Who we are
Qtora is a free, location-based service for finding activity partners, clubs, communities, gyms, trainers and open games on the island of Ireland. It is run by the operator named below, who is the data controller for the personal data described in this notice (“Qtora”, “we” and “us”).
- Data controller
- How to reach us
- Our contact form
What this notice covers
This notice covers the Qtora website and web app at qtora.eu — including when you install it on your phone or computer — the emails we send you, joining an event as a guest, and messages you send us through our contact form. It applies to people in the Republic of Ireland under the EU General Data Protection Regulation (GDPR) and to people in Northern Ireland under the UK GDPR.
The personal data we collect
When you create and use an account
| Data | Where it comes from | Who can see it |
|---|---|---|
| Name, email address and password | You, when you sign up. The password is stored only as a one-way (bcrypt) hash — we cannot read it. | Your name: other people (see section 5). Your email address: only you and Qtora staff. |
| Mobile number (optional) | You, in Settings → Account. | Only you and Qtora staff. |
| Profile | You: a short bio, your skill level, when you’re usually free, your activities with a level for each, and a profile photo if one is set. | Other people. |
| Location | You choose a place by searching, picking a town, or tapping “Use my current location” (your device asks your permission first). We store an area name and map coordinates. | Your area name and an approximate distance (to 0.1 km) are shown to others. Your coordinates are never shown to anyone. |
| Settings | You: whether you appear in discovery, your in-app notification and email preferences, and which in-app guides you have seen. | Only you and Qtora staff. |
| Account details | Created by the service: account type and status, whether your email address is confirmed, the “verified” tick (set by the Qtora team), when you joined and were last active. | “Verified”, when you joined and “active now / last active” are shown to others. |
If you browse without an account, the location you choose stays in your browser and is sent with each search so results can be sorted by distance. It is not saved on our servers.
When you use Qtora with other people
- Connections and blocks — requests you send or receive (with any message), their status, connections you remove, and people you block (with an optional reason). Nobody is told that you blocked them.
- Messages — your chat messages, plan cards posted in a chat, and how far each person has read (for unread counts and read ticks). “Typing…” and online presence are not stored, apart from your last-active time.
- Plans — activity, date and time, an optional place, an optional note, who is invited and how each person answered.
- Events you create — title, description, activity, venue, area, map position, start time, duration, skill level, format, number of places and status. Events are public: anyone with the link can see them.
- Events you join — whether you are confirmed, waitlisted, invited, declined or removed, when, and who invited you.
- Requests to clubs, gyms and trainers — your message, the kind of request and any session or time you picked, with your name and email address. They go to the Qtora team, not automatically to the club, gym or trainer.
- Reports — what you reported, the reason and your description, and our team’s handling notes. The person you report is not told who reported them.
- Notifications — the notifications in your list and when you read them.
When you join an event as a guest
You can take a place in an event without an account, using your name, email address and, if you like, a phone number. We store those details, the event, and the IP address the request came from (to limit abuse), and email you a single-use link. Only a fingerprint (SHA-256 hash) of each link is stored. Opening the link creates a guest record — no password, never shown in search or discovery — and confirms your place; a second link lets you view or cancel it. Your phone number is seen only by the Qtora team. If you later sign up with the same email address, the guest record becomes your account.
If you are outside our launch area
If you choose a place outside the island of Ireland, you can join our waitlist with your name, email address, an optional phone number, and the area, country and map position you chose.
When you contact us
When you use our contact form we store your name, email address, the topic, your message, the IP address it came from (to stop abuse) and, if you were signed in, which account sent it. Our team adds a status and internal notes while dealing with it, and replies to the email address you gave.
Visitor statistics
When you open a page, the web app tells our server which page it was — the path only, never the part of the address after “?”, which can carry one-time links — and the website you came from (its name only). With that we record your IP address, the country it belongs to, your browser, operating system and device type, a visitor code that changes every day (a one-way hash of your IP address and browser), and — if you are signed in — your account. We use this to count visitors, see which pages are used, and spot abuse. The daily visitor code on its own cannot be linked from one day to the next, but the IP address and the account stored with each page view can link your visits across days until those records are deleted.
