Privacy Policy

This policy explains, in plain language, what data the Spice My Date app ("the App", "we") handles, where it lives, how long it lasts and what you control. Spice My Date is built by generictec, the data controller under the GDPR (Regulation (EU) 2016/679).

1. The 30-second summary

• The dates you plan, the people and the answers about them stay on your phone and are not sent to our servers.
• A sneak peek carries only when the date is, each idea's title and any photos you add, without their location data. It is sealed on your phone to your partner's key, and we cannot open it. It disappears once seen and, if nobody opens it, the server deletes it after 10 days.
• A pairing request can be accepted for 2 days, and the request record is deleted at most 30 days after it was created. Two different windows, for two different things.
• The age check runs before you create an account, and your date of birth stays on your profile.
• We use anonymous, aggregated analytics to improve the App, and you can turn it off in your profile. There are no ads in the App.

2. Account and profile

You need an account to use the App. You can create one with an email and password, or sign in with Google or Apple. Authentication is handled by Firebase Authentication, which processes your email and credentials.

On your profile you can also save, if you want to: a name, a profile photo, a phone number and a country. The name and country let your partner know who you are; the phone number is a contact detail you type in, is never verified and, as a one-way code, lets your partner find you, and none of these fields is required. The date of birth you give in the age check is also kept on your profile, to suit ideas to your age. The profile photo is kept on your phone without its EXIF metadata, location included, and, where storage is configured, also uploaded to our storage so your partner can see it. We also store your choice about receiving product communications.

What stays on your phone only. The dates you plan, the people you plan them with, the answers about each of them and the count of weekly dates you've done are stored on the device only. They are not sent to our servers or synced between phones, and Settings → Delete all data deletes them.

If you turn on the app lock, the PIN is kept on the phone only as a salted hash, never the PIN itself, and unlocking with biometrics is handled by the system. None of this leaves the device.

3. Pairing and the request

You can use the App without pairing. To send sneak peeks and see the same weekly idea, you pair your phone with your partner's. One of you sends a pairing request, and the other accepts or declines it in the App. From then on the two accounts are linked, and each side publishes its public key so the other can seal content to it. The private key never leaves the device: it is not exported, copied or handed to anyone, including us.

Finding your partner. In Couple, you choose your partner from your contacts or by phone number or email. The App reads your contacts on your phone, and only if you choose to. Each number and email is turned on the phone into a salted one-way code, and only that code is sent to check for a match. The check happens in real time and the code is not stored. So that your partner can find you, a one-way code of your own phone number, and of your email if your sign-in provider verified it, is stored with your account id, with no name and no key. That code is deleted with your account.

A request has two deadlines, and the difference matters:

• it can be accepted for 2 days; after that it stops working and a new one has to be sent;
• the request record is deleted at most 30 days after it was created, whether it was accepted or not.

An account pairs with one person at a time. Either of you can undo the pairing alone, without the other's permission. When that happens, anything neither of you has opened yet is destroyed at that moment: the destruction happens before the pairing itself goes, so nothing is left stranded behind a bond that no longer exists. Both sides are told and are free to pair again.

4. Sneak peeks

Once you've planned a date, you can send your partner a sneak peek: when the date is and each idea's title, never the details, plus up to five photos if you add them. Photos travel without their location data and are sealed on your phone. What happens to that content:

• it is sealed on your phone to your partner's public key (X25519 → HKDF → AES-256-GCM) before it leaves the device;
• our infrastructure stores and delivers opaque bytes only, which we have no way to open;
• it opens only on the recipient's phone, and on Android the sneak peek screen blocks screenshots and screen recording; iPhone gives an app no equivalent control, so we do not promise it there;
• it is destroyed once seen;
• and, whatever happens, it is erased from the server 10 days after it was created.

A sneak peek that expires before it is opened can be reopened once with a one-off purchase (section 11), before it is erased, which happens at most 10 days after it was sent. Nothing about its content changes: it stays sealed, is destroyed once seen and is erased from the server at most 10 days after it was created.

There is no album and no history. Nothing is archived, exported or re-uploaded, so deletion is the normal path rather than a request you have to make.

5. The age check

Before any account exists, the App asks for your date of birth in a single check. The age check runs before you create an account: if you pass, your date of birth is kept on your profile (section 2). Anyone the check turns away leaves no trace at all: no account, no record and no analytics event.

This check is a policy measure of ours, not an identity or age-verification mechanism.

6. Analytics and the advertising ID

We use Firebase Analytics to understand how the App is used. What is collected is product usage: counts, event names from a fixed vocabulary, and a day counter. Never your dates, the ideas, the answers about a person, the content of a sneak peek or your partner's identity. Analytics is on by default and you can turn it off in your profile; when it is off, the App stops keeping an analytics identifier and Firebase receives only aggregated signals without that identifier.

Advertising ID (Android). The App bundles Firebase Analytics, which merges the advertising-ID permission (com.google.android.gms.permission.AD_ID) into the package; we do not remove it from the manifest. At runtime, collection of that identifier is off and both ad-consent signals, ad user data and ad personalisation, are denied unconditionally. We do not use it for advertising and we do not share it with ad networks. This is exactly what we declare on the Google Play Data Safety form.

