Privacy

Updated 14 November 2026. Range is an app by Breinpro. Questions, a copy of your data, or deletion: info@nostranger.app.

Who we are

Range is an app by Breinpro, the sole proprietorship (eenmanszaak) of Florian Julius, registered with the Dutch Chamber of Commerce (KvK) under number 42073963 and based at Zeekraal 23, 1796 BM De Koog (Texel), the Netherlands. Breinpro is responsible for your data in Range (the controller). For an event's guest list we work on the organiser's instructions; see Events with a guest list. You reach us at info@nostranger.app, in Dutch or English. Range is for people of 18 and older. The rules for using Range are in our terms.

Your account

You sign in with Apple or with your e-mail address. We do not store your e-mail address in readable form, either way.

With Apple, we use only a fixed sign-in code for Range, which we keep as a one-way hash, never in readable form. When Apple gives us one, we also keep a token so that we can end Range's sign-in at Apple when you delete your account, as Apple requires.

With e-mail, we send a 6-digit code to the address you type, which works for 10 minutes. We keep the address only as a one-way hash, never in readable form: that hash is your sign-in. To send the code, our server passes the address to Resend, which sends our e-mails; Resend keeps a record of the mail it sent for a limited time, as part of its service. We keep the code as a hash too, until its 10 minutes end; once you have used it, it no longer works. The e-mail has no images and nothing that tracks whether you opened it: no pixel, no rewritten links. Whether an address already has an account, the reply and the e-mail never say.

Your phone makes two keys for sealed chats; our server keeps their public halves so your matches can seal messages for you. A sign-in on a new phone replaces them. The app can also register a key with Apple's App Attest, which lets our server check that a request to enter a room comes from the real Range app; we keep its public half until you move to a new phone or delete your account. A sign-in (session) lasts 30 days after you last used the app. We also keep when your account was made and when each sign-in was last used.

Your profile, and who sees it

What you fill in: your first name, age, one line about yourself, what you like to talk about, what you are exploring, what you are open to, your this-or-that answers, your language, up to six photos, your About, your personality sliders and interests, and if you want, dating choices and your social accounts (LinkedIn and Instagram).

• Going. When you enter a room's code, people Going to or at the same event see your first name, first photo, your one line and your status for the evening, from the moment the list opens.
• At the place. People who are there at the same time see your full card: your age, all your photos, your About, what you like to talk about and are exploring, what you are open to, your sliders and interests. A match sees the same once the chat between you has opened for them. Your this-or-that answers and your language are not on your card.
• Dating shows only between two people who both switched dating on. See Dating, below.
• Social accounts (LinkedIn, Instagram) are never on your card. You share them in a chat yourself, and choose which.
• Hidden. While you hide yourself, you appear in no list or deck, and you cannot say hi or post in the room chat. People you already matched with still see you in that chat, and what you posted in the room chat earlier stays there.
• Blocked. A block removes you from each other's lists, decks, room chats and chats, everywhere in Range.

Range's moderators can see your photos, also one that is still being checked.

Dating

If you switch on Open to dating, you also say who you are ("I am": woman, man or non-binary) and whom you want to see ("Show me"). Together these say something about your sexual orientation. That is special category data under the GDPR (article 9), so we use it only with your explicit consent: before dating goes on, the app asks for it on a screen of its own.

Only people who switched dating on themselves see that you are open to dating and your "I am". Your "Show me" is shown to no one. In a why-text between two people who both date, Claude may see the dating part of what you can already see of each other (see AI in Range). Your About draft never uses it.

You withdraw your consent at any time by switching dating off in your profile. Your "I am", your "Show me" and your consent are then deleted from our server, not just switched off.

Findable by your number

In an event room the app can show which people there have a number that is in your phone's contacts ("In your contacts"). This stays off until you switch it on, and it works only with a Dutch mobile number. Only someone who is findable can look.

Your number. To make you findable, we send a 6-digit code by SMS to the number you type, through Twilio Verify. Twilio sends and checks the code, and keeps its own records of these checks for a limited time, as part of its service. Once you confirm the code, our server keeps your number encrypted (AES-256-GCM) and as a keyed hash (HMAC-SHA256 with a secret key), which keeps one account per number and carries the limits. Being findable lasts 365 days; a new SMS code renews it. When you switch it off, your number and everything made from it go at once; the keyed hash stays 30 days longer as a record for the limits, then goes too.

