Serbs.social Privacy Policy

Version 1.4.1 (private beta) · Last updated: 19 October 2026

1. Who we are

Serbs.social (the "Service") is provided by Parada Co Pty Ltd (ACN 703 107 180, ABN 73 703 107 180) ("Serbs.social", "we", "us", "our"), of 2, 290 Boundary Street, Spring Hill QLD 4000, Australia.

You can contact us about privacy at support@serbs.social, or write to us at the address above.

This Privacy Policy explains how we collect, use, disclose and protect personal information when you use the Serbs.social app, website and related services. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The beta starts with invited people in Australia and is planned to open to invited people in other countries later; section 10A explains the extra rights you may have if you live outside Australia.

This policy is a notice. It tells you what we do with personal information. It is not a contract and we do not ask you to agree to it; the agreement between you and us is our Terms of Use. When we want your permission for something optional, we ask separately, it is off unless you turn it on, and you can turn it off again at any time.

2. The private beta

The Service is currently an invitation-only private beta. It is:

• for people aged 18 or over whom we have invited and approved. In the first stage (week 1) we are inviting only people who are currently in Australia;
• still being tested, so some features are switched off or unfinished;
• something we may change, pause or end at any time;
• opened in stages: we are starting with Australia and may invite people in other countries later.

The beta starts with photos and stories. Some other features described in this policy are not available in the beta yet and are switched on later, one at a time: videos, voice and video calls, push notifications and translation. This policy describes how each of them works when it is on, so you can see what would happen before it starts, and we tell you in the app when a feature is switched on. Some smaller features described here may not be in every version of the app yet; a feature that is not in your app does not collect anything. Browsing posts by hashtag is switched off in the beta; you can still type a #hashtag in a post.

We do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has an account, we will close it and delete their information, except a minimal record we must keep to protect children or to meet a legal obligation (see section 9).

3. What we collect

We collect only the information we need to provide and protect the Service.

3.1 Information you give us

• Account details:
  • your email address;
  • your password. Our hosting provider stores it only in a protected (hashed) form, and we never see it;
  • one-time codes we email you to confirm your address;
  • the username and display name you choose.
• Eligibility confirmations: that you are 18 or over, that you will follow the laws where you live and, while we are inviting people in Australia only, that you are currently in Australia, and when you confirmed each. These are declarations you make: we do not check your age or where you are with documents, GPS or your IP address.
• Profile details you choose to add: bio, hometown, country, links, languages, your city, and a profile photo and cover photo if you add them.
• Content you create:
  • posts (including photos and videos you add), comments, replies and reactions;
  • descriptions and tags on photos: a description of a photo you post (alt text, up to 1,000 characters) and up to 20 tags of other members in a photo. A tag records the tagged account, who placed it and where in the picture it sits (a position inside the image, not a place on a map). Tags are placed by members by hand; we do not use face recognition to identify people in photos;
  • saves and collections;
  • direct and group messages (including one to four photos in a message), group chat images and message reactions;
  • stories (a photo, with any text you add to it) that you share for 24 hours, and likes you give to stories. A reply to a story is sent as a direct message;
  • messages, replies and reactions in the Serbs World live rooms and, if you create a room of your own, its name, an optional topic, a colour, who created it and when, and who has joined;
  • community and event content (including community profile and cover images and event cover images) and RSVPs;
  • business profile information.
• Your settings and choices: who you follow, block or mute; your privacy settings; your notification preferences (and, when push notifications are on, which kinds you want and whether message previews are shown).
• Records of what you were shown and accepted:
  • which versions of this Privacy Policy and of the short notice shown when you join you acknowledged, in which language, where in the app, and when;
  • which version of our Terms of Use you accepted and when, with the versions of this policy and of that notice in force at that moment;
  • these records are kept while your account exists and deleted with it (section 9).
• Reports and requests: reports you make about content or people (including the reason you choose and any note you write, up to 1,000 characters, which can describe other people), appeals, privacy requests, and emails you send us.

