Common, Privacy Policy

Effective date: 2026-07-24 Controller: Ilias Muller, operating Common as an individual ("Common"). There is no company behind Common yet. A small team works on the Service under his authority and on his instructions; access to personal data is limited to the people who need it for the task at hand, and each of them is held to confidentiality. Contact / privacy requests: privacy@common-app.co EU/UK representative: not yet appointed; will be appointed as required under GDPR Article 27.

1. Scope

This Policy explains what personal data Common collects through the Common app, our website at www.common-app.co, and the related services (together, the "Service"), why, on what legal basis, with whom we share it, how long we keep it, and your rights. It is designed to meet the Swiss FADP, which applies alongside the EU/UK GDPR for EU users, as well as Thailand's PDPA (2019) and Indonesia's UU PDP (Law No. 27/2022) where relevant.

2. Data we collect

The app is currently entirely free during the launch period: no subscription exists and no payment data is processed. We do not collect or process payment card numbers; once the Traveler Pass launches, subscription payments will be handled by Apple (and RevenueCat), not by Common.

Emergency contact. Your emergency contact is another person's personal data. By providing it, you confirm that you have that person's permission to share their name, phone number, and relationship with us. We use these details only to reach that person in an emergency, and for no other purpose. That person (or you) may contact privacy@common-app.co to access or remove their details.

3. Why we use your data, and legal bases

Where we rely on consent (e.g., location, identity documents), you may withdraw it at any time; this does not affect prior processing.

4. Sensitive / specific data

Your first profile photo doubles as our identity check. When you finish onboarding, our team looks at the first photo on your profile to confirm the account belongs to a real person, and that same photo is the one other users see, so you should treat that photo as public (see section 5).

The verified badge is optional, and its selfie is private. If you ask for the badge, the app opens your camera and you take a selfie then and there. That selfie is not a profile photo: it is stored in a private location, it is never shown to other users and never published, and its only purpose is to let our team check that you match the photos on your profile. You can use every feature of the app without ever asking for the badge, you can withdraw your consent by asking us to delete the selfie, and changing your photos removes the badge until you ask again.

Both checks are a manual, human review. We do not build face templates and we run no facial-recognition or automated matching, so we do not process biometric data for the purpose of uniquely identifying you.

Identity documents. We do not ask for an identity document as a matter of course. Where we cannot otherwise establish who someone is, in particular for a host applicant or following a safety report, we may request one. An identity document is sensitive personal data: we would request it only for that purpose and with your consent, restrict access to the people carrying out the review, never publish it, and delete it at the end of the retention period in section 7. Given this processing and our use of precise device location, we have conducted (or will conduct before offering verification in each market) a Data Protection Impact Assessment (DPIA).

5. How we share data

• Other users: signed-in users can see your public profile: first and last name, your profile photos and cover, the city you chose, your intention, bio and tags, your Instagram handle, your nationality shown as a flag, whether your account is verified, whether you host, how many Moments you have hosted, your host rating, and the date you joined. Your Moments are visible on the map. If you host, your WhatsApp number is disclosed to a traveler once you confirm their booking, and only then. Your email, date of birth, home address, emergency contact, exact location, the answers and languages on a host application, and any identity document are not shown to other users.
• Images are served from public links. Profile photos, profile covers, and Moment photos are stored so that anyone holding the direct link can open the image, without being signed in to Common. Treat any photo you upload as public.
• WhatsApp (Meta): once a booking is confirmed, coordination moves to WhatsApp, outside the Service. What you exchange there is governed by WhatsApp's own terms and privacy policy, not by this Policy, and we never see it. If you would rather not use WhatsApp, do not add a number: it is only required to host.
• Processors / sub-processors acting on our instructions:
  • Supabase (database, authentication, file storage, serverless functions), hosted in the EU (Frankfurt region, eu-central);
  • OpenStreetMap / Nominatim (OpenStreetMap Foundation): turns a home address you type, or your approximate coordinates, into a place name and city, so we can assign your host city and power the return-home feature; only the address text or coordinates are sent, never your identity;
  • Google Firebase: push-notification delivery only (Firebase Cloud Messaging);
  • Apple Maps (on iOS) and Google Maps (on Android): draw the map itself. The map provider receives the coordinates needed to render the view you are looking at. If you tap “Get directions” for a confirmed Moment, the meeting point is handed to the map app you choose, which then applies its own privacy policy;
  • RevenueCat and Apple (subscription processing and entitlement), applicable only once the Traveler Pass launches.
• Analytics: none. We use no analytics SDK, no advertising SDK, and we do not track you across apps.
• Authorities: when required by law, or to prevent imminent harm, fraud, trafficking, or child exploitation.
• We do not sell your personal data.

6. International transfers

Common is operated from Switzerland and uses processors that store data in the EU (see §5). Where we transfer personal data out of Switzerland, the EEA/UK, Thailand, or Indonesia, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) and the safeguards required by the Swiss FADP, PDPA, and UU PDP.

