Privacy Policy
Reach (“we”, “us”, “our”)
Website: https://reachapp.ie
App: Reach for iOS and Android (com.reach.app)
Effective date: 23 August 2026
Last updated: 23 August 2026
Reach is the data controller for personal data processed through the app and this website. We are based in Ireland.
For privacy questions or to exercise your rights, email hello@reachapp.ie.
We have not appointed a Data Protection Officer. That is typical for a small Irish service that does not carry out large-scale systematic monitoring. The contact above is the right place for every privacy request.
This policy covers the Reach mobile app, reachapp.ie (including waitlist signup, password-reset, and email-confirm pages), and related support.
1. Who this is for
Reach is a hyperlocal Irish town app. Residents browse posts from nearby businesses. Businesses create a public profile and post updates, deals, and events.
We are based in Ireland and designed for people in the Republic of Ireland. We process personal data under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.
Reach is not directed at children. You must be 16 or over to create an account (Ireland’s digital-consent age). We do not knowingly collect data from anyone under 16. If you believe a child has an account, email us and we will delete it.
2. What we do not do
We do not:
- sell your personal data
- use advertising networks, trackers, or data brokers
- send OS push notifications or collect device push tokens
- take payments or store card details (no billing in the app today)
- use Sentry, PostHog, Firebase Analytics, or similar product-analytics SDKs in the app
- track your location in the background
- store a live GPS trail of your movements
3. Data we collect, and why
We only collect what we need to run Reach. Legal bases are in section 5.
3.1 Account and identity
When you sign up or sign in we process:
| Data | Typical source |
|---|---|
| Email address | You, or Google / Apple if you use social sign-in |
| Password | You (stored as a hash by our auth provider; we never see it in plaintext) |
| First name, surname, display name | You, or Apple if you share your name with Sign in with Apple |
| Account role | Resident or business (organisation accounts are not offered in the app today) |
| Email / phone verification status | Our auth provider after you confirm |
| Profile photo | You, if you upload one |
Guests can browse without an account. Guest bookmarks and reactions stay on that device only.
3.2 Resident profile
- Home town (name, county, and that town’s map coordinates from our Ireland places list)
- Optional avatar
- Feed preferences (which post topics you prefer or hide)
- Posts you save, reactions (love / thanks), and businesses you follow
3.3 Business profile (public)
If you create a business account we also process, and publish on your public profile:
- Business name, type, category, bio / description
- Address, town, county, Eircode
- Map coordinates (town centre, or a pin you set)
- Phone number and website
- Opening hours
- Logo and cover image
- Verification status (the public “Verified” badge is granted only after a successful phone check, when SMS is available)
Owner first name and surname stay on your private account record. They are not shown as the public business name.
3.4 Posts and media
Businesses can publish text, photos, and events (title, description, start/end). Images are stored in our cloud storage and served as public URLs. Anyone who can open the app can see public posts that are not hidden. A shared post link opens that post in the Reach app.
You can delete your own posts in the app. We may hide or remove posts that break our rules.
3.5 Location
On the device (optional, when you allow it): we request foreground location so we can show what is nearby and sort by distance. The system prompt says: “Reach uses your location to show what's nearby and sort posts by distance.” We do not request always-on / background location.
What we store on our servers: the town you choose (and that town’s coordinates from our places list), not a history of GPS points. Live coordinates are held in memory on the device for a short time (about five minutes) to avoid asking the GPS again.
If the device cannot name the town, we may send those coordinates once to OpenStreetMap Nominatim to reverse-geocode them. You can refuse location and still use Reach by picking a town yourself.
3.6 Photos and camera
We request photo-library and (if you choose) camera access so you can set a profile photo, cover image, or post images. We only read photos you pick. We do not scan your library.
3.7 Phone number and SMS
Residents can verify with email or phone (one-time proof, not ongoing two-factor). Businesses need a verified Irish mobile (+353) for the public Verified badge.
When SMS is configured, a one-time code is sent through our auth provider’s SMS partner. Until that is live, email confirmation is the working path and a number may be saved on the profile without granting the badge.
3.8 Sign in with Google or Apple
If you use Google or Apple we receive the identifier and, if you allow it, your email and name. We do not get your Google or Apple password. You can revoke access in that provider’s account settings.
