Privacy Policy

1. Controller and contact

The data controller is the operator identified in the operator and contact block on this page, at the postal address stated there. Use the privacy address in that block, or the public Contact page, for privacy questions and rights requests.

The operator is established in Germany, so the competent supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht. You may instead lodge a complaint with the supervisory authority for the country where you live or work; for members in Poland that is the Urząd Ochrony Danych Osobowych.

No data protection officer is currently appointed. If the scale or nature of our processing makes one mandatory, we will appoint a data protection officer and publish the contact details here.

2. Data we process

Depending on how you use the service, we process the following categories.

• Account and contact data: user ID, email, phone number, authentication and account status, verification events, locale, and market.
• Profile and matching data: display name, age or date of birth, confirmed matching market, gender or sex descriptors, sexual orientation, relationship goals, photos, profile text, preferences, interests, section access, availability, and compatibility inputs.
• Survey and reflection data: answers, importance, dealbreakers, visibility choices, survey version, and completion state. Some answers may reveal religion or philosophy, political views, sexual orientation or sex life, and health- or fertility-adjacent information.
• Verification data: selfie images, profile-photo metadata, phone-verification status, manual visual-review outcome, review notes, and identity-mismatch reports. The current service uses manual visual comparison and does not create a face-recognition template.
• Interaction data: private interests and passes, mutual-interest and confirmation state, locks, messages, milestones, checkpoints, video-date scheduling and room-participation metadata, blocks, reports, closure surveys, and support tickets.
• Payment data: provider, product or section, amount, currency, transaction and customer references, payment status, refunds, and the credit reservation and consumption ledger. We do not receive complete card details from Stripe, Apple, or Google.
• Device and technical data: notification token, app and platform version, essential cookies and session data, security logs, request metadata, and a one-time foreground location reading when you choose to check your matching market. Precise coordinates are rounded on your device before transmission and are not stored. If you are inside an open market, we retain only the market assignment. If you are outside, we retain the rounded area only after you separately choose to join the launch waitlist; leaving the waitlist erases that area.
• Operational and audit data: notifications, delivery results, privacy requests, privacy-minimised product events, administrative actions, moderation decisions, safety evidence, and provider webhook or operation records.
• Communications and legal evidence: emails, support correspondence, complaints, notices, and records of document presentation, acceptance, consent, or withdrawal.

3. Why we use data and our legal bases

We do not sell personal data. Paid status does not improve profile ranking or visibility. We do not use sensitive matching information for advertising.

• Account creation, authentication, service delivery, messaging, milestones, and video dates: performance of our contract and legitimate security interests.
• Special-category compatibility and matching information: separate explicit consent under Article 9 GDPR.
• Introduction ordering and recommendations: contract, legitimate service-quality and safety interests, and explicit consent for special-category inputs.
• Manual selfie/profile consistency review and phone verification: contract and legitimate interests in preventing impersonation and abuse; additional consent if future processing legally requires it.
• Payments and the authoritative credit ledger: contract, legal obligations, accounting, and legitimate fraud-prevention interests.
• Moderation, reports, blocks, security, and fraud prevention: legitimate interests, legal obligations, and legal claims where applicable.
• Support, complaints, privacy requests, and appeals: contract, legal obligations, and legitimate interests.
• Essential service messages: contract, legal obligations, and legitimate operational interests.
• Reliability measurement without advertising profiles: legitimate interests balanced against your rights, and consent where legally required.

4. Explicit consent for sensitive matching data

Some matching questions reveal special categories of personal data. We ask for separate, specific, affirmative consent before collecting or using those answers for matching. Refusing consent means that features which depend on those inputs cannot operate.

You may withdraw through Privacy Controls as easily as you gave consent. Withdrawal does not affect the lawfulness of earlier processing. It stops future sensitive matching use and pauses the discovery features that depend on those inputs. Active locks and Focused Matches are not silently altered.

Withdrawal does not by itself erase answers you have already given. To have them erased, write to the privacy address in the operator block. We complete an erasure request within one month of receiving it, and if the request is unusually complex we may extend that by up to two further months and will tell you within the first month that we have done so.

5. Matching and profiling

The Vow evaluates compatibility and eligibility using market, age and orientation compatibility, relationship intent, preferences, survey answers, dealbreakers, section eligibility, blocks, safety restrictions, availability, and one-person-at-a-time locks. An authorised administrator may provide a prioritisation signal. Payment does not improve ranking.

The system recommends introductions; it does not decide whether you must interact, confirm, date, or continue a relationship. Those decisions remain yours. Use the Contact page to request human review of a materially incorrect recommendation or restriction.

6. Visibility and other members

A recipient may take a screenshot or disclose content outside our control; such misuse may violate the Safety Standards and law.

