Last updated 23 August 2026
This explains what Attaway stores about you, why, and how to get rid of it. In plain language, because you should not need a lawyer to read a privacy policy.
Bregox AS (org. no. 933336727), Norway, is the data controller for Attaway. You can reach us at [email protected].
Your account: the identifier your sign-in provider gives us (Apple or Google), your email address, your display name, your username and your friend code.
Your activity: the awards you give and receive, the notes and photos attached to them, gold stars, comments, and who your friends are.
Notifications: a push token for your device, if you allow notifications.
We do not track your location, we do not run advertising, and we do not sell anything about you to anyone.
You can give points to someone who has not signed up. We store the name you type for them and the note you write, and we put it behind a private link so you can send it to them.
That link shows only the giver’s first name, the points, and the name the award was addressed to. It never shows the note or a photo — those wait until the person signs in and claims the award.
Anyone holding the link can delete the award outright, without creating an account. The giver can withdraw it at any time. If you are named in an award and no longer have the link, email [email protected] and we will remove it.
Unclaimed awards are permanently deleted 30 days after they are created. That is the retention limit for a named non-user’s data: after 30 days the name and the note are gone, not merely unreachable.
Photos are only ever the ones you pick or take yourself. Before a photo leaves your phone we resize it and re-encode it, which means none of the original’s embedded metadata survives — including any GPS coordinates. Attaway never asks for location permission and does not have it.
You can report an award, a comment or a person from inside the app, and you can block anyone. When you report something we store what was reported, so it can still be reviewed if the content is later deleted or a name is changed.
Reports are the one thing that outlives account deletion. If you delete your account, reports you filed remain but your identity is removed from them, and reports about you remain. A safety record that the person reported can erase by deleting their account would not be a safety record.
Most of it is necessary to provide the app you signed up for — that is the contractual basis under GDPR. Push notifications rest on the consent you give when you allow them, and you can withdraw that at any time in Settings. Keeping reports rests on our legitimate interest in running a safe app, and on the obligations the app stores place on us.
All data is stored in the European Union, in Supabase’s Ireland region.
One other processor is involved, and only for operational email: Resend sends us an alert when a child-safety report is filed, and a summary of how many reports are waiting. Those messages contain a report reference and counts — never a name, a note, a photo or any other content from a report.
We keep your data for as long as your account exists, except unclaimed awards (30 days, above) and reports (kept, with the reporter’s identity removed on deletion).
You can see and correct your profile inside the app, and delete your account from Settings — that permanently removes your profile, your awards and your photos. Comments you left on other people’s awards stay, with your name removed, so those conversations still read.
You can also ask us for a copy of your data, ask us to correct or erase it, or complain to the Norwegian Data Protection Authority (Datatilsynet). Email [email protected] and we will handle it.