Werjo — Privacy Policy

Last updated: August 15, 2026 | Version: 1.1Suomeksi

Werjo Oy ("Werjo", "we", "us" or "our") respects your privacy. This Privacy Policy explains how we collect, use, store, and share information when you use the Werjo mobile applications for iOS and Android, Werjo websites, and related services.

1. Who We Are And How To Contact Us

Werjo Oy is responsible for the Werjo app, websites, and related services.

Company address: Antinkatu 3 D 7, 00100 Helsinki, Finland. Werjo Oy is registered in the Finnish Trade Register. Business ID: 3633018-3

Support/privacy/legal contact: support@werjo.com.

Support page: https://werjo.com/support/.

2. What Werjo Is

Werjo is an event and city discovery platform. Werjo displays information about events, places, venues, organisers, maps, media, embedded media, and related content from public, official, partner-provided, or other available sources.

In the current version of the service, Werjo does not sell tickets, process event registrations or ticket payments, offer in-app purchases or subscriptions, or allow organisers to self-publish events directly through the service.

3. From Where We Collect Personal Data

Werjo may collect personal data from different sources depending on the relevant feature, service, integration, content source, user choice, privacy setting or consent choice.

Werjo may collect personal data:

directly from users, when they create an account, sign in, complete profile setup, update profile information, select preferences, save events or locations, use social features where available, report issues, contact Werjo, or manage settings;
automatically when users use the website, mobile application, content API, embedded content or related digital services, for example through technical logs, cookies, SDKs, local storage, request metadata, analytics, diagnostics and similar technologies;
through service providers used to operate, secure, authenticate, host, analyse, troubleshoot and improve the service;
from optional login providers, such as Google Sign-In or Sign in with Apple, where the user chooses that login method;
from third-party services, integrations or platforms, where the user chooses to connect, use or interact with such services through Werjo;
from public, official, partner-provided or other available sources in connection with event, venue, organiser, location, map, media and city content. This may include publicly available event-related or business contact information, where applicable.

4. What Personal Data We Collect

Account And Authentication Information

When you create or sign in to a Werjo account, we may process account information such as email address, authentication provider, Firebase user identifier, email verification state, login/session metadata, and account security metadata.

The exact data processed depends on the account setup, login method, user settings and features used. Werjo does not collect all of the data listed above in every case.

Account creation, first-time profile setup or access to certain features may require confirmations, such as acceptance of the Terms of Use and this Privacy Policy, confirmation that the user is at least 18 years old, or other legally required confirmations. Werjo may store related confirmation metadata, such as confirmation source, timestamps, confirmation of 18+ account eligibility, and Terms or Privacy Policy version identifiers.

If you choose Google Sign-In or Sign in with Apple, the provider may give Werjo the account information needed to sign you in, such as your email address, name, account identifier, and basic profile information depending on your provider settings. Werjo does not receive your Google password or Apple ID password.

Profile Information

Werjo may process profile information, such as display name, nickname, avatar, selected city or district, app language or locale preference, profile visibility settings, favourite-event visibility settings, profile creation and update timestamps, and profile status or moderation information.

Where provided by the user and where available, Werjo may also process optional profile information, such as birthday or gender. The exact profile information processed depends on the features used, the information provided by the user, and the user’s privacy settings.

Some profile information may be visible to other Werjo users where social features are available and depending on the user’s privacy settings and the feature being used. For example, profile information may be used or displayed in connection with friends, invitations, blocked-user screens and social activity features.

Profile information may also be used by Werjo to operate safety, support, moderation, issue-reporting and abuse-prevention processes.

Avatar And Media You Provide

If you upload, select or import a profile avatar, Werjo may store the image and related metadata, such as storage path, avatar URL, source, file information and update time. The current app normalises avatar images for profile use and stores profile avatars in Firebase Storage.

The exact metadata processed may depend on the upload method, device, storage provider and app version.

Profile avatars may be shown to other signed-in users in app features where profiles are visible, depending on the feature used and the user’s profile visibility settings.

