Privacy Policy for Gennety

Last Updated: 13 October 2026 · Version 4.4

This Privacy Policy explains how Gennety ("Gennety", "we", "us", or "our") collects, uses, shares, and protects your personal data when you use the Gennety matchmaking service through our Telegram bot (@gennetybot), our Telegram Mini Apps, our native mobile application, and our website at gennety.com (together, the "Service").

Gennety is an AI-first matchmaking service. By design we process more context about you than a traditional dating app — psychological context, biometric data used for identity verification, and preferences you state for a date. Some of what we process is special-category data under GDPR Article 9 (biometric data; and, if you state them, dietary requirements that can reveal religion or accessibility needs that can reveal health). We process those only with your explicit consent — see Section 6.

Please read this Policy carefully. Related documents: Terms of Service and Cookie Policy.

1. Quick Summary

This summary is for orientation only — it does not replace the full Policy below.

2. Data Controller

The data controller responsible for your personal data is:

• Gennety, a service operated by Gleb Gosha, an individual established in Kyiv, Ukraine. There is no separate legal entity; the operator is the data controller personally.
• Privacy contact: [email protected]

Article 27 GDPR representative: not yet appointed. Because we offer the Service in German and Polish and therefore target users in the EEA, a representative in the Union is required, and one will be appointed and named here. Until then, you can reach us directly at [email protected] and we will handle your request under the GDPR exactly as set out in Section 18.

Although Gennety is established in Ukraine, where we offer the Service to users located in the European Economic Area (EEA) or the United Kingdom, we apply the EU General Data Protection Regulation (GDPR) and the UK GDPR to that processing.

3. Scope

This Policy applies to all personal data we process about:

• users and prospective users of the Service, including during onboarding and before an account is fully created (for example, a phone number or email you submit to receive a verification code, even if you never finish sign-up);
• visitors to gennety.com.

It does not cover:

• third-party services you reach through our links or embeds — for example the Telegram app itself, the Apple App Store, the Spotify player embedded on our website, or an online shop a Date Wishlist item links to. Those services process data under their own privacy policies;
• what another user does with information you choose to share with them.

Note on the website. Since 19 July 2026, the website runs no part of onboarding. It does not verify emails, does not create accounts, and does not hand any pre-filled data to the bot or the app. Its sign-up buttons only send you to Telegram or the App Store, where onboarding happens natively. The only personal data the website itself records is your cookie-consent choice (Section 5.4 and the Cookie Policy).

4. The Data We Collect

We collect data in three ways: data you give us, data generated by your use of the Service, and data we derive or generate to power matchmaking.

4.1 Data you provide

4.2 Data generated automatically

4.3 Data we derive or generate

We do not create per-message embeddings of your conversations. We do not sell your data, and we do not use your data for third-party advertising or ad-profiling.

4.4 Permissions on your phone, and why we ask

Your phone asks your permission before our iPhone app (or a Telegram Mini App) can use any of the features below. We ask for each one only at the moment you use the feature that needs it, never all at once at launch. Saying no to one switches off only that feature, and you can change your mind at any time in iOS Settings → Gennety (or, in Telegram, in your device's settings for Telegram).

• Camera — to take profile photos or a profile video, and for the identity check: the liveness selfie that confirms you are a real person and that your photos are of you (Section 10). The identity check is required to be matched, so the camera is the one permission without which you cannot be matched; photos can also come from your library instead.
• Photo library — to choose profile photos or a video, or screenshots for your Date Wishlist. We receive only the items you pick; with the iOS photo picker the app does not see the rest of your library.
• Location while using the app — to find your dating city, to propose a meeting point and venue that are fair for both of you, for Date Radar and the Date Bump on the day of the date, and for frequently visited places (Section 11). We never ask for "Always" location and never collect your location in the background. Precise location is needed only for Date Radar, the Date Bump and frequently visited places; with approximate location the rest still works.
• Notifications — to tell you about a new match, your partner's answer, the time and venue of a date, and reminders; and for the Live Activity on your lock screen on the day of a date. Optional: without it, you see the same things when you open the app.
• Microphone (where offered) — only while you record a voice note for our AI concierge or your Date Wishlist, or a voice answer for your profile. We never listen in the background.
• Apple Health (optional) — only if you connect Tempo Sync: read access to your step count for the last 28 days, turned into two labels on your phone (Sections 5.5 and 6). We never write to Apple Health.
• Apple Music / Media Library (optional, where offered) — only if you import songs for your profile: the app reads your recently played songs on the device and sends us only the songs' identifiers.
• Clipboard — iOS asks before the app reads a promo code you copied from a Gennety promo link (Section 4.2).