3.2 Information created when you use the Service

• Service and security records:
  • our hosting provider records technical information about each request to our servers, such as your IP address, the time, the request made, your device's operating system and the app version;
  • sign-in records include the IP address and the type of device used to sign in;
  • we use these records to operate, secure and troubleshoot the Service, and to prevent abuse.
• Sign-in sessions: records of your active sessions, so you stay signed in and can be signed out.
• Push notifications (only when switched on): if you allow notifications, your phone gives us a device token issued by Apple (APNs) or Google (FCM), with the phone type, the sign-in session it belongs to and your app language. We also keep your notification choices and a record of each notification we prepared for you: who it was for, who or what it was about (by identifier), its kind, the time, and whether Apple or Google accepted it for delivery or why it was not sent. These records do not contain message text. The notification itself, which Apple or Google deliver to your phone, has a title and a short text and identifiers that open the right screen in the app. Even with previews off, the notification shows the other person's @username and the kind of activity (for example "New message from @ana"). If you turn on message previews (they are off unless you do), up to 100 characters of a direct (one-to-one) text message can be part of the notification. That text then passes through Apple's or Google's servers and can appear on your lock screen. Previews never include group messages, comments, or messages that were unsent or removed before the notification was prepared. We do not use notifications to ring you for calls.
• Voice and video calls (only when switched on): you can call from a direct conversation that has been accepted, or from a group you are in. A group call rings every member of the group except anyone you have a block with (either way) and accounts under a safety restriction; up to 8 people can be connected at once. A call rings only while the other person has the app open. We keep a record of each call: which conversation it was in, who was asked to join and who took part, whether it was voice or video, when each person was asked, answered, joined, was last connected and left, how the call ended, and how many minutes were used. A short note of the call is added to the conversation, for example "Voice call · 4 min", "Missed voice call", "No answer", "Call declined" or "Call cancelled". During a call you can report or block any other person in it. During a call your voice and, in a video call, your camera picture pass through our call provider (section 6) to the other people in the call, together with connection details such as your IP address. The provider is given a random call identifier and a random identifier for each person in the call, not your name, username or account identifier, but our records can link those identifiers back to accounts, and a voice, a face or an IP address can identify a person. We do not record, transcribe or analyse calls and the app has no call recording feature, but other people in a call can record it on their own devices. We may use call records to investigate safety concerns and to control cost.
• Story views: when you watch someone's story, we record that you viewed it and, if you like it, that you liked it. The story's author can see this, and it lets the app show you which stories you have already watched.
• Translations (only when translation is switched on): when you tap "See translation" on a post, comment or message, we send that text to our translation provider (see section 6) and show you the result. For the daily translation limits we count how many translations you used today. We do not keep a record of which items you translated. A short-lived technical record exists only while a translation is being made, normally a few seconds and never more than about an hour.
• Anti-abuse counters: short-lived counters that limit automated or excessive use.
• Founding Member status: a record that you joined during the beta. It appears as a badge on your profile.
• Online status (only when switched on): while the app is open on your screen, it tells our server about every two minutes that you are online, with your phone type (iPhone or Android) and the app version. Nothing is sent while the app is in the background or when you are signed out, and nothing is stored on your phone for it. We keep the last time you were seen, the last day you were active, your phone type and the app version (replaced each time), and a list of the days you were active. This record holds no IP address, location or device identifier. We use this only to run the beta: to count how many members are online or active, in which cities, and which app versions are in use. These counts have no names in them, and a city is shown only when at least 3 members there are online. Only the owner can see this information. Other members never see it, and for each member the owner's dashboard shows only the last day they were active, never a time or a history.

3.3 Information stored on your device

• What the app keeps on your device:
  • your sign-in session, in your device's secure storage (iOS Keychain or Android Keystore);
  • an encrypted copy of some of your account data, so the app works smoothly and can finish actions that were waiting for a connection;
  • photos and videos you have chosen, in temporary prepared copies made for the upload. The app keeps a copy while an upload is waiting, or so it can try again later if our check could not be completed;
  • your app preferences, such as language and script, appearance, time format, haptics, reduced motion, and whether the Serbs World card is folded.
  • your Home feed choice (Recommended or Following). It is never sent to us, and it is cleared when you sign out or remove the account from the device.
• Who can see it: this information stays on your device and is not sent to us, except where it is needed to perform an action you take.
• How to remove it: use Remove this account from this device in Settings, or delete the app.
• Videos of other people (when video is switched on): they never start by themselves. A video is downloaded and played only when you tap it. The playback link we give your app works only for a short time and is not stored on your device.

3.4 Information from others

• Content that other users post about you or send to you, for example mentions, messages, photo tags and reports. A photo another member posts may show you or name you in its description or a tag.
• Information from the person who invited you, or from the waitlist, used to approve your access.
• If you test the app through TestFlight or Google Play testing, Apple or Google send us crash reports from your device (when your device settings allow it) and any feedback you choose to send them (which can include a screenshot and your comment).