- No cookie or device identifier is involved.
- If your browser sends Global Privacy Control or Do Not Track, no page view is recorded at all. Visits from a browser in which a Qtora staff member is signed in to our admin panel, and visits by known bots, are not recorded either.
- The country is looked up on our own server from a copy of the DB-IP Lite database; your IP address is not sent to DB-IP or anyone else for this. IP geolocation by DB-IP (licensed under CC BY 4.0).
- The records are deleted after 90 days.
Emails
For each email we send we keep a record of the recipient address, which kind of email it was, its subject, the details used to fill it in (for example your first name and an event title), its delivery status and times, and our email provider’s reference. On the live service the full text of an email is not kept once it has been sent — it can contain one-time links. Our email provider tells us whether an email was delivered and, where its tracking is switched on, whether it was opened or a link was clicked; we store that as the email’s status. One-time links (password reset, email confirmation, guest links) are stored only as SHA-256 fingerprints, together with the IP address that asked for a password-reset or confirmation link.
Security records, logs and backups
- Audit log — sensitive actions are recorded with the IP address and browser or app identifier (user agent) that made them: changing your password, deleting your account, requests to listings, every action by Qtora staff (including each time a staff member opens a reported conversation) and staff sign-ins.
- Rate limits — to stop abuse of sign-up, sign-in, password reset, email confirmation and the contact form we record a one-way hash of the email address, IP address or account involved — never the value itself.
- Server logs — our web server logs each request’s IP address, time, page path (without the query string), response status and size, and user agent. Our application logs record each request’s IP address and web address, with any one-time token removed.
- Backups — copies of the database are taken every day and before each software release.
What we do not collect
No payment details (Qtora takes no payments), no date of birth, no contacts or address book, no photos uploaded from your device, and no advertising identifiers. We use no advertising or third-party analytics tools and set no cookies (see section 9).
Why we use it — our legal bases
We only use personal data where the law gives us a basis to. The articles below are those of the GDPR and the UK GDPR.
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account; sign you in and keep you signed in | Account data, settings, sign-in tokens | Performing our contract with you (Art. 6(1)(b)) |
| Show you people, places and events near you, and show your profile to others | Profile, activities, location, discovery setting | Contract (Art. 6(1)(b)). You can switch off discovery at any time. |
| Use your device’s current position | Coordinates from your device | Your consent, given through your device’s permission prompt (Art. 6(1)(a)). The position is used only to set your location. |
| Connections, messages, plans, events and joining as a guest | What you share with other people and as a guest | Contract, or steps you ask us to take before one (Art. 6(1)(b)) |
| Account and security emails (password reset, email confirmation, welcome, “your password was changed”) | Email address, name | Contract (Art. 6(1)(b)) and our legitimate interest in keeping accounts secure (Art. 6(1)(f)) |
| Activity emails (connection requests, unread messages, event and plan updates, reminders) | Email address, name, the activity concerned | Legitimate interest in telling you about activity on your account (Art. 6(1)(f)). Each kind can be switched off in Settings → Notifications. |
| Answer messages you send us, including data-protection requests | Contact-form data | Legitimate interest in answering you (Art. 6(1)(f)); for requests about your rights, legal obligation (Art. 6(1)(c)) |
| Visitor statistics | Page-view records | Legitimate interest in understanding how Qtora is used and keeping it secure (Art. 6(1)(f)). Global Privacy Control or Do Not Track switches it off. |
| Keep Qtora safe: reports, blocks, moderation and enforcing our Terms | Reports, the reported content, account status, staff notes | Legitimate interest in a safe service (Art. 6(1)(f)); legal obligation where it applies (Art. 6(1)(c)) |
| Protect the service from abuse and attacks; investigate incidents | Audit log, rate-limit hashes, IP addresses, server logs | Legitimate interest (Art. 6(1)(f)) |
| Waitlist outside the launch area | Your waitlist details | Your consent (Art. 6(1)(a)) — ask us to remove you at any time |
| Back up the service so it can be restored | All of the above | Legitimate interest (Art. 6(1)(f)) |
| Comply with the law and defend legal claims | As needed | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
We do not sell your data, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects. Suggestions such as “people you may know” come from shared activities, distance and mutual connections.
