Deerdate — Privacy Policy
Last updated: 30 September 2026
This draft describes what the current Deerdate release collects, why, and what you can do about it. The retention schedule below was approved on 25 September 2026. The automatic purge jobs that enforce it are not built yet, so each row also states what the system actually does today. Counsel and operations review is required before this policy is published for a store submission; until the purge jobs ship, this draft must not be represented as a final published retention policy.
The short version
- Deerdate is pseudonymous by default. You choose a display name and use an illustrated avatar. Members with paid VIP can add one profile photo, shown only after human review.
- We do not sell your data, and there are no advertising or analytics trackers in the app.
- You can request an account export and delete your account inside the app. The export contents and the data that remains after deletion are described below.
- Voice in a room is live only in the current release. Live audio leaves the device and is processed in memory to provide the call. Deerdate does not record or store it.
Who we are
Deerdate is operated by the person named at the bottom of this page. Deerdate application data is stored on a server we run in Nuremberg, Germany.
What we collect
When you sign in. Deerdate supports Google or Apple sign-in and supported email/password accounts. For Google or Apple sign-in, we store the provider's account identifier and the email address when the provider supplies one. For email/password sign-in, we store the email address and a password hash, never the password itself. We also store session records needed to keep you signed in.
When you set up your profile. We store the display name you choose, a generated handle, a seed for your illustrated avatar, how you eat chay, your connection preferences, and your birth month and year. We do not ask for your birth day. The month and year are used to enforce the 18+ age gate.
When you use the app. We store your introductions and conversations, the private messages and room messages you send, room participation, your notification and connection settings, and the people you block. Reports store the reason, any detail you enter, their status and resolution record. A report about a room message also stores a link to that message.
If you post to Moments or go live. Text posts you write are shown to eligible members newest-first until you delete them, a moderator removes them, or 30 days pass. Live broadcasts show your display name, title, and listener count while live; broadcasts you join show you as listening. Reports can reference a post or a live broadcast. Voice and broadcast audio is live only and is never recorded.
If you buy VIP or add a profile photo. VIP is a paid subscription bought through Google Play; Deerdate never sees your payment details. With active VIP you may upload one profile photo (JPEG, PNG, or WebP, up to 5 MB). The photo stays private until a human reviewer approves it, and it is hidden again immediately if your VIP expires, if the photo is rejected or removed, or if you delete your account. Rejected and removed photos are deleted from storage; approved photos are served only while your VIP is active.
If you enable Android push notifications. The app creates a random installation identifier on your device and obtains a Firebase Cloud Messaging registration token. Deerdate stores the installation identifier and token with your account and signed-in session so it can deliver generic notifications. Notification permission is optional. The notification does not contain private message text.
If you enable nearby matching. The app asks for your approximate location while the app is in use. Your device's position is reduced on our server to a coarse area of about one kilometre; your exact position is never stored, logged, or shown to anyone. Other members only ever see a broad distance band (under 1 km, 1–5, 5–15, 15–50, or 50+ km), never a number. The stored area is deleted after 24 hours and sooner if you turn nearby off, sign out, delete your account, or revoke the permission. Location permission is optional; ordinary matching works without it.
Technical data. The service produces ordinary server logs for reliability and abuse handling. The approved retention period is 30 days; the automatic purge is not built yet, so a fixed expiry is not yet enforced.
What we do not collect in this release
- No photos or videos except the single optional VIP profile photo described above, shown only after human approval and only while VIP is active.
- No location data beyond the optional nearby area described above; precise location is never collected.
- No contacts or address book.
- No advertising identifiers and no third-party analytics. There is no Google Analytics, Facebook SDK, or attribution tracking in the app.
- No voice recordings. The current release has no report-audio capture or storage path.
Voice conversations
Voice in a room is live only in the current release. Live audio is transmitted off the device and processed in memory for the real-time call. Deerdate does not record room audio, keep a rolling audio buffer, attach audio to reports, or store audio transcripts. Any future report-audio feature would require an updated privacy policy and store declaration before it is enabled.
Why we hold this data
- To provide the service — your account, profile, introductions, conversations, messages, room participation, settings, and optional push delivery.
- To keep people safe — reports, links from reports to room messages, blocks, moderation status, and resolution records.
- To meet legal obligations where a record must be preserved or disclosed.
Who receives data
- We do not sell personal data or share it for advertising.