We do not ask for access to your contacts, Bluetooth, local network, motion sensors (the Date Bump is a press-and-hold, not a shake), or calendar, and we do not ask for permission to track you (App Tracking Transparency), because we do not track you and have no advertising identifier to read.

5. Where the Data Comes From

5.1 From you

Most data comes directly from you — your answers, photos, messages, and choices.

5.2 From Telegram

If you use the Telegram bot or a Mini App, Telegram provides us with your Telegram user ID, first name, language code, and public @username (if any). If you use the one-tap phone sharing, Telegram provides your phone number as trusted contact data. Everything you send in the chat is also processed by Telegram under Telegram's own privacy policy, which we do not control.

5.3 From our providers

Our liveness provider (Amazon Rekognition Face Liveness) returns the verification selfie and the liveness result; our face-comparison provider (Amazon Rekognition) returns similarity scores and safety labels; our payment rails return payment confirmations and transaction identifiers.

5.4 From your browser (website only)

When you make a cookie choice on gennety.com, we store an append-only consent record: the action (accepted / rejected / partial / withdrawn), which categories you allowed, the version of the cookie policy in force, a random session identifier held in your browser's local storage, the page URL where you made the choice, your browser's user-agent string, and a salted hash of your IP address (we do not store the raw IP). This record exists to prove that a valid consent was given, as consent laws require. Details are in the Cookie Policy.

5.5 From Apple Health (iPhone app, optional)

If you connect Apple Health (Section 6), the iPhone app reads your step count for the last 28 days — including wheelchair pushes, if your iPhone records them — and turns it on the phone into the two life-rhythm labels described in Section 4.3. Only those labels are sent to us; the step counts never leave your device.

5.6 From public web pages (Date Wishlist)

When you look for a product for your Date Wishlist, our AI provider's web search returns public shop pages that match what you typed, and our server reads the public product details (title, image, price) that a shop page publishes about itself — from the pages the search found or the links you pasted. This is information about products, not about you; it becomes part of your wishlist only when you choose an item.

6. Special-Category Data (GDPR Article 9)

Some of what the Service processes falls into the "special categories" that receive extra protection. We rely on your explicit consent (Art. 9(2)(a)) for each of them, we ask for that consent at the moment the data is collected, and you can withdraw it at any time (Section 18).

Dietary and accessibility requirements are used only to filter and rank date venues. They are never used to rank you, to score you, or to decide who you are matched with, and they are never shown to your match as a category — your match sees only the venue we chose.

Life rhythm is different, and we say so plainly. If you connect Apple Health, your two rhythm labels are used (a) to plan the date — for example preferring a venue close to the metro, or suggesting a park or café nearby for afterwards — and (b) as one small factor in matching: when both people have a rhythm, a similar rhythm raises the pair's score slightly and a very different one lowers it slightly, by at most a few percent. It never excludes anyone, it does nothing when either person has not connected Apple Health, and it is far weaker than the other factors (Section 8). Your match never sees your labels or learns that rhythm played any part. The labels are never sent to our AI provider, never used in any text written about you, and never shown to our staff one person at a time — only as statistics over many pairs. Disconnect in the app (Settings → Your tempo → Disconnect) erases them from our servers immediately; revoke Health access in iOS Settings → Health → Data Access & Devices → Gennety.

Racial and ethnic origin: not collected. Until 1 August 2026 onboarding asked an optional "nationality or ethnic background" question, and the answer formed part of the text we turned into your matching profile. That was a special category under Article 9 feeding an automated matching decision, and it was removed: the question is gone, the stored values were erased, and nothing in the product asks for or infers your ethnicity. The visual preference feature (Section 8) deliberately uses only hair, build, style and tattoos — never skin tone or any proxy for ethnicity.

