Privacy Policy

1. Who is responsible for your data

The data controller is City Dev, registered with the Dutch Chamber of Commerce (KvK) under number 94677662, VAT number NL005101580B27, Ripperdapark 37D, 2011 KE Haarlem, the Netherlands.

For any privacy question or request, e-mail jk@techlead.fit. We answer within one month at the latest.

2. What data we collect

Data you give us:

• Account data: e-mail address and password (stored only as a secure hash), or — if you sign in with Google — your Google account identifier, e-mail address and name.
• Profile data: first name, date of birth (others see only your age), your sign (the gender description you choose, e.g. M, F, MM, FF, FM or your own words), your interest for tonight, photos, whether you are out tonight, and your search preferences (age range, distance, who you want to see).
• Location: the area you set or allow from your device. Other members only ever see an approximate distance — never your exact location or address.
• Messages: chats with other members, including photos you send, edits, and whether you shared your name in a chat.
• Events: events you host or join, requests, waitlists and, for hosts, the address and entry instructions you add.
• Safety: blocks, reports you make or that concern you, and moderation decisions.
• Payments: what you bought, the amount, currency and the country/region used for pricing, and your subscription status. Card and bank details are entered directly with our payment provider; we never see or store them.
• Your choices: language, notification and e-mail settings, consent records (for example for subscriptions and cookies).
• Messages to us: anything you send to support.

Data collected automatically:

• Device and usage data: IP address, device type, app version, browser, language, time zone, and when you were last active (used for the "active now" indicator).
• Push notification tokens, if you turn notifications on.
• Technical logs used to keep the Service secure and working.
• Partner links: if you arrive through a partner link, a click record with the partner code and a one-way hashed version of your IP address and browser details.

Sensitive data. Your sign, your search preferences and your messages may reveal your sexual orientation or details of your sex life, which the GDPR treats as special categories of data. You decide whether and what to share; we process this information only because you choose to provide and publish it on your profile, and only to run the Service for you. You can change or remove it at any time in your profile, or delete your account.

We do not use advertising trackers, sell personal data, or build advertising profiles.

3. Why we use your data and on what legal basis

• To provide the Service (contract): creating your account, showing your profile and approximate distance to other members, chats, events, notifications you asked for, and the features you buy.
• Sensitive profile information (explicit consent): information about your orientation or sex life that you choose to add to your profile. You can withdraw this consent by changing or deleting that information or your account.
• Payments and invoicing (contract and legal obligation): processing purchases and subscriptions, receipts, refunds, and keeping financial records as Dutch tax law requires.
• Safety and integrity (legitimate interest and legal obligation): preventing fake accounts, spam, fraud and abuse, handling reports, moderating content, enforcing our Terms, and responding to lawful requests from authorities.
• Improving the Service (legitimate interest): understanding which features work, fixing errors and keeping the Service secure, using our own aggregated statistics.
• Communication (contract and legitimate interest): service e-mails such as verification, password reset, receipts and important changes, and — unless you switch it off — a weekly summary and occasional offers. Every e-mail of the latter kind contains an unsubscribe option.
• Partner program (consent / legitimate interest): attributing sign-ups to the partner who referred you, so we can pay that partner. In the EU, the partner cookie is only set with your consent.

Some reports may automatically place an account under review (for example reports about minors or threats to safety). A person reviews these cases before any lasting decision is made. We do not take decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who can see your data

Other members see your public profile: first name only after you share it in a chat, age, sign, photos, interest for tonight, approximate distance, badges and whether you are active now or out tonight. Members you chat with see your messages. If you hide your profile with a subscription, other members do not see it in the feed while it is hidden.

We use carefully selected service providers (processors) who handle data only on our instructions and under a data processing agreement:

• Amazon Web Services (AWS), region Frankfurt, Germany — servers, database, file storage and e-mail delivery.
• Vercel — hosting of the website.
• Stripe — payment processing. Stripe also acts as an independent controller for its own legal obligations (for example fraud prevention and financial regulation).
• Google — sign-in with Google (only if you use it), Firebase Cloud Messaging for Android notifications, and Google Maps Platform for turning places into map positions. Google Play acts as an independent controller for purchases made through Google Play.
• Expo (650 Industries) — delivery of push notifications to the mobile app.
• Partners — a partner who referred you receives only aggregated statistics and, for networks, an anonymous click reference; never your profile or contact details.

We may disclose data when the law requires it, to protect members' safety, or to establish or defend legal claims. If our business is ever transferred, your data would transfer under the same protections and we would inform you.

5. International transfers

We store your data in the European Union. Some of our providers (such as Vercel, Stripe, Google and Expo) may process data outside the EU, mainly in the United States. Such transfers are protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses with additional safeguards.

6. How long we keep data

• Your account and profile: as long as your account exists.
• After you delete your account: your profile is removed from the Service immediately; the remaining account data is kept for up to 6 months to handle safety reports, fraud and legal claims, and is then deleted.
• Chats: deleted together with your account. Messages you sent remain visible to the other member until their account or yours is deleted, as in any messaging service.
• Payment and invoice records: 7 years, as required by Dutch tax law.
• Partner click records: 90 days.
• Security logs: a short period, normally no longer than 90 days, unless needed to investigate an incident.
• Reports and moderation decisions: as long as needed for safety, at most 2 years after the account was closed.

7. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw any consent you gave (this does not affect processing before the withdrawal). Most profile data can be changed directly in the app; you can delete your account under You → Delete account.

To exercise your rights, e-mail jk@techlead.fit. We may ask you to confirm your identity. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the authority in your country.

8. Cookies and similar technologies

The website uses only the cookies it needs to work: a secure session cookie that keeps you signed in, a cookie that remembers your language, and short-lived security cookies during sign-in with Google. The app stores your sign-in session securely on your device.

If you arrive through a partner link, a partner cookie remembers which partner referred you for up to 30 days. Visitors in the EU, EEA, the UK and Switzerland are asked for consent first; without consent the referral is kept only for the current visit.

We do not use advertising or third-party analytics cookies.

9. Security

We protect your data with encryption in transit (HTTPS/TLS) and at rest, hashed passwords, strict access controls, private chat photos that only the people in the chat can open, and regular updates. No system is perfectly secure; if a data breach affects you, we will inform you and the authorities as the law requires.

10. Age limit

The Service is only for people aged 18 and over. We do not knowingly collect data from minors; accounts that appear to belong to a minor are removed. Please report any such account.

11. Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows the latest version. For important changes we will notify you in the app or by e-mail before they take effect.

12. Contact

City Dev · Ripperdapark 37D, 2011 KE Haarlem, the Netherlands · KvK 94677662 · jk@techlead.fit