Privacy policy

Last updated 20 October 2026

Who is responsible

Fistbump is run by Sinda Khenine, Rothenburg ob der Tauber, Germany. Email: contact@skatalystai.com. This is the controller for the personal data described here under the EU General Data Protection Regulation (GDPR).

What we collect and why

When you sign in with X, X shares with us, with your permission:

• your X account ID, name, @handle, profile photo and bio;
• your follower and following counts, account creation date and the location text on your profile;
• your email address, if X provides it;
• whether you and other Fistbump members follow each other on X, checked only for people who are themselves Fistbump members.

We use this to create your account, show your profile, and place the right people on your map (contract, Art. 6(1)(b) GDPR). We never post, follow, or send messages on X for you, and we don’t collect data about people who aren’t Fistbump members.

What you add: the country and optional city you choose (never a street address or GPS), your character’s look, interests, bio, project details, who may find you, trips and free times you announce, pings, invitations, messages, meetup confirmations, events and RSVPs, blocks and reports. We use these to run the service you ask for (Art. 6(1)(b) GDPR).

Safety: reports and blocks are used to keep members safe and to act on abuse (legitimate interests, Art. 6(1)(f) GDPR).

A profile picture you upload on the map stays in your own browser and is not sent to us.

Who can see what

Only approved members see the member map, and only according to your settings: by default just your X connections who use Fistbump, or also other approved builders if you allow it, or nobody if you hide. Your location is shown at country or city level only. Messages are visible only to the two people in the conversation. Exact event venues are shown only to guests who are going, unless the host marks the venue as a public place.

Services we use

• Supabase stores the database and handles sign-in, hosted in the EU (Frankfurt). Our X access tokens are stored encrypted.
• X Corp. provides sign-in and the profile and follow data above, under X’s own privacy policy.
• GitHub Pages serves this website and the web app, and OpenFreeMap serves the map tiles. Both receive your IP address when your browser loads files from them.

Some of these providers may process data outside the EU; where they do, they rely on the EU’s standard contractual clauses or an adequacy decision.

Cookies and storage

We don’t use advertising or analytics cookies. Your browser stores your sign-in session and, if you upload one, your profile picture, so the app keeps working between visits.

How long we keep data

We keep your account data while your account exists. When you delete your account, your profile, requests, messages, announcements and events are deleted; reports about other members may be kept as long as needed to handle them.

Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interests. Write to contact@skatalystai.com. You can also complain to a data protection authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA).

You can disconnect Fistbump from your X account at any time in X’s settings under connected apps.