Privacy Policy

1. Introduction

This Privacy Policy explains how Tinderhaj collects, uses, and protects information when you use the service. By creating an account or using Tinderhaj, you acknowledge the practices described here.

2. Who is responsible

The controller responsible for processing your information is Nikki Sophie Berthold, Friedrich-Karl-Straße 28, 32584 Löhne, Germany, reachable at contact@tinderhaj.com. Full contact details are in the Imprint.

3. Information you provide

We collect information you provide directly, including:

• Account details such as your email address, username, and password credentials. Passwords are stored in hashed form.
• Sign-in security settings you choose to set up: the secret for your authenticator app and your backup codes (both stored encrypted), and the public keys of your passkeys. Passkeys' private keys and your fingerprint or face never leave your device.
• If you sign in with another service, such as Google, Apple, Microsoft, GitHub, Discord, X, Twitch, or Facebook: your account ID there, your email address and whether that service verified it, and your name or handle there, which we use to suggest your username. We also receive access tokens from that service, which we store encrypted and don't use after you sign in. We don't keep your profile picture from it.
• Profile information about your sharks, such as display name, avatar and banner images, birthday (shown as an age), pronouns, location, size, interests, and biography.
• Hearts your profiles send and receive, when they were sent, and when you saw the ones you received.
• A way for your matches to reach you, such as a username or link elsewhere, if you choose to add one.
• Reports you make: which profile, the reason and any details you give, and when. Reporting the way to reach a match's owner keeps a copy of it as it was.
• Moderation information such as verification status, which parts of a profile need fixing and a moderator's note about it, and, if your account is banned, the reason, when the ban ends, and which moderator banned you.
• Messages or requests you send to us, including privacy or support requests.

4. Information collected automatically

When you use Tinderhaj, we may receive limited technical information needed to operate and secure the service, such as your IP address, browser type, timestamps, and basic usage or error information provided by our hosting infrastructure.

For each session where you are signed in, we store the IP address and browser (user agent) it was started from, along with when it started, when it was last active, and when it expires. You can see this list in Account Settings, so you can spot and sign out of sessions you don't recognize. We also count requests per IP address for a short time to limit repeated sign-in attempts.

5. How we use information

We use information to:

• Provide, operate, and maintain accounts, profiles, discovery, hearts, and matches.
• Authenticate users, maintain sessions, and send account emails: email verification, email change confirmations, password recovery, sign-in codes, and account deletion confirmations.
• Review profiles, enforce our Terms and Guidelines, prevent abuse, and keep the community safe.
• Diagnose problems, protect the service, and improve its features.

6. Legal bases for processing

We process your information on the following legal bases under the EU General Data Protection Regulation (GDPR):

• To perform our agreement with you (Art. 6(1)(b) GDPR): your account, sign-in, profiles, hearts and matches, and the emails your account needs.
• Our legitimate interests (Art. 6(1)(f) GDPR) in a safe and working service: reviewing profiles, enforcing our rules and bans, limiting repeated sign-in attempts, the list of your sessions, and technical information for security and fixing problems.
• To comply with legal obligations (Art. 6(1)(c) GDPR), for example when we must keep or disclose information by law.
• Your consent (Art. 6(1)(a) GDPR), where we ask for it. You can withdraw consent at any time, without affecting what was done before.

7. Who can see what

Verified profile information may be visible to anyone through discovery and on your user page, along with your username and when you joined. Your user page, when its link is shared, shows a preview picture of your verified sharks. Profiles that aren't verified are visible only to you and to moderators.

When one of your profiles sends a heart, the owner of the profile it goes to sees which of your profiles sent it. When two profiles heart each other, both owners see the match, and each sees the way to reach the other that they added, if any. It isn't shown anywhere else.

Moderators and admins can see profiles waiting for review and the moderation information about them, along with your username, role, and any ban. They also see reports, including who made them; the person reported is never told. Admins can also see your email address, whether it's verified, and how many sessions you have, and can sign you out everywhere, send you a password reset link, or delete your account.

We do not sell personal information. We share information only with service providers needed to host, operate, secure, store, or deliver parts of the service, or when required for legal and safety reasons.

8. Third-party services

We use these service providers, which process information on our behalf and only as needed to provide their services:

• Vercel Inc. (USA) hosts the website. Every visit passes through it, so it processes technical information such as your IP address and the pages you request.
• Our database, the pictures you upload for your profiles, and the mail server that sends our emails are on a server we rent from Index-Hosting (Kurz & Lankow GbR, Germany), in a data center in Germany. Accounts, profiles, pictures, hearts, and sessions are stored there, and the emails we send you go out from there to your email provider.

If you choose to sign in with another service, that service learns that you are signing in to Tinderhaj, under its own privacy policy. You can disconnect it in Account Settings, as long as you keep another way to sign in.

Tinderhaj links to its pages on other sites, such as GitHub. If you follow one, that site's own privacy policy applies.

9. Cookies and browser storage

Tinderhaj uses only essential httpOnly cookies: to keep you signed in, and short-lived ones while you sign in with another service. If you use two-step sign-in, a short-lived cookie remembers that you entered your password while you enter the code, and if you choose "Don't ask again on this device", a cookie lets that device skip the code for 30 days. If a banned account tries to sign in, a cookie lasting 15 minutes lets the ban page show that account its reason.

Your browser's own storage keeps your selected theme, a profile you're writing until you save it, where you were on a page, and a note to send a sign-in code once. This stays on your device and isn't sent to us. We do not use advertising or cross-site tracking cookies, or analytics.

10. Retention and deletion

We retain information while it is needed to provide the service, meet legal obligations, resolve disputes, and protect Tinderhaj. You can delete your account from Account Settings after confirming a link sent to your email. Account deletion removes your account, profiles and their hearts, sessions, passkeys, two-step sign-in settings, and pending email links from the application database, subject to backups and information we must retain by law. You can also delete a single profile, along with its hearts, at any time.

Sessions end when you sign out or after a few days without use, and email links expire after one to 24 hours. Ban details are cleared when a ban is lifted, or at the next sign-in after it runs out.

11. Your rights

Under the GDPR you have the right to access your information, to correct it, to have it deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time.

You can manage your username, email, password, two-step sign-in, passkeys, sessions, profiles, and account deletion in the app, or contact us at contact@tinderhaj.com for anything else.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the one where you live, or the one responsible for us: the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

12. Security

We use measures such as password hashing, protected sessions, optional two-step sign-in and passkeys, limits on repeated sign-in attempts, access controls, and encryption in transit to help protect information. No method of transmission or storage is completely secure, and we continue to improve our safeguards.

13. Children's privacy

Tinderhaj is not intended for children under 13, or under the minimum age required in your country. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can review and remove it where appropriate.

14. International processing

Vercel is based in the United States, so information it processes may be transferred there. These transfers rely on the safeguards the GDPR provides for, such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

15. Changes to this policy

We may update this Privacy Policy as Tinderhaj changes. The updated version will be posted on this page with a revised update date.

16. Contact us

Questions about this Privacy Policy or how we handle information can be sent to contact@tinderhaj.com.