Where your data is processed
Our server provider (Contabo GmbH) and our email provider (Brevo) are based in the European Union, in Germany and France. The services your browser contacts directly (section 5) may process your IP address outside the European Economic Area under their own terms. You can avoid BigDataCloud entirely by searching for your town instead of using your current location.
How long we keep it
| Data | How long |
|---|---|
| Account, profile and settings | While your account is open. |
| When you delete your account | Settings → Account → Delete account closes the account at once: you are signed out everywhere, you can no longer sign in, and you disappear from search, suggestions and other members’ views. The account record is kept, marked as deleted — together with your messages, connections, plans and events — so conversations other people are part of, reports and safety records stay intact; the email address cannot be used to sign up again. Accounts closed by our staff are handled the same way. To have the remaining data erased, send us a privacy request (section 8): we will erase or anonymise what we are not required to keep. |
| Messages, connections, plans, events and notifications | While your account is open, then as described above. |
| Requests to listings, reports and the audit log | Kept as safety and security records, without a fixed deletion date. |
| Guest details | The confirmation link works for 24 hours and the manage link until 24 hours after the event; the guest record is kept like an account. |
| Password-reset and email-confirmation links | Valid for 30 minutes and 48 hours; the stored fingerprint is deleted 7 days after the link is used or expires. |
| Email records | Deleted after 180 days. The full text is not kept after sending. |
| Visitor statistics (page views) | Deleted after 90 days. |
| Messages sent through the contact form | While we deal with them, then deleted 12 months after we close them. |
| Rate-limit records | Deleted after a day. |
| Server and application logs | Rotated automatically: older entries are deleted or overwritten after a short period. |
| Backups | Daily copies of the database are deleted automatically after 14 days. Copies we take by hand before a software update or other maintenance, so that a mistake can be undone, are not deleted automatically: we delete them by hand once they are no longer needed for that. Data we have erased can remain in a backup until that backup is deleted. |
| Waitlist | Until you ask us to remove you. |
| Data in your browser | Until you sign out or clear it — see section 9. |
Your rights
You have the right to access, correct and erase your personal data, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time. To use any of them, contact us through our contact form and choose “Privacy or data request”. We reply within one month, as the law requires, and may first need to confirm it is you — usually by replying to the email address on your account.
| Right | How it works on Qtora |
|---|---|
| Access / a copy | Send a privacy request. There is no download button yet; we send your data by email. |
| Correct | Edit your name, mobile, bio, location, activities, skill and availability in Settings and Edit profile. To change your email address, send us a request. |
| Erase | Settings → Account → Delete account closes and hides your account at once. To have the remaining record and content erased, send a privacy request. |
| Restrict or object | Switch off discovery (Settings → Privacy) and each kind of email and in-app notification (Settings → Notifications); block anyone. Turn on Global Privacy Control or Do Not Track to stop visitor statistics. For anything else, send us a request. |
| Portability | Send a privacy request and we will send your data in a common, machine-readable format. |
| Withdraw consent | Location permission: in your browser or phone settings. Waitlist: send us a request. |
| Complain | To us first if you like, and to a supervisory authority: the Data Protection Commission in Ireland or, in Northern Ireland, the Information Commissioner’s Office. |
Children
Qtora is for adults. You must be 18 or over to create an account or join an event as a guest, and you confirm your age when you sign up. We do not ask for or store a date of birth. If we learn that an account belongs to someone under 18, we will close it. If you believe a child is using Qtora, please tell us through our contact form.
How we protect your data
Connections to Qtora are encrypted (HTTPS). Passwords are stored as bcrypt hashes and one-time links only as fingerprints, and resetting your password signs you out on every device. Our database and application servers cannot be reached from the internet except through our web server. Staff access is limited by role and sensitive staff actions are logged. Emails that contain links are not kept after sending, and our logs leave out the parts of web addresses that can carry links. No system is perfectly secure: if a breach puts your data at risk, we will tell you and the regulator as the law requires.
Changes to this notice
We update this notice when Qtora changes how it uses personal data. The date at the top shows the current version. If a change is significant, we will tell you before it takes effect — by a notice in the app or by email.