3.5 What we do not collect

• We do not collect your precise location (GPS). If you choose a city, we store only that city. We do not use your IP address to work out where you are.
• We do not access your contacts or calendar. The app asks for your camera when you take a photo, record a video or (when calls are on) make a video call, and for your microphone when you record a video or (when calls are on) make a call. It uses them only while you are doing that. It asks to send you notifications only when push notifications are on.
• The app does not run advertising, analytics or tracking tools, and we do not use advertising identifiers.
• Photos and videos: the app accesses only the photos and videos you choose to share, or your camera (and, for a video, your microphone) while you are using it to take a photo or record a video. Before anything is uploaded, the app makes its own copy: photos are converted to a standard JPEG (at most 2,048 pixels on the longest side) and, when video is switched on, videos to a standard MP4 (at most 3 minutes, at most 1080p), and location and other hidden details are removed. Our server then rebuilds the file again before it is checked. Removing hidden details does not make a photo or video anonymous: people, places and documents shown in it can still identify you or others. A video keeps its sound unless we have switched sound off for new videos.

4. How we use your information

We use personal information to:

• Provide the Service:
  • create and manage your account;
  • show your profile, posts and messages to the people you choose;
  • show your stories to the people you choose for 24 hours, and show you who viewed and liked them;
  • deliver messages and in-app notifications;
  • translate a post, comment or message into your app language when you ask for it, once translation is switched on (we never translate automatically);
  • connect you with the people you choose in voice and video calls and room conversations, and send you the notifications you asked for, once those features are switched on;
  • show the description and tags of a photo to the people who can see that photo (a tag is shown only where the tagged member's profile, audience and block settings allow it).
• Personalise what you see:
  • Home shows your posts and posts from people you follow, newest first, moved up a little when people like, comment on, save or repost them. Up to 1 in 4 posts (1 in 2 while you follow fewer than 5 people) are popular public posts from other members;
  • Following: if you choose Following in Settings (Home feed), Home shows only your posts and posts from people you follow, newest first. It does not use anyone's activity;
  • Nearby shows public posts from members who show the same city as you, and from cities in the same country within 100 km when your city is quiet;
  • the Serbs World map shows how active each city is, as a level only;
  • Suggested people suggests accounts you may know, and suggested communities suggests public communities you may like;
  • how this works: we count each person's like, comment, save or repost once, never the author's own. Activity from accounts under a restriction counts for less. In order of weight, Home and Nearby use: whether you follow the author; how recent the post is; how many different people liked, commented on, saved or reposted it; and whether it is under report or mostly an argument. Suggested people also uses the city you show on your profile, the following lists of people you follow (only where their privacy settings allow it), communities you share, and whether the person follows you. Communities marked as sensitive (for example about faith, politics or health) are never suggested and never used as a reason;
  • safety first: a post that someone reported, or that is mostly an argument between a few people, is not shown to people who don't follow its author until we review it. Posts from people you blocked or muted, and posts you reported, are hidden for you;
  • reasons: each suggestion, and each post in Home when you tap Why you're seeing this, shows one reason, such as "You follow this profile", "Popular on Serbs.social" or "In your city", never a number or the names of people who liked or saved it;
  • what we never use: your messages, what you look at or for how long, your profile details (such as bio, hometown or languages), the words or pictures in posts, or guesses about you. We do not store a ranking or profile of you. None of this ranking produces legal or similarly significant effects on you.
• Keep people safe:
  • review reports, including the reason you chose and any note you wrote (which can name or describe other people). To decide which reports need attention first, and when a room message is hidden automatically, we weigh each report using signals about the reporter: how long their account has existed, whether their past reports were dismissed, whether they have been timed out, and whether the reporters follow each other. This only orders our review and can hide a room message until someone looks at it;
  • check photos and videos automatically before they are published (section 4A);
  • enforce our Terms of Use;
  • prevent spam, fraud and abuse;
  • respond to the eSafety Commissioner or law enforcement where required by law.
• Run and improve the beta: fix problems, maintain security, watch usage and cost (for example call minutes and photo and video checks) and plan improvements.
• Communicate with you about your account, the beta, and changes to this policy or our terms. We do not send marketing messages without your consent, and any marketing message will include a way to unsubscribe.
• Meet our legal obligations, and establish, exercise or defend legal claims.

We do not sell your personal information, we do not use it for advertising, and we do not use it to train artificial intelligence models. If we introduce advertising in the future (for example, local businesses promoting themselves in areas of the Serbs World map), we will:

• update this policy and tell you in the app before it starts;
• explain what information is used;
• never use private messages or sensitive information (such as ethnic origin, religion, politics or health) to choose ads;
• not sell your personal information.

