Privacy Policy of the Vshage App

This is an English translation provided for your convenience. The Russian version is the legally binding one; if the two differ, the Russian original prevails.

Effective date: 1 July 2026 (2026-07-01)
Last updated: 20 August 2026 (2026-08-20)
Document version: 1.1

1. General

Vshage («Вшаге», the "App", "we") is an iOS mobile app (com.vshage.app) that helps you find and stay in touch with the people around you: make friends, find useful contacts, meet people at events and more. The App uses Bluetooth to show you Vshage users who are physically nearby, and it also includes direct one-to-one chats, voice and video calls, a public feed and an events section («Афиша»).

This Privacy Policy (the "Policy") explains what data the App collects, how we use, store, protect and share it, and what rights you have over your data.

By using the App you agree to this Policy. If you disagree with any part of it, please do not use the App.

We process personal data in line with Federal Law No. 152-FZ "On Personal Data" and — because the App's server infrastructure is hosted in Germany (EU) — with the general data-protection principles that apply in the European Union.

Our principle is simple: we ask only for the data and permissions a specific feature actually needs, and nothing beyond that. No phone number. No tracking.

2. What data we collect

2.1. Device identifier and signing in to your account

Vshage does not use registration by phone number and does not use passwords; we do not offer social-network login. On first launch the App automatically creates a unique device identifier (device_id — a UUID), which is stored in your device's Keychain and used to authenticate you and to link your profile, messages and settings to your account. Until you provide an email address, using the App is essentially anonymous and tied to the device rather than to your identity.

Email address. If you choose to sign in by email, or to link an email address to an account you already have, we store the address you provide. Sign-in still stays passwordless: we send a one-time code (or a one-time sign-in link) to that address. The App neither asks you for a password nor creates one. The address is used only in order to:

• sign you in to your account without a password;
• restore access to your account on a new device or after you reinstall the App;
• send you service messages about your account and its security (a confirmation code, for example).

Your email address is not shown to other users — it does not appear in your profile and cannot be found through search inside the App. We do not use it for advertising, we do not send advertising or marketing mailings to it, and we do not pass it to ad networks or data brokers. The address is kept in your account for as long as the account exists and is erased from it the moment you delete the account (Section 8). One-time codes and sign-in links are valid for 10 minutes, are stored only for that period, and are consumed once used. Separately from your account we keep a service log of sign-in attempts (the address, the IP address and the time the code was requested) — it exists to rate-limit requests and to investigate abuse, including codes being sent to someone else's address; it is not used for advertising or profiling (Section 8).

2.2. Profile data

When you set up your profile you provide a display name. In addition, you may optionally provide:

• city;
• tags / interests;
• occupation (role);
• your Telegram username — this field is for contacting you outside the App; it is not used to sign in to the App.

Every field listed above except the name is optional.

2.3. Content you create

We store on our server the content you send through the App: text messages (in direct chats and in the public feed), voice messages, photos, videos and files. Please note: what you post in the public feed («Лента») is visible by default to other users of the App — unlike direct chats, which are available only to their two participants.

2.4. Location — only when you choose

Vshage does not collect precise GPS coordinates and does not track your location in the background. Approximate location is requested and transmitted only when you decide to share it inside a particular chat: at that moment iOS shows the standard "While Using the App" (when-in-use) prompt, and the coordinates become part of the message you send. The App does not perform continuous or background location tracking.

2.5. Bluetooth and discovering people nearby

The App uses Bluetooth Low Energy (BLE) to discover other Vshage users who are physically near you — this works even without an internet connection. Bluetooth permission is requested through the standard iOS system dialog; you can revoke it at any time in iOS Settings.

2.6. Contacts — only when you choose

The App accesses your address book only when you decide to send a contact card in a chat, and only the specific contact you choose to send. We do not read or sync your whole address book.

2.7. Additional device permissions

Several App features require additional iOS permissions. Each one is requested only the first time you use the corresponding feature. For most of them you can allow, decline or revoke access at any time in iOS Settings → Vshage.

2.8. What we do not collect

• We do not request or store a phone number; the App neither asks you for a password nor creates one.
• We do not require an email address in order to use the App: you provide one yourself if you want to sign in by email and be able to restore access (see 2.1). We do not show it to other users and we do not send advertising mailings to it.
• The App has no social-network login and no Sign in with Apple.
• We do not track your location in the background — only through your explicit action inside a chat (see 2.4).
• We do not read your whole address book — only the specific contact you chose to send (see 2.6).
• We use no third-party analytics SDKs and no trackers: statistics are computed on our own server and only as anonymized aggregates.

3. How and on what basis we use data

We use the data we collect in order to:

• run the basics of the App: device_id authentication (and, if you provided an email address, signing in and restoring access with it), syncing your profile and settings;
• show you Vshage users nearby over Bluetooth;
• deliver text and voice messages, photos, videos and files in direct chats, and publish your content in the public feed;
• provide voice and video calls;
• show events and sync them with your calendar in the «Афиша» section;
• handle your requests to the in-app AI assistant (Section 4);
• review reports and keep the community safe (Section 7);
• keep the App technically operational, stable and secure.

The basis for processing is your consent — which you give on first launch of the App, when filling in your profile, when granting iOS system permissions and when taking specific actions (for example, sending a message with your location or a contact card) — together with the need to perform the functions you request yourself.

