Privacy
Last updated 18 October 2026
The short version
- No accounts, no passwords, no e-mail address or phone number.
- We store only what the group puts into a selection: names you type, the places you share and how everyone voted.
- The data sits on a server in the EU (Germany).
- No analytics, no ads, no tracking, no third-party SDKs. We sell nothing to anyone.
Who we are
The So, where? app (formerly Vacall) is a small iPhone app for choosing a place to stay together. Its website moved from vacall.app to so-where.app in October 2026. It is run from the Czech Republic by Svoboda Solutions s.r.o., which is the controller of your data:
Svoboda Solutions s.r.o.
č.p. 65, 252 41 Libeř, Czech Republic
Company ID (IČO) 22551522, VAT ID (DIČ) CZ22551522
Registered in the Commercial Register kept by the Municipal Court in Prague under file no. C 418152
For anything about your data, write to support@so-where.app.
What we store on our server
- The selection: its name and the collecting deadline.
- Parties and participants: the names the organizer types (for example “The Smiths” and “Eva”). They do not have to be real names.
- Invites: a random token and a short invite code for each participant. Whoever holds the invite link acts for that party, so treat it like a key.
- Places: the Booking, Airbnb or other link that was shared, and the public title, description and image address that the linked page publishes for link previews.
- What the group did: hearts and thumbs-down, run-off picks, approvals, vetoes with the reason written for them, and the organizer's steps (closing or reopening collecting, setting the order after a tie), each with the time it happened.
Everyone in the same selection sees these names, places and votes. Nobody outside it does.
What stays on your iPhone
The app keeps the invite tokens of the selections you joined in its own storage on the phone, so it knows who you are without an account. Deleting the app deletes them.
Link previews
When you share a link to the So, where? app, it asks the linked page for its preview on your phone, and our server fetches the same page to read its public preview tags (title, description, image address). Nothing else is read from the page: no prices, no availability, no other photos. Photos are never copied; the app shows the image from the address the page published, so the site that hosts it (for example Booking or Airbnb) sees a request from your phone, just as when you open the link yourself.
What we do not do
- No analytics, no crash-reporting service, no advertising, no tracking across apps or websites.
- No third-party SDKs in the app.
- No access to your contacts, location, photos or camera.
- No cookies on this website and no scripts except the one that opens an invite in the app.
Where and how long
Everything is stored on a server in the EU (Germany) that runs nothing but the So, where? app. The server is a virtual machine rented from Contabo GmbH (Germany); e-mail to support@so-where.app is forwarded through Cloudflare, Inc. The data of a selection is kept until its organizer asks us to delete it; write to support@so-where.app. We keep daily backups for 14 days, so a deleted selection disappears from them within 14 days.
Like any web server, ours writes technical logs (IP address, time, the requested address and the app or browser version) to keep the service running and safe. Invite codes and tokens are removed from these logs. A wrong invite code is remembered for one day with a one-way hash of the address it came from, so that nobody can guess codes. The logs are rotated automatically and overwritten after a short time.
Your rights
We use the data only to run the selection you take part in. You can ask what we hold about you, have it corrected or deleted, or object to its use: write to support@so-where.app. You can also complain to the Czech data protection authority, ÚOOÚ.
Changes
If what the app does with data changes, this page changes with it and the date at the top moves. This policy is governed by the law of the Czech Republic.