GIMZWARE LTD, a company registered in England and Wales, company number 16913668 ("we," "us," or "our") operates the Bog Standard mobile application and website (the "Service") and is the controller of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.
We handle your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Information We Collect
1.1 Information You Provide
- Account Information: Email address, username, and optional profile details when you create an account.
- User Content: Reviews, ratings, photos, and comments you submit.
- Communications: Messages you send us for support or feedback, and reports you make about a review, a user, or a place.
- Friends and Activity: The friends you add, the nudges you send or receive, the loos you save, the users you block, and the referral link you share or use.
- Facility Details: When you review a toilet, you can say which kind of toilet you used (for example accessible, ladies or gents) and, for an accessible toilet, whether it had step-free access, a wide doorway, grab rails or space to turn. These answers are optional. They are shown with your review, next to your username, so other app users can see them. Taken together, they could suggest something about your health or a disability, so only answer if you are happy for them to be public. You can change them by editing the review. If you delete the review, your answers are taken down with it, as section 5 explains.
1.2 Information from Third Parties
If you sign in with Apple, Google, or Facebook, we receive only the information you authorise them to share (typically name, email, and profile picture). We never receive or store your social login passwords.
1.3 Information Collected Automatically
- Device Information: Device type, operating system, and unique device identifiers.
- Usage Data: Features used and crash reports.
- Diagnostic Logs: When the app or the website talks to our servers, our monitoring records technical details of each request, such as the time, the feature used and whether it worked. These records can include your account identifier and your phone's platform (iOS or Android) and app version. Some sign-in and account security records also include your IP address. Until 5 October 2026, a few also included your email address or username. We have stopped recording those, and the older records are deleted automatically within 90 days of being written. Diagnostic logs are kept for 90 days, then deleted automatically.
- Streaks: Your daily activity streak, which we use to run streaks and to send streak reminders if you have allowed notifications.
- Push Notification Token: A code that identifies your device so we can send you notifications you have allowed.
- Referrals: Who referred you, or whom you referred, and when.
- Time Zone: The time zone your device is set to, recorded when you open the app and stored with your account. It shows roughly where in the world you are. We collect it so that streaks and reminders can follow your local day in future. Today they all use UK time, so we do not use it yet.
- Location Data: With your permission, we use your location to find toilets near you and to give directions. Your position is sent to Google Maps to find nearby toilets and is not stored by us on our servers or with your account. You can turn off location access in your device settings at any time. Before 30 September 2026, our diagnostic logs recorded the position used in some searches. Those records are deleted automatically by the end of December 2026.
- Website Visits: When you view our home page, your browser asks our servers for the current top-rated places and their names. Our servers see your IP address when this happens. To limit how often you can do this, we hold the address in memory for about a minute, and for the daily limit we keep a one-way, technical fingerprint of it instead of the address itself. That daily record is deleted automatically within two days. We do not use your address for anything else.
1.4 Purchase and Virtual Currency Data
If you make in-app purchases or earn virtual currency ("Flushes"), we record the transaction type, amount, and platform receipt data (Apple App Store or Google Play). Payment card details are handled entirely by Apple or Google and are never collected by us.
1.5 Advertising Data
We use Google AdMob to show adverts in the app. AdMob may collect your device's advertising identifier (where your device settings allow it), your IP address and information about how you use the app, to show adverts and measure them. Before adverts are shown, the app may ask for your choices about advertising using Google's consent form. On iPhone, adverts are personalised only if you allow tracking when the app asks.
You can limit personalised adverts through your device settings at any time. Rewarded adverts, which would let you earn Flushes by choosing to watch a video, are switched off. If we switch them on, we will update this policy before we do.
1.6 Photo Content Moderation
Every photo you upload is checked automatically for harmful content by Microsoft's Azure AI Content Safety service before other users can see it.
- If a photo for a review is flagged, it is not published. It is held out of public view, and a member of our moderation team looks at it. If they approve it, it can then be published with your review. If they do not, it stays unpublished.
- If a profile picture is flagged, it is refused, and you can choose a different one.
- If the check cannot run at that moment, the upload is refused and you can try again shortly.