Sexual orientation. Your gender and the gender you want to be matched with are, together, capable of revealing sexual orientation. We collect them because matchmaking is impossible without them, we use them only to match you, and we never share them outside the match itself.

Withdrawing consent for biometric verification does not undo processing that was already lawful, but it stops further processing, removes you from matching, and lets you request erasure of the biometric material we still hold.

7. How We Use Your Data and Our Legal Bases

"Legal basis" refers to GDPR Article 6 (and Article 9 for special-category data).

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; you can object at any time (Section 18) and we will stop unless we have compelling legitimate grounds.

You can withdraw any consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

8. Automated Decision-Making and Profiling

Matchmaking is automated. We use algorithms and AI to:

• build a psychological profile and an embedding of you;
• extract structured "vibe" axes from your free-text answers;
• estimate an attractiveness / "league" rating from your photos, which strongly influences who you are considered compatible with;
• where the feature is active, derive coarse appearance tags from your photos (hair colour and length, build, style, tattoos — never skin tone, ethnicity, or any proxy for either) and score them against another user's stated visual preference;
• decide which person (if any) you are matched with in each weekly round, and in what priority order — taking into account, like other post-date feedback, your morning-after answers about earlier dates;
• personalise the Date Wishlist catalog and suggestions from your profile, your follow-up answers, the places of your past dates and the places you saved (and the places you visit often, only if that setting is on);
• bucket each of your photos as pass / borderline / fail / no-face during identity verification, which routes your account to verified, manual review, or rejected;
• triage a report about you into a severity tier, which can produce a warning, a suspension, or an investigation;
• where you have connected Apple Health, compare your two life-rhythm labels with another person's as a minor factor in the match score, and use the calmer of the two to lean the venue choice (Section 6);
• select the venue for your date.

These automated steps can affect whether and with whom you are matched, and whether your account stays open. We consider that no automated decision here produces a legal or similarly significant effect that you cannot question, and we build in the following safeguards:

• Human intervention on request. You may ask us to review any verification outcome, moderation decision, or account restriction, express your point of view, and contest the result. Write to [email protected].
• Fail-safe routing. If our own infrastructure or a provider fails during verification, you are routed to manual review — never auto-rejected.
• Rehabilitation. Verification re-runs automatically whenever you change your photos, so a bad outcome is not permanent.
• Safety decisions are reviewable. Suspensions for repeated breaches expire automatically; investigations are reviewed by a person.

9. AI Processing

To generate your psychological summary and matchmaking signals, we send relevant profile text to our AI provider for analysis, embedding, transcription, moderation, and visual scoring.

• Your psychological summary is built from your ordinary onboarding answers — your hobbies, what you want in a partner, and your free-text "vibe" answers.
• The summary and its embedding are treated as your personal data, are used only to build your profile and your matches, and are never shown to another user.
• We use AI providers on terms that do not permit them to train their public models on our API data.
• AI outputs can be wrong. Nothing our AI produces is advice; see the Terms of Service.

Date Wishlist. If you build a wishlist with our AI agent, that conversation is processed like any other chat with our concierge. To find a real product:

• the text you type to look for it is sent to OpenAI's web search, which looks for matching products on public shop websites. We do not send your name, photos or profile with it — at most your city and language, so it can find shops near you;
• our server then opens the shop pages the search found, or the links you pasted, and reads only the product details the page publishes (title, image, price). The shop receives a request from our server, not from your device, and learns nothing about you;
• instead of typing you can record a voice note or add screenshots from your photo library (up to six at a time — people often keep screenshots of things they would love). The voice note is transcribed by OpenAI and our AI picks out the ideas in it; the screenshots are read by OpenAI's image model, which names the products on them. Neither the recording, its transcript nor the screenshots are kept — only the items you then choose. A screenshot can show more than the product (a notification, someone's name): our AI is told to ignore anything personal and nothing of it is stored, but cropping it first is still the better habit;
• the image of the item you choose is copied to our private storage, so viewing a wishlist — yours, or yours as your match sees it — does not load anything from the shop's website (only following a shop link does). The price is kept only as a range (from € to €€€€), never as an exact figure.