4A. Decisions made automatically

Some decisions are made by our systems without a person checking first:

• Photo and video checks. Every photo and video is published or refused by an automated check (section 6, Sightengine). This covers photos in posts, stories, direct and group messages, and profile, cover, community, event and group images. The check uses the photo or video itself and the scores it produces. For videos the check looks at a picture every 2 seconds or so, and does not check the sound, so it cannot promise that every moment of a video has been checked. A photo or video that fails is refused. If the check estimates that a photo or video may show a person under 18 in a sexual or suggestive context, it is refused and the account is suspended at once, and we keep a record as described in section 9.
• Reports in the live rooms. When reports about a room message reach a threshold, the message is hidden automatically until a moderator looks at it. Reports are weighted using the signals listed in section 4.
• Child-safety reports. Where the app offers the "Child sexual abuse or exploitation" report reason, a photo that a member reports for that reason is hidden from everyone at once while we review the report.
• Empty rooms. A Serbs World room that members create is closed and deleted automatically when its last member leaves (section 9).
• Calls (when switched on). A call ends, or a person is taken out of it, automatically when someone in it blocks another person, when an account is put under a safety restriction, when a daily or monthly call limit is reached, after 2 hours, when one person has been alone in it for 3 minutes, when nobody answers within 45 seconds, or when we switch calls off. If our system that disconnects people from calls is not working, new calls are refused until it is.
• Reported posts. While a report about a post is open, the post is not shown to people who don't follow its author, and it gets no lift from activity. Its author's followers still see it. A person reviews the report.
• Limits. Rate limits and daily limits (for example on uploads or translations) refuse a request automatically when a limit is reached. This has no lasting effect.

If you think an automated decision about you is wrong, use Appeal in the app where it is offered, or write to support@serbs.social. A person will review it.

5. Who can see your information

Anything you share with others can be copied or screenshotted by them. Please share thoughtfully.

Our authorised personnel can access stored information only where needed to:

• operate and secure the Service;
• investigate a report or a breach of our Terms of Use;
• comply with the law.

6. Who we share information with

We share personal information only:

• With our service providers. They process it for us under contract, only to provide the Service:
  • Supabase (Supabase Pte. Ltd., Singapore, with its affiliate Supabase, Inc., United States, for support): database, sign-in, file storage and server functions. Your data is stored in Supabase's Sydney, Australia (ap-southeast-2) region. The server functions that check uploaded photos and videos run in the Supabase data centre nearest to you, so a photo or video may be processed briefly in another country before it is stored in Sydney. Supabase personnel and Supabase's own service providers, most of them in the United States, may access information to support or secure the Service;
  • Plus Five Five, Inc., trading as Resend (United States): email delivery, to send sign-in and confirmation codes to your email address. Resend keeps a copy of each email it sends, including the code, and delivery records, in the United States for 30 days;
  • Microsoft: email hosting for our support mailbox. Emails you send to support@serbs.social are stored there;
  • Apple and Google: when you download the app through their stores or testing programs (TestFlight and Google Play testing), under their own privacy policies. If you test through TestFlight or Google Play testing, they send us crash reports and any feedback you choose to send (section 3.4). When push notifications are on, Apple's Push Notification service (APNs) or Google's Firebase Cloud Messaging (FCM) delivers notifications to your phone: we send them your device token and the notification (a title, a short text and identifiers), and they may keep their own logs. We do not send notifications through any other push relay.;
  • Kozelo SAS, trading as Sightengine (France): automated image and video moderation. Each photo you upload (including a photo in a story, a photo you send in a direct or group message, and profile, cover, community, event and group images) is sent to Sightengine as a rebuilt copy made by our server. When video is switched on, for each video the rebuilt video file and a still image you choose (the cover) are sent. The video file Sightengine receives includes the sound. It checks them for nudity, sexual content, violence, weapons, drugs, hate symbols, self-harm and similar harmful content, and estimates whether people shown may be under 18. For videos, Sightengine checks one picture about every 2 seconds (we can set this between half a second and 2 seconds); it does not check the sound. A photo or video that fails is not published and is deleted. If the check cannot be completed, the photo or video is not accepted and no copy of it is kept; the app asks you to try again later. The estimate of whether someone may be under 18 is used only for our safety checks and is kept with the file's technical record (see section 9). No person at Serbs looks at a photo or video that fails the check. Sightengine processes this content to provide the check, under its terms of service, which include its data-processing terms. Sightengine uses cloud providers in France, Germany and the United States. By default, it sends each check to whichever of its servers is available, so your photo or video may be processed in the European Union (France, Ireland, Germany or Finland), Canada or the United States. A private photo sent in a message is also sent to Sightengine.;
  • LiveKit (LiveKit Cloud, United States project region): voice and video calls, only when calls are switched on. During a call your voice and, in a video call, your camera picture pass through LiveKit's servers to the other people in the call, together with connection details such as your IP address. We give LiveKit a random call identifier and a random identifier for each person in the call, not your name, username or account identifier. LiveKit is not asked to record the call, and we do not claim calls are end-to-end encrypted.;
  • Google LLC (Google Cloud Translation, United States): translation, only when translation is switched on. When you tap "See translation", the text of that one post, comment or message is sent to Google to be translated. No other information about you or the author is sent with it. Google processes the text on its worldwide network, only to provide the translation, under the Google Cloud data-processing terms, and does not use it to train its models;
  • Cloudflare, Inc. (United States): delivers our web pages, including this policy and our other legal pages, and the small page shown when you open a shared Serbs.social link (link.serbs.social) in a web browser. Cloudflare processes your IP address and browser details to deliver them;
• With other users, as described in section 5 and according to your choices.
• When required or permitted by law:
  • for example, to comply with a court order or a notice from the eSafety Commissioner;
  • to assist law enforcement;
  • to lessen or prevent a serious threat to someone's life, health or safety;
  • suspected child sexual abuse material: if our automated checks identify it, the material is not published or kept and the account is suspended at once. If a member reports it using the child-safety reason (where the app offers it), we hide it from everyone at once while we review it, and if we confirm it we delete our copies and suspend the account. We refer the relevant account and incident details (such as the username, the time and a digital fingerprint of the file) to the Australian Federal Police or another appropriate authority.
• In a business transfer: if our business is merged, sold or restructured, personal information may transfer to the new owner, who must continue to protect it in line with this policy.

