BuurtFix
This is version 2026-10-01 of this document, kept exactly as it was published. This page will not change again: anyone who accepted this version can always read back what it said at the time.
Links in the text below point to the current site. View the current version · All versions
Privacy policy
Version 2026-10-01Who is responsible
BuurtFix is built and run by one person, who is therefore the data controller. For anything about your data — access, correction or deletion — write to privacy@buurtfix.nl.
Name and postal address of the data controller
Madi Sagimbekov
Damiettastraat 19
1448 MP Purmerend
Netherlands
No registered business; BuurtFix is run by a natural person, so there is no Chamber of Commerce number.
What we process
| Data | Why | Lawful basis |
|---|---|---|
| Email address | Signing in, confirmation emails, password recovery | Performance of a contract |
| Display name and profile photo | So a neighbour knows who is coming round | Performance of a contract |
| Location of a task | Showing nearby tasks and calculating distance | Performance of a contract |
| Task description and photo | Showing it to possible helpers | Performance of a contract |
| Messages | Arranging the task between the two of you | Performance of a contract |
| Ratings | Trust between neighbours | Legitimate interest |
| Blocks and reports | Preventing abuse | Legitimate interest |
| Chosen notification area (location and radius) | Alerting you to tasks in that area | Consent (only if you turn this on yourself) |
| Push token for your device | Delivering notifications to your device | Performance of a contract |
| Device ID | Recognising whether a device has been blocked, so a block cannot be bypassed with a new account | Legitimate interest |
| Crash reports (error message and technical details about your device) | Finding and fixing bugs in the app | Legitimate interest |
| Acceptance of the terms (time and version) | Demonstrating that you agreed | Legal obligation (Art. 5(2) GDPR) |
We do not share your exact address
The map does not show someone else's task at its real position. Every point that is not yours is given a fixed offset of 60 to 180 metres, so the app cannot be used to collect neighbours' addresses. The distance you see is still calculated from the true location, so "1.2 km away" is accurate.
Your location when you search
To show tasks nearby we send your current location, or the place you pick on the map, to our server. We use it only to answer that request and do not save it to your account. The place you chose, your radius and your filters stay on your own device.
If you search for a place on the map, or the app shows the name of a place you chose, the search text or the map point goes to your phone's place service: Apple on an iPhone, Google on Android. What they do with it falls under their own privacy policies.
Who else sees your data
| Party | For what | Where |
|---|---|---|
| Supabase | Database, accounts, photo storage | Frankfurt (EU) |
| Resend | Sending email | Ireland (EU) |
| Apple Maps | Map rendering and place search on iPhone | See Apple's privacy policy |
| Google Maps | Map rendering and place search on Android | See Google's privacy policy |
We do not sell your data and do not use it for third-party advertising.
How long we keep it
We keep nothing longer than it is needed for. For most of it there is no fixed period: it exists for as long as your account does, and goes when you delete it.
| Data | Retention | Why |
|---|---|---|
| Account and login details | Until you delete your account | No account, no app |
| Name and profile photo | Until you delete your account | Neighbours need to know who is coming |
| Tasks and photos | Until you delete them or your account | They are yours |
| Messages | Until either account is deleted | Arranging a task |
| Ratings | Until the rated account is deleted | Trust between neighbours |
| Abuse reports | 2 years from the report | See below |
| Chosen notification area | Until you turn the setting off or delete your account | No area, no alert to send |
| Push token | Until it goes invalid or you sign out on that device | An invalid token cannot receive anything anyway |
| Device ID | For as long as your account exists; a blocked device ID is kept afterwards too | Otherwise the block disappears the moment the account does — exactly what it exists to prevent |
| Crash reports | Kept as long as needed to investigate, no fixed limit yet | Long enough to find a problem, no longer than needed |
| Deletion requests | 7 days | Only so the link works |
| Acceptance of the terms | Until you delete your account | Demonstrating you agreed (Art. 5(2) GDPR) |
Reports are the exception, deliberately. If they vanished with the account, deleting and re-registering would be a way to shed a report — the very thing they exist to prevent. Once the reported account is deleted the report no longer contains anything identifying that person, and after two years it goes entirely.
You delete your account yourself via Delete your account.
Your rights
You may access your data, have it corrected, have it deleted, take it to another service, and object to processing. Contact us at the address above. If you disagree with how we handle it, you can complain to the Dutch Data Protection Authority.