If you select a profile avatar through the system photo picker, the app receives the image you choose to provide. The current app does not request camera access. Where the system photo picker is used, Werjo does not receive access to the user’s full photo library through that picker.

Werjo does not use profile avatars for facial recognition or biometric identification.

Werjo may remove, restrict or replace avatars that violate the Terms of Use, safety rules, privacy rights, image rights, intellectual property rights or other third-party rights.

Social Features

Where social features are available and used, Werjo may process social feature data such as friend relationships, friend requests, event invitations, blocked users, blocking relationships, social notification state, and related visibility state. We may use this information to provide social features, enforce privacy choices, prevent unwanted contact, and protect users from abuse.

Saved Content, Preferences, And App Interactions

Werjo may process saved content, preferences and app interaction data, depending on the features used, user settings and privacy choices.

This may include saved events, saved locations, selected visit dates, favourite-event state, favourite-location state, feed state, events or locations already shown in your feed, notification or reminder schedules, privacy choices, diagnostics choices, selected city or district, and other account or app settings.

Werjo does not process all of the data listed above in every case. The exact data processed depends on how the user uses Werjo, which features are available or enabled, and the user’s settings or consent choices.

Werjo uses this information to provide core app features, personalise and sync app state, avoid showing duplicate feed items as new, support favourite-event or social visibility features where enabled, remember user settings, and maintain a consistent experience across sessions and devices.

Saved locations, selected city or district, and selected visit dates are based on information selected or saved by the user in the service. They do not necessarily mean that Werjo collects precise real-time location data.

Reports And Moderation

Where reporting, safety or moderation features are available or used, Werjo may process information related to reports and moderation cases.

If you report another user or content, or if another user reports you, Werjo may process information such as user identifiers, profile information, report reasons, optional report details, timestamps, source screen or context, moderation actions, review status, and related metadata.

Werjo does not process all of the data listed above in every case. The exact data processed depends on the report, the feature used, the information provided by users, and the action needed to review and handle the matter.

Werjo uses this information to review reports, enforce the Terms of Use, protect users and the service, prevent abuse, investigate safety issues, handle disputes, comply with legal obligations, and maintain the integrity of the service.

Safety and moderation records may be retained after account deletion where necessary for security, abuse prevention, Terms enforcement, legal compliance, dispute handling, protection of users or protection of Werjo’s rights.

Werjo’s standard retention and review period for user reports and moderation records is up to 24 months from the latest relevant event, such as report creation, the latest moderation action, case closure, or the related account deletion event. A longer retention period may apply where necessary for an active safety, legal, support, abuse-prevention or dispute issue.

Werjo may limit the information shared between the reporting user and the reported user where this is necessary to protect privacy, safety, legal rights, or the integrity of the review process.

Server, Search, And Technical Request Information

When you search, filter, browse, or request app or website content, Werjo servers may process technical request and log information. This may include search terms, filters, requested content, IP address, timestamps, URLs or object paths, user agent, app version, device type, operating system, request metadata, network-related metadata, App Check or app integrity metadata, and operational or security log data.

Werjo does not process all of the data listed above in every case. The exact information processed depends on the request, device, app version, service configuration, security settings and features used.

Werjo uses this information to deliver requested content, maintain service reliability, troubleshoot issues, monitor server health, analyse technical performance, detect suspicious activity, prevent misuse, and protect the service, users and third parties.

Server, search and technical request logs are not used for advertising personalisation or profiling-based marketing.

Werjo’s current standard retention period for server, search and technical request logs is normally up to 90 days. A longer retention period may apply where necessary for an active security, abuse-prevention, legal, support, technical investigation or dispute issue.

Analytics And Crash Diagnostics

Werjo may use Google Analytics for Firebase and Firebase Crashlytics to understand app usage, diagnose crashes, improve performance, troubleshoot technical issues, and maintain the reliability and security of the service.

Depending on the app version, device, operating system, error type, service configuration and user settings, this may include app interactions, device and app information, crash logs, stack traces, timestamps, diagnostic categories, diagnostic identifiers, error information, performance-related information and sanitised diagnostic event parameters.