Overseas disclosure and transfers. Your information is stored in Australia (Sydney), wherever you live. If you use the Service from outside Australia, your information is transferred to Australia, whose data protection laws may differ from those of your country. We make this transfer because it is necessary to provide the Service you have asked to use, and we protect your information as this policy describes. Some of our providers, or their staff or service providers, are in other countries: the United States (Supabase support, Resend, Google, Apple, Microsoft, Cloudflare, LiveKit, Sightengine and its cloud providers), Singapore (Supabase), France and Germany (Sightengine and its cloud providers), Ireland, Finland and Canada (Sightengine's servers), and wherever a Supabase server function runs when it checks a photo or video you upload (the data centre nearest to you). When you ask for a translation, the text you chose is processed by Google outside Australia. When you make a call, your voice and picture are relayed through LiveKit, which has a United States project region and may use relay servers in other places. Notifications pass through Apple's and Google's servers. These providers' personnel may access information to support or secure the Service. We take reasonable steps, including contractual protections, to ensure overseas recipients handle personal information consistently with the APPs.

7. Links and news articles

The Service may show links to news articles and other websites, and previews of them. We create these previews on our own servers, so publishers do not learn who is reading the Service; the app never loads a publisher's image directly. One exception: for a YouTube link, the preview appears only if you tap Load preview, and then your phone contacts YouTube (Google) directly, so Google receives your IP address and learns which video you are looking at. If you open a link, you leave the Service, and that website's own privacy policy applies.

8. How we protect your information

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include:

• encrypted connections;
• access controls on our database, so each person can reach only what they are allowed to see;
• protected password storage;
• limits on automated and excessive requests;
• invitation-only access;
• restricting administrative access to authorised personnel using two-step sign-in.

No online service is completely secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and any other regulator that the law where you live requires us to tell (for example, within 72 hours in the European Union and the United Kingdom).

