Your information,
treated with care.

Social! Oslo is an unregistered community based in Oslo, Norway. Oscar Björn Karlsson is the data controller for the processing described in this policy. Privacy questions and requests to exercise your rights can be sent to contact.socialoslo@gmail.com.

Applications and contact

When you apply to join the WhatsApp community, we may receive your name or nickname, email address, application answers and anything else you choose to include. When you contact us, we receive your contact details and message. The contact form on this website opens your own email app; the website does not store the message.

Historical member-account records

Records collected through the retired Social! Pass service may include display names, email addresses, primary event platforms, account and approval status, sign-in and activity records, reactivation messages, optional profile photos and visibility choices, community titles, administrator roles, notes and status history. Retirement of the service does not by itself confirm deletion of every historical record. Any retained records remain subject to the retention and privacy-request process below.

Social! browser app

The app uses Google sign-in. We receive the Google account identifier, email address and basic profile details Google shares; we do not receive your Google password or access to your Gmail inbox through this sign-in. Profile setup currently requires a name and profile image. You can add an about text and interests, choose a theme and control profile visibility. These records are stored in the app’s own database.

A Google account can use a non-Gmail email address. Apple sign-in is not currently enabled. Changing your language or theme changes your own preferences, not the language or appearance of other members’ accounts.

The app’s events, Hangouts, chats, workout challenges, member directory and administration features use live server-side data. We store the information you submit and the records needed to operate them: event details and cover images, bookings and cancellations, attendance, messages and attachments, reactions, Hangout requests and participation, workout entries and scores, reports and administration actions. Temporary Hangout chats expire with the Hangout; other chat rooms have their own visibility periods. A message disappearing from a screen does not by itself confirm physical deletion from storage.

For a Green event you can join without an app account by providing your first name or nickname and email and accepting the participation rules. We store the booking, rules acceptance and cancellation or attendance status. Booking confirmations contain event details and a private booking/cancellation link. Reminders are scheduled 24 hours and 3 hours before the event if the booking was made before each reminder became due. We also send cancellation emails and event updates when the host chooses to send them by email. These messages support your booking and do not subscribe you to marketing. Keep the private link to yourself. If you later sign in with a verified Google email matching your guest booking, that booking can be linked to your app profile. For events using website bookings, selecting “Going” on WhatsApp or another platform does not reserve a place: the website does not import registrations from other platforms.

Hangout records include the host, plan, expiry, join requests, decisions and participants. Accepted participants can use the temporary chat. A host can remove a participant, end a Hangout or extend it in one-hour increments. We also store app inbox messages, moderation decisions, event-creation permissions and inactivity/reactivation records needed to administer access.

Historical event records and current event chat

Historical records from the retired service may include event details, bookings, cancellation and check-in times, attendance and past strikes. These are historical records, not current attendance penalties. Current website events are listed at socialoslo.no/events; the browser-app and guest-booking information above describes their operation.

Event chat stores the message, event, sender name, sender account reference, Admin status and time sent. A visible profile photo and community title may appear beside the sender’s name. Please do not put sensitive, medical or private information in event chat.

Member benefits

The member area displays partner names, logos, offers, availability and benefit terms to signed-in members. When you choose to show a benefit, the screen displays your account name, profile photo and current account status so partner staff can confirm eligibility. Partners do not receive access to your member account through this feature, and Social! does not currently create a benefit-redemption history.

Reports and community safety

If a member reports another member, we store who made the report, who was reported, the event or feature involved, the report text, time, review status and any Admin note or outcome. Reports can contain information supplied by another member rather than by the person being reported. Please include only what is needed to explain the concern.

Social! Workout

If you join a workout challenge, we record the activity type, workout date, duration, score, ranking and any corrections made by an administrator. Challenge leaderboards show participating members’ display names, results, community titles and, when enabled, profile photos. The feature is for activity and scoring information; we do not ask you to provide medical information or use workout entries to infer a health condition.

Technical information

Our database and hosting providers may process technical logs such as IP address, browser or device information, request time and security events. Signed-in sessions are stored in your browser so you can remain logged in. If you use QR check-in, camera access is used on your device to read the code; Social! does not store the camera feed.

Legacy website member-account request and login forms use Cloudflare Turnstile to distinguish people from bots; the browser app uses Google sign-in. Cloudflare may process security signals such as IP address, browser details and the website origin. Turnstile does not receive your form entries, and Social! uses the verification result only to decide whether to accept that request.

Community photos

Social! may receive photos from events or community members and may publish selected images on public community pages. Identifiable promotional photos are used with the person’s permission or another lawful basis. Contact us if you want an image of you reviewed or removed.

Where information comes from

Most information comes directly from you. Attendance, activity and security records are generated when you use the member area. Event hosts, other members and Admins may supply check-in information, reports, corrections or administration notes. Technical logs and security signals are generated automatically by the services that run and protect the website.

Providing the services you request

We use your information to create and authenticate your account, collect bookings made through a shared Social! event link in one event space, operate tickets, check-in and event chat, display member benefits, run workout challenges, and provide the event-hosting tools you choose to use. This is necessary to provide the service or take steps at your request under GDPR Article 6(1)(b).

