Privacy Policy

1. Who we are and what this covers

GanApp is the event companion from Advanced Thinkers. It brings together event passes, programs, venue maps, booth stamps and your barkada. In this policy, “GanApp,” “we” and “us” refer to the people operating this service.

This policy covers ganapp.ph, the GanApp attendee app, the organizer dashboard and our app previews. For privacy questions or requests, email hello@ganapp.ph.

Event organizers decide what information they request from attendees and how they use their event records. We handle those records to provide GanApp’s services to them. An organizer’s own registration website or services may have a separate privacy policy.

2. What we collect

Your account and sign-in

We keep your email address, display name, profile picture when provided, and barkada code. These let you sign in and let your friends recognize you. GanApp uses email sign-in codes rather than passwords. The server stores a hash of each code and the request’s IP address to help prevent abuse. Session refresh tokens are also stored as hashes.

Your events

Event records include your registration name and email, ticket type, pass number, device key for your pass, and check-ins such as the time, gate and staff member. We also handle booth stamps, saved sessions, AR activity results and raffle results. These support admission, the event program, your stamp passport and the organizer’s event records.

Your barkada

We keep friend relationships, friend requests and your location-sharing choices so you can connect with the people you choose. Live location is described separately below.

Your device and notifications

When notifications are enabled, we use a notification token and platform type, such as Android, iOS or web, to deliver event announcements. The app can also share your phone model, camera calibration and Bluetooth sensitivity to improve AR and indoor positioning. These calibration records do not include camera photos or recordings.

What stays on your device

Camera frames used for QR scanning and AR, raw Bluetooth beacon readings, and motion-sensor readings are processed on your device rather than uploaded to us. Downloaded passes are stored on your device for use offline; the server also keeps the event registration used to issue the pass. Staff can record a test walk to tune a venue map, but that recording leaves the device only if they choose to share the file.

When you contact us

If you email us, we receive your email address and the information you include so we can respond. Please share only what is needed for your request.

3. Location sharing is your choice

GanApp’s indoor positioning uses venue markers, Bluetooth beacons and motion sensors on your device. It does not use GPS for indoor positioning. The app sends your event position only when you turn on Share my location in the Barkada tab for that event.

You can share with your barkada, select specific friends, or turn sharing off. While you share, GanApp receives your position within the venue, an accuracy estimate and the time. Updates are sent as you move, with periodic updates while you are standing still. Friends allowed by your sharing settings can see your live pin at that event.

Shared positions are also retained to produce reports about crowd activity, such as visits to different areas, time spent there, common movements and busy areas. Organizer reports show aggregated results and omit figures based on fewer than three people. They do not show your name or individual route.

Turning sharing off stops new position updates and removes your live pin from friends’ maps. Previously shared samples remain for the retention period below unless you delete your account. Browsing this marketing website does not request or collect your device’s live location.

4. Website visits, cookies and local storage

You can read ganapp.ph without creating an account. The marketing website does not set advertising or analytics cookies, use analytics or crash-reporting SDKs, or save preferences or activity in persistent browser storage. Its fonts, scripts, images and trailer video are hosted on this site. The trailer loads when you choose to play it.

Interactive stamps, feature selections and motion settings on the marketing page exist only for the current page session. They are not submitted as event activity or saved to an account. Your browser may cache public files to load the website faster.

Our web server keeps access and error logs to deliver the site, investigate problems and protect it from abuse. Access logs can include your IP address, forwarded IP information, the requested URL, request time, response status, referring page and browser user-agent. Error logs can contain request and connection details associated with a technical problem.

Links to the attendee app, organizer dashboard or other websites take you to separate services. Signed-in app functions use account sessions and local storage needed for passes and offline use, as described in this policy. Other websites are responsible for their own privacy practices.

5. Why we use data and who sees it

We use account and event information to provide the services you request, such as signing in, entering an event, saving a session and connecting with friends. Optional location sharing depends on your choice to enable it. Operational logs and security records support reliable service and abuse prevention. We may also process or disclose information when necessary to meet applicable legal obligations.

The applicable basis depends on the information and purpose, including consent, providing the requested service, legitimate operational and security needs, or legal requirements. The Philippine Data Privacy Act of 2012 sets out the criteria for lawful processing.