9. How long we keep your information

• Account information and content: kept while your account exists and the beta runs.
• Photos: kept with the post, story, message, profile, community, event or group they belong to, until the photo is removed or replaced, or the item or your account is deleted. When you replace or remove a photo, or unsend a message with a photo, the old photo is withdrawn at once and its stored file is queued for deletion and removed from our storage by our clean-up process, which may take a short while. A photo that was uploaded but never used is withdrawn after 7 days, and an upload that is never finished is cancelled after 1 day. Photo descriptions and tags are kept with the photo and removed when a tag is removed or the photo, the post or the account is deleted.
• Videos (when switched on): the file you upload is kept only until our server has checked and re-packaged it (usually minutes; at most 2 hours if the upload is never finished), then deleted. The re-packaged video and its cover are kept with the post until you delete the post or your account. A video that is never published is deleted after 7 days. No person reviews videos before publication: each one is published or refused by the automatic check. If our automatic check cannot be completed, the video is deleted at once and you can try again. A video that fails the check is deleted at once.
• Technical records of photos and videos: when a photo or video is checked, we keep a short technical record (sizes, length, file fingerprints, the check result and its scores, or the failure code if the check could not run), but not the photo or video itself. It is kept for up to 30 days after the photo or video is deleted, refused or not accepted. Counts of how many photos and videos you uploaded and had checked are kept per day for 40 days, and as totals without names for 400 days.
• Child-safety records: if the automatic check estimates that a photo or video may show a person under 18 in a sexual or suggestive context, we keep a record of the account, the time, fingerprints (hashes) of the file and the check's scores for 2 years, so we can report it to the authorities. The photo or video itself is not kept, and the account is suspended at once. When a member reports a photo as child sexual abuse, we keep the same kind of record while we review the report: if we confirm it, the account is suspended and the record is kept for 2 years; if the report was mistaken, the record is closed and deleted with the account if the account is deleted, and otherwise after 2 years. A record whose matter is still open, or has been referred to an authority such as the police, is not deleted at 2 years or when the account is deleted: we keep it, with any reported photo we are still holding hidden, until the matter is closed.
• Stories: shown for 24 hours, then deleted automatically together with their photo, the list of who viewed and liked them, and our record of replies (the replies themselves stay in your messages). This happens within 24 hours of the story ending, which relies on a scheduled job. You can delete a story earlier. If a story is reported, the report keeps a copy of the story's text and a technical fingerprint of its photo (not the photo itself), as described for reported content below.
• Translations: a translation of a post or comment is kept so other readers can see it without a new request. It is deleted when the original is edited, deleted or removed, when its author's account is deleted, and after 30 days at the latest. Translations of messages are never stored on our servers. The count of translations you used today is deleted after 2 days.
• Calls (when switched on): the record of a call is kept for 90 days after the call ends. Each person's daily call usage count is kept for 35 days, and monthly totals without names for 13 months. Technical records of events from the call provider are kept for 2 days and records of our housekeeping runs for 7 days. A call note in a conversation follows the retention of the conversation. When an account is deleted, its entries in call records and its usage counts are removed and it is removed from any call in progress, but a call record can remain for the other people who took part. The call provider's own retention is not yet confirmed.
• Push notifications (when switched on): your device token is deleted when you sign out of that session, when Apple or Google tell us the token is no longer registered or not valid for our app, and when your account is deleted. A scheduled job also removes devices whose sign-in sessions ended elsewhere, at least 10 minutes after the session ended. We have not set a maximum period for a token that is still active. Delivery records are eligible for deletion after about 2 days (about 1 day if the notification never left the queue) and request receipts after 30 days; timing depends on the schedule. Apple and Google keep their own records.
• Serbs World rooms that members create: a room exists while it has members. When the last member leaves, or a moderator closes it, it is hidden and, if no report about the room or its messages is open, it is deleted at once with its messages. If a report is open, we keep the hidden room for 30 days before deleting it. Closed reports about rooms are kept for 12 months. If the person who created a room deletes their account, an occupied room can keep running without a link to them.
• Live room presence (that you were recently in a room): used for the room's head count, for "who's here", and to decide who receives live updates for that room. This includes people who turned "who's here" off, who are still counted and still receive updates but are not named. Deleted automatically after 1 day. Typing notes can no longer be read after about 6 seconds. The stored note is removed at the next room activity or within the regular automatic clean-up.
• Online status (when switched on): the record of when you were last seen is replaced each time and kept while your account exists. The list of days you were active is deleted after 35 days. Daily totals with no names in them are kept for about 13 months. All of it about you is deleted when your account is deleted.