6A. Local representatives

Because Common is established outside the EU/UK, Thailand, and Indonesia, we will appoint the representatives required by applicable law before offering the Service to data subjects in those territories: an EU/UK GDPR Article 27 representative; a Thailand PDPA representative; and, for Indonesia, we will complete PSE (Electronic System Operator) registration and appoint a local Person in Charge (PIC) as required by UU PDP and Permenkominfo 5/2020. Contact details for these representatives will be published in this Policy once appointed.

7. Retention

We keep personal data only as long as needed for the purposes above:

• account & profile data (including date of birth, home place, browsing city, a host's WhatsApp number, and host ratings): for the life of your account;
• any identity document we asked for: for the duration of your account or host status, plus 12 months as needed for legal/audit purposes;
• a verification selfie you sent to get the badge: for the life of your account, so we can re-check the badge if your photos change; deleted with your account, or sooner if you ask;
• waitlist entries collected on our website: until you unsubscribe or ask us to delete them, and in any case no more than 24 months after your last interaction with us;
• push-notification tokens: until you sign out, disable notifications, or delete your account;
• reports / moderation records: up to 24 months to enforce our rules and meet legal obligations;
• after account deletion, we delete or irreversibly anonymize your data promptly, except limited records we must retain by law.

7A. Deleting your account and your data

You can delete your account and your personal data at any time; you do not need our permission, and it is free.

In the app (fastest). Open Common and go to Profile → “Delete account”, then confirm. Your account is closed and deletion begins immediately. Deletion is permanent and cannot be undone.

Another way (no app needed). If you can't access the app, email privacy@common-app.co from your account's email address and ask us to delete your account. We may need to verify your identity, and we respond within 30 days (one month under GDPR).

What we delete. We delete or irreversibly anonymize your profile (name, date of birth, city, intention, bio, tags, Instagram handle, nationality), your photos (profile, cover, and Moment photos, including the first photo used for the identity check), any identity document we asked for, your email and authentication data, your WhatsApp number, your emergency contact, your home address and location data, your onboarding transcript, your host application, your activity and host ratings, and your push-notification tokens.

The website waitlist is separate. If you also joined the waitlist on www.common-app.co, that entry lives outside your app account: use the unsubscribe link in any email we send, or write to privacy@common-app.co, and we remove it.

What we keep, and for how long. We retain only a limited set of records, and only where safety or the law requires it:

Everything else is deleted or irreversibly anonymized promptly after you delete your account. Common uses no analytics or advertising SDKs, so there is no third-party advertising profile of you to erase. Messages already exchanged on WhatsApp are held by WhatsApp, not by us; delete them from your own device and ask the other person to do the same.

8. Your rights

Subject to applicable law (FADP / GDPR / PDPA / UU PDP), you may:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data (you can delete your account in-app: Profile → “Delete account”);
• restrict or object to certain processing;
• request portability of data you provided;
• withdraw consent where processing is based on consent;
• lodge a complaint with your supervisory authority (the Swiss FDPIC; EU DPAs; Thailand PDPC; Indonesia’s data-protection authority).

To exercise these rights, contact privacy@common-app.co. We respond within 30 days (one month under GDPR) of receiving your request, unless a longer period is permitted and notified to you under applicable law.

8A. California and US state privacy (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect about you, to access, delete, and correct it, and to opt out of the sale or sharing of your personal information. We do not sell or share your personal information with third parties for cross-context behavioral advertising. To exercise these rights, contact privacy@common-app.co. We will not discriminate against you for exercising these rights. Residents of other US states with comparable privacy laws (Virginia, Colorado, Connecticut, Texas, and others) have similar rights and may submit requests through the same contact.

9. Children

The Service is for users 18 and over. We ask for your date of birth when you create your account and refuse the account if it shows you are under 18. We do not knowingly collect data from children. If we learn we have, we delete the account and its data.

10. Security

We use industry-standard measures (encryption in transit, access controls, row-level security on our database, restricted access to verification documents). No system is perfectly secure.

11. Data-breach notification

If a personal-data breach is likely to result in risk to you, we will notify the relevant authority and, where required, affected users, under the Swiss FADP, GDPR (without undue delay, within 72 hours where feasible), Thailand PDPA, and Indonesia UU PDP (notification within 3×24 hours).

12. Apple / device disclosures

Our App Store privacy disclosures (“nutrition label”) and bundled privacy manifest reflect the data described here. Permissions (camera, photo library, location, notifications) are requested in-context with clear explanations, and you can change them in device settings.

13. Changes

We may update this Policy; material changes will be notified in-app or by email, with an updated effective date.

14. Contact

Questions or requests: privacy@common-app.co. Postal address: available on request via privacy@common-app.co.