Retired: the personal AI export. Earlier versions of the Service invited you to paste in a psychological analysis produced by your own AI assistant (the "Magic Prompt"). That feature is no longer offered and we no longer accept such an export. If you provided one while it was available, the raw text was never retained — only the redacted signal summary and its embedding, which are erased with your account like everything else.

10. Photos, Video, and Biometric Data

Identity verification and face-matching involve biometric data — a special category under GDPR Article 9. We process it only with your explicit consent, which we ask for on a dedicated screen before the check starts. That screen tells you what is captured, who processes it (Amazon Web Services, in the EU), how long it is kept, and what happens if you say no.

• Verification is mandatory to be matched. You cannot be shown to other users, or see them, without passing it. (A small legacy group of users who skipped verification before it became mandatory, and accepted a rating penalty, remain matchable under the terms they agreed to.)
• Liveness selfie. Your device streams a short liveness video directly to Amazon Rekognition Face Liveness — it does not pass through our servers. AWS returns a single still frame, which we store privately as your verification reference and compare against your profile photos. The AWS session and everything in it expires three minutes after it is created.
• Face-match scores. A similarity score is stored per profile photo to decide the verification outcome. Photos where no face is detected (group shots, scenery) do not count against you.
• Selfie retention. Your verification selfie is automatically deleted 90 days after verification (Article 9 data minimisation). You remain verified; only the reference image is erased. If you verify again later, a new selfie is captured.
• Re-verification on photo changes. Every time you add, replace, or delete a profile photo, the verification pipeline re-runs against your current photos.
• Photo safety, face presence, and duplicates. Uploaded photos are checked for prohibited content, for the presence of a usable face, and for duplicates (using a perceptual hash). Rejections are logged as a minimal audit record (reason, media type, time) — the rejected media and any biometric material from it are not retained.
• Profile video. An optional profile video is scanned for safety only: a small number of frames and the audio are analysed transiently for prohibited content. The extracted frames, the audio, and the transcript are not retained — only a validation timestamp and version. The video itself is display-only and carries no identity check.
• Partner photo protection. When you are matched, your photos are shown to your match in a forward/save-protected form, and a shareable date card blurs the partner's face before it can leave the platform. If the blur cannot be produced, we refuse to send the shareable copy rather than send a clear one. (Note: operating-system screenshots cannot be technically blocked in a normal chat — this is a platform limit, not a choice.)

11. Location Data

Location is the most sensitive thing a dating service can hold after your face, so we use it only for the purposes below, only while you are using the app, and we store as little of it as each purpose needs. We never collect your location in the background, the iPhone app never asks for "Always" access, and we never show your position to another user.