- We keep fingerprints of photos our moderators have removed, and check new uploads against them to stop the same photo being posted again.
We do this to keep the Service safe, which is our legitimate interest. No decision with a legal or similarly significant effect on you is made by automated means alone. If you think a photo was held or refused by mistake, email us at bogstandard-support@gimzware.ai.
2. How We Use Your Information
- To provide, maintain, and improve the Service
- To create and manage your account
- To display reviews, ratings, and other user content
- To show relevant toilets near you
- To respond to enquiries and provide support
- To send administrative messages, updates, and security alerts
- To send you a weekly digest email of highly rated toilets near areas you have reviewed, only if you have opted in via the in-app prompt or the Settings toggle. Each digest includes a one-click unsubscribe link, and you can turn it off at any time in the app's Settings. We use your email address, username, and the general areas of establishments you have reviewed for this service.
- To detect, prevent, and address technical issues, fraud, or abuse
- To comply with legal obligations and enforce our policies
- To conduct analytics and improve our Service
2.1 Featuring reviews on our website
We may show a short excerpt from one of your reviews on the Bog Standard website, to show people what the app is like and encourage them to download it.
What we show: up to 160 characters of your review text, your star rating, the month you wrote it, and the label "Bog Standard user", which is the same on every quote. We do not show your username, your profile picture, your photos, the place you reviewed, or the exact date.
Which reviews: only reviews rated 4 or 5 stars, written on or after 11 October 2026, that have no unresolved report against them, that you have not opted out of featuring, and that a member of our team has approved by reading the exact excerpt that would appear. We choose among them by how many people found them helpful. Reviews written before that date are never featured.
Why we can do this: our lawful basis is legitimate interests. Our interest is showing real experiences of the app to people deciding whether to use it. We think this is fair to you because the excerpt is short, carries no username or photo, and you can stop it at any time.
Your right to object: you can stop your reviews being featured at any time, and you do not need to give a reason. Email us at bogstandard-support@gimzware.ai and we will stop featuring them as soon as we can, and within one month at the latest. Editing a review also takes it off our website until our team has approved the new wording.
The excerpt is not anonymous. The same words appear in the app next to your username, so someone who uses the app could work out who wrote them. Unlike the app, our website can be seen by anyone, without an account.
3. Legal Basis for Processing (UK GDPR)
- Contract: Processing necessary to provide the Service you requested.
- Consent: Where you have given consent (e.g., location data, marketing, weekly digest emails).
- Legitimate Interests: For improving our Service, security, fraud prevention, checking uploaded photos for harmful content (see section 1.6), and featuring short review excerpts on our website (see section 2.1).
- Facility Details: If your answers about the toilet you used say something about your health, we rely on the fact that you chose to publish them with your review (Article 9(2)(e) UK GDPR).
- Legal Obligation: Where required by applicable law.
4. How We Share Your Information
- Publicly: Reviews, ratings, and usernames you make public are visible to other users of the app. Short excerpts of some reviews may also appear on our website without your username, as described in section 2.1.
- Service Providers and Partners: The companies named in section 4.1.
- Legal Requirements: When required by law or to respond to legal process.
- Protection: To protect the rights, property, or safety of us, our users, or others.
- Business Transfers: In connection with a merger, acquisition, or sale of assets.
We do not sell your personal information to third parties.
4.1 The companies that handle your data
These companies process personal data for us, under contract and only on our instructions:
- Microsoft (Azure): runs our servers, database and cache in its UK South region in London. It stores photos and diagnostic logs in its West Europe region in the Netherlands, and notifications, feedback and reports in its Sweden Central region. It also sends our emails through Azure Communication Services and screens review text and photos for harmful content (Azure AI Content Safety).
- Expo: delivers push notifications and app updates to your device. For push notifications, it receives your push notification token and the text of each notification.
- Sentry: receives crash reports and error details from the app, to help us fix faults.
These companies receive data when you use a feature that depends on them, and are responsible for how they use it under their own privacy policies:
- Google: Google Maps receives your position when you search for nearby toilets or ask for directions. Google AdMob shows the ads in the app and receives your advertising identifier (where your device settings allow it), your IP address and information about how you use the app. Google Play handles purchases on Android. Google sign-in, if you choose it.