3.9 Device sign-in helpers
- Face ID / Touch ID / fingerprint only unlocks a saved Reach session on that device. Biometric data never leaves the device and is not sent to us.
- Saved sessions (including if you switch accounts) are stored on the device. Session tokens are encrypted with a key kept in the device secure store.
- Guest bookmarks, reactions, onboarding flags, and signup drafts are stored in on-device storage until you sign in, sign out, or uninstall.
3.10 In-app notifications
If you follow a business, we create an in-app inbox item when they post. We do not send lock-screen / OS push or marketing email from those settings.
3.11 Sharing
If you share a post we copy a link that opens that post in the Reach app, or we open the system share sheet / WhatsApp. WhatsApp then processes whatever you send under Meta’s terms. That is your action, not our transfer for advertising.
You can also open an event in Google Calendar. That is optional and happens in your browser / Google account.
3.12 Reliability (error reports)
If the app fails, we may send a report to our own database: error message and stack, screen name, app version, platform (iOS / Android / web), a random client session id, and your user id if you are signed in. Passwords, tokens, and API keys are stripped. Emails in the report are partially masked (for example jo***@example.com).
3.13 Support
If you email us or we help with a lockout, we process the address you write from, the account we look up, and a short audit note of what we did (for example a password-reset email or an erasure). We verify it is your account before we change anything.
3.14 Website waitlist
On reachapp.ie/signup we collect email and whether you are a resident or a business, plus the time of submit, so we can tell you when Reach is available in your town.
3.15 Website analytics
The marketing site uses Vercel Analytics (page views, device/browser, country-level location). It is not an advertising pixel and is not wired into the mobile app.
3.16 What we do not collect
Date of birth, government ID, payment cards, contacts list, precise background location, advertising IDs, or microphone / contacts permissions.
4. How we use your data
| Purpose | Examples |
|---|---|
| Provide the service | Account, session, feed, Explore map, events, follows, saves, reactions |
| Show you local content | Town on your profile; optional GPS on device to sort by distance |
| Let businesses be found | Public profile, posts, images, map pin |
| Verify accounts | Email confirm / reset links; phone OTP when SMS is available |
| Safety and trust | Hide or remove content; Verified badge after phone proof |
| Keep the app working | Error reports, security, abuse prevention |
| Support | Password help, profile fixes, erasure |
| Waitlist | Email you about launch |
| Legal | Tax, crime, or regulator requests where the law requires it |
We do not use your data for automated decisions that produce legal or similarly significant effects. There is no credit scoring or automated ban engine.
5. Legal bases (GDPR Art. 6)
| Processing | Legal basis |
|---|---|
| Account, feed, posting, follows, saves, reactions, in-app inbox, password reset | Contract (Art. 6(1)(b)) — we need this to give you Reach |
| Location permission, camera / photos, Face ID, optional Google / Apple sign-in | Consent (Art. 6(1)(a)) — you can refuse and still use much of the app |
| Waitlist email | Consent — you can ask us to remove you |
| Error reports, security, moderation, support audit logs | Legitimate interests (Art. 6(1)(f)) — running a safe, reliable service. You can object |
| Responding to a rights request or a lawful order | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, those interests are: keeping Reach available, fixing bugs, stopping abuse, and proving we handled support and erasure properly. They do not override your rights to a private life.
You can withdraw consent at any time (turn off location or photos in system settings; stop using biometrics; disconnect Google / Apple). Withdrawal does not affect processing already done.
6. Who can see your data
Public (anyone using Reach or a post link): business profiles, public posts and images, display name on resident activity such as reactions where the product shows it, town associated with public business listings.
Only you (and our systems that serve you): email, password hash, private resident profile fields, saved posts, follows, notification inbox, verification codes.
Our operators, only to help you or meet the law: support lookup, password-reset send, post hide/restore, account erasure. Privileged fields such as verification status are not editable from the app client.
Other users do not get your email or precise GPS.
