This is a translation of the Dutch text; in case of differences the Dutch version prevails.
Privacy Statement
Oikoi is a private place where you share photos and memories with people you know. This statement explains which personal data we process, why, for how long, and what rights you have. We have written it so that you can read it without a lawyer.
1. Who is responsible
Oikoi.nl, registered with the Dutch Chamber of Commerce under number 72503068, established at Pruisisch blauw 31, 2718 KK Zoetermeer, the Netherlands (“we” or “Oikoi”), is the controller within the meaning of the General Data Protection Regulation (GDPR). Questions about privacy: privacy@oikoi.nl.
2. Principles
- Nothing is public. There is no public profile, no search by name and no shareable link that works without an account.
- No recommendation algorithm, no advertising, no profiling. We show posts in strictly chronological order and do not sell or share data for marketing.
- As little as possible, as briefly as possible. We only collect what is needed to make the service work and keep metadata for a short time.
- European. Storage and processing take place within the European Economic Area with European suppliers.
3. What data we process and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address, password (hashed), language preference | Your account and logging in | Performance of the contract | As long as your account exists |
| Country of residence, stated by you for your account or (optionally) on the waiting list; we never derive it from your IP address | Offering services per country (printing, storage bundles, face finding) and excluding countries where we are not active. Visible only to you and the administrators, never to your circle | Performance of the contract | Until you change it or delete your account |
| Optional: avatar, cover photo, short description, place of residence, birthday (shown without the year) | Your profile, visible only to your first-degree connections | Performance of the contract; you choose what to fill in | Until you remove it or close your account |
| Previous avatars and cover photos (kept instead of erased when you change or remove them), and the original of your profile and cover photos, so you can crop them again later | So that you can see, restore and download them yourself; visible only to you, not to your circle or the administrators, and they do not count towards your storage | Performance of the contract | Until you delete your account |
| Hashed version of your email address and, if you set it, your telephone number | So that people who already have your address or number can find you. We do not store the number itself and never confirm whether someone has an account. | Legitimate interest (findability without a member list); telephone number only through your own action | As long as your account exists; telephone hash until you remove it |
| Connections, invitations and connection requests | Determining who may see what | Performance of the contract | As long as the connection exists; declined requests remain recorded so they cannot be repeated |
| Photos, texts and comments | The core of the service | Performance of the contract | Until you delete them or close your account |
| Conversations: messages, photos, voice messages, files and polls, and who is a member of which conversation | Talking privately with the members of that conversation; visible only to the members | Performance of the contract | Until you remove them yourself; if a conversation is closed, everything is erased after 30 days |
| A location you share yourself, once, in a conversation (rounded coordinates and optionally a place name) | Showing where you are, only to the members of that conversation; never live and never in a notification | Performance of the contract; you share the location yourself | With the message: until you remove it or the conversation is erased |
| Travel conversation: only if the organiser of a conversation switches on Travel conversation, their app records their own location once when they send a message | A travel log on a map. The points are invisible until the organiser chooses “Close trip”; after that the members see the route. A location is never recorded for members | Consent of the organiser (the switch and the device’s location permission) | Until the organiser removes the points or the conversation is erased |
| Event conversation (public): the photos you post in such a conversation, in one joint post | Visible to the members of the conversation and in the circle of everyone who adds photos to it, including people who do not know you; anyone who knows none of them sees nothing | Performance of the contract; your choice to post in an event conversation (stated when you open the conversation) | Until you remove them; they remain yours and count towards your storage |
| Private event: a copy of the photos you post in such a conversation, held by the host | The host (for example a wedding couple) receives all photos for their own archive afterwards | Performance of the contract; your choice to post in a private event | The copy belongs to the host until they remove it; your original remains yours |
| The place of an event (a name and optionally a point on the map), entered by an administrator of the conversation | Showing where the event was, next to the joint post; a location is never recorded for members | Performance of the contract | With the post |
| Read receipts: whether a message in a conversation has been delivered and read | Ticks on your own messages, without names or numbers | Legitimate interest; setting “Read receipts”, on by default and reciprocal: if you switch it off, you share nothing and see it from no one | Only the latest state per conversation, as long as you are a member |
| The metadata contained in your photo files: date taken, camera, colour profile, and any caption, keywords or names you once entered | Organising and interpreting your archive; the original remains the original | Performance of the contract | With the photo. The GPS location is the only exception: it is always removed from the file. If you keep it (switch “Keep location”), it is stored encrypted next to the photo in the database; otherwise it is discarded. The reduced versions we show never contain metadata. |
