Privacy Policy

DRAFT to be reviewed by a lawyer before publication. Last updated: [DATE].

In short

• We don't sell your data and we don't show ads.
• We don't use your content (photos, texts, messages) to train artificial intelligence systems.
• Your exact location never leaves your phone: we only store a location rounded to about 1 km.
• Nobody reads your messages, except those that are reported.
• You can delete your account and your data at any time from the app.

Who processes your data

Data controller: [CONTROLLER NAME], [ADDRESS]. Contact: nearlyappsupport@gmail.com.

Representative in the European Union (if required by the GDPR): [EU REPRESENTATIVE].

The controller is based in Colombia: we process data under Colombian data protection law (Law 1581 of 2012 and its implementing decrees) and, for people living in the European Union, also under the GDPR.

What data we collect

Data you give us

• Sign-in data: your Google account email or phone number.
• Profile: name, date of birth, gender, who you're interested in, languages, bio, what you're looking for, interests, prompt answers, height, job, education, where you live, lifestyle, whether to show your star sign.
• Profile photos (up to 6). Before storing them we remove the file's hidden metadata, including GPS location.
• Chat messages, likes, Super Likes, reports and blocks.
• Lovelark Open (only if you turn it on): that you use the mode and when you consented; if you create a couple profile, the linked partner, "About us", "We're looking for" and each partner's yes or no on profiles.
• Purchases, once subscriptions are live: product, date, length and status of the subscription. Payment is handled by Google Play: we don't receive your card details.

Data collected automatically

• Approximate location, only if you allow it: rounded on your phone to about 1 km before it's stored.
• Technical identifiers: the installed app's identifier, the push notification token, the check that the app is genuine (Firebase App Check with Google Play Integrity).
• Technical crash data: if the app crashes, Firebase Crashlytics receives the phone model, Android and app versions and the place in the code where the error happened. It does not include messages, photos or location.
• App language and preferences saved on your phone (visual style, filters, daily counters).

Data we receive from others

• From Google, if you sign in with Google: your account's email address.
• From other users: reports about you and, in Lovelark Open, your partner's actions on the couple profile.

Special category data

Gender and "who you're interested in" may reveal your sexual orientation, which is special category data (Art. 9 GDPR). We process it only with the explicit consent you give by creating your profile, and only to show you compatible people. You can withdraw consent by deleting your account. Turning on Lovelark Open reveals an interest in non-monogamous relationships, which is data about your sex life (Art. 9 GDPR): we process it only with the explicit consent you give when turning it on, and you withdraw it by turning it off. Under Colombian law these are sensitive data: you are not obliged to authorise their processing. Saying who you're interested in is optional: with "Show me everyone" you don't say it and you see people of all genders; if you do say it, we ask for separate consent and record its date.

Why we use it and on what basis

• Creating and running your account, showing you profiles, matches, chat and notifications: performance of the contract.
• Using sexual orientation and Lovelark Open to show you compatible people: your explicit consent.
• Working out distances with your approximate location and sending you notifications: your consent, given through your phone's permissions and revocable in the settings.
• Community safety: handling reports, preventing scams and abuse, checking that the app is genuine: legitimate interest.
• Automatic checks on messages, on your phone and on the server, to block payment details and credentials, severe insults and threats, and phone numbers, emails, links and social handles in the first 24 hours after a match: legitimate interest (preventing scams and harassment).
• Automatic photo checks (nudity, violence and, for the first photo, whether a face is visible) with Google Cloud Vision: legitimate interest (community safety). The check only looks at whether there is a face, not who you are: we don't use facial recognition.
• Fixing app errors (Crashlytics): legitimate interest.
• Handling purchases and subscriptions: performance of the contract and tax obligations.
• Complying with the law, responding to authorities and defending our rights: legal obligation and legitimate interest.

We don't sell your data, don't show ads, don't send you marketing and don't use your content to train artificial intelligence.

Automated decisions

Some decisions are made by the app without human involvement: message checks may block a message from being sent, the photo check may reject a photo, and the order of profiles while swiping depends on filters, distance, Super Likes and Boosts. None of these decisions has legal effects on you. If you think an automatic block was wrong, write to nearlyappsupport@gmail.com: a person will review it.

Who sees your data

• Other users see your profile and the distance in km, never your exact location or your contact details.
• Messages are seen only by the people in the match: two, or 3 or 4 in Lovelark Open group chats.
• In Lovelark Open your partner sees your yes and no choices. People who haven't turned on Lovelark Open see neither the couple profile nor the fact that you use it.
• Providers that process data on our behalf, under contracts that oblige them to protect it: Google Ireland Ltd. (Firebase: sign-in, database, notifications, crash reporting, App Check, website; Cloud Storage and Cloud Vision for photos) and Google Play for payments; with subscriptions, RevenueCat Inc. to manage their status.
• Authorities: only when the law requires it, on a valid request, or to protect someone's life or safety.
• If the business is merged, sold or transferred, your data passes to the new controller, who must respect this policy; we'll tell you beforehand.

Where your data is stored

The database is located in the European Union. Some Google services and, with subscriptions, RevenueCat may process data in the United States or other countries: in those cases we use the safeguards required by the GDPR (an adequacy decision such as the EU-US Data Privacy Framework, or standard contractual clauses). Transfers from Colombia to these countries follow the rules of the Superintendence of Industry and Commerce (SIC) on countries with an adequate level of protection.

How long we keep it

• As long as your account is active.
• If you delete your account, we immediately delete your profile, photos, likes, matches, chat messages and registered devices. Technical copies in the provider's systems are deleted within the provider's timeframes (normally within 180 days).
• If you unmatch or block someone, the chat and its messages are deleted for everyone in the match.
• Reports: up to 12 months, for community safety.
• If we close an account for serious violations, we may keep the minimum data needed to prevent a new sign-up for up to 2 years: only an encrypted fingerprint (hash) of the phone number or email, not the profile.
• Crash data (Crashlytics): 90 days.
• Purchase data: for as long as tax law requires (up to 10 years).
• Longer only if the law requires it or for an ongoing dispute.

How we protect your data

• Data travels encrypted between the app and the servers.
• Access rules on the database: everyone can only read and change what concerns them (for example, messages only by the people in the match).
• App Check: we check that requests to the database come from the genuine app.
• Location rounded on your phone and automatic checks against scams and sensitive data in chat.

No system is 100% secure: if a data breach affecting you occurs, we'll inform you as required by law.

Cookies and similar technologies

• The app doesn't use cookies, doesn't use your phone's advertising identifier and contains no advertising or tracking tools.
• On your phone we only store your preferences (language, visual style, filters, daily counters) and the Firebase technical identifiers described above.
• The Lovelark website uses no cookies and no analytics tools.

Your rights

You can request access to, correction, deletion, restriction and portability of your data, object to processing and withdraw consent at any time, without affecting what was done before.

• In the app: edit your profile, pause it, turn off Lovelark Open, delete your account (Profile → Delete account). Location and notifications can be turned off in your phone's settings.
• For anything else, write to nearlyappsupport@gmail.com. We reply within one month (extendable by two more months in complex cases, after telling you). Under Colombian law, we answer queries within 10 business days and complaints within 15 business days (extendable by 5 and 8 business days, explaining why).
• You have the right to lodge a complaint with the supervisory authority of your country (in Colombia the Superintendence of Industry and Commerce, SIC; in the UK the ICO).

Minors

The service is only for people aged 18 and over. If you think a user is a minor, report them from their profile with the reason "Appears to be underage": we close the account and delete their data.

Changes

We may update this policy. We'll tell you about important changes in the app before they take effect.