Your contacts. Contact names and readable contact numbers stay on your phone. To compare, your phone turns each number into a blinded value for that one room, which our server answers without being able to see the number behind it (a cryptographic method called an oblivious pseudorandom function). Your phone then compares the answers with the room's tags of findable people itself. So the numbers in your contacts, also those of people who do not use Range, never reach our server in readable form, and we keep none of them. A room's tags go 7 days after the event.

What others can see. Anyone who has your number (or guesses it), is findable themselves and is in the same event room can see that you are there. Every guess costs one evaluation for one number in one room, and evaluations are limited. You get no notice when someone sees you this way, and what someone already saw cannot be taken back. A number the phone company later gives to someone else can match that person.

Events with a guest list

Some events are invite only. The organiser (for example NL Groeit) gives us its guest list, and the room's code then opens only for an e-mail address on that list; anyone else sees "not invited". We store that list for the organiser until 7 days after the event.

What the organiser gives us about you

Your e-mail address, and if the organiser has them: your name, role, company, a LinkedIn link, your table, what you seek and offer at the event, and for matching your sector, company size, growth stage, what you are up against, your region and a short note. When you sign in with the address on the list, the app fills your profile in with the name, role, company and LinkedIn link from the list; you can change every field. If you signed in with Apple, or with Google using another address, the app lets you confirm your invitation with a code we e-mail to the address on the list; that ties your account to that one invitation.

These fields are the organiser's data. They are not passed through our word filter, and they stay in the list when you delete your account; your account's link to them goes.

Who at the organiser sees what

An organiser's staff sign in to a dashboard of their own with a code we e-mail them; we keep their e-mail addresses in readable form, because they are staff, not people in the app. There are two roles:

• Beheerder (manager) sees the whole list: e-mail address, name, role, company, LinkedIn link, table, what you seek and offer, the fields for matching, the LinkedIn profile fetched for you (see Your LinkedIn profile), whether you have the app, are Going or have been admitted at the door, and the match suggestions. A manager changes the list and tables, exports it, sends announcements, computes matches, and can read, remove and mute in the event chat, the table chats and the helpdesk.
• Kijker (viewer) sees only name, company, table and status (invited, has the app, Going, inside), scans passes at the door, and reads the overview and the helpdesk. No e-mail address, no LinkedIn link, no seeks and offers, no chats, no changes.

Neither role sees who you said hi to, whom you matched or chat with, or your sealed messages in chats between two people. Range's team can act as a manager in any event for support.

Your table and your pass

The organiser can put you at a table. The app shows you your own table and a chat with the people at it; it never shows anyone else's table. At the door you show a pass: a QR code that carries the event, your alias in that room and a time, nothing else. The scan records that you were admitted, when, and by which staff member; a viewer can undo their own scan within 5 minutes. The pass does not work without internet, and the door can then look you up by name.

Matches suggested by Claude

At an event the app asks: "Range may use your role, company, what you seek, offer and are up against, the organisation's details about you and your public LinkedIn profile to suggest matches. This is done with an outside AI service." That service is Claude by Anthropic. Only if you tick it does anything of yours go to Claude for this, and only then do you see suggestions. If you ticked the older, shorter question, only your role, company, what you seek and offer and a table number are used.

Claude can first write a short card per participant: what your company does, its sector, size and stage, and up to three points each on what you are strong in, seek and are up against. For that card it gets your role and company, what you seek, offer and are up against (your own answers, else the list's), the organiser's sector, size, stage, region and note, and, where it was fetched and confirmed as yours, text from your LinkedIn profile, once. Claude then picks matches, with each participant a number for that run, with a table number. Nothing else: no name, e-mail address, link, account, photo, age or anything about your looks or background.