| Payment data (for a storage bundle): customer and mandate reference at Mollie, invoice details | Payment and invoicing | Performance of the contract; statutory retention obligation | Invoices 7 years (tax retention obligation); we do not see the bank account number |
| Names on a photo (who is in it), keywords and the place | An archive that can still be understood in fifty years: searching by who, where and when | Legitimate interest (archive function); you fill in what you want, and the person named can have it removed | With the photo, until you or the person named removes it |
| Descriptive data from the photo file: date taken, camera and — if you switched it on yourself — the place | Organising and finding things in your archive | Performance of the contract | With the photo. The file we deliver is and remains fully stripped; we read these fields before stripping and keep only what is listed here. |
| Boxes of detected faces (coordinates only), if you switch on “face finding” | Preparing an empty name box when describing a large archive | Consent (you switch it on and off yourself) | Until you add a name or remove the box; no facial features are ever stored |
| Time of your last activity on the site | So the administrators can see which accounts are still in use | Legitimate interest (managing the service) | Only the latest time; as long as your account exists |
| Only if you switch it on in the app yourself: a rough location, your approximate area (rounded to 0.1 degree, roughly 10 km) | So the administrator can see on a map where the app is used; that overview shows only numbers per area, no names | Consent (off by default; you switch it on and off yourself) | Only the latest location, without history; updated at most once a day when you open the app. If you switch it off or delete your account, it is erased |
| Session and security data: session ID, IP address, browser type | Logging in, preventing abuse and intrusion | Legitimate interest (security) | Sessions 2 hours of inactivity; server logs at most 7 days |
| App link: a device key per phone or tablet, and — only if you allow notifications — a push token from Apple (iPhone, iPad) or Google (Android), or a push subscription from your browser | Staying signed in to the app and delivering the notifications below | Performance of the contract; notifications only with your consent (the system prompt) | Until you sign out on that device; we clean up dead push tokens ourselves |
| For a print order: name, delivery address and the chosen photos as a print file | Having prints and photo books printed and delivered | Performance of the contract | Address with the order (invoice 7 years, tax retention obligation); the print file link expires within 7 days |
| Email traffic (invitations, password reset, export ready) | Necessary messages about your account | Performance of the contract | With the mail provider briefly, for delivery |
We send no newsletters and no reminders to come back. Push notifications only exist if you allow them yourself, and then only in narrow kinds: “you are in a photo” when someone from your circle confirms you in a photo, a new message in a conversation you are a member of (only the sender’s name, the name of the conversation and the kind of message), the Photo of the day if you use it, and — for the administrator — the message that someone has linked the app. No activity sprinkling, no “come and have a look”. If you wish, you can switch on a periodic email overview yourself.
How push notifications travel. A push notification can only be delivered through the notification service of the maker of your device or browser: Apple Push Notification service (iPhone and iPad; Apple Distribution International Ltd, Ireland), Firebase Cloud Messaging (Android; Google Ireland Limited, Ireland) or your browser’s push service (for notifications on the site; the content is then encrypted for your browser). This is the only exception to our rule that everything stays within the EEA: these services belong to groups outside the EEA, and data may be processed outside the EEA in the process. That is why only the short notification text above and a technical address of your device travel through these services, never the content of messages or photos. If you do not allow notifications, we do not use these services.
4. What we expressly do not do
- No facial recognition: we do not calculate facial features, do not compare faces and recognise no one — not within your own archive and certainly not outside it. If you switch on “face finding” yourself, the software only determines where in a photo a face is, so that you can type a name there; only that box is stored, and as soon as you enter the name it disappears. This is not biometric processing within the meaning of Article 9 GDPR. It is off by default.
- No content analysis of photos or texts for profiling or advertising.
- No external analytics, tracking pixels, session recordings or fingerprinting. We count events (number of uploads per day) without linking them to people.
- No linking of people across circles; a name on your photo is yours, not part of a register. Linking to an account is only possible within your own circle, and anyone you name can always have their own name removed.
- No transfer outside the EEA and no American (sub)processors for your archive itself. One limited exception that you switch on yourself: if you allow push notifications, the notification service of Apple, Google or your browser delivers them (see section 3). Only the short notification text travels there — never the content of messages or photos.
5. Who sees your data
You decide. Your photos and texts are visible to your first-degree connections (your “circle”). If you choose the “extended” reach for a post, a reference may appear in the circles of contacts who act as a bridge: only your name and avatar, never the content. Anyone who wants to see that content must request a connection, which you can decline. A question or contribution on a post is not a public comment: only you and the archivist of that post (the poster and their co-owners) read that thread. This is stated at the moment you write something.