• Ranking: nothing about how posts are ranked for you is stored. Weekly totals that show whether ranking works, with no names in them and only where at least 10 members contribute, are kept for 13 months. If you object to ranking using your activity, we keep a note of that on your account until you withdraw it or your account is deleted.
• Room timeouts, helper actions and story removals: kept as moderation records for up to 12 months.
• Content you delete: removed from the Service promptly. Copies may remain in our hosting provider's daily backups for up to 7 days before they are overwritten. If we ever have to restore a backup, before the Service is used again we delete again every account deleted since that backup was taken. If one of those accounts is the subject of an open child-safety matter, we delete it again once the owner has confirmed the deletion can go ahead. Content you deleted yourself in that period (for example a post, comment, message or story) may reappear; if that happens, we will tell members so they can delete it again.
• Service and security logs: our hosting provider's request logs are kept for about a week. Sign-in security records (which include IP addresses) are deleted after 90 days. We may keep specific records longer if we need them to investigate abuse or meet a legal requirement.
• Internal records of requests to our servers (which can include a copy of what was sent): deleted automatically after 30 days. The one exception is the record of when you joined, which we keep while your account exists because it supports the Founding Member badge.
• Reported content and the reports themselves: kept until the report is reviewed, as moderation evidence, so we can deal with appeals and comply with the law. After that, a report about a post is deleted 12 months after it was made (or as soon as it is closed, if it is still open then). Other reports, and the copies of reported content kept as evidence, are deleted at the latest 12 months after they are closed; evidence for a decision under appeal is kept until the appeal is decided. A Serbs World message hidden because of reports is kept until a moderator reviews it. The reason and note you add to a report are kept with the report and deleted with it. If you delete your account, notes you wrote in reports are cleared, but the report itself can remain.
• Moderation decisions about your account (such as warnings, suspensions and appeals): kept while your account exists, and deleted with your account unless the account was removed for a serious breach (see "Account deletion" below).
• Sign-in sessions: the app's own session records hold no IP address and are kept no longer than your account exists. Our hosting provider's sign-in service also keeps a record of each sign-in session, including the IP address and type of device, until the session is closed (for example when you sign out) or your login is deleted; we have not yet set a maximum period for these. Its sign-in security records (which also include IP addresses) are deleted after 90 days (see "Service and security logs").
• Notices you acknowledged and the details recorded when you accepted our Terms of Use: kept while your account exists, and deleted with it.
• If you sign in but never join: your sign-in login (which holds your email address) and the notices you acknowledged are kept until the login is deleted; the notices are then deleted automatically, usually within a day. We delete such logins by hand and have not yet set a fixed time for it. You can ask us to delete yours at any time.
• Administrative records: our internal audit log keeps account identifiers and event codes after an account is deleted, and records of waitlist and roster entries made before someone joins have no fixed retention period yet.
• Emails you send us: kept while we deal with your message and any follow-up, and then only as long as we need a record of how we handled it.
• Account deletion (see also our Delete your account page): you can ask for deletion in the app (Settings → Delete account) or by email. We complete the deletion within 30 days of your request and email you when it is done. Your account keeps working until it is deleted. If a child-safety matter about your account is open, or has been referred to an authority, we may not be able to complete the deletion until that matter is closed. When we delete your account, we delete or de-identify your personal information. We may keep limited records where the law requires it, or to resolve disputes, enforce our terms or prevent abuse. For example, we may keep a record that an account was removed for a serious breach, including the related moderation records, so the person cannot simply rejoin. We may also keep a one-way, de-identified record that a Founding Member badge was issued. Deleting your sign-in login itself can take a few extra days, but you are blocked from the Service as soon as your account is deleted. Messages you sent are removed from the conversations of the people you sent them to (they show as unsent). Your device tokens are deleted, your entries in call records are removed, and stored files for your photos and videos are queued for deletion and removed from our storage by our clean-up process; copies in our provider's daily backups and any copies held by the providers in section 6 are deleted on their own schedules, which we have not yet confirmed for every provider. A record of a call you took part in can remain for the other people in it, without your account. We keep a record of each account deletion so we can repeat it if a backup is ever restored: the account's random identifier, the request's identifier, when it was deleted, who carried it out and whether it was a serious-breach deletion, with the follow-up steps (such as deleting the sign-in login) and when each was done. It holds no name, email address or content; until your login is deleted it also holds a one-way code of the login, so we can see when it is gone. We have not set an end date for this record. The owner also keeps a copy of these records outside our hosting provider, in a password manager, for about 8 days.

