How we handle your data.
Short version: we collect the minimum we need to run smove.city and the SMOVECITY application, we don't sell your data, and you can ask us to delete it at any time by writing to contact@smove.city.
On this page
1. Who we are
SMOVE.CITY LIMITED is a private company limited by shares, registered in the Republic of Cyprus under company number HE 406652, with registered office at 81, Griva Digeni Avenue, 6043 Larnaca, Cyprus. For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for personal data collected through smove.city and the SMOVECITY mobile application.
2. What we collect on the website
On smove.city we deliberately keep data collection to a minimum:
Contact form. If you write to us through /contact, we receive the name, email address, optional organisation, the topic you selected, and the message you typed. This goes into our support database so we can reply.
Cookies. We use a single first-party cookie that records
your choice on the cookie banner (cookieConsent in your
browser's local storage). No advertising trackers, no cross-site
cookies, no fingerprinting. See the
cookie policy for the full list.
Server logs. Our hosting provider (Netlify) keeps short-lived request logs containing your IP address, user-agent and the URLs you requested, for the purpose of running the site, debugging problems and blocking abuse. These logs are retained for up to 30 days.
3. What the mobile application collects
The SMOVECITY mobile application collects the following, only as needed to provide the features you use. We do not use any of it for advertising and we never sell it. These practices are also reflected in the App Store and Google Play privacy labels.
Account & profile. Your email address and password (the password is stored only as a salted hash by our authentication provider), your display name, and an optional profile photo.
Location. Your precise and approximate device location, used only while the app is open and only after you grant permission, to show nearby transport, plan journeys, and — only when you explicitly choose to — share your live location with a friend you select for a limited time that you set.
Messages & social. The direct and group-chat messages you send, the friends you add, and any posts, comments or trips you choose to share with others in the app.
Photos. Your profile photo and any images you attach to a chat. The app requests photo-library or camera access only when you tap to add an image.
Travel & usage data. Saved places you add (for example a home, work or hobby address), planned trips and routines, bookings you start through our partners, World Cup match predictions, and basic in-app activity that keeps features like your itinerary and streaks working.
Notifications. A device push token, so we can send the trip and match alerts you opt into. You can turn notifications off at any time in Settings or in your device settings.
AI assistant. When you use AI Buddy, the message you send and relevant context — such as the city you are viewing, an itinerary, and, only if you grant calendar permission, the titles and times of upcoming calendar events — are sent to our AI provider to generate a reply. Weather information shown in the app is fetched from a weather provider. See section 5 for who these providers are.
Deleting your data. You can permanently delete your account and everything listed above at any time, directly in the app (Profile → Settings → Delete Account) or from smove.city/delete-account. See sections 6 and 7 for details.
4. Why we collect it (legal basis)
Under GDPR Article 6, we rely on the following legal bases:
Performance of a contract — for journey planning, account features and bookings inside the app, because those are the service you asked for.
Legitimate interests — for security logs, fraud prevention and replying to messages you send us.
Consent — for any non-essential cookies or analytics that may be added in the future. Consent can be withdrawn at any time from the cookie banner or by clearing your browser storage.
5. Who we share it with
We don't sell personal data. We share it only with the service providers who help us run the platform, under written processing agreements:
Hosting. Netlify (United States) for the website. Database & backend. Supabase (EU region) for the contact form and the app's backend, including your account, messages and saved data. Email delivery. Resend (EU region) for transactional email. App stores. Apple and Google for distribution and crash reporting.
AI assistant. Anthropic, PBC (United States) processes the requests you send to AI Buddy to generate a reply. We do not allow it to be used to train models on your data. Maps, geocoding & routing. Mapbox (United States) and OpenStreetMap/Nominatim provide addresses, directions and points of interest; the underlying map is rendered by Google Maps on Android and Apple Maps on iOS. Weather. Open-Meteo provides current conditions and forecasts.
We share personal data with public authorities only where the law obliges us to do so. We do not sell personal data and we do not use it for third-party advertising.
6. How long we keep it
Contact-form messages are retained for up to 24 months from the date of receipt, after which they are deleted unless an active conversation is still open. Server logs are retained for up to 30 days. App account data is retained for as long as the account is active.
When you delete your account — directly in the app (Profile → Settings → Delete Account) or from smove.city/delete-account — your profile, messages, photos, saved places, trips, routines, bookings and predictions are removed from our live database straight away. Encrypted backups that may still contain a copy are rotated out within 30 days, after which no copy remains. We keep only the minimal records we are legally required to (for example, basic transaction records where tax law requires it), with all other personal identifiers removed.
7. Your rights
Under GDPR you have the right to access the personal data we hold about you, to have it corrected if it's wrong, to have it deleted ("right to be forgotten"), to restrict or object to processing, and to portability. You can exercise the right to erasure yourself, at any time and without contacting us, in the app (Profile → Settings → Delete Account) or at smove.city/delete-account. To exercise any other right, write to contact@smove.city and we will respond within 30 days. You also have the right to lodge a complaint with the Cypriot Commissioner for Personal Data Protection or with the supervisory authority in your country of residence.
8. International transfers
Some of our service providers are based outside the European Economic Area (notably Netlify in the United States). Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or on an adequacy decision to ensure your data continues to receive an essentially equivalent level of protection.
9. Changes to this policy
We may update this policy from time to time — typically when we add a new service or change a sub-processor. Material changes will be announced on the website at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent change.
10. Contact us
For any privacy question or to exercise a GDPR right, write to:
SMOVE.CITY LIMITED
81, Griva Digeni Avenue
6043 Larnaca — Cyprus
contact@smove.city