Sharing your area with the administrator. Only if you switch it on yourself (in the app, under Menu; it is off by default) do we share a rough location, your approximate area (rounded to roughly 10 km), with the administrator of Oikoi, to see where the app is used. The app measures this at most once a day, when you open it, never in the background. Only the latest location is kept, and the administrator’s overview shows only numbers per area, without your name. Other residents never see it. You can always switch it off, in the app or under Settings › Privacy; the location is then erased. This location is separate from a location you share yourself in a conversation.
Oikoi staff do not look at your content unless this is strictly necessary to fix a fault or to assess a report of illegal content, and then only to the extent necessary. Administrators may view reported content to assess the report; such viewing is logged. Where Oikoi is legally required to do so or receives a valid legal order, it may provide data to the competent authorities.
6. Processors
We only engage European parties, with a data processing agreement. New processors outside the EEA are contractually excluded.
- TransIP B.V., Leiden (Nederland) — hosting, storage and backups
- TransIP B.V. (e-mailverzending via smtp.transip.email)
- Mollie B.V., Amsterdam (betalingen) — only if you pay for something (storage bundle or printing)
- Profotonet B.V., the Netherlands — only if you order printing: your name, delivery address and the chosen photos as a print file
- Apple Distribution International Ltd, Ireland — only if you allow push notifications on an iPhone or iPad: delivery of the notification text
- Google Ireland Limited, Ireland — only if you allow push notifications on Android: delivery of the notification text
- Your browser’s push service — only if you allow notifications on the site: delivery of the encrypted notification text
We keep this list up to date on this page.
7. Security
Connections are always encrypted (TLS). Passwords are stored hashed; two-factor authentication is available. Photos are never stored in a public location and are only delivered after checking that you may see them. Files get meaningless names. We make a backup every night: a copy on a separate disk next to the server (kept for 14 days) and an encrypted copy at a European storage service with 14 daily, 8 weekly and 12 monthly restore points. In the event of a data breach that poses a risk to you, we inform you and, where required, the Dutch Data Protection Authority within 72 hours.
Conversations. The content of conversations (messages, photos and voice messages) is stored encrypted, with a key per conversation that is managed on the server. This protects against data breaches, a stolen backup and unauthorised access to storage; it is not end-to-end encryption, so our systems can technically decrypt the content, and we only do so to provide the service. Who talks to whom and when is readable, because the service needs it. A conversation is never visible in a circle, with one exception you choose yourself: in an event conversation, the photos you post appear in the circles of everyone who adds photos to that event (see section 3). If you report a message to the administrators, we receive that one message, the sender’s name, your own name and whatever you add; the administrators use this only to assess the report. People you block are no longer shown to you in conversations; this is remembered only for you. A closed conversation is permanently erased after 30 days; the key is erased with it, so the content can no longer be read even from a backup.
8. Children
An account is intended for people aged 16 and over. Photos of children are posted by adults from their own circle, under their responsibility; at an event, only post photos of other people’s children with their parents’ consent. A child or their parent can always ask us to have a photo removed; see section 10.
9. When you leave
Exporting is always possible: your original photos, texts and own comments as a ZIP file, without database codes. Stopping posting requires no action; what you shared stays with those who could already see it. Deleting your account is a separate, deliberate action: your photos, texts and comments then disappear everywhere, including for the people who saw them. They disappear from the backups by themselves: from the local copy after 14 days and from the last monthly restore point after twelve months at the latest; we never bring back anything you deleted.
10. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. You can do much of this yourself in the app: change your data, export and delete your account. For anything else, email privacy@oikoi.nl; we respond within a month. If you are in someone else’s photo and want it removed, you can also report that to us; see also the terms. You can always lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
11. Continuity and acquisition
A family archive is long-term. That is why we promise in our terms — not only here — that if the service ends we will announce it at least 90 days in advance and offer everyone a full export, and that in the event of a change of ownership your data will not pass to a party outside the EU without your renewed, individual consent.
12. Changes
If we change this statement in substance, we announce it in the app at least 30 days in advance. The date at the top indicates the current version.
Notice for residents of the United States
- No sale, no ads. We do not sell or “share” personal information (including for cross-context behavioural advertising), we show no advertising and we do not profile you.
- Your rights. Depending on the state you live in, you may have the right to know which personal information we hold about you, to access it, to have it corrected or deleted, and to receive a portable copy. Much of this you can do yourself in the app (export, edit, delete your account). For anything else, email privacy@oikoi.nl; you or an authorised agent may make a request, and we may need to verify your identity.
- Non-discrimination. We will not treat you differently for exercising your rights.
- Copyright. How to send a copyright (DMCA) notice is set out in our Terms of Service, section 5a.
- Contact. privacy@oikoi.nl.