Last updated: September 2026
Michael Lang
Wendelstr. 48
66787 Wadgassen
Germany
Email: info@purlyu.com
Purlyu is a messenger with contacts, member groups, and optional location-based GPS groups. We process personal data to provide the service (Art. 6(1)(b) GDPR), for security and abuse prevention (Art. 6(1)(f)), and, where required, based on your consent (Art. 6(1)(a)), e.g. for push notifications, location features, or optional cloud chat backup.
User ID, sign-in identifier (email or provider subject), display name, optional profile picture, sign-in provider (Google, Apple, email, or passkey), account status, and timestamps. Session tokens are stored on the server in hashed form and are invalidated when you sign out. Optional passkeys and biometric app lock use your device’s secure hardware; Purlyu does not receive or store biometric data or passkey secrets.
Public key bundles (Signal) may be stored on the server so contacts can establish encrypted sessions.
The server stores who added whom as a contact so new contacts can be discovered and profiles synchronized. Purlyu does not access your device’s system contact list.
For GPS-based groups we store group metadata (name, area, derived location labels), readable message text, and approximate sender location fields (for example geohash) for regional routing. When you search for nearby groups, an approximate last search location (geohash precision about 1.2 km) may be stored on the server. Location is reported by the app based on your device permission and settings.
If enabled, FCM/APNs push tokens and technical mappings (for example short-lived GPS group registrations) are stored so the service can signal new activity. You can hide message previews in notification settings.
To limit abuse such as repeated sign-in attempts or mass requests, the server records request events keyed by a hashed form of your IP address and, for sign-in, of your sign-in identifier. These records are deleted after at most 48 hours (Art. 6(1)(f) GDPR).
The app stores chats, contacts, groups, and preferences locally for offline use. After decryption, readable message text and media may remain on your device for display and search; cryptographic keys and session tokens are kept in protected secure storage.
If you enable backup in the app, contact chats and member group messages (not GPS group chats) may be uploaded to your private Google Drive app folder or Apple iCloud app storage, depending on platform and linked accounts. You choose encryption: passphrase, device lock after app unlock, or no extra encryption. Unencrypted backups may be readable by anyone with access to your cloud account.
Map views load tiles from the operator’s map service (osm.purlyu.com).
Requests may include your IP address, approximate map area, and a technical tile key.
Map data is based on OpenStreetMap contributors.
When you send a message via Settings → Support, we transmit your message together with basic account data (user ID, display name, sign-in provider, account status, sign-in identifier) by email to the operator to handle your request (Art. 6(1)(f) GDPR). You may optionally attach the app’s technical logs (an opt-in choice, consent under Art. 6(1)(a) GDPR). These logs contain technical diagnostic data (e.g. push status, notification permission, platform) and app-activity identifiers (e.g. contact, group and message IDs), but no message content and no precise location (coordinates are removed on the device before sending). Delivery is handled via the mail service configured by the operator.
Purlyu’s own infrastructure — the API, the database and the map tile service — is operated in Germany, within the EU. The services listed above are the exceptions, and only receive the data described for each of them. Data processing agreements under Art. 28 GDPR are in place where required. Transfers to third countries (e.g. the USA) only occur with appropriate safeguards (e.g. EU Standard Contractual Clauses), where applicable.
Account data is kept until you delete your profile (see Account deletion below) or the operator removes data as part of providing the service. One-to-one messages are deleted from the server after delivery acknowledgment. GPS group messages are shown to participants for 7 days; they remain stored on the server after that, so that reported abuse can still be reviewed, until the sender’s account is deleted. Blocks, group invitations and group memberships are kept until they are removed or the account is deleted. Reports, including the copies of messages stored with them, are kept for as long as needed to review them and to handle any follow-up. Technical logs may be kept for shorter periods (typically up to 14 days). Support messages and optionally attached logs are retained for as long as needed to handle your request.
If Purlyu allowed you to create an account, you can permanently delete it. Deactivation or signing out alone does not delete your account on our servers.
This permanently deletes your Purlyu account on our servers and removes local app data from that device. If chat backup was enabled, Purlyu also attempts to delete your backup file from your Google Drive app folder or iCloud app storage.
If you no longer have the app installed, email info@purlyu.com from the address linked to your account (or state your user ID if you know it). We will verify the request and delete the account.
You may have rights of access, rectification, erasure, restriction, portability, and objection. Contact info@purlyu.com or delete your profile as described in Account deletion above. You may lodge a complaint with a supervisory authority (e.g. LDA Saarland in Germany).
The service is intended for users aged 16 and over. Younger users should not use the service without parental consent.
Deutsch · Français · Español · Italiano · Nederlands · Polski