• Your dating city. The city you select determines your match pool. You can search for it or let us find it from your device location — in that case the position is used once, to work out which of our cities you are in, and we store the centre of that city, not your position.
• Date logistics. For a confirmed date, the departure point you mark (a pin, a shared Telegram location, or a place you searched for) is used to compute a fair meeting area and to find a venue that is convenient for both of you. It is kept with the date record. Your match is never shown your departure point — only the agreed venue. To search for a place, what you type is sent to Google, together with our city's centre (or, outside our cities, the centre of the map you are looking at); to choose the venue, only the pair's meeting-area point is sent to Google, and to check the weather only that point and the date are sent to Open-Meteo — never who you are.
• Date Radar (the day of the date). In the 45 minutes before the date, while you have the app open, your phone sends its position so we can tell your date "on the way", "arriving around 19:05" or "here". Your date sees only that status — never your position or your route. The position is held in memory for the moment and is never written to our database or logs.
• The Date Bump (at the venue). When you and your date put your phones together, we check that each phone is within about 100 m of the venue, so the bump cannot be faked from elsewhere. The position is checked and not stored; we keep only that the bump happened and when.
• Frequently visited places (iPhone app; on unless you switch it off). While the app is open — once when it opens and then every ten minutes — it compares your position with the circles around the public cafés, restaurants, lounges and museums in our venue catalog, and sends it to us only when you are near one of them (otherwise it sends only "away", with no position). A single check is never a visit: you must be at the same place for at least 15 minutes. We then store the place and the calendar day only; the coordinates are discarded at once, and no time of day or duration is kept anywhere. Parks are deliberately excluded, because a park crossed every day can reveal where someone lives. Visits are deleted after 180 days. Up to three places you keep returning to are shown on your profile and to your match, with the venue's name, category, photo and its public map location — never how often or when you were there (Section 12.1). They are never sent to our AI provider and never used to score or rank you; besides your profile, they are used only to suggest places for your own Date Wishlist. How to control it: switch it off in the app, where your frequently visited places are shown — collection stops immediately and the block disappears for you and your match; or hide any single place, which stops it being shown. Switching off does not delete the visits already recorded — they expire after 180 days, or you can ask us to erase them now (Section 18), and they are erased with your account. Denying location access in iOS also stops it.
• Map colouring ("explored areas") — retired. This optional feature, off unless you switched it on, recorded approximate grid squares (about 1.2 km across) while its screen was open. It was withdrawn on 2 October 2026; nothing has been collected for it since, and anything recorded earlier is no longer used and is erased with your account. The date map in the app is now drawn only from the venues of dates you attended.

Map tiles shown in our Mini Apps and app are proxied through our own servers, so the map provider does not receive your IP address. Opening a ride or directions hand-off (Uber, Apple Maps, Google Maps) from a date screen passes only the venue's address to that app; your own location is never put into the link.

Date Wishlist suggestions collect no location. They draw only on what we already hold: the places of your past Gennety dates, the places you saved, and — only while your "frequently visited places" setting is on — the places you keep coming back to. A place on your wishlist is a public venue you chose, not your position. If you share your wishlist, though, a match can see which places you love, so add only the ones you are happy for a date to know.

12. Who We Share Data With

We do not sell your personal data. We share it in the following situations only.

12.1 With your match

When a match is created, the other person sees: your first name, age, photos (and profile video, if you added one), a verification indicator, and AI-generated text about you (a pitch, icebreakers, a hint). Where you have them, they also see the songs on your profile, can listen to your recorded voice answer (through a short-lived private link — its transcript is never shown), and see up to three of your frequently visited places — each venue's name, category, photo and public map location, but never how often, on which days or at what time you were there (Section 11). They do not see your contact details, your email or phone, your exact location or departure point, your psychological summary, your ratings or scores, or your safety history. Telegram contact details are exchanged only if you both explicitly choose to, through the pre-date coordination flow (Section 13).

Your match never receives your life-rhythm labels, or any statement that rhythm influenced the match, the venue or an after-date suggestion. An after-date suggestion, when there is one, is shown to both of you with the same neutral wording.

The Morning After. Your answer is never shown to the other person on its own. If either of you says "Didn't click", neither of you is told what the other answered — the "it's mutual" message simply does not come. Only when you both say "It was great" are you both told that the interest is mutual.

Your Date Wishlist — only after mutual interest, and only while you let it. If you have made a Date Wishlist, a person with whom the interest is mutual can see it as a cheat sheet for a second date. That is what the wishlist is for, and it says so at the top while you build it:

• about a tenth of it for free (for example one place or one drink; nothing, if your list has only one or two items), and the rest once they buy a one-off unlock or have Gennety Premium. The money is paid to us; you are not paid and you pay nothing;
• for each item they see its category, title, brand, your note, the product image, the price range, and the shop link where there is one;
• nobody else ever sees it — not a match before you have both said "It was great", and not any other user;
• it always shows your list as it is now: what you edit or delete changes or disappears for them too, and what you add later appears. Once they have opened it, they can come back to it later;
• if you have not added or removed anything for 45 days or more, they also see when you last did (for example "last updated 52 days ago"), so they know some of it may be out of date — before they decide to open the rest;
• "Don't show my list" (in My wishlist, in your profile) hides the whole list — and the taste hint below — from every match at once, until you show it again; blocking or reporting the person hides it from them; deleting your account deletes it.

