Privacy Policy

1. Who we are

Date to Marry is a marriage-first matchmaking platform owned and operated by Pila Studio UG (haftungsbeschränkt), a company with limited liability registered in Germany. For the purposes of the EU General Data Protection Regulation (GDPR) and equivalent laws, Pila Studio UG (haftungsbeschränkt) is the data controller for your personal data.

Contact: hello@datetomarry.app. Full company details are on our Impressum.

2. What we collect

2.1 What you give us

2.2 What we collect automatically

• Device information: device type, operating system, app version, timezone, and locale.
• Usage data: which features and screens you use, and when you were last active.
• Log data: IP address, timestamps, and error logs.
• Crash and performance reports: diagnostic data via Firebase Crashlytics and Firebase Performance Monitoring.
• Session recordings: recordings of how the app’s screens are used, sent to PostHog so we can find and fix problems. Passwords, messages, voice notes, your journal, identity verification, reports, references and every photograph are hidden in these recordings; see section 18.
• Push tokens: the device token used to deliver notifications.

2.3 What we get from others

• Didit: the result of your verification, the details read from your document (such as your name, date of birth, document type and number, issuing country and expiry date), and the scores of its authenticity, liveness and face-match checks. Didit keeps the document and selfie images, and the biometric data made from them, for us for six months after your verification and then destroys them; we do not store them ourselves. See section 10.1.
• OpenAI: for each new profile photograph, an assessment of what it shows: whether it is a photograph of a person, how clearly the face can be seen, and whether it looks generated, heavily edited, or unsuitable for a profile.
• Apple and Google sign-in: if you sign in with Apple or Google, your name and email address (or Apple’s private relay address) and an account identifier.
• Apple, Google, Stripe and RevenueCat: confirmation that a purchase is valid, its product, date, price and store country. We never receive your card details.

3. How we use your data

• Running your account: creating it, securing it, and authenticating you.
• Verifying identity and age: confirming through Didit that members are real adults.
• Checking profile photographs: before anyone else can see a new profile photograph, checking that it is a real photograph of a person and suitable for a profile. See section 9.
• Matching: applying your absolutes and preferences, scoring compatibility from your answers and profile, asking an AI model to read the two profiles of a possible pair side by side, and showing you one introduction at a time. See section 9.
• Showing your profile: when you are introduced to another member, your first name, age, city, photographs, introduction, the answers on your profile and the values you chose to share are shown to them, and theirs to you.
• Conversations: delivering messages and voice notes between matched members.
• Companion features: your journal and check-ins power your own coaching, and nothing else.
• Payments: taking payment and keeping transaction records.
• Safety: investigating reports, enforcing the Terms, preventing fraud, and protecting members.
• Legal compliance: meeting our obligations and responding to lawful requests.
• Improving the service: analysing usage events and session recordings under a pseudonymous identifier to find and fix problems, and analysing aggregated, de-identified data to make matching better.
• Running the business: internal notifications to our team about sign-ups, introductions, purchases and safety reports, so a person can act on them.
• Communicating: transactional email, and optional informational email if you opted in.

4. What we never do

• We never sell your personal data.
• We never show you advertising in the app. We do let Meta measure and improve our own ads on Facebook and Instagram, as described in section 7 and section 18; on iPhone, your account details are part of that only if you allow tracking.
• We never share your identifiable content with third parties for marketing.
• We never show your partner your journal entries or check-in answers.
• We never show anyone your exact location. See Location and distance.

5. Legal bases for processing

If you are in the EEA, the UK, or another jurisdiction with comparable law, we rely on the following (the article numbers are those of the GDPR):

Where we rely on consent you may withdraw it at any time, in the app or by writing to us. Withdrawal does not affect processing already carried out. Where we rely on legitimate interests, you may object at any time for reasons relating to your situation.

6. How we share your data

We do not sell, rent, or trade your personal data. We share it only:

• With the people you are introduced to: when we introduce you to someone, your profile is shown to them inside the app, as described in section 3.
• With processors: the providers in section 7, who may process your data only on our instructions and under contract.
• With Meta, for our advertising: so we can measure and improve our ads on Facebook and Instagram. Meta also uses this data for its own purposes as an independent controller, under its own policy. Exactly what is sent, and the choice you have on iPhone, are in section 7.
• For legal reasons: where required by law, court order, or regulation, or where we believe in good faith that disclosure is needed to protect someone’s safety or prevent illegal activity.
• For child safety: we are legally required to report confirmed child sexual abuse material to NCMEC and to national authorities, and will share what is necessary to do so.
• On a business transfer: in a merger, acquisition, or sale, with notice to you before your data becomes subject to a different policy.
• With your consent: for anything else.

7. Third-party processors

These providers process personal data on our behalf and on our instructions, under data processing agreements. Apple and Google also act for themselves when they sell you something through their stores or sign you in, under their own privacy policies.