Werjo does not process all of the data listed above in every case. The exact data processed depends on the feature used, the technical issue, the app configuration and the user’s consent or diagnostics settings.

Werjo does not use Google Analytics for Firebase for advertising personalisation or profiling-based marketing.

App usage analytics collection and crash diagnostics collection are controlled by separate settings in the app, where available.

The current app stores diagnostics and analytics choices locally on the user’s device and sends or records analytics or crash diagnostics only where the current app configuration and the relevant user setting allow it.

Werjo aims not to include unnecessary personal data in crash logs or diagnostic event parameters. Diagnostic data should not intentionally include sensitive information, passwords, authentication tokens, payment details or other content that is not necessary for diagnostics.

Firebase Crashlytics and diagnostics data are retained according to Werjo’s diagnostics retention settings and applicable provider retention periods. Google’s Firebase documentation currently states that Crashlytics keeps crash stack traces and associated identifiers for 90 days before starting removal from live and backup systems.

App Integrity And Security

Werjo may use Firebase App Check with Apple App Attest on iOS, Google Play Integrity on Android, and similar app integrity or attestation technologies to help verify that requests to Werjo backend services come from legitimate app instances and to protect the service, users and infrastructure from abuse, fraud, automated misuse, unauthorised access and other security risks.

These technologies may process app integrity, attestation, security and request metadata, such as app instance information, integrity or attestation tokens, device or platform signals, request timestamps, backend request metadata, and related security verification results.

Werjo uses this information to protect backend services, enforce security rules, prevent misuse, maintain service reliability, investigate suspicious activity, and support legal and Terms enforcement where necessary.

App integrity and security information is not used for advertising personalisation or profiling-based marketing.

Push Notifications And Device Identifiers

When you enable push notifications or the app is registered for notifications, Werjo uses Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) to deliver optional app notifications and reminders.

Werjo may store the FCM registration token and Firebase Installation ID under your Werjo account together with technical metadata such as platform, app locale, timezone, app version, build number and bundle identifier. Firebase Messaging processes the APNs device token and associates it with a Firebase installation identifier or FCM registration token.

These identifiers are linked to your Werjo account while they are stored under that account. Werjo uses them only to deliver, localise, troubleshoot, rate-limit, deduplicate and clean up optional notifications and reminders as part of App Functionality. Werjo does not use these identifiers for advertising tracking or advertising personalisation.

Apple and Google/Firebase may separately process technical service identifiers according to their own privacy information, terms and retention practices.

Maps

Where map features are used, Werjo uses Mapbox to display maps, venue locations, event locations, city or district areas, and map previews.

When maps are loaded or used, Mapbox may receive and process technical information, map usage information and request metadata, such as IP address, device or browser information, app information, map tile requests, viewed map area, timestamps and related usage data, according to Mapbox’s privacy policy and terms.

The current Werjo mobile apps do not request access to the user’s precise or current device location for map display. Maps are based on venue, event, city, district or content coordinates, not on real-time GPS tracking of the user.

If Werjo introduces device location features in the future, Werjo will update this Privacy Policy where necessary and request device permission in context, where required.

MapLibre, OpenFreeMap, And OpenStreetMap

The Werjo mobile app startup animation uses MapLibre to render vector tiles supplied by OpenFreeMap using the OpenMapTiles schema and OpenStreetMap data.

When the startup map is loaded, OpenFreeMap and its delivery or security providers may receive and process technical request data such as IP address, requested tile resources, timestamp, and device or operating-system information. According to OpenFreeMap's current privacy information, regular logs are anonymised without IP addresses by default, while temporary IP logging may be enabled to investigate security incidents.

The startup map does not request or display the user's device location. Map attribution, provider information and licence links are available in the app's Data Licenses section and at https://werjo.com/licenses/.

YouTube Videos

Some event, venue, location or city content pages may include embedded YouTube videos.

Where possible, Werjo uses YouTube’s privacy-enhanced embed mode. The current Werjo mobile apps also configure embedded web views to avoid persistent local website storage where technically feasible.

