Privacy Policy

Last updated: 22 September 2026

This notice explains which personal data the Nearoo app (Android) collects, why it collects them, who they are shared with, how long they are kept and how you can exercise your rights. It applies to the app and to the www.djo2.it website pages linked to Nearoo.

1. Data controller

The controller of the processing of personal data is Cristian (Nearoo project, powered by DJO2), who distributes the app through the www.djo2.it official project website. For any question about this notice or about your data you can write to djo2@djo2.it.

Nearoo has no mandatory data protection officer (DPO): requests go directly to the controller, who answers within one month.

2. What data we collect

We collect only the data needed to make a proximity app work: nothing more.

Data processed by the Nearoo app, with the purpose and the legal basis of each one.
Data	What it is for	Legal basis
Name, email address and profile photo of your Google account (Google Sign-In)	Create and manage your account, show your name and photo to the other users.	Performance of a contract (Art. 6(1)(b) GDPR)
Device location (precise and, if you turn the radar on, also in the background)	Work out who is near you and show them on your radar. If you deny the permission the app does not work: it is the core feature.	Consent (Art. 6(1)(a) GDPR), revocable from the Android settings
Photos you upload (profile and gallery)	Let the other users see who you are.	Performance of a contract
Chat messages, Smoke Signals, voice messages	Deliver the messages to the recipients and to the people within your range.	Performance of a contract
Preferences (visibility, radar range, notifications, theme)	Remember how you want to use the app.	Performance of a contract
Notification service token (Firebase Cloud Messaging) and session identifier	Send you notifications and keep your access secure on your device.	Performance of a contract
Reports and blocks you send, with the reason you give	Moderate the community and protect the users.	Legitimate interest in safety (Art. 6(1)(f) GDPR)

We do not use analytics, advertising profiling or crash reporting SDKs: no device identifier is collected for statistics. We do not collect contacts, SMS, calls, calendar, banking data or health data.

3. Location, radar and obfuscation

Location is the most delicate data in Nearoo, so it works like this:

We never show your exact location to the other users. Before leaving the server, every location is moved to a random point of the privacy ring of 70-500 metres, calculated with a stable value linked to your account: the same person always appears in the same obfuscated point, so the radar does not "jump" and does not become a tool to triangulate your home.
The distance you see on a user's card is calculated towards the obfuscated point, so the text and the map are always consistent with each other.
If two users are very close (for example two phones in the same room), the point is flipped to the opposite side: the distance shown never drops below 70 metres.
In the Smoke Signal the presences of the other users have no name and no photo: they are anonymous dots with already obfuscated coordinates.
You can hide whenever you want from the settings: while it is active you do not appear on anybody's radar. You can revoke the location permission at any time from the Android settings (Settings, Apps, Nearoo, Permissions).
We use location also in the background, and only to tell you when somebody enters your range: Android asks you explicitly on the first launch and you can turn it off whenever you want. For the nearby places searches we forward to Google Places an approximate location, not your exact location.

4. Why we process them (purposes and legal bases)

Make the app work (account, radar, chat, Smoke Signals, notifications): performance of the contract, that is the use of the service you chose to install.
Use location, also in the background: consent, which you give on the first launch and which you can revoke from the Android settings. Without location there is no radar and no Smoke Signal.
Safety and moderation (reports, blocks, checking unlawful behaviour): legitimate interest of ours and of the community in a usable service.
Legal obligations: if a legitimate request from a judicial authority arrived, we would be required to answer.

We do no advertising profiling and we do not use your data for marketing purposes: there is no advertising in Nearoo.

5. Who they are shared with

With the other users

Name, profile photo, gallery photos you choose to publish, badges, obfuscated distance and the messages you send (to those who receive them). In the Smoke Signal the other presences are anonymous: just an obfuscated dot.

