Last updated 30 July 2026
Vamos is operated by Onno Blom. This policy explains what the iPhone and Android apps and vamos-app.nl process, why, and the choices you have. Questions or privacy requests can be sent to privacy@vamos-app.nl.
Account and profile: your sign-in email and provider identifiers, username, display name, biography, profile photo, language and preferences. Other signed-in people see only the public profile fields needed for the social features; your email, contact hash, home coordinates and notification settings are private.
Activities and social content: activities, meeting points, routes, times, notes, photos, club and friend relationships, participation, group messages, reports and feedback. A route or meeting point can reveal precise location information. Visibility settings limit ordinary in-app access. Anyone who receives an unexpired share link can see its limited preview and use it to request or join; share links should therefore be treated like invitations.
Optional location and contacts: with your permission, the app can use your current location while you choose a meeting point and can store a home point you choose for notification-distance filtering. If you type a home address, it is sent to Apple's map search to resolve its coordinates; Vamos then stores the address and resolved point. If you choose contact matching, email addresses are normalized and SHA-256 hashed on your device; only the hashes are sent for matching, and the stored match values are additionally keyed with a server-only secret. Hashes are pseudonymous rather than anonymous and are not used for advertising. Your address book is not uploaded.
Notifications and operations: device push tokens, notification state, security rate-limit records, and infrastructure logs such as timestamps, request metadata and IP addresses needed to operate and protect the service. Vamos does not include advertising SDKs or third-party analytics.
Strava: if you connect Strava, Vamos stores encrypted OAuth credentials on the server and requests your saved routes on demand. OAuth credentials are never returned to the app. Only a route you deliberately import is added to a Vamos activity. Disconnecting revokes the Strava grant and deletes the stored connection.
We process account, activity and operational data to provide the service you request, keep accounts and groups safe, prevent abuse, deliver invitations and notifications, respond to support, and meet legal obligations. Optional contacts, location, notifications and Strava access are used only after your choice or device permission and can be disabled.
Vamos uses Supabase for authentication, database, file storage and server functions in its EU region; Netlify to serve this website; Apple services for Sign in with Apple, maps where used and iPhone push delivery; Google Firebase for Android push delivery; and Strava only when you connect it. These providers process limited data under their own security and legal terms. We do not sell personal data or share it with advertisers.
Active account data is kept while your account exists. Expired security state and completed delivery records are pruned automatically. When you delete your account, Vamos attempts to revoke a connected Strava grant, removes its local encrypted tokens and your uploaded files, then deletes the active account and related database rows. A temporary Strava outage never blocks deletion; you can also revoke Vamos from Strava's settings. Encrypted provider backups follow the configured provider retention schedule, are access-restricted and are not used for ordinary product access; deletion from rotating backups may therefore complete after active-service deletion. Safety reports and a limited copy of the reported content may be retained separately, with the deleting reporter's account identifier removed, where needed to protect users, investigate abuse and enforce the rules.
You can change visibility and notification settings, disconnect Strava, remove uploaded content where the app offers that control, block or mute people, report content, and delete your account. Depending on where you live, you may also request access, correction, export, restriction or objection, or complain to your local data-protection authority. Email privacy@vamos-app.nl for help.
In the app: open the You tab → scroll down → tap Delete account and confirm. Active-service deletion starts immediately; if a provider is temporarily unavailable, the account is frozen and the app asks you to retry safely.
Can't sign in? Email privacy@vamos-app.nl from the address on your account and we'll delete it for you within 7 days.
What gets deleted: your profile and sign-in account, activities and routes, messages, photos, friend and club relationships, push tokens, home point, contact hash and Strava connection, subject to the backup and safety-report exceptions described above.
Vamos is not directed to children under 16. We may update this policy when the service or legal requirements change; the updated date above will change and material changes will be communicated in the app where appropriate.
Privacy questions or requests: privacy@vamos-app.nl. General support: hi@vamos-app.nl. See also the terms of use.