Even where privacy-enhanced embed mode is used, Google or YouTube may still process information when a video embed is loaded, displayed, interacted with or played. This may include IP address, device or browser information, app or web view information, video playback interactions, timestamps and related technical data, according to Google’s privacy policy and YouTube terms.

Werjo does not control Google’s or YouTube’s separate data processing, cookies, storage technologies, terms or privacy practices. Users should review Google’s and YouTube’s own privacy information for more details.

Spotify Audio Players

Some event or venue content pages may include embedded Spotify audio players.

The current Werjo mobile apps load Spotify content in an embedded web view configured to avoid persistent local website storage where technically feasible and to require user action before media playback.

Spotify may process information when an embedded player is loaded or displayed, when the user interacts with it, or when audio is played. This may include IP address, device, browser or web view information, content identifiers, playback interactions, timestamps and related technical data, according to Spotify’s privacy policy and terms.

Werjo does not control Spotify’s separate data processing, cookies, storage technologies, terms or privacy practices. Users should review Spotify’s own privacy information for more details.

Media Delivery

Werjo-hosted event, venue, location and city media may be delivered through Werjo backend, hosting, CDN or other media infrastructure. User avatar images are stored in Firebase Storage.

When media is requested, loaded or displayed, Werjo and its technical service providers may process technical request metadata needed to deliver the media and protect the service. This may include IP address, URL or object path, timestamp, user agent, app or browser information, network-related metadata, storage or delivery logs, and related security or diagnostic information.

Werjo uses this information to deliver media, maintain service reliability, secure the service, prevent misuse, troubleshoot issues, investigate technical problems, and protect users, Werjo and third parties.

Media delivery metadata is not used for advertising personalisation or profiling-based marketing.

Support Messages

If you contact Werjo, Werjo may process information related to your request, such as your email address, message content, attachments or screenshots you provide, account identifier where needed, timestamps, correspondence history and related metadata.

The exact information processed depends on the communication channel used and the information you choose to provide.

Werjo uses this information to respond to your request, provide support, troubleshoot issues, investigate technical or account-related problems, maintain appropriate records, protect users and the service, and handle legal, safety or dispute-related matters where necessary.

Attachments, screenshots or messages you send to Werjo may contain personal data about you or other people. Please do not send sensitive or unnecessary information unless it is relevant to your request.

Information Not Collected In The Current Mobile App Releases

In the current Werjo mobile app releases, Werjo does not ask users to provide, and its own app features do not directly request access to or collect, the following categories of data:

payment card data;
in-app purchase data;
device address book contacts;
phone numbers as a Werjo account or profile field;
camera recordings;
microphone recordings;
health or fitness data;
the user's current or precise GPS location;
IDFA, Android Advertising ID, or advertising tracking data.

The current Werjo mobile apps do not ask users to provide a phone number as part of their Werjo account or profile and do not request access to the camera, microphone, address book, health or fitness data, or the device's current or precise GPS location for the features described in this Privacy Policy.

Integrated providers and third-party websites, ticket providers, embedded content providers, map providers or other external services may process technical, account, map-area, SDK or other data as described elsewhere in this Privacy Policy and in their own privacy documentation when users access or interact with those services.

If Werjo introduces new features that require additional data collection or device permissions, Werjo will update this Privacy Policy where necessary and update any required in-app permission flows, consent flows or platform-store disclosures.

5. What We Use Personal Data For

Werjo may use personal data for the following purposes, depending on the features used, the user’s settings, privacy choices and consent choices:

create, authenticate, verify, and manage user accounts;
provide profiles, saved content, selected city/district preferences, social features, invitations, reports, blocks, moderation tools, maps, media, embedded media, account deletion, and support;
sync app state and personalize the app based on user choices and saved state;
provide in-app notification records, reminder schedules, and, if introduced or enabled, push notifications;
maintain security, verify app integrity, prevent spam, abuse, fraud, scraping, and unauthorized access;
respond to support, privacy, legal, abuse, and rights requests;
manage consent, privacy, diagnostics, marketing, notification, and account preferences;
troubleshoot bugs, crashes, server issues, and service availability problems;
improve app reliability, content quality, and user experience;
send service communications and, if introduced, marketing communications only where permitted by law and where required with consent;
comply with legal obligations and handle legal claims or disputes.