Before sending, we strip e-mail addresses, links, phone numbers, @handles and your own name (as the guest list, your profile and your LinkedIn profile spell it) from those texts. That does not always succeed: a nickname, initials, a name of two letters, or the name of someone else in your LinkedIn text (a colleague, a co-founder) is not recognised and can be in that one request. Claude answers with up to six suggestions per person and one sentence on why, which we check (no contact details, no long numbers, no names we know, through the word filter) and keep for that event. The organiser can add, pin or remove suggestions and sees them with names. You see at most four cards: name, first photo, role, company and the sentence. A hi to a suggested match opens the chat for both of you as soon as both say hi, also before the event starts.

A suggestion is not a decision. You decide whom you say hi to, and the organiser decides which suggestions stand. Nothing with legal or similarly significant effect is decided about you by automated means alone (article 22 GDPR). Suggestions and cards go 7 days after the event, or at once when you leave the list, delete your account or block someone. Taking your tick back deletes your card and leaves you out of the next run.

Your LinkedIn profile

Only at events where the organiser had it switched on and told guests beforehand, we fetch the public LinkedIn profile behind the link on the guest list. Apify runs that fetch for us; it gets only the profile link, nothing else from the list.

What we keep of it: your name, headline, "about" text, industry, location, up to 30 skills, up to three positions (title and company, and the description of your current one), and a copy of your profile photo. Apify may also find e-mail addresses with the profile; we only compare them with the list to check that the profile is yours, and do not store them. We have Apify delete every fetch afterwards.

What it is used for: the app offers to fill in your photo and About from it, with Use this, Adjust and Don't use this. Nothing goes into your profile unless you choose so, and never over something you already have. With your match tick, text from it can go to Claude once, for your match card (see above). The organiser's managers see the fetched profile in the dashboard, to confirm or reject that it is yours; viewers do not.

The organiser is responsible for this fetch and relies on its legitimate interest in matching its guests well; we do it on its instructions. You can object: tell the organiser, mail info@nostranger.app, or tap Don't use this in the app. We then delete what we fetched and do not fetch it again for that event. Everything fetched goes 7 days after the event at the latest. What you took into your own profile is yours, and stays until you change it or delete your account.

Announcements from the organiser

A manager can send a message to everyone Going, to everyone there at that moment, or to one table. It arrives as a push notification with the room's name and the organiser's own text (up to 500 characters, cut to fit), marked time-sensitive when urgent, and in the app under the room. For each announcement we keep, per recipient, how far it got: queued, accepted by Apple or Google, failed, or loaded by your app. Not whether you read it. Those records go 7 days after the event.

Also by e-mail

If you tick "also by e-mail" for an event, an announcement whose push cannot reach you (no notifications allowed, no push address) also goes to your address on the guest list, sent through Resend from "<room> via Range", without images. A mail an organiser sends to guests who have not joined yet may show the organiser's logo. Your mail program then fetches it from nostranger.app, at an address that is the same for every guest: we cannot tell from it who opened which mail, and we keep no record of it. Every such mail carries an unsubscribe link and a one-click List-Unsubscribe header; one click stops all organiser mail for that event. We still store no readable address of yours: the address comes from the organiser's list.

Event chat, table chat and helpdesk

These are not sealed, like the room chat. Everyone in them reads them, our server reads them, and the organiser's managers can read, remove and mute. Every message you post there first passes our word filter and then goes, as text alone, to Claude Haiku (Anthropic), which judges whether it is fine, needs a second thought ("This may come across as hurtful. Send anyway?") or is blocked. We log the verdicts for 30 days, with the text only for a nudge or a block. Three blocks in 24 hours mute you in that event for an hour. The helpdesk is a chat between you and the organisation; they read it, and answer as the room, never under a staff member's name. These messages go 7 days after the event.

Your location

When you enter a room, our server checks once that you're at the place. It doesn't keep your position.

To enter, the app sends your position with that request. The server compares it with the circle around the place and throws it away: it is not stored, not logged and not sent to anyone. While you stay, the app sends a fresh position every few minutes to keep you in the room, and each one is handled the same way. Without a fresh one you leave the room within 10 minutes. What we keep is which room and which of its places you were at, and when; not your position.

If you allow Location Always, your phone itself watches the circles of the places whose code you entered and of Range's partner places, so it can let you in and out automatically. That happens on your phone. You can switch one place off, or location as a whole, in Settings; we keep which places you switched off. The demo room for App Review does not check your position at all.