From photo checks we keep only the results: what each check found in a photograph and the reasons for any decision. We never store your verification selfie, or a template of your face, ourselves.

8. International transfers

We and our processors operate internationally, so your data may be transferred to, stored in, and processed in countries outside your own, including the United States, whose data protection laws differ from yours.

Where we transfer data outside the EEA or the UK, we rely on an adequacy decision where one exists (for United States providers certified under it, the EU-US Data Privacy Framework and the UK Extension to it), and otherwise on Standard Contractual Clauses approved by the European Commission or the UK authorities, together with additional safeguards where they are needed. You may ask us for a copy of the safeguards that apply.

9. Automated decision-making

Matching is automated, and it is profiling. It works in this order:

• Hard rules first. Two people are only introduced if both pass the other’s absolutes and dealbreakers, fall within each other’s age range and meeting area, and are identity-verified.
• Then a score. For pairs that pass, we calculate compatibility from your life plans, your written answers and bio, a reading of the two profiles side by side by an AI model (OpenAI), your values answers where both of you have enough of them, and what each of you says you want. Pairs below a minimum quality are not introduced.
• Then the order. Members who have waited longest are considered first. Among good fits, people who have been active recently come first, and a trust score moves each person up or down a little. That score starts in the middle and changes with the reviews other members leave after a match and with safety reports we uphold.

These decisions determine who you are introduced to and how often. They do not change your legal rights, but because the search fee buys introductions, we treat them as significant anyway: you may ask a person to review any matching decision, contest it and put your point of view, by writing to hello@datetomarry.app.

Profile photographs are checked automatically. Before anyone else can see a new profile photograph, OpenAI checks what it shows: that it is a real photograph of a person, that the face can be seen, and that it does not look generated, heavily edited, or unsuitable for a profile. This check does not identify you and does not compare the photograph with your face or your selfie. A photograph that clearly fails is not added, and you are told why. A photograph the check is unsure about is held for a person on our team to decide, and nobody else sees it in the meantime; if nobody has approved it within three days, it is declined and you are told why. To decide, that person may look at the selfie from your identity check, while Didit still holds it, to see whether the photograph is of you; every such look is recorded. A photograph that fails after it was added is taken off your profile, and you are told in the app.

You can ask a person to look again at any decision about your photographs, from the app or by writing to hello@datetomarry.app. Photographs already on your profile before these checks began were not checked and have not been changed.

10. Sensitive data

Some of what we collect is “special category” data under the GDPR:

• Religious or philosophical belief: your faith answer, faith tradition, and values answers about faith.
• Political opinions: values answers about society and politics, if you choose to give them. They start private.
• Sex life: values answers about sexual ethics, if you choose to give them.
• Biometric data: the liveness check and the comparison of your selfie with your document photo during identity verification, carried out by Didit for us. It is used only to confirm that you are a real, present person and the person on the document, never sold, and kept by Didit for six months after your verification, then destroyed. Everything about your face data is in section 10.1.
• Health information: where you disclose it in a character prompt, a self-declared fact, or Companion data.

We process it only with your explicit consent, which you give by accepting our Terms and, for your answers, by giving them: section 5 of the Terms covers the biometric checks and section 14 your answers about faith, intimacy and politics. The app does not ask for these consents separately. We use this data only for identity verification, deciding on a profile photograph the automatic check was unsure about, compatibility matching, showing the answers you did not keep private to the people you are introduced to, and your own coaching features. It is never sold, never shared with advertisers, and never used to decide anything about you other than who you are introduced to and whether a profile photograph is accepted. You can withdraw consent at any time by deleting those answers in the app, by writing to us, or by deleting your account; the answers are then deleted and no longer used in matching.

10.1 Your face data

What we collect. Once, when you verify your identity, the app opens Didit’s verification screen, which uses your camera to capture a photograph of your government-issued ID (which shows your face) and a short live selfie. From these Didit checks that you are a real person present in front of the camera (liveness) and compares your face with the photo on the document (face match), which creates biometric data. The app does not use Face ID, the TrueDepth camera’s depth data, or any face mapping on your device, and keeps no copy of the images on your device.

How it is used. Only to confirm that you are an adult and the person on the document, and, if a new profile photograph is held for a person on our team because the automatic check was unsure about it, to let that person see whether the photograph is of you (section 9). It is never used for advertising, never used to identify you anywhere else, never used to train any model, and never sold.

Who receives it, and where it is stored. Didit captures, processes and stores the images and the biometric data made from them, on its own secure servers, as our processor under a data processing agreement, and on our instructions only. We never store your selfie, your document images or a template of your face on our servers. We receive and keep only the result: whether you passed, the details read from your document (section 2.3) and the scores of the checks. Nobody else receives your face data: it is not shared with the people you are introduced to, with OpenAI, with Meta, or with any other third party.

How long it is kept. Didit keeps the document and selfie images and the biometric data made from them for six months after your verification, then destroys them automatically.