Werjo does not sell personal data and does not use personal data for advertising personalization in the current release.

6. Legal Bases For Processing

Werjo relies on different legal bases depending on the processing context, the feature used, the user’s settings, privacy choices and consent choices.

Werjo may process personal data based on:

performance of a contract, where processing is necessary to provide the Werjo service and account features, such as creating and managing accounts, authenticating users, operating profiles, saved content, preferences, selected city or district settings, social features, maps, media, embedded content, account deletion features and user support;
consent, where required by law or where Werjo asks for the user’s permission, such as for non-essential cookies or similar technologies, analytics, marketing communications, push notifications, diagnostics sharing or similar optional activities;
legitimate interests, where processing is necessary for Werjo’s or a third party’s legitimate interests and those interests are not overridden by the user’s rights and freedoms. This may include service security, fraud and abuse prevention, app integrity verification, technical operation, service improvement, operational and security logs, troubleshooting, report handling, moderation, rights protection, Terms enforcement, dispute handling, and protecting users, Werjo and third parties;
legal obligation, where Werjo must process or retain personal data to comply with applicable law, respond to legally valid requests, fulfil regulatory obligations, or keep records required by law.

Werjo does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning users or similarly significantly affect users.

7. Cookies, SDKs, Local Storage, And Similar Technologies

Werjo may use cookies and similar technologies on its website. Werjo may also use SDKs, local storage, app storage, embedded web technologies and similar technologies in the mobile application and related digital services.

These technologies may store or access information on the user’s device and help Werjo operate, secure, improve and measure the use of the service. Where permitted by law and, where required, with the user’s consent, they may also be used to measure marketing effectiveness or support marketing-related features.

The exact technologies used may depend on the website, app version, device, browser, operating system, feature, service configuration and the user’s settings or consent choices.

Essential technologies

Essential technologies are always enabled where they are necessary for the service, security, login, account management, app integrity, user preferences, consent management or basic service functionality. These technologies are required for the service to work properly and cannot be disabled through Werjo’s consent settings.

Blocking or deleting essential technologies through browser, device or operating system settings may affect the functionality of the website or application.

Analytics technologies

Analytics technologies help Werjo understand how users use the website or application, which features are used, and how the service can be improved.

Analytics technologies are used only where permitted by law and, where required, with the user’s consent or relevant app setting.

Marketing technologies

Werjo may use marketing cookies or similar technologies on the website to measure marketing effectiveness, personalise marketing or show promotional content.

Marketing technologies may be used only where permitted by law and, where required, with the user’s consent.

Werjo does not use app analytics for advertising personalisation or profiling-based marketing in the current release.

If Werjo introduces advertising personalisation or profiling-based marketing in the future, Werjo will update this Privacy Policy where necessary and request any consent required by law before starting such processing.

Managing choices

Users can manage cookie, analytics and marketing technology choices through the cookie, privacy or app settings available in the service, where applicable. Users may also manage or delete cookies through browser settings.

Werjo will provide information about the main cookies and similar technologies used, their purposes, providers and retention periods in the cookie settings, cookie banner, cookie policy or cookie list, where applicable.

Mobile App Local Storage And Embedded Content

The Werjo mobile apps may use local app storage, including UserDefaults on iOS and SharedPreferences or equivalent app storage on Android, for app-specific preferences and settings, including diagnostics consent choices and local configuration state.

Embedded YouTube and Spotify web content is configured with non-persistent local website data in the current mobile apps where technically feasible. However, third-party embedded content providers may still process technical data according to their own privacy policies and terms when embedded content is loaded, displayed, interacted with or played.

8. Marketing Communications And Choices

Werjo may send service communications related to the use of Werjo, such as account, security, legal, privacy, support, moderation, service change or other important service notices. These service communications are not marketing communications.

Werjo sends newsletters, promotional messages, partner offers, marketing push notifications or similar marketing communications only where permitted by law and, where required, with the user’s consent.

