Where provider processing involves a transfer of personal data outside the EEA, DipIn relies on the transfer safeguards applicable under the relevant provider terms. OpenAI's current data-processing terms provide for OpenAI Ireland to process EEA data and for onward transfers to use European Commission Standard Contractual Clauses or an applicable adequacy decision. Resend's current data-processing terms incorporate the EU Standard Contractual Clauses for relevant transfers outside the EEA. Google Maps Platform's European data-protection terms also incorporate Standard Contractual Clauses for relevant overseas transfers. Information about these safeguards, including how to obtain the applicable terms, can be requested at dipinhelp@outlook.com.
Contact
Privacy and data-protection questions can be sent to dipinhelp@outlook.com. General product and support questions can be sent to dipinhelp@outlook.com.