Deletion. When you delete your account, we instruct Didit to erase every verification session you started, with the images, the selfie, the details read from your document and any biometric template made from them, within eight days; if Didit cannot be reached, we try again every day until it is done. The single exception is an account we closed for fraud or a false identity, whose verification is kept as evidence of the fraud for as long as that requires. You can also ask us to delete your face data at any time by writing to hello@datetomarry.app.

Security. The images travel only over encrypted connections, from the camera straight to Didit. Only a few people on our team can open a verification, through Didit’s console, which requires two-factor authentication, or through our own console, which records every time a selfie is viewed.

11. Location and distance

Distance matters to matching, so we need to know roughly where you are. We do this from the city you tell us: the app does not request device location permission, and we do not collect GPS coordinates from your device.

From that city we store approximate coordinates, and use them to calculate the distance between you and potential matches, and to honour the radius you set.

12. Companion privacy

Partner journal entries, relationship health check-in answers, and private reflections belong to you alone. We do not show them to your partner, and we do not share them with any third party, except where the law requires it.

Behavioural reviews left about you after a match are used for safety and trust scoring. They are never shown verbatim to the person they describe.

13. How long we keep things

14. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit using TLS, encryption at rest of our database and stored media by our hosting provider, access controls limiting who can see what, two-factor authentication on the console of our identity verification provider, private storage for every uploaded photograph, voice note and document with short-lived links for viewing, and reputable infrastructure providers.

No system is perfectly secure. If you believe your account has been compromised, write to hello@datetomarry.app immediately. Where a breach is likely to result in a high risk to your rights, we will notify you and the relevant supervisory authority as the law requires.

15. Children

Date to Marry is strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18, and every member must pass government-issued identity verification confirming their age before they can be matched.

If we learn that we hold data from a person under 18, we delete it and terminate the account. If you believe a minor has created an account, report it to hello@datetomarry.app immediately. See also our Safety Standards.

16. Your rights

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct anything inaccurate or incomplete.
• Delete your data, in the app or by writing to us, subject to our legal retention obligations.
• Restrict processing in certain circumstances.
• Port the data you gave us, in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent where processing relies on it.
• Ask for human review of an automated decision. See section 9.

To exercise any of these, write to hello@datetomarry.app. We respond within 30 days, and may need to verify your identity first. Data export and account deletion are also available inside the app; see Account deletion.

United States residents. Depending on your state, you may have rights to know what we collect, to access, correct and delete it, to limit the use of sensitive personal information, and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell personal information. Both apps send Meta the events described in section 7 so we can measure and improve our own advertising; some state laws treat that as “sharing” for targeted advertising, and you may opt out by writing to us, or on iPhone by asking the app not to track. We use sensitive information (such as your identity documents, religious beliefs, and views on sexual ethics or politics) only to provide the Service you asked for. To exercise any right, write to us as above; we will not treat you differently for doing so, and you may appeal a refusal by replying to our answer.

17. Notifications and email

We send push notifications for matches, messages, and reminders, delivered through Firebase Cloud Messaging. You can turn them off per type in the app, or entirely in your device settings.

We send transactional email (verification, password reset, match notifications), which is necessary to run your account and cannot be switched off while the account is open. Informational email is sent only if you opted in, and every one carries an unsubscribe link.

18. Analytics and cookies

In the app. The app does not use cookies. It sends product analytics events to PostHog, on its EU servers, under a pseudonymous identifier, so we can see which features are used and where people get stuck. It also records about half of all sessions longer than ten seconds, as a replay of the screens and taps, so we can see and fix what goes wrong. In those recordings every photograph is hidden, and so are passwords, messages and voice notes, your journal, identity verification, references, and reports. Recordings are kept for 30 days, IP addresses are anonymised, and nothing from them is shared with advertising networks.

Advertising measurement. Both apps tell Meta when they are installed and opened and when a member reaches a few steps, so we can tell whether our ads work and Meta can show them to people likely to be interested; see section 7 for exactly what is sent. On iPhone, the app asks first, using Apple’s own permission; if you choose “Ask App Not to Track”, it never reads your advertising identifier or sends your account details, and you can change your answer at any time in Settings, Privacy and Security, Tracking. On Android, you can reset or delete your advertising identifier in your phone’s settings.

You may object to analytics and recordings at any time by writing to hello@datetomarry.app. We will answer within 30 days and tell you what we can do for your account.

On this website. This website uses PostHog together with Vercel Analytics and Speed Insights. These measure page views and performance and do not build an advertising profile of you.

19. Changes to this policy

We may update this policy to reflect changes in what we do, the technology we use, or the law. We post the updated version here and in the app, and for material changes we notify you by email or in-app notice. The date at the top shows when it last changed.

20. Contact and complaints

For any question or request about this policy or your data, write to hello@datetomarry.app. We aim to respond within 30 days.

You have the right to complain to a data protection supervisory authority, in particular the one where you live or work. Our lead supervisory authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany (www.datenschutz-berlin.de).