Skip to content

Privacy Policy

Last updated: 2026-10-16

The NearbyLove mobile application (the "App") is operated by Nir Nagar, trading as Hearth Software, an independent developer based in Israel. Nobody else runs the App on our behalf, so "we", "us" and "our" in this policy mean Nir Nagar, who is responsible for the information described here. Section 11 says how to reach us, and the contact form on this website is the route that reaches us. This policy explains what the App collects, what it is used for, who it is shared with, how long it is kept, and what you can ask us to do with it. Where something has a limit, this policy says so rather than leaving you to find out.

1. Information We Collect

1.1 Information You Provide

  • Account Information: Accounts are created with Google sign-in only. There is no email and password route, no other sign-in provider, and we never see or handle a password of yours. When you sign in, Google returns your name, email address and profile picture to the App; what our servers keep from that is your email address and the account identifier Google issues. Signing in only through Google is part of how we keep minors off the platform: there is no anonymous way in, and every account is tied to a Google account rather than to a throwaway address. It is not proof that you are an adult and we do not treat it as one. The age declaration below, and the reporting route in section 8, are the rest of that answer.
  • Profile Information: Nickname, date of birth, gender, bio, and any of the optional details you choose to fill in: body type, height, hair colour, eye colour, smoking, drinking, exercise, diet, pets, children and whether you want more, relationship status, education, occupation, religiosity, the languages you speak, and what you are looking for. Everything after nickname, date of birth and gender is optional, can be left blank, and can be cleared later.
  • Photos: Profile photos you upload (up to 6 photos).
  • Voice Recordings: Optional voice introductions you record (up to 20 seconds each).
  • Messages: Text messages, voice messages, and photos shared through the messaging features.
  • Preferences: Your matching preferences including preferred age range, gender, and maximum distance.
  • Age declarations: When you enter your date of birth we work out your age from it. If that age comes out under 18 the entry is refused, and we record the age it came to, together with the fact that it happened and when. We do not store the date you typed. We keep this because an age limit that forgets a refused attempt is not a limit, it is a hint about which number to type instead. Because we keep it, somebody who has declared themselves under 18 cannot then edit their way past it, and a second such declaration suspends the account so a person can look at it rather than simply asking again. Section 7 explains how to appeal if that happens to you by mistake.
  • Safe Date details: If you start a Safe Date session you tell us which of your contacts is the guardian, and you may add your own phone number, an emergency number, where and when you are meeting, and the name of the person you are meeting. If your guardian is not on the App you can invite them with a link, and if you choose to type their email address we store that too. Section 3 says exactly what the guardian is shown.
  • Requests to join: While sign up is by invitation, a person without a code can ask to join from the app. The request holds the name and email address of the Google account used, the app language, the country worked out from the connection's IP address, and an optional note you write. Only the NearbyLove team reads it, to decide the request, and if it is approved we send one email to that address.
  • Country of residence and messages: when you create an account you choose the country you live in and whether you agree to receive marketing messages. We keep your answer, and every later change you make in Settings, with its date and the version of the wording you were shown, because the law requires us to be able to show that you agreed.

1.2 Information Collected Automatically

  • Location Data: With your permission we collect your device's GPS coordinates so that Radar Discovery, Spark Mode and Safe Date can work. Important: for radar and discovery your phone snaps the reading to the centre of a fixed privacy grid before anything is sent, so your exact coordinates never reach our servers at all. The grid is 250 metres by default, or 100 metres if you choose to be found more precisely. This is not a random displacement: the same place always maps to the same point, so repeated readings cannot be averaged together to narrow it down. Two features are exceptions, and they are not the same as each other. Spark sends your actual coordinates so a short distance can be worked out in real time; they are not stored and no other user is shown them (section 4). Safe Date sends your true position to another person, the guardian you chose, while the Safe Date runs. Our server deletes it 7 days after the Safe Date ends, or 30 days after it if an emergency was raised (section 3).
  • Device and Connection Information: Device type, operating system version, device identifiers, and the push notification token your phone is issued. When you sign in, and each time your session is renewed, we also record the IP address the request came from and the device description your phone sends with it. Those two are stored on the sign-in record so that a session can be listed and revoked, and so that abuse can be traced back to a session rather than guessed at.
  • Usage Data: App interaction data, feature usage, and session information.
  • Server logs and request counting: Our web server keeps ordinary access logs: the IP address a request came from, the time, which endpoint was called, the response code, and the identifier your app or browser sends. They are rotated and overwritten on the server's normal schedule. We also count recent requests against your IP address or your account so a flood of attempts can be refused; that counter expires with its own short window and is then cleared away.
  • Country, for Voice Dating: When you record a Voice Dating intro, and when you browse intros, we work out which country the request came from using its IP address, so that you hear people in the country you are in. Only the two-letter country code is stored with your intro; the IP address is not kept for this purpose. If you use a VPN, we see the VPN's country. IP geolocation by DB-IP.