For the browser app, the Google sign-in identifier, an email address, your chosen name and a profile image are used to authenticate you and set up the profile needed to use the app. These details are necessary to provide the browser-app account you request under Article 6(1)(b). About text, interests, a theme and profile visibility are optional choices you can change in the app.

Keeping the community safe and active

We review applications and reports, administer member status, keep attendance and administration records, moderate chat, prevent bots and misuse, apply published attendance rules and protect members and Social!. We rely on our legitimate interests in operating a safe, accountable and active community under Article 6(1)(f). We limit access to the people who need it and provide an Admin review route for access decisions.

Your optional choices

Showing an optional website member profile photo to other active members, and using an identifiable community photo where we ask for permission, is based on your consent under Article 6(1)(a). You can withdraw consent or switch website profile-photo visibility off at any time without affecting the lawfulness of earlier use. The browser app currently requires a profile image for account setup, as explained above.

Law and claims

We may process information where required by a legal obligation under Article 6(1)(c), or retain limited records under our legitimate interests where reasonably necessary to establish, exercise or defend a legal claim.

For an existing website member account, your display name, email and primary event platform are required; its profile photo, photo visibility and reactivation messages are optional. For a browser-app account, provider sign-in, a name and a profile image are required; without them, app onboarding cannot be completed. Report text is required only if you choose to submit a member report. We do not sell personal information, use it for behavioural advertising or run third-party advertising trackers on this website.

Social! administrators can access member records where required for community operations. An event host can see the display name, reservation and check-in status of people attending that host’s event, plus a profile photo when the member has made it visible.

Messages in a public website event chat can be read by anyone viewing that event, including people who have not booked. Permission to send messages depends on the event’s access rules. The host and Admins can remove messages. Member names, profile images and role labels may appear in the relevant feature. Other eligible members may also see names, profile photos and scores in event lists or workout leaderboards.

When you show a member benefit in person, partner staff can see the member identity and current status displayed on your device. The benefit feature does not give partners access to the member database, your event history or your workout activity.

Member reports, the identity of the reporter and internal review notes are available only to active Social! Admins who need them to review the concern. They are not displayed to other members.

Published event details and cover images on a shared invitation link can be seen by anyone who has that link. The browser app also lists events for its members. Platforms where an invitation is shared may fetch and cache its title, description and image to show a preview. This is different from a private booking link, which can provide access to an individual booking. Do not share that private link or upload information you do not have permission to publish.

In the browser app, eligible signed-in members can see the profile information made visible through the member directory and social features. Names and profile images can appear with messages, event participation and workout results. Private chats are available to their participants through the app; community, event and Hangout messages are available to the members allowed into that conversation. Authorised administrators have access needed for support and moderation. Hiding a profile does not erase previous messages or attendance records.

We use the following services where needed to run Social!:

• Supabase processes authentication, databases and file storage for us. Existing website member tools use a project whose primary data region is Paris, France (EU). The browser app uses a separate project in Stockholm, Sweden (EU North). Supabase’s data processing terms include the EU Standard Contractual Clauses where they apply.
• Google handles browser-app sign-in under its own privacy policy. Supabase receives the sign-in result and account details shared by that provider.
• Vercel hosts the production website and processes delivery, security and operational logs. Its data processing terms describe its transfer safeguards.
• Resend processes email addresses and message content when the legacy website member tools send activation and login-code emails; the browser app uses Google sign-in instead.
• Brevo delivers browser-app booking confirmations and reminders directly, processing attendee names, email addresses, event details, private booking links and delivery logs. Its anonymous open/click tracking setting is enabled; this does not make recipient addresses or delivery records anonymous. Delivery logs are configured for one month of retention and new email previews are not stored. The former Zapier booking workflow has been retired and its old run history deleted. We have requested permanent removal of remaining saved samples and recoverable workflow copies; provider confirmation is still pending. Separate community application and legacy email workflows may still use Zapier and Gmail.
• GIPHY receives searches when you use GIF search and technical information when GIFs load from its service.
• Cloudflare Turnstile processes limited browser and network signals to protect legacy website member-account request and login forms from bots and abuse.
• Google Forms and Google Workspace services, including Sheets, Drive and Gmail, are used for WhatsApp applications, messages and community administration.
• Meta operates WhatsApp, Facebook and Instagram, and Meetup operates its own platform. They process information under their own policies when you choose to use those services.

Some provider support, security or platform operations may involve processing outside the EEA. Where Social! is responsible for such a transfer, the applicable provider terms use an adequacy decision, the EU Standard Contractual Clauses, or another lawful safeguard.

WhatsApp is separate from the member account. If you join a WhatsApp group, your phone number, profile details and messages may be visible to Meta and other participants in that group under WhatsApp’s settings and policy.

Vipps and Stripe donation options are not currently enabled in the browser app. We do not collect payment details through those inactive options. We will explain any payment processing before enabling it.

We do not currently use advertising or analytics cookies. The member area stores the member or Admin authentication session in your browser’s local storage. This is strictly necessary to keep you signed in to the service you requested and remains until you sign out, clear the browser storage, or the session is revoked or expires.

