Privacy policy

Last updated: 2 November 2026

This policy explains which personal data Joko processes, why, who it is shared with and what rights you have. It applies to the Joko app (iOS, Android and web) and to the website joko.beezey.it.

1. Who is the data controller

The data controller is Beezey (“we”). For any privacy request write to info@beezey.it.

2. What Joko is

Joko is an app to organise and join group sports activities (for example SUP, surf, padel, running). Organisers publish an activity with a limited number of places; people who want to take part sign up. The service is free and involves no payments.

3. Which data we process

Account data (you provide it when you sign up):

• email address;
• first and last name;
• date of birth, mandatory: it is used to check the minimum age to use Joko and the age limits of activities; we never show it to other users;
• password: it is handled by the authentication service (Amazon Cognito) and we cannot read it.

Profile data (optional, set by you):

• display name shown to others, profile photo, short bio and city;
• the sports you practise and, optionally, your level;
• gender (including “prefer not to say”);
• privacy settings (whether to show age and gender on your profile), notification preferences and language.

Activity data:

• if you organise: title, description, sport, level, date and time, city, venue name, address, venue coordinates, number of places, any age limits and the cover photo;
• if you take part: the activity you sign up for and when you join or withdraw.

Notification data: if you turn on push notifications, a device identifier (token) that lets us send them through Firebase Cloud Messaging.

Technical data: like any online service, our servers log technical details of requests (for example IP address, date and time, app version) for security and to make the service work.

Usage statistics: only if you turn them on in Settings › Privacy, we collect anonymous statistics on how the app is used (for example the screens visited) through Google Analytics for Firebase. They are off until you turn them on and you can turn them off at any time.

Reports and blocks: if you report an activity or a user we keep the report (reason, any details you write, who reported what) and the list of users you block.

We do not collect your GPS location: you choose your city by hand. We do not access your contacts. We do not use your data for advertising or to track you across other apps and websites.

4. What others can see

Joko is a social service, so part of your data is visible to other people:

• Activities are public: anyone, even without an account, can see title, description, venue and map, date, places, and the organiser’s name and photo.
• The list of participants (display name and photo) is visible only to signed-in users.
• Your profile is visible to registered users: display name, photo, bio, city, sports, how long you have been on Joko, how many activities you have organised and joined, the activities you organise and those you have in common. Age and gender appear only if you made them visible; email and date of birth are never shown.
• Photos (profile and covers) are stored in a storage space with a direct address: anyone who knows a photo’s address can open it.

Choose carefully what you write in your bio and descriptions: others can see it.

5. Why we process data and on what basis

• Providing the service (creating the account, showing and managing activities and sign-ups, applying age limits): performance of a contract, Art. 6(1)(b) GDPR.
• Push notifications, reminders and promotional messages: your consent, Art. 6(1)(a). Reminders for activities you join are scheduled on your device. Promotional notifications are off by default.
• Usage statistics: your consent, Art. 6(1)(a), which you can withdraw at any time.
• Security, abuse prevention and moderation (text filters, reports, account suspension): legitimate interest, Art. 6(1)(f), in keeping the community safe.
• Legal obligations and defence of legal claims: Art. 6(1)(c) and (f).

6. Who we share data with

We do not sell your data. We share it only with providers that process it on our behalf, as processors:

• Amazon Web Services (Cognito for sign-in, DynamoDB for data, S3 for photos, Lambda and API Gateway for the service). Data is hosted in the European Union, Milan region.
• Google Firebase (Cloud Messaging for notifications, Remote Config for app configuration and, only with your consent, Analytics).
• Google Maps Platform: when you search for a place the text you type is sent to Google for suggestions; to show an activity’s map its coordinates are sent to Google, which also receives your IP address.

Some of these providers may process data outside the European Economic Area (for example in the United States). In that case the transfer relies on appropriate safeguards, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.

We may also disclose data to authorities where the law requires it.

7. How long we keep it

• Account and profile data are kept while your account is active.
• If you delete your account (see below) we erase your profile, photos, sign-ups and sign-in data within 15 days. Activities you organised are cancelled and removed.
• Backups of our systems are renewed periodically: your data leaves them within 35 days of deletion.
• We keep longer only what the law requires or what we need to defend legal claims, and abuse reports for as long as needed to prevent repetition.
• Technical server logs are kept for a limited period.

8. Your rights

You have the right to access your data, correct it, erase it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest. You can withdraw consent at any time (notifications and statistics are managed in Settings), without affecting processing already carried out.

• Edit name, photo, bio, city, sports, gender and privacy: from your profile and Settings.
• Delete your account: Profile › Settings › Delete account. You do not need to write to anyone.
• Everything else (access, portability, objection…): write to info@beezey.it. We reply within 30 days.

If you believe the processing breaches the law you can lodge a complaint with the Italian data protection authority, the Garante (garanteprivacy.it), or with the authority of your country.

9. Children

To create an account you must be at least 14 years old: we check your date of birth at sign-up. If we find that an account belongs to a younger person we delete it. If you are between 14 and 17, use Joko only with the consent of your parents or legal guardian. The service is not aimed at children.

10. Security

We use encrypted connections (HTTPS), a dedicated authentication service, data access limited to the staff and systems that need it, and automatic filters against offensive content. No system is 100% secure: if a breach affecting you occurred we would notify you where and as the law requires.

11. Moderation

To protect the community we use automatic text filters, review user reports and may remove content or suspend accounts that breach the Terms of use. You can report an activity or a user and block anyone who bothers you from the “…” menu on their page.

12. Changes to this policy

We may update this policy. If the changes are significant we will tell you in the app or by email. The date at the top shows the latest version.