Tracking permission (iOS). On iPhone, the App asks for your permission through App Tracking Transparency before analytics starts. Because that prompt ships, the App Privacy answers on the App Store mark the collected data types as usable to track you. In practice what we collect is still product usage, and you can decline in the system prompt or in your profile, in the App.

7. App integrity

The App sends our backend an integrity attestation (Firebase App Check), provided by the operating system, which confirms that a request comes from a genuine installation of the App rather than a script. It is not a user identifier, it does not follow you across apps, and it is not used for advertising.

8. Notifications

If you allow notifications, we store your device's notification token, linked to your account, so we can tell you when your partner sends you a sneak peek. The token does not contain the content of the sneak peek, and neither does the notification.

The weekly date reminder is different: it is scheduled on the phone itself, for Thursday at 19:00, if you haven't marked the weekly idea as done yet, and it sends nothing to any server. It only exists if you're in a relationship and have notifications on. You can withdraw the permission at any time in your phone's settings.

9. Blocking and reporting

You can block and report whoever sent you a sneak peek, from the screen where you open it. A block is applied on your phone and also recorded server-side, so a blocked person cannot send you anything, even from a modified client.

A report creates a record with what we need to review it. Because our infrastructure holds only sealed content, what is attached to a report is the copy your own phone had already opened: it is the only readable version that exists. Reports can only be written by the App: no installation can read one back, including its own.

10. Cookies on this website

This website uses Google Analytics 4 in consent mode. Until you choose, storage is denied and GA4 sends cookieless, aggregated pings only. If you accept, the _ga and _ga_<id> cookies are set for usage statistics. You can change your mind at any time from the Cookies link in the footer.

11. Payments and subscriptions

Premium is a subscription sold and billed by the App Store or Google Play, with RevenueCat used to tell whether your account's subscription is active. We never receive or store your card details. We receive only the subscription's status, which our server records from a RevenueCat notification.

While you're paired, your partner's App reads whether your subscription is active and until when, never any payment data, so it can apply Premium to the dates you plan together. That stops when you undo the pairing or when the subscription ends. The subscription stays tied to the store account of whoever bought it.

Reopening an expired sneak peek is a one-off purchase, sold and billed by the App Store or Google Play at the price shown there. It is not a subscription and does not change your Premium status. As with the subscription, we never receive or store your card details. We only receive confirmation that the purchase is active, to reopen that sneak peek.

12. Device permissions

• Camera - to take your profile photo, if you want one, or a photo for a sneak peek. The capture happens on the device.
• Photos - to pick an existing photo instead, for your profile or for a sneak peek.
• Notifications - to tell you when a sneak peek arrives, and for the weekly date reminder.
• Biometrics - only if you turn on biometric unlock in the app lock. The check is done by the system, and the App only learns whether it passed.

The App never asks for location, reads your contacts only if you choose to find your partner there, and does not access any other content on your phone. You can refuse or withdraw any permission in your system settings.

13. Who we share data with

We do not sell data and we do not share data for advertising. We use only the processors the service needs to work: Google Firebase (authentication, database, storage, notifications, analytics and integrity), RevenueCat (subscription status) and the Apple App Store and Google Play stores (payments). We may also disclose data where the law requires it.

The App downloads the published ideas and packs from our database, so new ones arrive without updating the App. That request sends no data about you beyond the session you signed in with.

14. Deleting your account

You can delete your account inside the App: in Profile, open the ⋮ menu and choose Delete account. For safety we ask you to confirm your identity immediately beforehand (your password, or the Google/Apple account you signed in with). Deleting your account, in this order:

• undoes the pairing, destroying anything neither side has opened yet;
• deletes the authentication account and your user record with its name, phone, date of birth, country, profile photo and notification token;
• removes your encryption key and your profile from this phone.

There is no recovery window: after that moment neither you nor we can bring anything back. Reports already filed by someone else remain, because they are not yours and cannot be reconstructed. The dates and people you planned stay on the phone until you use Settings → Delete all data, which also clears the phone without deleting your account.

15. Your rights (GDPR)

You have the right of access, rectification, erasure, restriction, portability and objection in respect of the data we process (account, profile, pairing data, subscription status, anonymous analytics), as well as the right to withdraw consent. Because your dates stay on your phone and sneak peeks are never accessible to us, most of the control sits directly with you, in the App. To exercise these rights, write to info@spicemydate.app. You also have the right to lodge a complaint with your supervisory authority (in Portugal, the CNPD).

16. Minimum age

Spice My Date is for people aged 17 and over. It is not intended for children and we do not knowingly collect data from minors. If we learn that an account was created by someone under the minimum age, we delete it.

17. Changes to this policy

We may update this policy to reflect improvements to the App or legal changes. We will publish the revised version on this page, with the "Last updated" date at the top. Significant changes will be flagged in the App.

18. Contact

Data controller: generictec. For any privacy question, write to info@spicemydate.app.