Privacy Policy
Splits is a social dining platform operated by STROP DE RAI SRL, a company incorporated in Romania under CUI 42745265, with registered address at Brandusa 4, 700374, Iași, Romania, European Union, trading publicly as Stropapps.
Privacy contact: contact@stropapps.com
Governing legal framework: EU General Data Protection Regulation (GDPR) · Romanian Law 190/2018 on the implementation of GDPR · Apple App Store privacy requirements.
Our commitment: We collect only what is necessary to connect people over food. We never sell your data. We never store precise location. You are always in control.
01 Who We Are
Splits is a platform by STROP DE RAI SRL (Stropapps) that facilitates shared public dining experiences — connecting like-minded people over restaurant meals, brunch outings, and food events. We are established in Iași, Romania, within the European Union, and are subject to the full requirements of the EU GDPR and Romanian Law 190/2018.
For all privacy matters, contact us at contact@stropapps.com.
02 Data We Collect
We collect the minimum data needed to make Splits work. This includes:
- First name — to personalise your profile.
- Date of birth — collected at the start of registration solely to verify that you are 18 or older. If you do not meet the age requirement, no account is created and no data is retained.
- City — to show you relevant local experiences.
- Preferred experiences — dining types and occasions you enjoy.
- Social energy type — to help match you with compatible table guests.
- Bio, languages and "Looking for" choices — optional profile details you add to help other members get a sense of you before a table.
- Phone number (hashed — registration) — collected during registration for identity verification via SMS. Once verification is complete, your raw phone number is never stored on our servers. We retain only a one-way cryptographic hash of your phone number for safety purposes — specifically to prevent banned users from re-registering with the same number. This hash cannot be reversed to recover your original phone number.
- Hashed phone number (banned accounts only) — when an account is permanently banned for safety violations, a one-way SHA-256 cryptographic hash of the associated phone number is retained after all other account data is deleted. This hash cannot be reversed to recover the original phone number. It is used solely to prevent re-registration by users removed for safety violations.
- Device notification token (APNs / Firebase Cloud Messaging) — when you grant notification permission, Apple generates a unique push notification token for your device. This token is transmitted to and stored by Firebase Cloud Messaging to deliver notifications about your bookings, such as a cancelled reservation. It is linked to your account and deleted when you sign out, when you delete your account, or the next time you open the app after turning notifications off in your device settings.
- Behavioural and interaction data — attendance records, reports submitted, and community interactions. Used solely to maintain platform safety and calculate community trust scores (see Section 05).
- Table chat messages (where enabled) — Splits has a group chat feature for tables. It is currently switched off in every city where Splits is available, including Tokyo, so members cannot send or receive messages in Splits. We switch chat on for a city only after a legal review for that city. When chat is available, messages are stored only to deliver them and are deleted automatically between 48 and 49 hours after the dinner.
- Notification records — Splits sends you notifications about your tables: when your seat is confirmed, when a host cancels a table, and when a host changes the arrival time or meeting point. These messages are written by Splits. They contain only the venue name, the date and time, and the chosen option, never text written by another member. We keep a record of the notices we send you, linked to your member ID. The record is included in your data export and is deleted when you delete your account. To send notifications we store your device's push notification token.
- Cancellation reason code — when a host cancels a table, they choose a reason from a fixed list. We store only the reason code, visible to Splits staff only, and delete it after 90 days. Guests are not shown the reason; they see only that the host cancelled the table.
- Reports — members can report a table. We keep the reason and, if the report includes message text, that text for up to 180 days unless we need it longer for an ongoing safety matter. If you delete your account, reports you filed are kept without your identity.
- Waitlist email address — if your city is not live yet, you can join a waitlist by giving your email address, in the app or on our website. We use it only to tell you when your city launches. In the app, the entry is linked to your member ID; on the website it is not. We delete the entry once your city has launched and we have told you (within 30 days), when you delete your account, or when you ask us. If a city has not launched within 24 months, we delete its entries. Legal basis: your consent. You can withdraw it at any time by writing to contact@stropapps.com. Your data export includes your waitlist entry.
We do not collect surnames, raw phone numbers after verification, precise GPS coordinates stored long-term, government ID (except where you opt into voluntary identity verification), financial details, or any sensitive personal data category under GDPR Article 9.