A taste hint. Together with that offer, a person with whom the interest is mutual may see one of your answers to our follow-up questions as a hint — today only your favourite flowers (for example, "Her favourite flowers: peonies"). It is shown only after mutual interest, only if you answered that question, only if you have accepted this version of the Policy or have made a Date Wishlist, and never while your list is hidden.

12.2 Internal operations feed

Because Gennety is an early-stage service operated by a very small team, our founder receives an internal notification feed through a separate, private Telegram bot. It carries:

• On a new activated profile: a profile card (first name, age, gender, preference, city, height, hobbies, partner preferences, language, sign-up track, verification status, attractiveness score, Telegram @username if any) and your profile photos. It deliberately excludes your psychological summary.
• After each weekly matching round: a link to a private, unlisted, search-engine-excluded report page showing that week's pairs with the same kind of profile cards and photos. Access to that page is controlled by an unguessable token in the URL, and the link stops working after 90 days.
• When a date is confirmed: the two date cards and the venue.
• When an account is frozen or deleted: the profile card described above, your phone number, and your profile photos, so the operator can see who left and, where appropriate, follow up personally. It still excludes your psychological summary. This goes to the same single, private, founder-only Telegram bot as every other item on this list — it is not published, not shared onward, and not held anywhere beyond that one operator's own chat with their own bot.

Please read this part carefully, because it is the one place where deleting your account does not erase everything. When you delete your account we erase your data from every Gennety-operated system — the database, our file storage, and any stored weekly-report snapshot containing you. The operational notification above is the exception: it is sent at the moment of deletion and remains in the operator's private chat afterwards.

We disclose this plainly rather than bury it, because it is a real limit on your right to erasure. Two things follow from that:

• You can ask for it to be removed too. Write to [email protected] and the corresponding messages will be deleted from that chat. We treat that as part of an erasure request, not as a separate favour.
• It is a deliberate, time-limited choice. Gennety is at an early stage and run by one person, for whom understanding exactly who leaves is currently the main way the service improves. We have recorded this internally as an accepted risk with a named tradeoff, and we review it as the service grows — it is not intended to be permanent.

12.3 Staff and administrative access

The operator of the Service can access an internal administration interface that includes user profiles, conversation transcripts, photos, and verification state, for support, moderation, and investigating abuse. It runs on a separate, key-protected, rate-limited interface, and images are streamed through an authenticated proxy rather than published.

Being straightforward about the scale: Gennety is run by one person, and that interface is protected by a single shared key rather than per-person accounts, so it does not currently produce a per-person audit trail of who viewed what. We treat that as a limitation to fix as the team grows, not as a feature.

12.4 Processors (sub-processors)

We share personal data with the following service providers strictly to operate the Service. Each acts as our processor under a data-processing agreement and may process data outside Ukraine or your country (see Section 15).

We update this list as our providers change. A current list is available on request at [email protected].

Online shops are not on this list, because we send them nothing about you. When we read a product page for a Date Wishlist, our server asks the shop's website for that public page, the way any visitor's browser would; the shop receives our server's address, not yours, and no information about who the wishlist belongs to.

12.5 Legal and safety disclosures

We may disclose personal data where we believe in good faith that it is necessary to comply with a law, regulation, legal process, or enforceable governmental request; to enforce our Terms; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Gennety, our users, or the public — including reporting unlawful conduct to the authorities.

12.6 Business transfers

If Gennety is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction. We will notify you and, where required, give you a choice before your data becomes subject to a different privacy policy.

13. Communications and the No-Chat Model

Gennety does not provide open user-to-user chat. Your conversations are with our bot and AI concierge, plus the structured pitch, decision, scheduling, venue, safety, and report flows.

There are two narrow, optional exceptions, both after you are matched and scheduled:

• Contact exchange. Shortly before the date, you may choose to share your own Telegram handle with your match, or to ask for theirs. Sharing your own needs only your tap; receiving theirs needs their explicit approval.
• Anonymous pre-date relay chat. A time-boxed relay that passes text between you and your match so you can find each other. When it is used: it opens shortly before the date and closes automatically after it; it is text-only (media is rejected, which also prevents metadata leaks); every relayed message is logged to provide a moderation and safety trail and to support the in-line report control; and those logs are deleted when the related match is deleted.