Users may withdraw marketing consent or object to direct marketing at any time through the account, privacy, notification or app settings available in the service, by using the unsubscribe link included in marketing messages, or by contacting Werjo.

If a user opts out of direct marketing, Werjo will no longer use that user’s personal data for direct marketing purposes. The user may still receive service communications related to the use of Werjo.

Partner offers may be sent by Werjo only where permitted by law and, where required, with the user’s consent. Werjo does not share user-level personal data with partners for their own direct marketing unless this is clearly explained and the required legal basis, such as consent, applies.

Werjo accounts and account-based marketing and push-notification choices are available only to users aged 18 or older. Werjo does not knowingly direct targeted marketing or profiling-based advertising to persons under 18.

9. Who Can Process Personal Data And Third-Party Disclosures

Werjo may share or make personal data available to service providers and third-party services where this is necessary to provide, secure, maintain, analyse, troubleshoot or improve the service, or where the user chooses to use a third-party feature.

Some service providers act as processors on behalf of Werjo. This means that they process personal data according to Werjo’s instructions and for the purposes of providing services to Werjo.

Some third-party services may act as independent controllers for their own processing. This may apply, for example, where the user chooses to use a third-party login provider, loads embedded third-party content, uses map features, or interacts with a third-party website or service. In those cases, the third party’s own privacy policy and terms may also apply to its processing.

Key providers and services used in the current release, or used where the relevant feature is enabled, include:

Firebase Authentication, Firestore, Storage, Functions, Analytics, Crashlytics, App Check and related Google/Firebase infrastructure for authentication, account data, profile and social data, avatar storage, app integrity, analytics and crash diagnostics;
Firebase Cloud Messaging for optional push notification delivery and related token and installation identifier processing;
Apple Push Notification service for delivery of notifications to Apple devices;
Google Sign-In for optional account login and profile setup where the user chooses this login method;
Sign in with Apple for optional account login and Apple account deletion reauthentication or token revocation where applicable;
Mapbox for maps, map previews, venue or location display, attribution and map-related technical processing according to Mapbox settings, privacy policy and terms;
MapLibre, OpenFreeMap, OpenMapTiles and OpenStreetMap for rendering and supplying the startup map, tile delivery, map data, attribution and licence information;
YouTube/Google for embedded videos where videos are loaded, displayed, interacted with or played;
Spotify for embedded audio players where players are loaded or displayed, interacted with, or used for audio playback;
Werjo backend, content API, media infrastructure, object storage, hosting, logging, security and support systems used to provide, secure and maintain the service.

In the current version of the service, Werjo does not share user-level personal data with event organisers for ticket sales, event registration or organiser self-service publishing because those features are not currently provided by Werjo.

Werjo may disclose personal data where required by law, to respond to legally valid requests, to protect rights and safety, to prevent misuse, to enforce the Terms of Use, or in connection with a business transfer such as a merger, acquisition, restructuring or sale of assets.

Where personal data is transferred outside the EU or EEA, Werjo uses appropriate safeguards as described in the section on international data transfers.

10. Provider Location And International Transfers

Werjo is established in Finland and is designed primarily for users in Finland and the European Union. Werjo aims to keep core service infrastructure and core service data within the EU or EEA where reasonably possible.

However, Werjo uses service providers and third-party services to operate, secure, maintain, analyse, troubleshoot and improve the service. Some of these providers may process personal data outside the user’s country of residence and, in some cases, outside the EU or EEA, including in the United States.

This may apply, for example, to certain Firebase/Google services, Google Sign-In, YouTube/Google embedded content, Spotify embedded content, Mapbox, OpenFreeMap tile delivery, Apple login services, support, security, analytics, diagnostics, hosting, media delivery or other technical service providers, depending on the service used, provider infrastructure, user settings, service configuration, support needs, security needs and the user’s interaction with third-party features.

Where technically and commercially reasonable, Werjo configures core backend, database, storage and media infrastructure in the EU or EEA. However, Werjo does not guarantee that all processing by Firebase, Google, YouTube, Spotify, Mapbox, OpenFreeMap, Apple or other providers remains in Finland or within the EU or EEA.