Pending-confirmation messages remain invisible to the second person unless the Focused Match activates. Neither person is told whether the other confirmed, declined, withdrew, expired, established payment readiness, or encountered a payment failure.

• Profile: information shown to eligible members before a match.
• Match-only: information shown only after a Focused Match activates.
• Matching-only: information used for compatibility but not directly displayed.
• Private: reflections or account details visible only to you.
• Admin-restricted: information available only to authorised staff for a documented operational, support, legal, or safety reason.

7. Service providers and recipients

We disclose only the data reasonably needed for the stated purpose. Raw sensitive survey answers are not placed in push notifications or general product analytics.

The database, authentication, and private storage that hold your account, profile, survey, and messaging data are hosted inside the European Union. Some providers in the list above are established outside the European Economic Area. Where that is the case, we rely on an adequacy decision or on the European Commission's standard contractual clauses. This list names every provider we engage; we update it here when a provider is added or removed.

• Supabase: database, authentication, private storage, realtime, and backend services.
• Vercel: web hosting, request execution, and reliability or security logs.
• Twilio Verify: phone verification.
• Daily: voice and video rooms, participant and technical connection metadata, and streams in transit.
• Stripe: web payment processing.
• Apple, Google, and RevenueCat: native purchase processing and verification.
• Resend: transactional email.
• Expo, Apple Push Notification service, and Firebase Cloud Messaging: device notifications with privacy-minimised payloads.
• Professional advisers and public authorities: only information necessary for legal, accounting, claims, compliance, or valid official requests.

8. International transfers

Some providers process data outside the European Economic Area. Where they do, we rely on an adequacy decision, European Commission Standard Contractual Clauses with supplementary safeguards, or another lawful transfer mechanism.

Your account, profile, survey, messaging, and media data are held in the European Union. To ask which provider processes a given category, where it does so, and on which safeguard we rely, write to the privacy address in the operator block and we will tell you.

9. Retention

We keep personal data only for as long as necessary for service delivery, legal duties, safety, fraud prevention, accounting, or legal claims. Each category has an accountable owner, implemented purge mechanism, legal-hold rule, and provider or backup window before its period is published.

We keep each category only while one of these criteria applies, and delete or irreversibly anonymise it once none does: the data is needed to run your account and provide the service; a safety, fraud, or moderation record must be kept to protect other members; a payment, accounting, or tax record must be kept for the period the law requires; evidence is needed to establish, exercise, or defend a legal claim; or a legal hold applies. Data retained after account deletion is minimised, access-restricted, time-limited, and excluded from matching and marketing.

To ask how long we will keep a particular category of your data, write to the privacy address in the operator block.

10. Account deletion

You may initiate deletion through in-app Privacy Controls. The public Account Deletion page provides instructions if you cannot access the app. Deletion removes authentication access, profile and media, optional survey answers, and other associated data from active systems unless a narrow legal reason requires retention.

A retained payment, accounting, fraud, safety, legal-claims, or legal-hold record is isolated and minimised, carries a reason and expiry, and is not used for matching or marketing. Account freezing or profile anonymisation alone is not treated as completed deletion.

The in-app privacy area confirms a request and gives you its reference. We complete a deletion request within the period stated in the Account Deletion notice, instruct our providers to delete their copies as part of the same request, and confirm to you when it is done.

11. Your rights

Subject to applicable conditions, you may exercise the following rights.

Use Privacy Controls or the public Contact page. We may request proportionate verification. We do not charge unless a request is manifestly unfounded or excessive and the law permits a fee.

• Access personal data and receive a copy.
• Correct inaccurate personal data.
• Request erasure or restriction of processing.
• Receive portable data in a structured, commonly used, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time as easily as it was given.
• Request human review where applicable.
• Complain to a supervisory authority or seek a judicial remedy. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO).

12. Security

We use role-based access, row-level database controls, private storage, encryption in transit, server-only provider credentials, limited media access, audit logging, and transactionally enforced match and credit state. No method is perfectly secure. Use the Contact page to report a suspected security or privacy incident, and never include a password or one-time verification code.

13. Cookies and device storage

The current service uses essential session, authentication, security, language, and onboarding storage needed to operate. It does not use third-party advertising cookies or cross-service behavioural advertising. If optional analytics or marketing technology is introduced, this notice will be updated and consent requested before activation where required.

14. Children

The Vow is for adults aged 18 and over. We do not knowingly permit minors to create or use dating accounts. Use the Contact page promptly if you believe a minor is using the service. We investigate and delete or restrict data as required.

15. Changes to this policy

We publish the current version and effective date. For material changes, we provide prominent advance notice where practical. If a new purpose requires consent, we ask before using data for that purpose. Prior versions and a plain-language change summary remain available.