14. Payments and Subscriptions

Paid features are optional. When you buy something:

• Payment is processed by the platform's own rail — Telegram Stars inside Telegram, or Apple's In-App Purchase in the iOS app. We never receive or store your card number or payment credentials. Telegram or Apple handles those under their own terms and privacy policies.
• We retain a record of the transaction — amount, currency, status, time, the provider's transaction identifier, and what it relates to (a match, a bundle, a venue change, a Prime Time Pass, a Date Wishlist unlock, or a Premium period).
• For App Store purchases, the app attaches a random-looking identifier derived from your Gennety account (Apple calls it an appAccountToken), so that a purchase is credited to the right account and cannot be claimed by another one. We then confirm each purchase directly with Apple's servers rather than trusting the phone. We never receive your Apple ID, name, or payment details from Apple.
• For a Prime Time Pass — a one-off purchase that opens the late-evening times in the calendar for one date — the record notes which date it belongs to, so it can be returned if the date does not happen. This append-only ledger is what makes a purchase count exactly once, makes a refund possible, and meets our accounting obligations.
• For a Date Wishlist unlock — a one-off purchase, per match, that opens the rest of a mutual match's cheat sheet — the record also notes which match it belongs to and whose list it opened, so the sheet stays open for the buyer and a refund can be traced. It holds no wishlist content. If your list is the one unlocked, that record is therefore partly about you, and it is kept as part of the buyer's payment records (Section 16).
• For Gennety Premium (the monthly subscription, or a three- or six-month package), we additionally store when your entitlement started and ends, whether auto-renewal is on, which rail it came from, and the recurring transaction identifier we use to recognise renewals.
• If you cancel in chat and choose to tell us why, that free-text reason is stored against the cancellation record and used to understand churn.
• Refunds and their conditions are described in the Terms of Service.

15. International Data Transfers

Some processors are located outside Ukraine, the EEA, or the UK (for example, in the United States). Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, as applicable. You can request a copy of the relevant safeguards at [email protected].

16. Data Retention

We keep personal data only as long as necessary for the purposes above.

On account deletion we erase the storage objects we hold for you (verification selfies, profile photos and videos, chat attachments, voice recordings, Date Wishlist images — everything stored under your account, not only what your profile currently shows), remove any internal report snapshot containing your account, and then delete your account and the data tied to it across our database. Three kinds of record remain afterwards: payment and subscription ledger entries, detached from your profile; keyed hashes of your identifiers, used only to recognise you if you register again; and — only if your account had them — the safety records described in the retention table above. If a refund connected to your account is still being processed, deletion waits until it has gone through, so the money has somewhere to go; you can retry then. If storage erasure is temporarily unavailable, the deletion does not report success and you can retry — we never leave a half-deleted account. Some records may be retained where required by law (for example, financial records), where a processor keeps them under its own disclosed legal duties, or in anonymised form that can no longer identify you.

One further exception is disclosed in Section 12.2: the internal operational notification sent at the moment of deletion remains in the operator's private chat. You can ask for that to be removed as part of your erasure request.

17. Data Security

We apply technical and organisational measures appropriate to the sensitivity of the data, including:

• encrypted transport (TLS) everywhere;
• private storage buckets with short-lived signed access — media is never publicly addressable;
• cryptographic verification of requests from Telegram Mini Apps and signed tokens for the mobile API, with refresh-token rotation and revocation. Our liveness result is read server-to-server from AWS rather than accepted from the client, so a device cannot claim to have passed a check it did not;
• hashing of one-time codes and refresh tokens; salting and hashing of IP addresses in consent records; masking of any verification code you type before it is written to the chat timeline;
• separate, key-protected, rate-limited administrative interfaces;
• minimisation of biometric retention (90-day selfie deletion) and non-retention of transient media used for safety checks;
• rate limiting and abuse controls on messaging and code-delivery endpoints.