1.3 Photo Screening Before Publication

Every photo you upload, to your profile or into a chat, is written to a private quarantine area that our web server does not serve to anybody, and is screened before it can be seen. Two checks run on it, and they answer different questions.

  • An explicitness check on our own server: a classifier scores the picture for explicit content. It runs on the same machine that received the upload, and the image is not sent anywhere for this check. It detects nudity. It does not estimate anybody's age and it does not recognise abuse material, and we do not claim otherwise.
  • A fingerprint check against a known list: we compute a PDQ perceptual hash of the picture, 32 bytes from which the picture cannot be reconstructed, and send only that fingerprint to Project Arachnid Shield, a service operated by the Canadian Centre for Child Protection, to be compared against their catalogue of known child sexual abuse material. Your photo itself is never uploaded to them. Their interface can also accept a whole image, and we deliberately do not use that path.
  • What we keep: the scores, the fingerprint, the raw detections and the outcome are recorded against the upload, so that a decision can be explained to you afterwards and so that the thresholds can be checked against real photos rather than guesswork.
  • If a check cannot run, the photo is held: when the scanner is down, slow, or answers something we do not understand, the photo is held back and a person looks at it rather than it being published. Held is the safe error here, and it is the deliberate opposite of what we do when a rate limit check fails.
  • What happens to a held or refused photo: it stays in the quarantine area. It is not published, not added to your profile, and not visible to other users. A held photo is looked at by a person, who releases it or deletes it; a held or refused photo is deleted 30 days after that decision. A photo that matches known child sexual abuse material is handled differently: the account is closed, the match is reported to the police or the national body that receives such reports, and for that report we also record the internet address and the device the upload came from, and in a chat who it was meant for. These are kept only for the period required or requested by the authority or by law, a year after the report unless it says otherwise, and a minimal record of the match is deleted two years after the report. A match on harmful-abusive material, which may not meet a criminal-law threshold, suspends the account while a person reviews the case.

What this cannot do. Fingerprint matching finds re-uploads of material somebody has already catalogued. Newly made or newly generated imagery matches nothing and comes back clean, and published research shows that an attacker who knows the algorithm can alter an image until it stops matching. The explicitness check knows nothing about anybody's age. Screening catches the careless. It is worth having and it is not a guarantee.

1.4 The Question We Ask After a Safe Date

When a Safe Date ends we may ask you one question about how it felt. There are three answers: I felt fine, I felt uneasy, or I felt unsafe. Your answer is stored with your account and that Safe Date. It is also stored with the person you met, when the App knows who that was: either you set up the Safe Date from a chat with them, or you picked them from your list of friends when you answered.

  • Nobody is shown it: your answer is not shown to the person you met, not shown to your guardian, and not shown to any other user. Nothing about how you or anybody else appears in the App changes because of it, and no part of the App returns it or anything worked out from it.
  • An internal safety indicator: when you answer that you felt uneasy or unsafe, our server takes the uneasy and unsafe answers, reports and blocks that different people gave about the same person in the last 180 days, weighs them, and writes the result, with your answer, to our web server's error log. Our safety team may use it to look into a possible safety concern. It never restricts an account by itself. The log is deleted after 14 days, the number is not kept anywhere else, and it is not displayed to users in the App.
  • A person decides, never the arithmetic: nothing here suspends, removes or hides anybody on its own. If something needs acting on, a person acts on it, and the route that reaches a person is the reporting route in section 8.
  • One answer per session: the database itself permits one answer from one person for one session. Answering again replaces your answer rather than adding a second one. Your answers are not deleted when you delete your account, because they can protect the next person who meets the same person. They stop counting after 180 days, and they are deleted two years after the date.
  • If you also tell us what happened: after an uneasy or unsafe answer you can describe the date in your own words. That is filed as a report about the person you met, together with the reason you picked, which Safe Date it was, and whether you agreed to be contacted. Our moderators read it. The person is not told who reported them or what was written.
  • A separate recommendation, positive only: after a date that felt fine, and only then, you can choose to recommend the person you met. It counts only if the two of you had a match from before the Safe Date began. It is a different question from the one above and is stored separately: who recommended whom, after which Safe Date. When at least three different people have recommended someone, their profile shows a small badge. Nobody is told who recommended them or how many did, nothing negative is ever shown, and the safety answers above are never counted toward it. A recommendation is deleted with either account.

