Privacy Policy

Last updated: October 9, 2026 (Brazilian Portuguese: Política de Privacidade)

This policy explains which personal data the Borah app (iOS and Android) and the service behind it process, for what purposes, who we share it with, how long we keep it, and how you exercise your rights under the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018). The Brazilian Portuguese version is the reference version.

1. Who is the controller

The controller of your personal data is Eduardo Torres Lopes, who operates Borah. Contact for any privacy matter: privacidade@borahsp.com.

Borah operates as a small-scale processing agent (ANPD Resolution CD/ANPD No. 2/2022) and therefore does not appoint a data protection officer. The channel for data subjects is privacidade@borahsp.com.

2. Data we process, why, and the legal basis

We process only what the app needs to work. Each item below says where it comes from, what it is for, and the legal basis (LGPD art. 7).

• E-mail. You provide it when you sign in. Borah has no password: we e-mail you a sign-in link. We also use the e-mail to confirm account deletion and to reply to your requests. Basis: performance of a contract (art. 7, V).
• Display name and username, if you provide them. They identify your account in the app. Basis: performance of a contract.
• Date of birth and gender. The current version of the app does not ask for them. If you entered them in an earlier version, they remain stored, personalize event suggestions, and are deleted when you delete your account or ask us to delete them. Whenever the app has a gender field, it will be optional and include a "prefer not to say" option. Basis: consent (art. 7, I), which you can withdraw at any time.
• Preferences: event types, atmospheres, neighborhoods, genres and Home filters. They order and suggest events. Basis: performance of a contract.
• Your activity in the app: saved events, events you marked "Vou" (I'm going), favorites (venues and artists), lists, who you follow and who follows you, a history of the latest events you opened (we keep only the 100 most recent), and interaction records used to rank suggestions. We also use what you open, save and mark "Vou", in aggregate and without identifying you, to suggest events to other people who like the same venues, genres and artists. Suggestions appear only inside the app, never name another person, and are made only when at least two people share the same taste. What you did stops counting toward these suggestions after you delete your account, and at most 90 days after each action. Basis: performance of a contract. For this use in suggestions to other people, the basis is legitimate interest (LGPD art. 7, IX). You can object to this processing at any time (LGPD art. 18, §2) by writing to privacidade@borahsp.com. Your attendance at an event is visible to others only if you turn that option on and the person is approved as your follower; it is private by default.
• Guest account. If you use the app without creating an account, the app generates a random identifier (not the advertising identifier and not a hardware number) and stores it on your device and on our server, to keep your saves and favorites. When you create an account, that data is linked to it. Basis: performance of a contract.
• Push notification token. If you allow notifications, the app obtains a token from the Expo push service and sends it to our server to deliver reminders for your saved events and the events you are going to. Basis: consent (the system permission).
• Location. Only if you allow it, and only while the app is open (we do not collect background location). We use your position to order events by proximity, center the map and show the temperature. The app sends our server your position rounded to about 1 km to build the Home screen. Distances on cards are computed on your device. We do not write your location to our database, but the rounded coordinates, and the coordinates of the map area you are viewing, appear in request URLs and therefore in technical logs (next item). Basis: consent (the system permission, which you can revoke in the device settings or in the app).
• Calendar. If you tap "add to calendar" and allow it, the app writes the event (title, date, place and link) to your device calendar. We do not read your calendar and we do not send this data to our server. Basis: consent.
• Technical logs. The server records the IP address, device and system (user agent), app version, date and time, the request address and the result. They serve security, abuse prevention, fixing faults and measuring performance. Basis: legitimate interest (art. 7, IX). We keep these logs for 7 days. If Borah comes to be operated by a legal entity, access logs (IP address, date and time) will be kept for 6 months as required by art. 15 of Brazil's Marco Civil da Internet, and this policy will be updated.
• Crash and performance diagnostics. The app sends error and performance reports to our own GlitchTip instance (Sentry-compatible), with the device model, system, app version, the IP address of the connection and your internal user identifier. We do not send your e-mail or username. In a share of sessions (10%) and in every session where an error occurs, the app records a screen replay in which all text, images and icons are masked. Basis: legitimate interest.
• Usage statistics. The app sends usage events (screens viewed, button taps, language, screen size, device model, version) to our own Umami instance, associated with your internal user identifier. We do not send your e-mail or coordinates in these statistics. We also count impressions and taps on sponsored content. Basis: legitimate interest. You can object to this processing at any time (LGPD art. 18, §2) by writing to privacidade@borahsp.com. Once your request is handled, the app stops sending usage statistics and recording screen replays for your account.
• Feature flags. The app queries our own Unleash instance to know which features are on. We do not send it your e-mail or your user identifier. Basis: legitimate interest.

We do not collect the advertising identifier (IDFA or AAID), we do not read your contacts or photos, we do not collect background location, and we do not process sensitive personal data (LGPD art. 5, II) such as sexual orientation or health data. Date of birth and gender are treated as ordinary personal data.

3. Who we share it with (processors and third parties)

We do not sell personal data and we do not share it with advertising networks or data brokers. We use the providers below, which process data on our behalf or which the app contacts directly.