With the technical providers (data processors)

Google — Google Sign-In (identity), Firebase Cloud Messaging (push notifications), Google Maps and Google Places (maps and search for nearby places, with approximate location).
Aruba S.p.A. — hosting of the website and of the database where the data is stored (servers in Italy/EU).
DeepSeek — used only when a chat is reported or blocked for its content: the text of the reported conversation may be sent to the artificial intelligence model to produce a summary for moderation. Conversations that are not reported are not sent to any model.
Expo / EAS — distribution of the app updates published on the Play Store.

Some providers (in particular Google, Firebase, DeepSeek and Expo) may process the data also outside the European Union: in that case the transfer takes place on the basis of the standard contractual clauses of the European Commission and of the further safeguards declared by the providers. Your data are not sold nor transferred to third parties for commercial purposes.

6. How long we keep them

Account and profile: as long as the account exists. If you delete it, the linked data are deleted (see point 8).
Location: the app_posizioni table keeps only the last known position, continuously updated. We do not build a history of your movements and there is no chronological archive of your location.
Chat messages, Smoke Signals and voice messages: as long as the conversation exists or until you delete them; closed conversations are removed.
Reports and blocks: kept for the duration of the moderation and for the time needed to handle any objection.
Deletion requests: the confirmation link is single-use and valid for 15 minutes; a completed request no longer keeps your personal data.

7. Your rights

You can exercise at any time the rights set out in Articles 15-22 of the GDPR:

Access: know which of your data we process and obtain a copy of them.
Rectification: correct inaccurate data (you change name and photo directly from the profile).
Erasure: delete the account and the linked data (point 8).
Restriction and objection: ask for a processing to be suspended, for example by turning off the radar or the background location.
Portability: receive in a readable format the data you gave us.
Withdrawal of consent: at any time, from the settings of the app or of Android, without this affecting what was done before.
Complaint: you can address the Italian data protection authority (Garante per la protezione dei dati personali) (garanteprivacy.it).

To exercise them write to djo2@djo2.it: we answer within one month.

8. How to delete your account and data

You have two routes, both free and without having to write emails by hand:

From the app: Profile, Delete account. The deletion is immediate and cancels account, profile, uploaded photos, locations, preferences and linked conversations.
From the website, also without the app installed: api/delete-request.asp. Enter the email of your Google account: you receive a single-use confirmation link valid for 15 minutes. No password required.

What is deleted: account, profile data (name, email, photos), locations, preferences and visibility settings, linked conversations and messages, notification tokens. Only the data we are obliged to keep by law remain (for example the records of reports already handled or requests from an authority), for the minimum period provided for.

9. Minimum age

Nearoo is reserved for people over 18 years of age. We do not knowingly collect data of minors: if we become aware that an account belongs to a person of a lower age, we disable it and delete the data. If you believe that a minor is using Nearoo, write to the address given in point 12.

10. How we protect the data

All the communications between the app and the server travel over HTTPS/TLS: clear traffic is blocked.
The session and the tokens stay on your phone in an encrypted archive protected by the operating system (Keystore/Keychain).
The data are stored in a Microsoft SQL Server database accessible only from the servers of the application, with dedicated credentials and an encrypted connection.
The exact location of the other users never leaves the server: only the obfuscated point goes out.
No system is invulnerable: if a data breach involving a risk for your rights were to happen, we inform you and the Italian data protection authority within 72 hours as provided for by the GDPR.

11. Changes to this notice

This notice can change to adapt to new functions of the app or to obligations of the law. The version in force is always the one published on this page, with the last update date at the top; for substantial changes we inform you also inside the app.

12. Contact Details

Data Controller & Service Owner: Cristian — Nearoo project, powered by DJO2.

Email for privacy, rights, and data deletion requests: djo2@djo2.it

For technical app issues (installation, notifications, permissions), the fastest route is the in-app help section; for personal data requests, please use the email above.

For technical problems of the app (installation, notifications, permissions) the fastest way is the help section inside the app; for personal data use the address above.