Find each other

With a match, you can both switch on Find each other for 20 minutes. Only while both of you have it on, your phones send each other your positions through our server, sealed so that only the other phone can read them. The server passes them on and never stores them. It does keep, for those 20 minutes, that you switched it on, and your match sees that.

Bluetooth, when there is no internet

In a room where the organiser has it on (it is on by default), Range phones at the same event form a small Bluetooth network with each other, so that saying hi, matching, chatting and Find each other keep working when the venue has no signal. Internet stays the main path; Bluetooth is the backup. Your phone asks for the Bluetooth permission (on Android: Nearby devices) the first time; without it Range works over the internet only.

What leaves your phone over Bluetooth. While you are in such a room, also with internet, your phone broadcasts a code that changes every 15 minutes and that only members of that event can recognise, and connects to other Range phones that broadcast it. To each one it shows a membership certificate our server signed for you: your alias in that room, two keys your phone made for this event, the event and an end time (24 hours after the event). So a phone that connects to you learns your alias in that room, as your card already shows it. What then travels is what the app would send over the internet anyway: hi's, matches, chat messages and Find each other positions, each sealed for the one phone it is meant for. Other Range phones in the room may carry a sealed message along a few hops to its recipient, without being able to read it, for at most 15 minutes. Never over Bluetooth: your photos, your full profile, reports, joining a room.

What your phone keeps for it. While online, the app caches the name, first photo and one line of the people Going to the event (what the Going list shows you) so that you can see them offline. It goes when the certificate ends. People who join after you went offline stay invisible to you until you are back online.

Our server has the last word. Everything done over Bluetooth is sent to our server with proof when internet returns; the server checks it against the same rules as online (blocks, the guest list, the limits on hi's) and its answer wins. A message that the server refuses is marked "Not sent" on the sender's phone, even if it already arrived over Bluetooth. A block you make offline is sent first. A block someone else made while you were offline reaches your phone only when you are back online. We can switch Bluetooth off for one room or for everyone; your phone stops within 6 hours at most, at once when online.

Our server stores your two public mesh keys per event, with the certificate's end time, until 7 days after the event or until you delete your account. Bluetooth traffic itself never passes through our server, and it cannot read your sealed messages.

Chats

Chats between two people are end-to-end sealed: your phone locks each message for the other phone only, and our server cannot read it (the one exception is a chat with a test bot during the beta, see AI in Range). The server does see who writes to whom, when, and how large a message is. A message waits on the server until the other phone confirms it received it, at most 30 days; a new phone, a block or a deleted account removes it sooner. Message numbers are kept for 30 days so a message sent twice arrives once.

The room chat is not sealed. Our server can read it, everyone at the place in the room reads it, and we can remove messages from it. The app says so in the room chat itself.

Swapping numbers and WhatsApp

In a chat you can swap numbers (Swap numbers), only when you both say yes. What is swapped is the number each of you confirmed by SMS (see Findable by your number). It travels sealed inside your chat, end to end: our server cannot read it. After the swap your number is on the other person's phone, in the chat and in People, and Range cannot take it back from there, also not when you delete your account. Put in your phone opens your phone's own new-contact screen; Range never gets permission to write to your contacts.

Open in WhatsApp opens a WhatsApp link with that number and a greeting already typed. Nothing goes through Range to WhatsApp: your phone opens WhatsApp, or the link in your browser. What you do in WhatsApp falls under WhatsApp's own terms.

People

People, in the Chats tab, lists the people whose number you swapped or whose shared contact (LinkedIn, Instagram) you saved, by the room and day you met. It lives only on your phone and is never sent to our server. You remove someone with Remove from People; a later swap with them brings them back.