7. Processors and other recipients
We use other companies as processors (they act on our instructions) or, where you choose them, as independent controllers.
| Who | Role | Where data is processed |
|---|---|---|
| Supabase (Auth, database, file storage) | Hosts accounts, app data, and images. Project region EU West (Ireland) | Ireland / EU |
| Maps in Explore (API key in the app); optional Google sign-in; optional “add to Google Calendar” | Google’s regions; may include the US | |
| Apple | Optional Sign in with Apple | Apple’s regions; may include the US |
| OpenStreetMap Nominatim | Occasional reverse-geocode of coordinates to a town name if the device cannot do it | Typically EU (OSM / Nominatim infrastructure) |
| Email delivery (via Supabase Auth / our SMTP) | Confirm-email and password-reset messages | Depends on the configured mail host |
| SMS provider (via Supabase Auth, when phone verification is enabled) | Phone verification codes, when enabled | Provider’s regions; may include the US |
| Vercel | Hosts reachapp.ie and site analytics | Vercel’s regions |
| WhatsApp / your share targets | Only if you tap share | That app’s own policy |
Supabase is our main processor. The live database sits in eu-west-1 (Ireland).
If a provider is in the US or another third country, we rely on the EU–US Data Privacy Framework where they are certified, and/or the European Commission’s Standard Contractual Clauses, plus the provider’s security measures.
We do not use Expo, EAS, or developer tools to collect extra personal data from people using a production build beyond what is listed here.
8. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, follows, saves, reactions, in-app notifications | Until you delete the account (or we erase it on request) |
| Business profile, posts, images | Until you delete them, or we remove them for moderation / erasure |
| Auth session on the device | Until you sign out or uninstall |
| Guest saves / reactions | On that device until you clear app data or uninstall |
| Live GPS on device | Minutes only (in-memory cache); not stored as a history on our servers |
| Signup drafts on device | Until you finish or clear them |
| Error reports | Only as long as we need them to diagnose issues, then we delete or anonymise them |
| Waitlist email | Until we have contacted you about launch, you ask us to remove it, or it is clearly stale |
| Support / erasure audit notes | As long as we need to show we handled the request lawfully |
| Hidden / moderated posts | As long as needed for safety and dispute handling |
Backups may lag a short time after deletion. We do not keep a separate marketing profile.
9. Your rights
You can:
- Access the personal data we hold
- Rectify it (most profile fields are editable in Settings)
- Erase it (“right to be forgotten”)
- Restrict processing in the cases the GDPR allows
- Object to processing based on legitimate interests
- Port data you gave us, in a common machine-readable form
- Withdraw consent where we rely on consent
- Complain to a supervisory authority
How to ask: email hello@reachapp.ie from the address on the account (or prove you own it). Say which right you want.
There is no in-app “Delete my account” button yet. Erasure is done by our support process: we delete your auth user, profile, follows, saves, reactions, notifications, owned businesses, their posts and media, and related records. This is permanent.
We aim to finish erasure within 5 business days. The legal maximum is one month (extendable by two months for complex requests). We will tell you if we need more time or cannot action part of the request (for example data we must keep for a legal claim).
Your Irish authority is the Data Protection Commission: https://www.dataprotection.ie. You can complain there even if you have also written to us.
10. Security
- Access to app data is enforced by row-level security in our EU database. The app only ships a public “anon” key; it cannot bypass those rules.
- Passwords are hashed by the auth provider.
- Privileged fields (verification, ownership) change only through server-side functions, not from the client.
- Images you upload are on public URLs by design (so the feed can load). Do not upload anything you do not want public.
- Error reports redact secrets.
- Session tokens on device are encrypted; older Android storage still has platform limits. Sign out on a shared device.
- We never put a service-role / admin key in the app.
No method is perfect. If we become aware of a breach that is likely to risk your rights, we will notify the DPC and, where the law requires, affected people.
12. International use
We expect users in Ireland. If you use Reach from outside the EEA, your data is still processed in the EU as described above, and may be accessible from your country when you open the app.
13. Changes
We will update this page when our practices change (for example if we add OS push notifications, payments, or a new analytics tool). The “Last updated” date will change. Material changes will be called out in the app or by email where we can.
The previous version of this page said we collected “device tokens used for push notifications”. That was incorrect. Reach does not implement OS push and does not collect push tokens.
14. Contact
Privacy and rights: hello@reachapp.ie
Website: https://reachapp.ie
This policy: https://reachapp.ie/privacy
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
https://www.dataprotection.ie