4. The in-app AI assistant

Vshage includes a built-in AI assistant. When you use it, your request is processed by a third-party AI provider. As of the last update of this Policy, that provider is Alibaba Cloud Model Studio (Qwen model).

What is passed to the provider is what is needed to answer your request: the text of your request, the history of your conversation with the AI assistant itself, the main fields of your profile (name, city, interests, for example), the notes the assistant has saved about your preferences, and the data required for the action you asked for (found events, your connections, or the nearest entries in your calendar, for example). Your correspondence in direct chats is not passed to the AI assistant. The transfer happens only at the moment you use the AI assistant yourself.

We may change the AI provider, or use more than one — for the quality of answers or for resilience, for example. The current provider is always named in this section and in the table in Section 6; when it changes, we update this Policy (Section 11). If you do not want your data passed to an AI service, do not use the AI assistant (Section 9).

5. Where data is stored and how it is protected

The App's server infrastructure is hosted in a data center in Frankfurt am Main, Germany (European Union). That means your data is physically processed and stored on servers in the EU, whichever country you are in.

Data in transit between the App and our servers is protected by standard encryption (TLS/HTTPS). We apply reasonable technical and organizational measures to protect data: restricted server access, infrastructure configuration control and regular software updates.

6. Sharing data with third parties, advertising and tracking

We do not sell your personal data and we do not pass it to ad networks or data brokers. We do not track you across other apps and services for advertising purposes.

We share data with a limited set of technical partners — only to the extent a specific feature requires:

We may disclose data where the law requires it, on a lawful request from a public authority, or to protect the rights, safety and property of users and of the App.

7. Moderation, reports and community safety

To keep Vshage a safe space, the App provides moderation tools:

• Block — you can block any user.
• Mute — you can turn off notifications from a user without blocking them.
• Reports — you can report either a user as a whole or an individual message. The content of the report and the related content (for example, the text or media file of the message you are reporting) is passed to our moderation team for review.
• Blocked list — a dedicated settings section where you can review and undo your blocks.

We review incoming reports within 24 hours and, if the violation is confirmed, take action up to and including removing the offender from the App.

8. Retention and account deletion

Your data is kept for as long as your account exists. You can delete your account yourself at any time — the "Delete account" button in the App's settings.

Deletion happens immediately and irreversibly. We do not defer it "for up to 30 days" and we do not keep your profile hidden away in case you come back: neither you nor we can restore a deleted account.

The moment you delete it, the following is erased for good:

• profile data: your name (replaced with «Удалённый аккаунт» — "Deleted account"), profile picture, city, occupation, bio, tags and interests, requests, field-visibility and notification settings;
• the identifiers by which you can be found or linked to the account: email address, username, Telegram link, and the link to your device's device_id;
• push notification tokens — a deleted account receives no notifications;
• visibility flags: you stop being shown in search, in suggestions and in Bluetooth discovery, and your posts in the feed and your stories stop being shown to other users;
• every access token issued earlier: sessions on all devices end immediately.

What remains, and why. The messages you sent in direct chats — together with the media attached to them — the conversations themselves and call records stay with the people you talked to; so do the comments you left under other people's posts. The reason is not technical: correspondence is two people's data. A message that has been received is part of your counterpart's private correspondence exactly as much as it is yours, and erasing it on their side would mean deleting their data. Everything that remains is de-identified: your name in those conversations and comments is shown as «Удалённый аккаунт», the profile picture is gone, the profile can no longer be opened from them, and you cannot be contacted through them.

Beyond that, we retain: the service log of sign-in attempts (clause 2.1) — it protects sign-in against code guessing and against codes being sent to someone else's address; information we are required by law to keep; and anonymized aggregate figures (activity counters, for example) that cannot identify you.

How this relates to the right to erasure. We honour the right to have personal data deleted immediately and in full for the data that is yours to dispose of — your profile, your identifiers and your account links. It does not automatically extend to information that is at the same time another person's personal data (their correspondence with you), to data the law requires us to keep, or to anonymized aggregate figures. If you need a specific message to stop being available to the person you sent it to, write to privacy@vshage.app before you delete your account — afterwards we can no longer link that correspondence to you.

9. Your rights

In relation to your personal data you have the right to:

• request access to the data we hold about you;
• request correction of inaccurate data in your profile;
• request deletion of your data and account — what is erased, what remains and why is set out in Section 8;
• withdraw consent to processing that you previously gave;
• stop the AI assistant processing your data — simply by not using that feature.

To exercise any of these rights, write to us at privacy@vshage.app. We answer such requests within 30 days.

10. Children and age limits

Vshage is not intended for anyone below the age set by applicable law for using services of this kind on their own. We do not knowingly collect data from children below that age. If you become aware that a child has given us their data without a legal guardian's consent, write to privacy@vshage.app — we will delete that information.

11. Changes to this Policy

We may update this Policy from time to time — for example, when new App features appear. For material changes we will notify you inside the App. The date at the top of the document always reflects the current version of the Policy. Continuing to use the App after changes are published means you accept the updated Policy.

12. Contact

For any question about this Policy and about how your data is processed, write to us:

• Email: privacy@vshage.app

Vshage — stay in touch with the people around you.