03 Lawful Basis for Processing
GDPR Article 13 requires us to state the legal ground on which we process each category of your personal data. The table below sets this out explicitly.
| Processing activity | Lawful basis (GDPR Art. 6) |
|---|---|
| Account creation and management (name, age, city) | Art. 6(1)(b) — Performance of contract |
| Phone verification via SMS and retention of hashed phone number | Art. 6(1)(b) — Performance of contract (verification is required to use the service and the hash is retained to enforce safety bans) |
| Matching you with dining experiences and table guests | Art. 6(1)(b) — Performance of contract |
| Managing reservations | Art. 6(1)(b) — Performance of contract |
| Sending notifications about your bookings, such as seat confirmations, cancellations by the host and changes to arrival time or meeting point | Art. 6(1)(f) — Legitimate interests (keeping you informed about bookings you made) |
| In-app waitlist — the email and city a member enters in the app | Art. 6(1)(a) — Consent |
| Notification records — notices sent to a member about their own bookings (seat confirmed, table cancelled, details changed) | Art. 6(1)(b) — Performance of contract |
| Host cancellation reasons — the reason a host picks when cancelling a table | Art. 6(1)(f) — Legitimate interests (keeping the platform reliable) |
| Safety reports — reports filed about members or tables | Art. 6(1)(f) — Legitimate interests (safety) |
| Processing and storing the APNs / FCM push notification token | Art. 6(1)(f) — Legitimate interests (service delivery of transactional notifications the user has opted into) |
| Retention of SHA-256 hashed phone number (permanently banned accounts) | Art. 6(1)(f) — Legitimate interests (protection of other users and platform safety). This processing continues after account deletion under Art. 17(3)(b) GDPR (necessary for the establishment, exercise, or defence of legal claims and safety obligations). |
| Community trust scoring and safety moderation | Art. 6(1)(f) — Legitimate interests (protecting all users; maintaining a safe community) |
| Age verification (18+ requirement) | Art. 6(1)(c) — Legal obligation (GDPR Art. 8; Romanian Law 190/2018) |
| Responding to data subject rights requests | Art. 6(1)(c) — Legal obligation (GDPR Arts. 15–22) |
| Collecting email addresses via the website waitlist form (unauthenticated visitors) | Art. 6(1)(a) — Consent. You must tick an explicit, unticked-by-default checkbox confirming your agreement before the form submits. You may withdraw consent at any time by emailing contact@stropapps.com. |
Where we rely on legitimate interests, you have the right to object to that processing at any time (see Section 08 — Your Rights).
04 How We Use Your Data
Your data is used only to power the Splits platform:
- Match you with dining experiences and other guests in your city
- Enable and manage reservations at partner venues
- Hosts choose the arrival time, meeting point and dress code for a table from fixed lists. There is no free text. These details are locked once the first guest books, and a host can change the arrival time and meeting point up to 3 times afterwards. Guests are notified of each change.
- Facilitate group chat between confirmed experience participants, in cities where chat has been switched on following a legal review for that city (see Section 02)
- Improve platform safety and moderate community standards
- Send relevant notifications about your bookings
- Waitlist notification: If you joined a city waitlist, on our website or in the app, we use your email only to tell you when Splits opens in that city. We will not use your email for any other marketing purpose without your separate consent.
Your data is never sold to third parties. Ever.
05 Profiling & Automated Trust Assessment
To maintain a safe and trustworthy community, Splits uses an internal community trust score to assess each user's account standing over time. This processing is disclosed as required by GDPR Article 22.
The trust score is calculated based on the following inputs:
- Attendance record (showing up to booked experiences vs. no-shows without cancelling)
- Reports submitted about your account by other verified users
- Reports submitted by your account about others (pattern analysis)
- Cancellation frequency and timing relative to the experience
- Community guideline violations recorded on your account
The trust score may influence:
- Ability to book new experiences (may be restricted for low-scoring accounts)
- Whether your account is flagged for human review
Human review is always involved before any account suspension or termination. Automated scoring flags accounts for review; a member of the Splits team makes the final decision on any enforcement action. No account is suspended or terminated solely by an automated process.