- People you are introduced to or share a room with can see the profile and message information needed for those interactions.
- Google or Apple processes sign-in data when you choose its sign-in method.
- If you enable Android push notifications, Google Firebase Cloud Messaging processes the notification registration token and generic delivery payload.
- If you buy VIP, Google Play processes your subscription payment; Deerdate verifies the purchase with Google and never receives your payment details.
- We disclose data to law enforcement only where legally required.
How long we keep it
The approved schedule (25 September 2026) and what the system does today:
| What | Approved retention | Current behavior until the purge job ships |
|---|---|---|
| Account, profile, settings, and push binding | Kept while the account is active. Push bindings are removed when the device is unregistered, its session is revoked, or the account is deleted. | Matches the approved rule. |
| Room messages | Deleted 30 days after the room ends. | A scheduled job deletes messages in rooms ended more than 30 days ago; report links to purged messages are cleared while the report record survives. |
| Private messages | Kept while the account is active; deleted when the account or conversation is deleted. | Account deletion pseudonymizes the sender, but messages already sent remain. No time-based expiry job exists. |
| Reports, appeals, report-to-message links, and resolution records | Deleted 12 months after the case closes. | A scheduled job deletes closed records older than 12 months; open reports are never purged. Account deletion pseudonymizes the account but does not remove these safety records. |
| Server logs | Deleted after 30 days. | No fixed retention period is enforced yet. |
| GPS nearby cells | Deleted 24 hours after the cell was snapped, and on nearby disable, logout, account deletion, or permission revocation. | A scheduled job deletes cells older than 24 hours; logout, logout-all, and account deletion remove the cell. Nearby matching ships with this release behind its feature flag. |
| Text feed posts | Deleted 30 days after posting. | A scheduled job deletes posts older than 30 days; authors can delete sooner and moderators can remove, which keeps the report record. |
| VIP photos | Hidden immediately when VIP expires or the photo is removed or rejected; the stored image is deleted on removal, rejection, or account deletion. | Uploads wait for human review and are never public while pending. Server-side purchase verification is implemented; the Play Console products that enable buying are still being configured. |
| Live broadcasts | Ended broadcasts and their viewer records are deleted 30 days after ending. | Audio is live only and is never recorded. The broadcast journey is implemented; live media attachment is verified separately. |
| Records under a legal or safety hold | Only the specific records subject to the hold are kept, until the hold ends. | No hold process exists yet; nothing is automatically purged. |
The purge jobs for this schedule are a release gate. This draft must not be represented as a final published retention policy until the schedule is implemented and reviewed by counsel and operations.
Your rights, and how to use them
The following actions are available inside the app under You:
- Request your account export. You → Your data → Show me everything. The export contains your profile and setup data, notification and connection settings, introductions, conversations, private messages you sent, room messages you sent, reports you filed, and people you blocked. It does not include another person's private messages, push registration tokens, internal moderation fields, or server logs.
- Delete your account. You → Delete my account. This revokes sessions, removes sign-in identities, notification bindings and profile details, and pseudonymizes the account.
- Block someone. From a conversation or room. Blocking works both ways for private messages and direct contact. Public-room admission checks only for blocks between the host and the person joining, not between all participants: a block prevents joining a room the other person hosts, but does not remove either of you from a room you already share or hide your public room messages from each other. A new block does not revoke existing public-room audio access.
- Report someone or a room message. Reports enter the moderation queue and can retain a link to the reported message.
What remains after deletion. Under the approved schedule, private messages are deleted when the account or conversation is deleted, reports and appeals are kept up to 12 months after the case closes, and records under a legal or safety hold are kept only while the hold lasts. Today the system pseudonymizes the account, keeps messages already sent so other participants do not lose their conversation history, and keeps safety reports and their message links with no automatic expiry. The purge jobs that will apply the approved schedule are not built yet; the schedule is recorded above so the difference is not hidden.
Depending on where you live, you may also have rights to request access, correction, restriction, objection, or deletion and to complain to a data protection authority. Write to us to exercise a right that is not available in the app.
Age
Deerdate is for people aged 18 and over. We ask for your birth month and year and do not let you finish onboarding when the server-side age check says you are under 18. If you believe a child is using Deerdate, report the account in the app or write to us. See our Child Safety Standards.
Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect.
Contact
hello@deerdate.com
Le Gia Hoang
Vietnam