No system is perfectly secure. If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where the law requires, you.

18. Your Rights

Subject to applicable law (and in full where GDPR/UK GDPR applies), you have the right to:

• Access the personal data we hold about you and receive a copy;
• Rectify inaccurate or incomplete data (note: some identity fields such as first name, age, and your verified contact rail are fixed after onboarding — contact us to correct them);
• Erase your data ("right to be forgotten");
• Restrict processing, or object to it — including any processing based on legitimate interests, and including profiling;
• Data portability — receive the data you provided in a structured, commonly used, machine-readable format;
• Withdraw consent at any time — including biometric verification, the optional visual type step, dietary/accessibility requirements and the research opt-in — without affecting processing already carried out;
• Not be subject to solely automated decisions that significantly affect you: you may request human intervention, express your view, and contest a decision (Section 8);
• Lodge a complaint with a supervisory authority (Section 22).

How to exercise them. Write to [email protected]. We respond within the time the law requires (generally one month under GDPR, extendable by two months for complex requests, in which case we will tell you). We may need to verify that the request comes from you.

Self-service. You can also:

• Pause matching at any time, from the menu or the app;
• Freeze your account (soft-delete) — you are removed from matching and your status is hidden, but your profile, photos, verification, and embedding are kept so you can return instantly. Any in-flight match is cancelled and your counterpart is told neutrally. You are silently reactivated the next time you open the bot or the app;
• Delete your account — permanent and irreversible erasure as described in Section 16, including your photos, your verification selfie and everything stored under your account. You do it yourself, without writing to anyone: in the iPhone app, in Settings → Delete account; in Telegram, in ⚙️ Settings → 🗑 Delete Account. You confirm once and the erasure runs at once. Two things to know: removing the app from your phone does not delete your account, and a Premium subscription bought through the App Store is not cancelled by deleting your account — Apple bills it, not us, so cancel it in iOS Settings → your name → Subscriptions. A Premium subscription paid in Telegram Stars is cancelled for you when you delete your account; if a renewal is still charged after that, we refund it in Stars. If a refund connected to your account is still being processed, the app tells you so and asks you to retry once it has gone through;
• Switch off frequently visited places, or hide any single place, in the app (Section 11);
• Withhold or withdraw any device permission in iOS Settings → Gennety (Section 4.4);
• Edit or delete your Date Wishlist — item by item — and hide it ("Don't show my list"), at any time, from My wishlist in your profile. Deleted items disappear from your match's cheat sheet too, and hiding the list hides it — and the taste hint — from every match at once.

Withdrawing biometric consent. There is no self-service button for this yet: write to [email protected] and we will erase the verification selfie and the face-match scores we hold. Because verification is what admits you to matching, withdrawing it removes you from the matching pool — you can keep the account and re-verify later, or delete it outright.

19. Children's Privacy

The Service is intended only for users who are at least 18 years old. We do not knowingly collect data from anyone under 18. If we learn that we have collected data from someone under 18, we will delete it and close the account. If you believe a minor is using the Service, contact [email protected].

20. Cookies and Similar Technologies

Our website uses cookies and local storage; our Mini Apps and mobile app use local storage only for things they need to work (such as your language, theme, and an unsent form draft). Inside the bot we operate a no-third-party-tracking model.

Full details — the categories, what each one enables, the optional Spotify embed, the consent record we keep, and how to change or withdraw your choice — are in the separate Cookie Policy.

21. Changes to This Policy

We may update this Policy as the Service evolves. When we make material changes we will update the "Last Updated" date and the version number and, where appropriate, notify you in the app or the bot. Where a change requires new consent under the law, we will ask for it rather than rely on continued use. Continued use after a non-material update means you accept the revised Policy.

Previous versions are available on request at [email protected].

22. Complaints and Contact

For any privacy question, request, or complaint, contact us at [email protected]. We would appreciate the chance to address your concern first.

If you are in the EEA or the UK and believe we have not handled your data lawfully, you may lodge a complaint with your local data-protection supervisory authority. If you are in Ukraine, you may contact the Ukrainian Parliament Commissioner for Human Rights (Ombudsman).