PRIVACY POLICY
This policy explains what personal data the PATCH iOS app collects, why, and what you can do about it.
Who is responsible
PATCH is operated by SPACESHEEP SRL (CUI 47424401), registered office Str. Oborul Nou nr. 13, bl. P10, sc. 1, et. 2, ap. 51, camera 1, Bucharest, Romania — the data controller for the purposes of the EU General Data Protection Regulation (GDPR).
Contact: bogdan@spacesheep.studio
What we collect
- Account data — your email address, the operator tag (username) you choose and your password. Passwords are stored only as a secure hash by our hosting provider; we never see them.
- Recordings — the audio you record, its waveform, title, notes and tags, and any photo you attach.
- Location — when you start a recording, the app captures your precise location (coordinates and altitude) and a place name. The precise location stays on your device; only the place name and coordinates rounded to about 1 km are stored in your account. You can remove the location before saving. Location is only collected while you use the app, never in the background.
- Moderation data — reports you submit about public signals and operators you block.
- Technical data — our hosting provider records standard server logs (such as IP address, device type and request times) for security and reliability.
We do not use analytics or advertising SDKs, we do not track you across apps or websites, and we never sell your data.
What is public
Recordings are private by default and stored only on your device and in your account. When you tap TRANSMIT, that transmission becomes public: anyone using PATCH can see and play it, together with its title, notes, tags, photo, place name and its area (coordinates rounded to about 1 km — never your exact location). It also appears on our website, patch.ro, on a page of its own and on your operator page (with your username, display name and bio), where anyone can play it without an account and search engines may index it. You can unshare or delete it at any time, and it disappears from the app and the website. Remove the location before saving if you do not want it published.
Why we use your data
- To provide the app — your account, cloud backup, syncing between devices and public signals (GDPR art. 6(1)(b), performance of a contract).
- To access the microphone, location and photos — only with your permission, which you can withdraw in iOS Settings (art. 6(1)(a), consent).
- To keep PATCH safe — moderating reported content, preventing abuse and securing the service (art. 6(1)(f), legitimate interest).
Who processes your data for us
- Supabase — database, file storage, authentication and account emails. Data is hosted in the EU (Ireland).
- Apple — converts your coordinates into a place name (reverse geocoding) and distributes the app.
These providers process data only on our behalf and under their own data protection commitments.
How long we keep it
We keep your data for as long as your account exists. When you delete a transmission it is removed from our servers. When you delete your account (PROFILE → DELETE ACCOUNT) your account, all transmissions, audio, photos, reports and blocks are permanently deleted. Server logs are kept by our hosting provider for a limited period for security purposes.
Your rights
Under the GDPR you can ask to access, correct, delete or export your data, object to or restrict its processing, and withdraw consent. You can delete transmissions and your whole account directly in the app; for anything else, email us. You also have the right to complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro).
Children
PATCH is not intended for children under 16, and we do not knowingly collect their data.
Security
Data is encrypted in transit. Access to your private recordings is restricted to your account by database security rules.
Changes
If we change this policy we will update the date above and, for significant changes, let you know in the app.