AI in Range

• Photo check. Every new photo goes to Claude, an AI model by Anthropic, which checks it for nudity, violence, hate, minors and contact details. Other people see a photo only after it passes; a rejected photo is deleted and you are told why.
• AI suggestions, only when you allow them. Before the first About draft or why-text, the app asks whether Range may send your name, age and profile answers to Claude by Anthropic. You can also write your own. You change your answer any time with the switch AI suggestions in Settings. Without it, nothing of yours goes to Claude for About drafts or why-texts.
• About. With AI suggestions allowed, Claude writes a draft About from your first name, age, your line, what you like to talk about, what you are exploring, what you are open to (without dating) and your this-or-that answers. Never from your photos, social accounts or dating choices. Nobody sees the draft until you approve it or write your own. With it, Claude fills in your sliders and interests if you have not set them yet. Those show on your card straight away; you can change or clear them.
• Why you two. With AI suggestions allowed by both of you, for the people at the top of your deck, Claude writes one sentence on why Range picked them and three opening questions, in your language. It uses only what the two of you may already see of each other at that moment: no photos, and dating only if you both date. We keep them for that pair and write new ones when what you can see of each other changes.
• Matches at an event. Only with your tick: your role, company, what you seek, offer and are up against, the organiser's details for matching, a table number and, if fetched, text from your LinkedIn profile go to Claude under a number, never your name, e-mail, photos or account. See Events with a guest list.
• Event chat, table chat and helpdesk. Each message you post there goes to Claude Haiku as text alone, which judges whether it is fine, gets a nudge or is blocked. This check does not need your consent: it rests on our legitimate interest in keeping these chats safe. See Events with a guest list.
• Covers. Only when you tap Make covers, and never before: your first photo goes to fal.ai, a company in the United States (outside the EEA), whose image model turns it into a studio portrait on one of your two cover colours. Before you see a cover, Claude Haiku (Anthropic) compares it with your photo, to check that it still shows you. We ask fal.ai not to keep the request and to delete the images it made after an hour. Making covers stores nothing on our server. The cover you keep is stored with your account, so it comes back when you sign in again or on a new phone. Only you can see it. We keep it until you remove it, until your first photo changes or goes, or until your account is deleted.
• Test bots. While Range is in beta, people who test the app (the Range team, and testers who joined through TestFlight or a test track) can meet test bots: made-up people played by Claude, marked "testbot", whose About says so. A chat with a bot is opened by our server and answered by Claude, and kept at most 7 days. People outside the beta, and the app stores' reviewers, never see a bot.

Anthropic does not use this to train its models. What AI makes is a suggestion, not a decision: you choose whom you say hi to and what goes on your profile, and an organiser can change match suggestions. Nothing with legal or similarly significant effect is decided about you by automated means alone (article 22 GDPR).

Push notifications

If you allow notifications, we keep your phone's push address until you sign out, delete your account, move to a new phone or Apple says it no longer works. A notification from Range itself never contains a name or message text. It says only "Someone said hi to you", "It's a match" or "Your match said hi back", "New message", "The room is open" with the room's name, "The organisers replied", or that someone worth meeting walked into the room, in your language, with a reference to the chat or room so the app can open it. The one exception is an announcement from an event's organiser: that notification carries the room's name and the organiser's own text. Apple delivers them on an iPhone, Google (Firebase Cloud Messaging) on Android.

The app also tells our server whether notifications are on, off or not yet decided on your phone (and on an iPhone whether time-sensitive ones are allowed), so an organiser can see how many guests its announcements reach and so the app can offer the "also by e-mail" fallback. We keep that status until it has not been seen for 180 days.

What we keep, and for how long

Deletion after these periods runs once a day, so something can stay up to a day longer.

Deleting your account

Delete your account at the bottom of Settings, or without the app on our deletion page, with a code we e-mail you (for an account you sign in to with your e-mail address). It goes at once: your profile, sign-in, memberships, hi's, room chat messages, waiting messages, blocks, the reports you made, your push address, App Attest key, settings and status, your dating choices, and your findable number with its room tags. From events: your choices per event (the match tick, seeks and offers, "also by e-mail"), the match suggestions about you, your match card, the LinkedIn profile fetched for you, your tie to a confirmed invitation, your door scans, your announcement records, your event, table and helpdesk messages, your notification status and your mesh keys. Your photos are wiped from storage right after, by a job that keeps trying until it is done. People you chatted with see "This account was deleted". If you signed in with Apple, we also ask Apple to end Range's sign-in. A few short-lived records, such as request counts and message numbers, run out on their own within 30 days.