1.5 Diagnostic Records During the Beta

While the App is in beta we record a trail of how it is used, so that a fault somebody reports can be reconstructed rather than guessed at. It holds which screen was opened, which action was attempted, whether it succeeded or failed, how long it took, your app version, and for requests to our servers the endpoint, the action, the method and the response code. It never holds message contents, coordinates or authentication tokens. It is linked to your account. A cleanup that runs while the App is in use removes records older than seven days, and the whole trail belonging to you is removed when you delete your account. This collection is switched off when the beta ends, and this section goes with it.

1.6 The Question of the Day

Answering the question of the day is optional. Each question comes with four answers to choose from, and nothing is typed.

  • What we keep: the answer you chose for each question and when you chose it. Earlier questions can be answered too, and if you change an answer we keep the one before it.
  • On your profile: your answers are shown under "What I think about..." to anyone who can see your profile, each person in their own language, together with how many answers the two of you share. Nobody sees them across a block, and the answers of a guardian-only account (section 1.7) are shown to nobody.
  • How everybody answered: once at least five people have answered a question, you can see what share of people chose each answer, after you answer it yourself. It carries no names.
  • "People who answered like me" and "AI Match": these lists show people in your country of residence whose answers match yours, the most alike first, and AI Match shows the share of identical answers as a percentage. Only people with a finished dating profile who can be found appear, matched both ways on the gender and ages each side looks for, and nobody across a block. You appear in other people's lists in the same way, with your name, your age if you show it, your photo under the same rules as your profile, and how many answers you share.
  • No AI processes your answers: despite its name, AI Match today is a count of identical answers, worked out on our own server. If an interview with an AI service is added, this policy will describe it, and name the service and what it receives, before it starts.
  • Topics: no question asks about health, religion, politics, sexual orientation or ethnicity. Your answers are deleted with your account and are included in the copy of your data.

1.7 Guardian-Only Accounts

A person invited to be somebody's Safe Date guardian can join only for that, without a dating profile. Such an account holds the Google account details used to sign in, a name, a date of birth (so that the 18+ check still applies) and a gender, the country of residence, sign-in records and the notification token. It has no photos and no dating profile, and it never appears on the radar, in Spark, in dating lists or in the question of the day lists. The person who invited it sees its name in their list of guardians. If its owner later creates a dating profile, the rest of this policy applies to them like anyone else.

1.8 Voice and Video Calls

A call connects the two devices directly when the network allows it, and otherwise through a relay on our own server in Germany. Either way the sound and picture are encrypted in transit by the calling technology itself, and we do not record or store them. A direct connection means that each device learns the other's IP address. We keep a record of each call: who called whom, whether it was voice or video, when it started, whether it was answered, how long it lasted and how it ended, and a short line about it appears in your chat. The technical details used to set up the connection, which include network addresses, are deleted after one day. Call records are deleted with either account.

1.9 The Web Version

Everything in this policy also applies to the web version of the App at app.nearbylove.app. It is for people who already have an account, and an account cannot be created there. A few things work differently in a browser:

  • Signing in: the sign-in page loads Google's sign-in script from accounts.google.com, and Google receives what it receives whenever that script runs, under Google's own privacy policy.
  • What your browser keeps: your sign-in token, your language, whether your account is guardian-only, the state of the location prompt and a random value used for the privacy grid are kept in your browser's local storage, so that you stay signed in and the App works the same way next time. We use no advertising or tracking cookies.
  • Location: the web version asks your browser for a position only for IT'S A DATE!, and it snaps it to the privacy grid inside the browser before anything is sent, exactly as the phone does. The exact-position side of Safe Date stays on the phone.
  • Sign-in records: the device description stored with a sign-in from the web is your browser's.

