Privacy Policy
This policy explains what data the Balkan Nexus app collects, why it collects it, and what you can do about it. It is deliberately written in plain language, without unnecessary legalese.
1. Who we are
The Balkan Nexus app is provided by IM Tech Solutions, Belgrade, Republic of Serbia, company registration number 67761138 (referred to below as "we"). We are the controller of the personal data we process through the app.
For any question about data protection, write to us at info@balkannexus.com.
2. What data we collect
Account data:
- your name (as you enter it, or as it arrives from the account you sign in with)
- your email address
- your profile picture, if you set one
- the city you choose as your own
We do not see or store your password — it is handled by our sign-in provider. If you sign in with Google or Facebook, you never set a password with us at all; in that case we receive the name, email address and profile picture from that account. We download the profile picture once and keep it as our own copy, and we do not retain the provider's access token.
Content you create yourself:
- posts on the community wall, comments and likes
- classified ads, real estate listings and job ads, including any contact details you enter in them
- your CV, if you attach one to an ad stating that you are looking for work
- places (organizations) you propose, and — if you hold an ambassador or administrator role — also events, guides and tourist locations
- seller reviews and event RSVPs
- images you upload with the above content
Technical data and settings:
- a push notification token, if you allow notifications — so we know which device to send them to
- your notification settings, the news sources you follow and your Home screen layout
- your contribution points and points log, badges and city roles
If you write to us through the "Contact us" screen, we keep your message and email address so that we can reply.
Private messages:
- the content of a message you send, the time it was sent, and when it was read
- who the participants in a conversation are
- the time you were last active, so the other person can see whether you are currently online
Life Index (rating the quality of life in a city):
- ratings from 1 to 10 across areas — housing, work, costs, safety, community and others
- and, if you choose to enter them, optional details: your rent and the size of your flat, an estimate of your salary, monthly costs, household type, whether you have school-age children, which healthcare system you use, how long you have lived in the city, and how you travel to work
These optional details are more sensitive than the rest, which is why we ask for them explicitly as optional. They are never shown next to your name — see "What is public and what is not".
Community safety:
- reports you send — what you reported, the reason, and the description you write
- the list of users you have blocked
3. What we do not collect
- We do not request access to your device location. Coordinates exist only if you tap a spot on the map yourself or type an address that we then look up.
- We do not use analytics, advertising networks or advertising identifiers — the app contains no such tools.
- We do not sell, rent out or trade your data.
- We do not ask for payment card details; nothing is paid for through the app.
4. Why we process data, and on what legal basis
- So the app works as promised — showing community content, your profile, publishing and search. Basis: performance of our contract with you.
- To protect the community — content moderation, preventing abuse and fraud, account security. Basis: our legitimate interest.
- To send notifications to your phone and to access your gallery or documents when you upload something. Basis: your consent, which you can withdraw at any time.
- To meet legal obligations where they apply. Basis: legal obligation.
- So a direct message reaches the person you addressed it to. Basis: performance of our contract with you.
- To show the Life Index, built from what users enter themselves. Basis: your consent, which you withdraw by deleting your vote.
5. What is public and what is not
Public is what you would expect to be public in a community: your name, profile picture, contribution level and points, city, badges, the content you publish, and the reviews you leave.
Not public:
- Your email address. It is technically inaccessible to other users — this is enforced at the database level, so it cannot be read even by querying; only our system sees it.
- Your CV. It is stored in a private area and downloaded through a temporary link valid for a few minutes, and only by signed-in users who open your ad.
- The member list of a place. Only the number of members is public; the list is visible to that place's owner.
- Your points log and your notifications — only you see those.
Please also keep this in mind: contact details you enter into an ad (phone or email) are visible to everyone who opens that ad, because that is their purpose. Enter only what you want to be public.
Also public is whether you are currently online. We derive this from the time you were last active and show it only as "online" or nothing at all — we never state when you were last seen.
Also not public:
- The content of private messages. Only the person you are writing with sees them; they also see when you have read their message.
- Your individual vote in the Life Index. Only the combined results for a city are public — averages and medians — and only once enough answers have been collected (five for the rating, three for the optional details). Your rent or salary is never shown on its own.