You may request information about your trust score status or challenge an enforcement decision at any time by contacting contact@stropapps.com. We will respond within 30 days.
Reviews: Members see only totals of the traits others chose for them, never who chose them.
06 Data Retention
Your data is retained for as long as your account is active and you continue to use the platform.
You can delete your account in Settings → Delete Account & Data. Deletion happens on our servers straight away. It deletes your profile, your reservations and your personal data, and cancels any tables you host; their guests are notified. Records that no longer identify you may remain: past tables you hosted stay as "Former member", staff logs keep only a reason code, and reports you filed are kept without your identity. Deleting your account does not cancel your subscription. Cancel it in iPhone Settings → [your name] → Subscriptions. If anything fails, write to contact@stropapps.com. Anonymised aggregate data (e.g. city-level attendance statistics) may be retained for service improvement purposes without any link to your identity.
- FCM / APNs notification token: Deleted when you sign out, when you delete your account, or the next time you open the app after turning notifications off in your device settings. (iOS does not notify an app in real time when notification permission is revoked, so this is detected on the next app launch rather than instantly.)
- Hashed phone number (permanently banned accounts): Retained for the lifetime of the platform, or until the safety risk is demonstrably resolved, under legitimate interests (Art. 6(1)(f)) and Art. 17(3)(b) GDPR. The associated ban reason and administrator action log are retained in a secure server-only audit log for a minimum of 2 years from the date of the ban, after which they are reviewed for deletion.
- Cancellation reason code: Retained for 90 days after the host cancels the table, visible to Splits staff only.
- Reports: The reason and, if included, message text are retained for up to 180 days, unless needed longer for an ongoing safety matter. If you delete your account, reports you filed are kept without your identity.
- Waitlist email: Deleted once your city has launched and we have told you (within 30 days), when you delete your account, or when you ask us. If a city has not launched within 24 months, we delete its entries. You may request deletion at any time by emailing contact@stropapps.com.
07 Data Security
- Encryption in transit: All data between the app, website, and our servers uses TLS encryption.
- Infrastructure: Powered by Firebase (Google LLC), with strict Firestore Security Rules controlling read and write access.
- Data region: We use Google Firebase servers in the European Union. Google also processes some data, such as sign-in and notifications, on its own infrastructure.
- Access controls: Access to personal data is strictly limited to authorised personnel only.
08 Location Data
Splits uses your phone's location only to work out which city you are in. We store the city, not your precise location.
Your city is used solely to surface relevant dining experiences near you. You can update or change your city at any time in the app's Settings. No location data is ever transmitted to third parties.
09 Minors
Splits is strictly for users aged 18 and over. We do not knowingly collect data from anyone under 18. If we become aware that an account belongs to a minor, it will be immediately and permanently deleted.
If you believe a minor is using the platform or has submitted a waitlist form, please report this to contact@stropapps.com.
10 Your Rights (GDPR)
As a user in the EU, you have the following rights over your personal data:
To exercise any right, email contact@stropapps.com. We will respond within one month (30 days).
Your data export includes your profile, reservations, tables, reviews, notices and waitlist entry.
Lead Supervisory Authority:
Website: www.dataprotection.ro · Address: Bd. G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 București, Romania.
11 Third-Party Services
Splits does not use advertising or analytics tools and does not track you across other companies' apps and websites. The app uses Google Firebase for sign-in, database, server functions and notifications, Google Places for venue search, and Apple for subscriptions and payments.
Splits uses the following third-party services. Each has its own privacy policy:
12 Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify app users via an in-app message. For website waitlist subscribers, material changes will be communicated by email before they take effect.
Continued use of the platform after changes are posted constitutes acceptance of the updated policy. If you disagree with any changes, you may delete your account or withdraw your waitlist consent by contacting us.
13 Contact
For all privacy questions, data requests, or concerns:
Legal entity: STROP DE RAI SRL (trading as Stropapps)
CUI: 42745265
Registered address: Brandusa 4, 700374, Iași, Romania, European Union
Email: contact@stropapps.com
Website: stropapps.com
Response time: Within one month (30 days)
This Privacy Policy is governed by Romanian law and the EU GDPR. It is available in English; this is the authoritative version. A Romanian-language version is available upon request at contact@stropapps.com.