10. Your choices and rights

You can:

• See and correct most of your profile information yourself in the app.
• Hide your city, change your privacy settings, and block or mute people.
• Ask for a copy of your personal information, including in a structured, commonly used electronic format so you can take it elsewhere.
• Ask us to correct information you cannot change yourself.
• Ask us to delete your account and information. See our Delete your account page.
• Remove a tag of you from a photo.
• Ask us to restrict how we use your information, or object to a particular use (for example how suggestions are made for you).
• Object to ranking using your activity. We then stop your likes, comments, saves and reposts counting in how posts are ranked for other people, and stop suggesting you to others. You can also choose Following in Settings at any time.
• Control notifications and calls: when they are on, choose which notifications you receive, turn message previews on or off, and decline or leave a call.
• Complain to us and to a regulator (section 12).

To ask for a copy, use Settings → Privacy → Ask for a copy or deletion in the app. To ask for deletion, use the red Delete account row in Settings, or the same Privacy page. You can also email support@serbs.social, as our Delete your account page explains. For anything else, email us. In the beta, the app accepts one request of each kind; for any further request, email us.

We reply within 30 days, and always within the time the law where you live allows (for example, one month in the European Union and the United Kingdom). If a request is complex and the law allows more time, we tell you within the first month why we need it. We may need to confirm your identity first, for example by asking you to reply from the email address on your account; we ask only for what we need. If we refuse a request where the law allows us to, we will tell you why and how to complain. We may not be able to give you information about other people, such as who reported you.

You can stop using the Service at any time.

10A. If you live outside Australia

The private beta is invitation-only, and some invited members live outside Australia. Parada Co Pty Ltd is responsible for (the "controller" of) your personal information. In addition to the rights in section 10:

• European Union, European Economic Area and United Kingdom. We use your information on these legal bases:
  • to provide the Service you signed up for (performance of a contract): your account, profile, posts, messages, stories, photos and videos, calls, communities, events, Serbs World, notifications, and translations you ask for;
  • our legitimate interests in keeping the Service safe and running it well: automated photo and video checks, moderation and report weighting, call and usage records, security and abuse prevention, records of requests to our servers, and records we keep about our handling of reports and requests. You can object to these uses (section 10);
  • for Home, Nearby and suggestions: showing you posts from people you follow and from the city you show is part of providing the Service. Counting likes, comments, saves and reposts, giving less weight to accounts under a restriction, and keeping reported posts from spreading are in our legitimate interests in showing members relevant posts and keeping the Service safe. You can object (section 10) or choose Following;
  • your consent, for anything optional you turn on and for marketing emails from our website. You can withdraw consent at any time;
  • legal obligations where the law of the European Union, a member state or the United Kingdom requires us to do something.
• Some decisions are made automatically (section 4A). You can ask for a person to review a decision that affects you.
• You can ask to access, correct, delete, restrict or move your information, and you can object to our use of it. You can also complain to the data protection authority in your country.
• Serbia. You have similar rights under the Law on Personal Data Protection, and you can complain to the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs).
• United States. You can ask what we hold about you and ask us to delete it. We do not sell your personal information, and we do not share it for targeted advertising.
• Canada. You can ask to access and correct your information, and complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
• Anywhere else. Contact us. We will respect the rights the law where you live gives you.

To use any of these rights, use Settings → Privacy → Ask for a copy or deletion in the app, or email support@serbs.social. If a law requires us to name a local representative in your country, we will publish their details here.

11. Our website and launch-notification form

This section covers the serbs.social website and its "Be first on Serbs.social" form. Signing up on the website does not create an app account.

• What we collect:
  • your email address and country (required);
  • your name and city, if you choose to give them;
  • when you submitted the form.
• How we use it:
  • to manage your registration;
  • to send you news about Serbs.social, including when the app or the private beta is ready;
  • to consider you for a beta invitation;
  • to understand where interest in Serbs.social comes from (your country and optional city).
• The private beta is open only to invited people aged 18 or over. If you are invited, we will ask you to confirm this in the app.
• Technical information: our website host and security services may process technical information, such as your IP address and browser and device details. Cookies and similar technologies help run the website, remember preferences and prevent spam.
• reCAPTCHA: the form is protected by Google reCAPTCHA, which is subject to Google's Privacy Policy and Terms of Service.
• Service providers: website hosting and form storage (GoDaddy), spam protection (Google) and email delivery. These providers may process information outside your country.
• Who can access it: only our authorised administrators, and the service providers helping with these functions.
• Unsubscribing: you can unsubscribe from updates at any time, using the link in any email or by emailing support@serbs.social.
• How long we keep it: we keep your signup information until the app's public launch and for up to 12 months after it, or until you unsubscribe or ask us to delete it, unless the law requires us to keep it longer.

We do not sell or rent your signup information, or use it for unrelated marketing. Your rights in section 10 (access, correction and deletion) also apply to your signup information.

12. Complaints

If you have a concern about how we handle your personal information, please contact us first at support@serbs.social. We acknowledge your complaint within 30 days and respond without undue delay, normally within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, phone 1300 363 992. If you live outside Australia, you can also complain to the data protection authority where you live (see section 10A).

13. Changes to this policy

We may update this policy, for example when we add a service provider or introduce new features. If a change is material, we will tell you in the app before it takes effect, and we may ask you to confirm that you have seen it. You are not asked to agree to this policy. The version and date at the top show the current version.

14. Contact us

Parada Co Pty Ltd (ACN 703 107 180, ABN 73 703 107 180) 2, 290 Boundary Street, Spring Hill QLD 4000, Australia Email: support@serbs.social

Parada Co Pty Ltd · ABN 73 703 107 180 · 2, 290 Boundary Street, Spring Hill QLD 4000, Australia · support@serbs.social