Cloudflare Turnstile runs only where a security check is needed. Its signals are used for bot detection and website security, not Social! advertising or member profiling.

External services you open from this website may use their own cookies or similar technologies under their own policies.

The browser app stores its sign-in session, preferences and some cached app state on your device. Clearing browser storage may remove those local items, but does not delete the server-side account or stored profile image. Shared messages, bookings and workouts are stored on the server.

Member account features use published rules rather than AI or behavioural profiling. Check-in records determine whether a ticket is shown as attended or not attended. Cancellations and missed check-ins may be kept as attendance information, but do not create attendance strikes. Workout scores are calculated from the published challenge rules.

We do not remove community members or suspend app access for inactivity. Activity and historical inactivity or reactivation records may still be retained under the retention rules below; they do not create a current inactivity deadline. Community behaviour and respect rules remain in force, and administrators can review reports and restrict access for misconduct or safety reasons.

Attendance strikes no longer restrict accounts. Removing the strike and inactivity systems does not itself delete historical records. Monthly workout scoring starts a new period each month; that does not itself erase the underlying history.

Administrators can review and correct attendance records, historical strikes or workout scores when a genuine mistake occurs. Email contact.socialoslo@gmail.com if you want a record explained or reviewed.

• Applications and contact: kept while the application or enquiry is being handled and afterwards only while needed for administration, community safety or a dispute.
• Legacy member-account records: kept while a request or account exists. A disabled account is not deleted; its history remains available if an Admin later restores access. Declined requests and Admin records remain until removed or no longer needed for integrity, safety or dispute handling.
• Browser-app account and profile: kept while the account is in use or retained for a specific permitted purpose. To request deletion, email us using the contact address below. Once an administrator confirms deletion, the account is locked and automated cleanup removes the app login, linked records and attributed files. Cleanup waits for previously issued upload links to expire and verifies removal of recorded booking emails from our email provider; provider processing can delay completion. Historical or unlinked material, other controlled copies, logs and backups require separate review. Signing out, removing a shortcut or deleting browser storage does not delete the server-side account.
• Events, tickets, attendance, historical strikes and workouts: kept with the relevant account, event or challenge until it is deleted or the record is no longer needed for attendance accuracy, corrections or disputes. Historical strikes do not create current attendance penalties.
• Chats and Hangouts: visibility and expiry depend on the chat type. Closing a Hangout, hiding a message or clearing a conversation from your view is not a promise that every stored copy is immediately removed. Account erasure removes linked personal messages and attributed attachments; private conversations can be removed for both participants, while unrelated members’ group messages are preserved. Name-only mentions and unlinked material require separate review.
• Booking emails and deletion progress: we keep delivery references needed to operate bookings and verify provider cleanup. An approved account-deletion job temporarily retains the identifiers and status needed to finish, retries provider checks automatically and removes its identifying job record after verification. Brevo processing can take up to 72 hours. Attributed files are checked again after old upload links have expired before final account removal.
• Member reports and Admin notes: kept while a concern is reviewed and afterwards only while needed to document the outcome, address repeat safety issues, or handle a complaint or dispute. They are deleted or anonymised when those purposes no longer apply.
• Security checks: Social! does not keep the Turnstile verification token after the request has been checked. Cloudflare may retain limited security signals under its own published terms.
• Technical logs and backups: retained for the provider’s limited security, troubleshooting and backup cycles, then overwritten or deleted under the provider’s terms.

To request deletion of browser-app data or a guest booking, contact us; you do not need to create an account to exercise your rights. We review the scope of the request, verify identity proportionately and explain any lawful retention exception. An app cleanup confirmation does not certify deletion from every service. A hosted event or Hangout can require reassignment or closure as part of handling the request; it is not a reason to retain personal data indefinitely. We must also account for copies with our providers and prevent deleted data being put back into use following a restore.

Deleting the app login removes its linked Google identity from our authentication system; it does not delete your Google account. We cannot recall emails already delivered to recipients or copies they independently keep. A restricted privacy-request record may be kept where necessary to document the request, its outcome and any permitted retention, or prevent deleted data being restored. We limit that record to what is needed and review how long it must remain.

We use access controls, database row-level security, restricted Admin functions, private profile-photo storage with time-limited links, encrypted connections and session controls. Access is limited according to the role and feature involved. Event details and cover images on direct event links remain accessible to people who have those links.

No online service can guarantee absolute security. If you believe your account or personal information has been misused or exposed, contact contact.socialoslo@gmail.com promptly.

Subject to the conditions in data protection law, you may request access to your personal information, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. We may ask for information needed to verify your identity before completing a request.

Send requests to contact.socialoslo@gmail.com. We normally respond without charge and within one calendar month. If a lawful extension is needed because of complexity or the number of requests, we will explain the reason within the first month. See Datatilsynet’s guidance on rights requests. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet).

We update this policy when the community, website, browser app or legal requirements change. The date at the top shows the latest revision. Before materially changing how information is used, we will update the relevant explanation and give a clear notice where appropriate.