Where personal data is transferred outside the EU or EEA, Werjo uses appropriate safeguards required by applicable data protection law. These may include adequacy decisions, standard contractual clauses, data processing agreements, contractual protections, supplementary measures where required, and other legally recognised transfer mechanisms.

Third-party services that act as independent controllers may also process personal data according to their own privacy policies, terms and international transfer mechanisms.

11. Retention

Werjo keeps personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

The retention period depends on the type of data, the purpose for which it was collected, the user’s choices, and any applicable legal, security, support, backup, moderation, abuse-prevention or dispute-related requirements.

In general:

account data is kept while the user account remains active;
saved events, saved locations, preferences, social state, selected visit dates, notification or reminder schedules, and feed state are kept while the user account remains active or until the user deletes, changes or expires the relevant item, where supported;
legal confirmation and consent records may be kept for as long as necessary to demonstrate account eligibility, consent status, Terms or Privacy Policy acceptance, and compliance, and for a limited period after consent withdrawal or account deletion;
marketing preference records may be kept for as long as necessary to respect opt-out or consent choices;
technical and security logs are normally retained for up to 90 days, unless longer retention is needed for an active security, abuse-prevention, legal, support, technical investigation or dispute issue;
support messages are kept for as long as necessary to handle the request and for a limited period afterwards in case of follow-up questions, legal obligations, support needs or disputes;
analytics data is kept for a limited period depending on its purpose and the relevant analytics or Firebase account settings;
Firebase Crashlytics and diagnostics data are retained according to Werjo’s diagnostics settings, provider settings and applicable Google/Firebase terms;
user reports, moderation records and completed account deletion audit records are reviewed against a standard 24-month retention window, unless longer retention is needed for an active safety, abuse-prevention, legal, support, moderation or dispute issue;
aggregated or anonymised data that no longer identifies a user may be retained for service improvement, analytics, reporting, security and abuse-prevention purposes;
backup copies, where maintained, are normally retained for up to 90 days, unless longer retention is needed for an active security, legal, support, technical investigation or dispute issue.

If a user deletes their account, Werjo will delete or anonymise personal data linked to the account, unless certain information must be retained for legal obligations, security, fraud prevention, abuse prevention, moderation, dispute resolution, support handling, accounting where applicable, or backup lifecycle purposes.

Some deleted data may remain in backup copies until those backups are overwritten or deleted according to Werjo’s backup lifecycle. If data is restored from backup, deletion requests are re-applied where required.

12. Your Privacy Choices

You can manage certain privacy and data choices in the Werjo app from Settings > Privacy & Data, where available.

Depending on your account, app version, device, operating system, features used and service configuration, this may include:

making your profile private or discoverable;
controlling whether favourite events are visible to friends;
enabling or disabling crash diagnostics sharing;
enabling or disabling app usage analytics sharing;
opening Werjo’s Privacy Policy and Terms of Use;
managing blocked users from the relevant settings screens;
deleting your account from Settings.

Some processing is required to operate, secure and maintain the app and cannot be disabled through privacy settings. This includes processing necessary for authentication, account security, app integrity checks, operational and security logs, report and block handling, moderation, backend request processing, content delivery, abuse prevention, legal compliance and enforcement of the Terms of Use.

If you delete your account, Werjo will delete or anonymise personal data linked to the account, unless certain information must be retained as described in the Retention section of this Privacy Policy.

13. Your Legal Privacy Rights

Where the GDPR applies, you may have the right to:

request access to your personal data;
request correction of inaccurate or incomplete personal data;
request deletion of your personal data in certain situations;
request restriction of processing in certain situations;
object to processing based on legitimate interests;
object to direct marketing at any time;
request data portability where applicable;
withdraw consent at any time, where processing is based on consent.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To make a privacy request, you can contact Werjo at support@werjo.com or use the relevant in-app or account setting where available. We may need to verify your identity or account before fulfilling the request.

Where the GDPR applies, Werjo will respond to privacy requests without undue delay and in principle within one month of receiving the request. This period may be extended where permitted by law, for example if the request is complex or if Werjo receives multiple requests from the same person. If the response period is extended, Werjo will inform the user of the extension and the reasons for it.