Your friends

Your display name and picture, and your live event location only when allowed by your sharing settings.

Your event’s organizers

Registration details, check-ins, stamps, AR activity and raffle results for their event. Saved sessions are available as counts. Shared-location reports contain aggregated crowd information.

People operating GanApp

Information needed to run, secure and maintain the service, or to help with your request.

Service providers

Hosting and database services, email delivery for sign-in codes, and Google Firebase Cloud Messaging for notifications. These services receive the information needed for their role.

Authorities

Information we are legally required to provide, subject to applicable requirements.

We do not sell personal data or use it for advertising or tracking across apps. Location reports are part of the event service, not an advertising profile.

6. How long we keep information

Retention depends on the purpose of the information. The current service uses these periods:

Account profile, friends and preferences

Until you remove the relevant information or delete your account.

Sign-in codes and associated request IPs

Deleted by routine cleanup about one day after the code expires.

Session refresh-token records

Revoked on sign-out. Hashed records are deleted about one day after their expiry, or when you delete your account.

Notification tokens

Removed on sign-out when the device unregisters, when a token becomes invalid, or after 60 days without the device being seen. Account deletion also removes them.

Live location pins

Expire 10 minutes after the last update, or are removed when you stop sharing.

Shared location samples

Kept for crowd reports until 90 days after the event ends. Deleting your account removes your saved samples.

Offline sync receipts

Kept for 30 days.

Organizer event records

Kept while the organizer retains the event in GanApp. Deleting your account unlinks it from those records; it does not automatically erase the registration name, email or event activity held by the organizer.

Website server logs

Rotated daily. The active log and seven daily rotated logs are retained.

Routine database backups

The current app preview uses a seven-day retention setting. Deleted information can remain in an existing backup until that backup passes through its scheduled retention cycle.

Privacy and support correspondence

Kept as needed to handle your request and any related follow-up or legal obligation.

If a legal obligation requires specific information to be kept longer, we retain it for that purpose rather than treating it as an active account.

7. How to delete your account

In the attendee app, go to Ako → Settings → Delete my account. You can also request deletion by emailing hello@ganapp.ph from the address you use to sign in. We may need to verify that the request comes from the account holder.

Deletion removes your account profile, friends and requests, sharing settings, saved location samples, saved sessions, device records and sign-in data. It removes your live pin and clears the app’s local database on the device performing the deletion.

Organizer records are separate. The organizer keeps its event registration and activity records, including registration name and email, without a link to your deleted account. Contact the organizer about deleting or correcting those records; you can also contact us for help directing the request.

If you are an organization’s only owner in the dashboard, transfer ownership to another member or delete the organization before deleting your account. Information already in a routine backup expires through the backup retention cycle.

8. Your privacy rights

Under applicable Philippine privacy law, your rights include being informed about processing, accessing and correcting your data, objecting to processing, requesting erasure or blocking, and receiving a copy in a usable format where applicable. You may also file a complaint and seek damages in circumstances provided by law. These rights are subject to applicable conditions and exceptions.

To make a request, email hello@ganapp.ph. Tell us what you need and which account or event it concerns. We may ask for information needed to verify your identity before sharing or changing personal data. You can withdraw optional location sharing directly in the app.

You can read the National Privacy Commission’s explanation of data subject rights and complaints, and the Data Privacy Act of 2012.

9. Security

Connections to GanApp use HTTPS. Sign-in codes and refresh tokens are stored as hashes, and digitally signed passes help verify authenticity. Access to service systems is limited to authorized personnel and providers who need it for their work. No system can guarantee absolute security.

If you notice a possible privacy or security problem, contact hello@ganapp.ph. Do not include a sign-in code or session token in your message.

Children

GanApp is intended for people aged 13 and older. If you are under 18, use the service with a parent’s or guardian’s permission. A parent or guardian with a concern about a child’s data can contact us at the same email address.

Demo content

App previews can show simulated people, events and locations to demonstrate features. Those simulated people are not real attendees, and their simulated location history is not retained. The marketing site’s screenshots, trailer and illustrative event imagery also use demo content.