What we cannot erase: messages already on the other person's phone, a number you swapped (it is on the other person's phone and in their People), what other phones received from you over Bluetooth, the backups our host Cloudflare keeps for its recovery window (up to 30 days), and your row in an organiser's guest list, which is the organiser's data (ask the organiser; it goes 7 days after the event).

What we keep: a note that the account existed and when it was deleted, so old sign-ins stay dead; reports about you with their evidence, for their 90 days; the admin log's rows about your account id, for their year; and the hash of your sign-in for as long as such reports run, so deleting and signing up again does not escape a ban. After a ban, that hash is kept for good.

Reports and safety

You can report or block anyone, from their profile, a chat or the room chat. A report keeps who made it, why, the note the reporter wrote, and what it is about as evidence, for 90 days: the person's profile as we store it, with a copy of their photos, or the room chat message. We never open sealed chat messages; a report about a chat holds the reporter's note and the person's profile as evidence, never the messages. Range's moderators see reports and their evidence; the person who reported sees only how far we are. We can remove photos and room chat messages and ban accounts; a banned Apple ID or e-mail address cannot sign in again. Names, profile texts and the room chat also pass a word filter before they are stored.

When a report comes in, the team gets an e-mail saying so, with its reason, the room and the time and a link to it in our moderation tool. That e-mail holds no names, no note and no messages.

What the Range team sees

Range's team can look up an account for moderation and support: the profile, photos, when the account was made and last used, which rooms it joined, the reports about it and its room chat messages. The team does not see who you said hi to, matched or chat with, except what a report shows: a report about a chat names the two people in it. Your sealed messages the team cannot read. For events, the team sees what a manager sees: the guest list, tables, matches, announcements and the event, table and helpdesk chats, and it manages the organisers' accounts.

Every change the team makes, such as removing a photo or banning an account, goes into an admin log: who made it, what it was, when, and which account id it was about. The log holds no messages, photos or profile text. We keep it for 1 year, also after the account is deleted.

To see how busy Range is, our server counts things like hi's, matches and people in a room, per 5 minutes. These counts hold no account ids. We keep them 30 days.

Our host Cloudflare keeps a short record of each request to our server: what kind of request it was, whether it worked and how long it took. It holds no account id, IP address or content. Cloudflare keeps it three months (Workers Analytics Engine).

Why we may use your data

For each use, the ground in the GDPR (article 6, and article 9 for dating) on which we rely:

Who helps us

• Cloudflare runs our server and stores its data. In the United States, under the EU-US Data Privacy Framework.
• Apple handles Sign in with Apple, push notifications and App Attest. In the United States, under the EU-US Data Privacy Framework.
• Anthropic runs Claude for the photo check, About and why-texts, the test bots, the check of a cover against your photo, the match cards and suggestions at events and the check of event, table and helpdesk chat messages. In the United States, under the European Commission's standard contractual clauses.
• fal.ai makes the studio portraits for your covers, only when you ask for covers. In the United States, under the standard contractual clauses.
• Google handles Sign in with Google and push notifications on Android. In the United States, under the EU-US Data Privacy Framework.
• Resend sends our e-mails: sign-in, deletion and invitation codes to you, sign-in codes and invitations to an organiser's staff, an organiser's announcements to guests who asked for them by e-mail, and to the team the notice of a new report. In the United States, under the EU-US Data Privacy Framework.
• Twilio sends and checks the SMS code that makes you findable by your number. In the United States, under the EU-US Data Privacy Framework.
• Apify fetches LinkedIn profiles, only at events where that is switched on. A company in the Czech Republic whose platform stores data in the United States, under the standard contractual clauses.
• Google Fonts serves the fonts of this website, so Google sees your IP address when you open it. The app does not use it.

If the EU-US Data Privacy Framework stops applying, we stop sending data to the company concerned, unless standard contractual clauses are in place with it.

Your rights

You can ask what data we have about you, get a copy, have it corrected or deleted, and object to how we use it, for example to the LinkedIn fetch. A consent you gave you can take back at any time; what we did before stays lawful. Write to info@nostranger.app. If you disagree with how we handle your data, you can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).