• Our own infrastructure. The API server, the database and the diagnostics (GlitchTip), statistics (Umami) and feature-flag (Unleash) tools are hosted by us on our own server. The server is in Brazil, in São Paulo.
• Cloudflare. It mediates access to our domain (DNS, proxy and tunnel): traffic between the app and our server passes through Cloudflare. Cloudflare also stores encrypted copies of our backups (we encrypt the content before upload).
• Transactional e-mail provider. It sends the sign-in and deletion-confirmation e-mails. It receives your e-mail and the message text. The provider is Resend, a United States company, which sends e-mail from its São Paulo region.
• Expo, Apple and Google (push notifications). To deliver a notification we send the token, title and message text to Expo, which relays it to Apple (APNs) or Google (FCM). Expo also provides the app update service.
• Open-Meteo (temperature). The app contacts the Open-Meteo service directly to show the temperature on the Home screen. It receives your position rounded to about 1 km, or the center of São Paulo if you did not allow location, and your device's IP address. We send it no identifier of yours.
• Event images. Some event images may load directly from the site of whoever promotes the event, which reveals your IP address to that site.
• Authorities. We may disclose data when the law or a court order requires it, or to protect rights and people's safety.

4. International transfers

Some of the providers above (for example Cloudflare, Expo, Apple, Google and the e-mail provider) may process data outside Brazil. In those cases the transfer takes place to perform the contract with you and with the safeguards of LGPD art. 33. The providers and their countries are: Cloudflare, Expo, Apple, Google and Resend (United States) and Open-Meteo (Switzerland). Transfers rely on the data protection contractual clauses adopted by these providers (LGPD art. 33, II, b, and ANPD Resolution CD/ANPD No. 19/2024).

5. How long we keep it

• Account and activity data: while the account exists. When you delete the account they are erased (section 6).
• Viewed-events history: the 100 most recent.
• Session: app access expires in 1 hour and renewal lasts up to 30 days.
• E-mail sign-in link: valid for a few minutes and single use.
• Inactive guest accounts: permanently deleted after 90 days with no activity.
• Technical logs: 7 days.
• Usage statistics (Umami) and diagnostics (GlitchTip): 90 days for diagnostics (GlitchTip) and 12 months for usage statistics (Umami). After that they are deleted automatically.
• Backups: kept up to 14 days on the server and up to 35 days, encrypted, at Cloudflare. Data deleted from the database may remain in those copies up to that period and is not restored for use.

6. How to delete your account

• In the app: Perfil › Conta e Notificações › Excluir conta (Profile › Account & Notifications › Delete account). We send a confirmation link to the account e-mail; when you confirm it, we delete your account and the data tied to it: profile, preferences, saves, "Vou", favorites, lists, followers and following, history, sessions and the notification token.
• On the web: https://borahsp.com/delete-account. Enter your account e-mail, open the link we send you and confirm the deletion. You do not need the app installed.
• By e-mail: write to privacidade@borahsp.com from the account e-mail. If you use the app as a guest, without an e-mail, delete your data directly in the app at Perfil › Conta e Notificações › Apagar meus dados (Profile › Account & Notifications › Delete my data). The session stored on your device confirms the request is yours.

What may remain after deletion: technical logs and backups for the periods in section 5, and diagnostics and statistics records already sent to our tools. These records are pseudonymous: they are linked only to your internal identifier, not your e-mail, and are deleted automatically at the end of the periods in section 5. Deletion does not affect copies that Expo, Apple, Google or the e-mail provider keep under their own policies.

7. Your rights (LGPD art. 18)

You may ask, at any time and free of charge, for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data (you can edit part of it directly in the app, under Perfil);
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in violation of the law;
• data portability;
• deletion of data processed on the basis of your consent;
• information about the entities we share data with (section 3);
• information about the possibility of refusing consent and the consequences of refusal;
• withdrawal of consent (for example by turning off location, notification and calendar permissions in the device settings, or by clearing date of birth and gender from your profile);
• objection to processing based on legitimate interest, where the law allows.

How to exercise them: send your request to privacidade@borahsp.com, preferably from your account e-mail so we can confirm the request is yours. We reply within 15 days.

Data export: you can get a copy, in a structured format (JSON), of your account, profile, preferences and activity data, without the password, session tokens and notification token. In the app, at Perfil › Conta e Notificações › Exportar meus dados (Profile › Account & Notifications › Export my data), you generate this copy instantly and can save or share it.

If you think we did not resolve your request, you may lodge a complaint with the Brazilian data protection authority (ANPD): www.gov.br/anpd.

8. Minors

The minimum age to use Borah is the one shown in the app store age rating, and never under 13. The app is not directed at children and does not knowingly collect data from children under 13. The app lists bars, clubs and other events that may involve alcohol, whose sale to people under 18 is prohibited in Brazil. Adolescents' data is processed in their best interest (LGPD art. 14). If you are responsible for a child or adolescent and believe they sent us data, write to privacidade@borahsp.com and we will delete it.

9. Sponsored content

The Home screen may show sponsored content, labeled as such. The app does not use third-party advertising networks, does not read the device advertising identifier, and does not track you across other apps and sites. We do not pass personal data to advertisers through the app. In our own statistics we count how many times each sponsored item was shown and tapped, associated with your internal user identifier. Reports we send to advertisers contain only aggregate numbers, never individual-level data. Sponsored content is not targeted based on your individual profile; at most by city or event category.

10. Security

• Communication between the app and the server uses HTTPS.
• Session tokens are kept in the device's secure storage; on the server we store only the hash of session, e-mail sign-in and deletion tokens.
• Sign-in and deletion links are single use, expire quickly, and each serves a single purpose.
• Backups sent to the cloud are encrypted by us before upload.
• The test environment does not receive user data.
• No system is completely secure. If a security incident that may cause relevant harm occurs, we will notify you and the ANPD as required by law.

11. Changes to this policy

We may update this policy. The version in force is the one published on this page, with the "Last updated" date at the top. For a relevant change we will notify you in the app.

12. Contact

Questions, requests or complaints about privacy: privacidade@borahsp.com.

© 2026 Eduardo Torres Lopes · Borah · borahsp.com