You may also have the right to lodge a complaint with a data protection authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman: https://tietosuoja.fi/en/home.

14. Account Deletion

You can request account deletion from the Werjo app in Settings, where available.

Account deletion removes or anonymises account data associated with your profile and app usage, subject to limited retention where necessary for security, abuse prevention, legal compliance, dispute resolution, support handling, backups, moderation records, account deletion audit records or deletion-support records.

Werjo's backend account deletion removes account-owned push token and delivery records, including the FCM registration token, Firebase Installation ID stored by Werjo, delivery markers and related push metadata associated with the deleted account. This removes Werjo's account-linked copies; Apple and Firebase may separately process service-side data under their own policies and retention practices.

If account deletion fails or you cannot access the app, you can contact Werjo at support@werjo.com from the email address associated with your Werjo account, where possible.

15. Security

Werjo uses technical and organisational measures designed to protect personal data. These may include HTTPS/TLS, access controls, Firebase Security Rules, authenticated backend access, callable functions for sensitive social or profile actions, app integrity checks, logging, monitoring and other security measures where applicable.

However, no system can be guaranteed to be completely secure. Users should also keep their account login details secure and contact Werjo if they suspect unauthorised access to their account.

16. Children's Privacy

Werjo accounts and account features are available only to individuals who are at least 18 years old. Persons under 18 may not create, access or use a Werjo account. Werjo may require users to confirm that they are at least 18 and may suspend or delete an account if Werjo reasonably believes that the account holder is under 18 or that the age confirmation is inaccurate.

Public event and city content may be accessible without a Werjo account. Access to public content does not permit a person under 18 to create or use an account. Some events listed in Werjo may also be subject to separate age restrictions, including 18+ restrictions, determined by the organiser, venue, ticket provider or applicable law.

Werjo does not knowingly permit persons under 18 to provide personal data through account features. If you believe that a person under 18 has created an account or provided personal data through account features, please contact Werjo at support@werjo.com. Werjo may still process limited technical data when public website content is accessed, as described in this Privacy Policy.

17. Third-Party Links And Event Sources

Werjo may include links to third-party websites, organisers, venues, ticket providers, map providers, embedded media providers, social media pages or other external sources.

Their services, content, availability, terms and privacy practices are separate from Werjo and are governed by their own terms and privacy policies.

Werjo is not responsible for third-party websites, services, content, privacy practices or actions, to the extent permitted by applicable law.

18. Changes To This Privacy Policy

Werjo may update this Privacy Policy from time to time as the service develops or if Werjo's data processing practices change. The latest version will be available through the service and will show the date when it was last updated.

If Werjo makes material changes to this Privacy Policy, Werjo will provide reasonable notice, for example through the service, by email, by in-app notification, or by another appropriate method. Where a change requires the user's consent, Werjo will request consent separately before starting the relevant processing.

19. Contact

For privacy questions, privacy requests, support, abuse, legal or moderation concerns, you can contact Werjo at:

support@werjo.com
https://werjo.com/support/

20. Privacy Policy Change History

August 15, 2026 — Version 1.1: updated this Privacy Policy to cover Werjo mobile applications for iOS and Android; clarified Google Play Integrity, Firebase Cloud Messaging, Android local storage, embedded media, map and advertising identifier practices; and added direct web pathways for account and selected-data deletion requests.

July 27, 2026 — Version 1.0: first public Werjo Privacy Policy published for the Werjo iOS app, website, user accounts available only to users aged 18 or older, age and Terms/Privacy confirmations, profile data, avatars, social features, saved content, notification and reminder state, optional push notifications, APNs/FCM device identifiers, notification and marketing choices, search and filter logs, essential, analytics and marketing cookies and similar technologies, Firebase and Google services, Mapbox, the MapLibre/OpenFreeMap startup map and OpenMapTiles/OpenStreetMap attribution, YouTube and Spotify embeds, contextual sponsored or promoted content, diagnostics and analytics choices, account deletion, retention, international transfers, privacy choices, and current non-collection boundaries.