- Who you have blocked and what you have reported. A blocked user is not told who blocked them, and a report is seen only by an administrator.
6. Private messages
A one-to-one conversation is seen only by the two of you. This is enforced at the database level, so another user cannot read someone else's correspondence even by querying directly.
Messages are not end-to-end encrypted. That means they are stored in our database like other content, and our system can technically access them. We do not read your correspondence and we have no moderation tool for doing so — which is also why the app has no option to report an individual message, only to report and block the user.
You can delete a message you sent; it is then no longer shown either to you or to the other person.
If someone writes to you while notifications are on, the notification title is the sender's name and the body is a short excerpt of the message. That excerpt passes through Expo and Google Firebase Cloud Messaging so that it can reach your phone, and it is visible on your lock screen. If you do not want that, turn off message notifications in Profile, under Notifications.
7. Who we entrust data to
We do not do everything ourselves — we use established service providers, who process data on our instructions:
- Supabase — database, sign-in system and file storage
- Resend — sending email (replies to your message and account deletion confirmations)
- Expo and Google Firebase Cloud Messaging — push notification delivery
- Google and Meta (Facebook) — only if you choose to sign in with them
- Mapbox — map display and address search; when you type an address, that query goes from your device to Mapbox
- flagcdn.com — flag images in city and news lists
- Cloudflare — public pages for shared links
Some of these services are located outside the European Union, so data is transferred to other countries to that extent. We choose providers that offer contractual safeguards for such transfers.
8. How long we keep data
We keep your account data and your content for as long as you have an account. News from external sources is kept for 30 days and then deleted automatically. Content deleted by you or by a moderator remains in our records flagged as deleted — it is no longer shown to anyone, but it serves us briefly for moderation and dispute resolution.
We keep messages for as long as both participants have an account — deleting either of those two accounts removes the entire conversation. We keep your Life Index vote until you delete the vote or your account; the combined result for the city remains after that, but with no link to you. We keep reports even after resolving them, so that we can recognise repeat behaviour.
9. Deleting your account
You can delete your account yourself, in Profile, under Settings. Deletion is permanent and cannot be undone; you receive a confirmation by email.
Deleted with the account: your profile, posts, comments, likes, classified ads, real estate listings, job ads, reviews, event RSVPs, memberships, points, badges, notifications and settings, notification tokens, and the files you uploaded, including your CV.
What remains, but with no link to you:
- A place (organization) you founded stays in the community without an owner, so someone else can claim it. That way the community does not lose content that is still useful to others.
- Events, guides and tourist locations you entered stay published, but without author details.
- Content created by others — for example a comment on your post — is not deleted automatically, in line with those users' rights.
In addition to the above, deleting your account also removes conversations and messages, your Life Index vote, the blocks you set, and the reports you submitted. A conversation is an exception to the previous rule: because it has two sides, deleting your account also removes the other person's messages in that conversation — their messages in other conversations remain.
10. Your rights
At any time you have the right to:
- be told what data we process about you and to receive a copy of it
- correct inaccurate data — you can change most of it yourself in the app
- delete your account and your data
- object to processing based on our legitimate interest
- withdraw consent for notifications, either in the app or in your phone settings
- lodge a complaint with a data protection supervisory authority — in Serbia this is the Commissioner for Information of Public Importance and Personal Data Protection, and if you live in another country, the supervisory authority of that country
To exercise these rights it is enough to write to us at info@balkannexus.com.
11. Age
The app is intended for people aged 18 and over. If we establish that an account was created by someone younger, we will delete it.
12. Security
Access to data is restricted at the database level, so everyone sees only what they are entitled to. Sensitive fields, such as email address and CV, are protected additionally. All communication between the app and our servers is encrypted. No system is absolutely secure, but we work to keep protection appropriate to the data we hold.
Private messages are not end-to-end encrypted — see the "Private messages" section for more.
13. Changes to this policy
If we change this policy, we will publish a new version in the app and update the date below. If a change is significant, we will notify you in the app.
14. Contact
IM Tech Solutions, Belgrade, Republic of Serbia — company registration number 67761138
Email: info@balkannexus.com
This policy exists in several languages. In the event of any difference in interpretation, the Serbian version prevails.