1.10 Laugh First, Look Later

In this feature two members who match each other are paired live and anonymously. Each one sees only the other's answer and messages, never a name, photo or profile, unless both choose to reveal. We keep who was paired with whom and when, the question, the two answers and the messages, encrypted like other messages. Phone numbers, email addresses and links are refused in answers and messages. If both choose to reveal, the conversation is copied into a regular chat between them. If not, the answers and messages are deleted 24 hours after the conversation ends, except a conversation that was reported, which is kept until the report has been handled. When nobody who matches is waiting, members who match the person waiting may get a push saying that somebody is waiting to laugh, at most once every four hours and only during the day in their country.

2. How We Use Your Information

We use the information we collect to:

  • Create and maintain your account.
  • Display your profile to other users based on mutual preferences and proximity.
  • Enable matching, messaging, and social features.
  • Provide location-based services (Radar, Spark Mode, Safe Date).
  • Send push notifications: messages, match requests and matches, Spark, Safe Date and safety alerts, calls, account notices, a reminder shortly before radar night once a week, timed by the local time of your country of residence, and at most one reminder a day, during the day in your local time, about a request or a chat waiting for your answer, each one only once. Under "Notifications I want" in Settings you can switch off messages, requests and matches, Spark, reminders and radar night. Safety alerts, calls and account notices cannot be switched off. The "somebody is waiting to laugh" push from Laugh First, Look Later (section 1.10) can be switched off there too.
  • Ensure the safety and security of our users.
  • Improve and optimize the App's performance and features.
  • Comply with legal obligations.
  • Screen photos before they are published, and act on what the screening finds.
  • Check and enforce the minimum age of 18, and review appeals against an age suspension.
  • Look into reports and blocks, and act on what they show.
  • Report child sexual abuse material to the authorities and to the bodies that receive such reports, and preserve the material and the records around it for them.
  • Our own ads, and nobody else's: the App can show a card for books and apps made by the maker of NearbyLove. No advertising network or other company is involved, and nothing about you is shared with anyone for it. Which card you see is chosen from your app language and the country your connection comes from. We count only how many times each card was shown, opened or hidden each day, with nothing recorded about who. People with a paid subscription do not see these cards.
  • Who can join: NearbyLove opens country by country. We use the country of your connection's IP address and the country you state to decide whether an account can be created. When it cannot, we only count the attempt for that country, with nothing recorded about you.
  • Marketing messages: we send them only to people who agreed, mark them as advertising, and each one says how to stop them. You can turn them off at any time in Settings. Service notifications about your own account and activity are not marketing.

3. How We Share Your Information

We share your information only in the following circumstances:

  • With Other Users: Your profile information (excluding exact location) is visible to other users based on your privacy settings and mutual preferences. Messages are shared only with intended recipients. If you joined during the launch period, your profile shows a founding member badge to others.
  • Safe Date Guardians: When you start a Safe Date session, your true position is sent to the guardian you named, with no privacy grid applied to it, and it is refreshed about every thirty seconds while the session runs. The App deliberately asks your phone for the most accurate fix it can give, because a point on the wrong side of a block is no use to somebody trying to reach you. The guardian is also shown your name and photo, the meeting place and time you entered, the name of the person you said you were meeting, your phone number and the emergency number if you gave them, and whether your check-in is overdue. Getting all of that to your guardian's phone means it passes through Google's push notification service and our realtime messaging provider, both listed in section 9. This is the one place in the App where another person is shown where you really are. It happens only during a session you started and only for the guardian you chose. Once the session ends your guardian can no longer see it, with one exception you should know about: a session that has gone into an emergency does not close by itself. It stays open to your guardian, with your position, until you check in or end it.
  • Service Providers: We use third-party services to operate the App:
    • Firebase Cloud Messaging (Google) for push notifications
    • Google Sign-In for authentication. Your sign-in token is normally checked on our own server against Google's published keys, so a valid token never leaves our server. If that check fails, the token is sent to Google to be checked before you are turned away, so that a fault on our side cannot lock you out of your account.
    • Project Arachnid Shield, operated by the Canadian Centre for Child Protection, for the photo fingerprint check described in section 1.3. It receives a 32 byte fingerprint of a photo and nothing else.
    • Google Firebase Cloud Messaging for push notifications. It receives the device token, the title and body of a notification, and its data payload. For a Safe Date escalation that payload includes your name, the meeting location text, the name of the person you said you were meeting, and your true coordinates.
    • Hostinger, which sends our emails: guardian invitations and our replies to the contact form. It receives the recipient's email address and the content of that email.
  • Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
  • Safety: We may share information to protect the safety of our users or the public.
  • Automatic escalation during a Safe Date: a job on our server checks running sessions every minute or two. If you miss a check-in your guardian is told. At about seven minutes overdue they receive an urgent alert that includes your last known position, and that alert repeats at about fifteen, thirty, sixty and one hundred and twenty minutes while the session stays unanswered. This happens without you doing anything, which is the point of it. It depends on your phone having had a signal to report a position, on the alert reaching your guardian, and on your guardian acting on it. We do not promise safety. We provide a tool that can help with it, and it can only do what a phone and an internet connection allow.
  • Child safety reporting: Where child sexual abuse material is identified, we report it, together with the account details attached to it, to law enforcement and to the bodies that receive such reports, and we preserve the material and the records around it for them. We do this whether or not we have been asked to. Our full child safety standards are on the Child Safety page.