- Apple: the App Store handles purchases on iPhone. Sign in with Apple, if you choose it.
- Meta: Facebook sign-in, if you choose it.
5. Data Retention
- Account data: retained while your account is active.
- Purchase and reward records: kept while your account is open. When you delete your account, we keep them with your identity removed, as explained below.
- Reviews, ratings, photos and comments: kept while your account is open. If you delete a review, we take it down from the app and our website, but we keep a copy linked to your account, which only our moderation team can see. That copy is deleted when you delete your account, and you can ask us to delete it completely sooner.
- Diagnostic and usage logs: kept for 90 days, then deleted automatically.
- Crash reports: kept by Sentry for 30 days, then deleted automatically.
- Support messages, feedback and reports you send from the app: we do not delete these automatically. They are deleted when you delete your account, or sooner if you ask us.
- Emails you send to our support address: we do not delete these automatically. You can ask us to delete them at any time.
- Photos held for review, or refused by a moderator: kept out of public view, and deleted when you delete your account.
- Featured excerpts: a copy is held in a short-lived cache. We delete it when you opt out, edit or delete the review, or delete your account, and when the review is reported or removed by our moderators. In any case it expires within an hour.
When you delete your account, we delete it and the data linked to it, with these exceptions. We keep the records of any in-app purchases you made, and of any rewards you earned by watching an advert, with your identity removed. Each record keeps the transaction reference from Apple or Google, the number of Flushes it added, and when. We keep them so that the same receipt or reward cannot be claimed again by another account, which is our legitimate interest in preventing fraud. We have not set a date to delete them, because a receipt or reward could be presented again at any time, so we keep them for as long as that remains possible. Places you added to the map stay on the map, without your username. Diagnostic logs and crash reports are deleted when their retention period ends, as above. If another user reported you, their report stays in our moderation record. It can include your username and what they wrote about you. We keep it to deal with abuse and keep people safe, which is our legitimate interest. You can ask us to delete it or remove your details from it, and we will unless we still need it to deal with a safety concern or a legal claim.
6. Your Rights (UK GDPR)
Under the UK GDPR, you have the right to:
- Access a copy of your personal data.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten").
- Restrict processing of your data.
- Port your data to another service.
- Object to processing based on legitimate interests.
- Withdraw consent at any time.
You can object to your reviews being featured on our website at any time by emailing us, as described in section 2.1.
To delete your account and the data linked to it, see Delete your account.
To exercise these rights, contact us at bogstandard-support@gimzware.ai. We will respond within one month.
6.1 Complaints to us
If you think we have not handled your personal data properly, you can complain to us by emailing bogstandard-support@gimzware.ai. We will confirm that we have received your complaint within 30 days. We will look into it, keep you updated, and tell you the outcome without undue delay.
6.2 Complaining to the ICO
You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk at any time, whether or not you have complained to us first.
7. Data Security
We implement appropriate technical and organisational measures to protect your personal information, including encryption in transit and at rest, access controls, and security checks on every release.
No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
8. International Data Transfers
Most of your data is stored and processed in the UK, in Microsoft's UK South region. Some is stored in the European Economic Area, in Microsoft's West Europe (the Netherlands) and Sweden Central regions. UK law recognises the EEA as protecting personal data adequately, so no extra safeguard is needed for those. Sentry stores our crash reports in the European Union. Google, Apple, Meta, Expo and Sentry may process data in the United States. For those transfers we rely on the UK-US data bridge where the company is certified to it, or on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
To ask for a copy of the safeguards that apply, email us at bogstandard-support@gimzware.ai.
9. Children's Privacy
The Service is not for anyone under 16. We do not knowingly collect personal information from anyone under 16. If we become aware of such data, we will delete it promptly.
10. Third-Party Links
Our Service may link to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy and updating the "Last updated" date.
12. Contact Us
GIMZWARE LTD, a company registered in England and Wales, company number 16913668
Email: bogstandard-support@gimzware.ai
Questions about this page? Email us: bogstandard-support@gimzware.ai
Back to legal