Privacy Policy Tokens App

Last modified: 11-9-2026

Controller

Tokens is provided by Social Layer Tech (“we”, “us”), KvK number 42130941, established at Langegracht 69J, 2312 NW Leiden. For privacy questions: via the in-app FAQ/contact options. This Privacy Policy applies alongside our Terms & Conditions.

What data we collect

When you use the Tokens app, we collect certain data to make the app work. This includes your name, username, email, preferred drink, date of birth, bio, profile and group photos you upload, group and event data, order/round history and technical usage data. We use date of birth among other things to filter content and comply with alcohol legislation (NIX18). If you use Find friends to add contacts who already have the app, we request one-time access to your address book.

IBAN and Open Banking payments

If you enter an IBAN and account holder name for settlement, we store them in your private account data (only you and our servers). When you pay via bank, the server uses those details so our licensed partner Yapily (Payment Initiation Service Provider) can initiate a transfer of the exact amount to the recipient. Other group members never see your IBAN. Tokens does not hold user funds and is not an intermediary for the money. Yapily processes payment data as needed to execute the payment.

How we secure your address book (GDPR)

We take your privacy seriously. When we scan your address book to find friends, we do not send your contacts in readable form to our servers. Phone numbers are encrypted (hashed) locally on your phone. We only compare these unreadable codes with our database. We never learn the numbers of contacts who do not use the app.

How we use your data

We use your data to enable core features: group balances, preferred drink in the lobby, order history, friends / Find friends, moderation of inappropriate names/content, security, support, group settlement (including Open Banking where available) and (where applicable) Premium/ads. Crowdsourced festival prices are stored anonymously; other groups can see that a price was confirmed, but not by whom personally.

User content (photos and text)

Profile and group photos and text you post are user content. You are responsible for their lawfulness. Nudity and drug-related content/associations are prohibited (see Terms & Conditions). We may remove content or restrict accounts upon (suspected) violation. Uploading does not mean every photo is automatically scanned.

Analytics, statistics and trends

Anonymous/aggregated data is used for:

1. Community Trends: statistics about festival visits and drink preferences within Tokens. Ages are stored only as age bands (e.g. 18–24), not as exact ages.
2. Optimisation & Partners: trends to improve the app and share anonymised insights with partners in the events industry.

Data sharing and sale

Tokens never sells your personally identifiable data to third parties. We do use anonymised and aggregated data for commercial purposes (trends/statistics with partners). That data cannot be traced back to you as an individual. We share data with processors that enable the app (including Google Firebase/Google Cloud, Google AdMob, Google reCAPTCHA Enterprise, app stores, and where applicable Yapily for Open Banking) as needed for those services.

Advertisements (AdMob)

Free users may see advertisements on the group page via Google AdMob. Google may process device identifiers and usage data to show and measure ads. By using the app you agree to this, as described in our Terms & Conditions. You can indicate in your profile under 'Ad preferences' whether ads may be personalised; if you decline, we still show general (non-personalised) ads. Premium subscribers do not see ads. More information: https://policies.google.com/privacy

Your rights and deleting data

You have the right of access, rectification, erasure, restriction and (where applicable) data portability and objection, within the GDPR framework. In the app you can press 'Delete account and data' on your profile page. We then erase your account, profile and order history from our servers to the extent technically and legally possible (back-ups/logs may briefly remain).

Changes

We may change this Privacy Policy. The “last modified” date applies. Continued use after a change constitutes acknowledgment. We may (but are not obliged to) explain material changes in the app.

reCAPTCHA (bot protection)

When you log in, register or reset your password with email, we use Google reCAPTCHA Enterprise to reduce abuse (bots). Google may process device and usage data for that assessment. More information: https://policies.google.com/privacy and https://policies.google.com/terms