We do not sell your personal information to third parties.

Where Your Information Is Held

Our server is in Germany, at Hetzner, and that is where your account, your photos and your messages are stored. The App is operated and administered from Israel. Several of the services listed in section 9 sit elsewhere again. Google operates globally and carries our push notifications, which is how an alert reaches a phone; during a Safe Date escalation that notification carries your name, the meeting details you entered and your true coordinates. Real-time events (new messages, requests, and during a Safe Date escalation your name and your true coordinates) run on our own server, not on an outside service. The photo fingerprint check described in section 1.3 is answered by a service operated in Canada. Our emails are sent through Hostinger. Map tiles are fetched by our server rather than by your phone. If you use the App from any other country, your information is transferred to and processed in these places. We keep no user database anywhere other than our own server. Our own server also carries the setup of voice and video calls, which includes the network (IP) addresses of both devices.

4. Location Privacy

We take your location privacy seriously:

  • Stored coordinates are snapped to the centre of a fixed privacy grid rather than displaced at random. With the default 250 metre grid the stored point sits at most about 177 metres from your true position, and about 96 metres on average. Because the same place always reports the same point, repeated readings cannot be averaged together to narrow it down.
  • A tighter grid if you want one: you can choose a 100 metre grid instead of the default 250, which makes you findable more precisely. Turning Spark Mode on takes the tighter grid, because Spark cannot tell that somebody is genuinely close without it, and that applies to your location everywhere in the App and not only in Spark. If you had already set the grid yourself on the radar screen, switching Spark on clears that earlier choice so the tighter grid can take effect. The App tells you at the moment it happens, and the Spark screen has its own switch you can turn off to stay on the wider grid. You can set the grid back yourself afterwards.
  • Your exact GPS coordinates are never shown to another user through discovery, matching or chat. The one person who is shown them is a Safe Date guardian you chose, during a session you started. See section 3.
  • Other users see only approximate distances (e.g., "500m away").
  • You can deactivate Radar at any time to stop location sharing.
  • Only while something is running: your location is collected only while a session you started is running, whether that is a radar session, a VibeSwipe or It's a Date session, or a Safe Date. It is not collected at any other time.
  • For radar and discovery, the degrading is applied on your phone before anything is sent, so your exact coordinates never reach our servers at all. There are two exceptions, and they are not the same. Spark sends your actual coordinates so a short distance can be worked out at that moment; they are not stored and no other user is shown them, and it is described below. Safe Date sends your true position to another person, the guardian you chose, while the Safe Date runs, and our server deletes it 7 days after the Safe Date ends, or 30 days after it if an emergency was raised; it is described in section 3.

Background Location

When you start a radar session and keep the "background search" toggle on (it is on by default and you can turn it off at any time), the App periodically collects your device's location in the background, approximately every 5 minutes, and sends it to our servers. This keeps you visible to nearby users for the duration of your session, even while the App is not on screen.

  • Only during an active session: Background location is collected only during a time-limited radar session that you start yourself. When the session timer ends or you turn the toggle off, background collection stops.
  • Persistent notification: A system notification is always visible while background location collection is running, so you always know when it is active.
  • Privacy offset: Your exact position is never shown to other users. What is shown is a point on a fixed privacy grid, at most about 177 metres from where you actually are with the default setting.
  • Secure and never sold: Background location data is transmitted over encrypted connections (HTTPS) and is not sold or shared with third parties.
  • Your controls: You can turn the background search toggle off at any time, stop the radar session, or revoke the location permission in your device's system settings.
  • Retention: The last reported position stays visible to nearby users only until the session expires, and it is then replaced by the data from your next session. The stored coordinates are cleared from the session record by a pass that runs once a day, once the session is more than a day old. The row itself is kept without them, so that your own session counts and statistics do not change under you.

Spark Mode

Spark Mode is an optional feature, turned off by default, that notifies you when another compatible user who also enabled Spark Mode passes near you during an active radar session.

  • Opt-in only: Spark detection runs only while you have an active radar session and have turned Spark Mode on. Stopping the radar automatically turns Spark Mode off.
  • Momentary use of precise location: To detect short-distance encounters accurately, your device sends your actual coordinates for the proximity calculation. They are used only to compute the distance in real time and are not stored. The location saved on our servers and shown to other users remains the privacy-offset one.
  • What the other person receives: When a spark occurs, both users are notified. The other user sees your partially hidden nickname (first two characters only), age, gender, an approximate distance rounded to 10 meters, and your main photo unless you chose to hide it for the session. Your exact location is never shared.
  • Spark records: We keep a record of spark events, meaning the two people, an approximate distance and the time, so that your spark history works and so that alerts are limited to at most one per person in 24 hours. The distance is cleared by the same daily pass once the record is more than a day old. The record that a spark happened, and when, stays in your history until you or the other person deletes their account, at which point it goes with the account.
  • Your controls: You can turn Spark Mode off at any time on the radar screen, and it never activates on its own.
  • A tighter grid: Spark uses a 100 metre privacy grid rather than the usual 250, so it can tell that somebody is genuinely close. This applies to your location everywhere in the app, not only in Spark. The app says so when you switch Spark on, and you can switch it back at any time.
  • Club mode: An optional window that narrows Spark to about 50 metres, for one place rather than a whole street. It closes by itself after three hours, and you can close it the moment you leave.

What proximity detection cannot promise. Spark and the radar report approximate proximity and do not guarantee detection. Satellite positioning is markedly less accurate indoors, in basements and among tall buildings, and the privacy grid adds a further tolerance by design. Two people in the same room may not be detected at all, and a detection does not mean somebody is at the distance shown. Do not rely on these features to establish where another person is, or is not.

5. Data Retention

  • Account Data: Retained for as long as your account is active.
  • Messages: Stored on our servers and synced to your device. Deleting a message hides it from your side of the conversation, and hiding a conversation removes it from your list; neither erases the message from our servers, and the other person keeps their copy. Everything you sent is erased when you delete your account.
  • Location Data: Coordinates stop being shown to anybody the moment a session ends. A pass runs once a day and clears them from the session record once the session is more than a day old, keeping the row itself so that your session counts and statistics do not change under you. Safe Date coordinates are your true position and are kept longer on purpose: the same daily pass clears them once the session is more than seven days old, or more than thirty days old if an emergency was raised during it, because the meeting point and the last known position are the two facts that matter if somebody comes back afterwards to ask what happened. No minute by minute movement trail is recorded at any point.
  • Voice Recordings: Retained for as long as your profile is active, or until you delete them.
  • Voice Dating Intros: Remain active until deleted by user.
  • Account Deletion: Deleting your account is immediate. It is not a request with a waiting period. In a single transaction we remove your profile, your photos, your voice recordings and voice intros, your messages, your matches and match requests, your blocks, your sessions and their location data, your guardians and guardian invitations, your referrals, your notification tokens, your sign-in records and your beta diagnostic trail, and your uploaded files are deleted from disk immediately afterwards. Three things survive, and you should know about all three. Backups of the database are kept, and a job deletes each one once it is fourteen days old, so a copy of your data can remain in a backup for that long. The backup file itself is not encrypted. Message bodies inside it are, because they are encrypted in the database. Some safety records are kept after you delete your account, each only as long as its purpose needs: a declaration of an age under 18, until the person who made it would be 18; the outcome of a photo screening, for a year; a photo that was held or refused, until 30 days after the decision about it; an appeal and its result, for a year after the decision; the answers you gave after a Safe Date, for two years (section 1.4); and reports you made, without your direct account identifiers, for two years after the case is closed. A declared adult age is deleted with the account. These are kept so that a decision can be explained and so that we can answer a lawful request about an incident. Support messages you sent us are kept as well, including the name and email address you gave when you wrote in, with the link to your account removed, and they are deleted 24 months after our last contact with you.
  • Photo screening records: the scores, the fingerprint and the outcome of each screening are kept, so that a decision can be explained to you and so that the thresholds can be checked against real uploads rather than intuition. A photo that was held or refused stays in the private quarantine area, where other users cannot see it, until a person releases it or deletes it, and at most 30 days after that decision; the screening record itself is deleted after a year. A photo that matched known child sexual abuse material is kept there only for the period required or requested by the authority it was reported to. Harmful-abusive material that is not reported is kept only as long as the review and any appeal need it: it is deleted within 30 days after a review that leaves no adverse decision, and otherwise when the appeal period ends or the appeal is decided, and in any event no later than six calendar months after the decision unless a legal hold applies. The record of the match, without the image, is deleted a year after the match. These records are not attached to your account by a database link, so they are not removed when you delete it. They do still record which account uploaded the photo.
  • Age and safety records: age declarations, and appeals and their outcomes, are kept while the account exists, and they are kept afterwards too, so that a decision can be explained and so that we can answer a lawful request about an incident. They are never shown to another user.
  • Diagnostic trail: beta diagnostic records are cleared once they are more than seven days old, they are removed with your account if you delete it, and the collection stops altogether when the beta ends.
  • Requests to join: a refused request is deleted 90 days after the decision, an unanswered or unused one after 180 days, and one that became an account 30 days after the account was created. Deleting that account deletes it at once.
  • Reports: reports about you and reports you made about other users may be kept for two years after we close the case. If you delete your account, your direct account identifiers are removed from reports you made and those reports are no longer linked to your account, so the safety record does not disappear only because the reporting account was deleted. A report may be kept longer only while an active investigation, legal claim or other legal obligation requires it.
  • Country and message choices: kept as long as your account exists, and deleted with it.
  • Answers, calls and reminders: your answers to the question of the day, your call records, your notification choices and the record of reminders we sent you are kept as long as your account exists and deleted with it.
  • Contact form messages: deleted 24 months after our last contact with you about the request, or 24 months after receipt if there was no further contact.
  • Security and sign-in records: security and administrative audit records that form part of our required access and security logging are kept for at least 24 months. Sign-in session records (the device and internet address of a session) are deleted 90 days after the session ends.
  • Messages between members: kept while both accounts remain, so that both people can see their conversation, and deleted when either account is deleted. A message or extract kept separately because of a report, a safety incident, a legal obligation or a dispute follows the retention period of that record.
  • Partnership inquiries: if you ask about launching NearbyLove in your country, we keep what you send in the form, including your name, email, country and anything you wrote about yourself or your proposal, so that we can reply and talk it over. We use it for nothing else. We delete it 24 months after our last contact with you about it, or sooner if you ask: write to us through the contact form at any time, and we will, unless the law requires us to keep it.

6. Data Security

We implement appropriate security measures to protect your data:

  • All communications use HTTPS/TLS encryption.
  • Authentication tokens (JWT) expire after 24 hours with secure refresh mechanisms.
  • Sensitive data on your device is stored using platform-specific secure storage.
  • Biometric authentication (fingerprint, Face ID) is available for additional security.
  • Rate limiting and brute-force protection on all API endpoints.
  • SQL injection prevention through parameterized queries.
  • The text of private messages, and their subject lines, are encrypted where they are stored, using AES-256-GCM, with the key held outside the application's configuration file and outside the database backup, so that a stolen copy of the database does not come with the key that opens it. This is not end to end encryption. Our server holds the key and can read messages, which is what allows us to act on a report about one. Photos and voice notes sent in a chat are stored as files and are not encrypted this way. Please do not treat the App as a confidential channel.

7. Your Rights

Depending on your location, you may have the following rights:

  • Access: You can get a copy of most of the personal data we hold about you in Settings, with "Get a copy of my data", up to three times a day. The copy is created when you ask for it and handed to you inside the App, after a fingerprint or face check where your phone has one, so you can save it on your phone or send it where you choose. It is not sent by email, and we keep no copy of the file. A few safety records are left out of it to protect the people who made them, such as reports and safety answers others gave about you, and the copy says which. For a full access request, or if you want the copy another way, write to us through the contact form on this website.
  • Correction: Update or correct inaccurate data through your profile settings.
  • Deletion: You can delete your account from inside the App at any time, and it takes effect immediately. Section 5 sets out exactly what is removed and what is kept.
  • Portability: The copy is a machine readable file (JSON). You get it the same way.
  • Withdrawal of Consent: Revoke location permissions or other consents at any time through your device settings.
  • Objection: Object to certain processing of your data.

How we handle a request. The App is run by one person. Send your request through the contact form on this website, which is the route that reaches us. Requests are worked through in order, and anything to do with a child's safety, or with somebody's immediate safety, goes to the front of that order. We are not going to put a deadline in writing that one person cannot keep, so we do not promise a number of days. Our outgoing email is not working yet, so please say in your request how we can reach you with the answer.

Automated Decisions

Some things happen to your account without a person looking first. A photo can be held or refused by the screening described in section 1.3. An account is suspended automatically if an age under 18 is declared twice, and also if three different people report it as being under 18 within ninety days. An account is also closed at once if a photo uploaded from it matches known child sexual abuse material, and suspended until a person reviews it if the match is on material marked harmful but not necessarily illegal (section 1.3). Which profiles you are shown is produced automatically too, from your preferences and theirs, your stated attributes and your approximate distance, and they are ordered by how close they are, never by a score. The App does work out a compatibility percentage between you and each profile you are shown, from the lifestyle answers both of you filled in. It is calculated at the moment you look, it is shown to you, it is not stored anywhere, and it does not decide who appears or in what order. In every one of these cases a person can look again: a held photo goes into a queue that a person works through, and a suspension can be appealed from inside the App, which puts it in front of a person. If you want an automated outcome reviewed by a person, write to us through the contact form and say so.

That describes the radar. Two lists work differently: "People who answered like me" and AI Match put the people whose answers to the question of the day most often match yours first, and AI Match shows that as a percentage. It is a count of identical answers, not a prediction about anyone, and it decides only the order of a list that you choose to open.

For EU/EEA Residents (GDPR)

If the General Data Protection Regulation applies to you, because you are in the European Union or the European Economic Area, the rights listed above apply to you as the Regulation sets them out, and a request from you is handled exactly the way we handle any other. Our server is in Germany. Our reasons for processing are your consent, for location and for the optional features, and the need to provide the service you asked for and to keep the people using it safe. You can also raise a concern with the data protection authority in the country you live in. We have not appointed a representative in the Union and there is no data protection officer, because the App is run by one person. That is a fact about us and it does not reduce any right you have.

For California Residents (CCPA)

If you are a California resident, the rights listed above apply to you: you can ask what we hold about you, ask for it to be deleted, and ask us to stop. We do not sell personal information and we do not share it for cross context advertising. There is no category of personal information that we have sold or shared, and we have never received any payment for anybody's data.

8. Children's Privacy

NearbyLove is for adults and is not intended for anybody under the age of 18. Accounts are created through Google sign-in only, so there is no anonymous way in. During profile setup you must give a date of birth. A date that makes you under 18 is refused, and the age you declared is recorded, the age only and never the date you typed. A second such declaration suspends the account so that a person can look at it, rather than deleting it on the spot, because a mistyped date should not cost somebody their account with no way back. Where a user is confirmed to be under 18 we remove the account and its content. We keep a minimal record that an age declaration was made, so that it cannot be edited away from inside the account and so that we can show what we did if we are asked, and that record is not removed when an account is deleted. If you believe a minor is using our App, please contact us immediately. support@nearbylove.app.

9. Third-Party Services

The App relies on the third party services below, each with its own privacy policy. Section 3 says what each one actually receives from us.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or via email. Your continued use of the App after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

The video is in English, with captions.