Slingshot Privacy Policy

Data we collect

Data you give us

• Account data: the email address you sign up with and the details you use to sign in. Slingshot does not collect your phone number or use usernames.
• Profile data: your name, date of birth and profile picture, which are required, and your gender.
• Matching data: the prompt you write before matching, your interests and topics, and your filters (such as gender preference). We also use your date of birth to match you with people in similar age groups.
• Chats: messages, photos, videos and reactions you send in chats.
• Ratings: ratings you give after a chat, and ratings others give you.
• Reports, blocks and support: reports you submit or that concern you (including the optional message you add), users you block, and messages you send to us.

Data collected automatically

• Location: with your permission, your device location, used for matching. Other users only see your city and district, never your exact position or your distance from them.
• Match history: who you were matched with, whether each of you accepted or skipped, when chats started, and when and how they ended (including automatic disconnection when the app is closed).
• Online status: whether you are currently online and available for matching.
• Device and usage data: IP address, device model, operating system, app version, device identifiers, features used, and crash and performance reports.

Device permissions

The app may ask for access to your camera, photo library, location and notifications. You can change these at any time in your device settings, although some features may not work without them.

How we use your data

• Provide your account and the app, including your profile, chats and photo and video sharing. (Contract)
• Match you with other users based on shared interests, prompt similarity, your filters and similar age groups. (Contract)
• Use your location for matching and show your city and district to your matches. (Consent)
• Improve the quality of matches using chat ratings. (Legitimate interests)
• Send service messages such as login codes and notifications about matches and messages. (Contract; consent for push notifications)
• Keep the app safe: check age, handle reports and blocks, moderate content (including automated analysis of reported profiles and conversations), prevent fraud and abuse, and enforce our Terms. (Legitimate interests; legal obligation; vital interests)
• Understand and improve the app with analytics and crash reporting. (Legitimate interests)
• Comply with the law and respond to lawful requests. (Legal obligation)

Legal bases

Each purpose above relies on one of these legal bases under Article 6(1) GDPR:

• Contract (Art. 6(1)(b)): processing needed to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)): for example keeping the Service safe, preventing fraud and abuse, and understanding how the Service is used so we can improve it. We only rely on this where our interests are not overridden by yours, and you can object at any time.
• Consent (Art. 6(1)(a)): for example optional device permissions, push notifications and non-essential analytics or marketing cookies. You can withdraw consent at any time without affecting earlier processing.
• Legal obligation (Art. 6(1)(c)): for example keeping accounting records, responding to lawful requests from authorities and reporting child sexual abuse material.
• Vital interests (Art. 6(1)(d)): to protect someone's life or physical safety, for example in an emergency involving a child.

Who we share data with

• Other users: people you are matched with see your profile and your city and district before deciding to accept or skip. In a chat, they receive the messages and media you send.
• Service providers that process data on our behalf under data processing agreements:
  • Supabase (database, authentication and file storage)
  • Google Cloud and Firebase (app backend and push notifications)
  • Google (Gemini API), which analyses reported profiles and conversations only
  • Apple and Google (push notification delivery and sign-in, if you use it)
  • Email providers (sign-in and service messages)
  • Map and geolocation providers (location features)
  • Analytics and crash reporting providers
• Authorities: law enforcement, courts and bodies such as the National Center for Missing & Exploited Children (NCMEC), where the law requires it or to protect someone's safety.
• Successors: a buyer or successor if our business is reorganised, merged or sold, subject to this policy.

Slingshot does not use advertising pixels or show third-party advertising. You can ask us for the current list of service providers at any time.

International transfers

We store your data primarily in the European Economic Area (EEA). Some of our service providers are based in, or access data from, other countries such as the United States. When data leaves the EEA, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified providers) or on the Commission's Standard Contractual Clauses with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

How long we keep your data

We keep personal data only as long as needed for the purposes described above:

• Account and profile data: while your account exists. When you delete your account, we delete or anonymise it within 30 days.
• Chat messages and media: you can no longer see a chat in the app once you start a new session. We keep messages on our servers only for a limited period after the chat ends, so that reports can be handled.
• Reported conversations and profiles: kept together with the moderation records described below.
• Backups: deleted data may remain in encrypted backups for up to 90 days before it is overwritten.
• Reports and moderation records: as long as needed to handle the report and any appeal and to prevent banned users from returning, normally no longer than 2 years after the account is closed.
• Analytics and diagnostic data: up to 24 months.
• Match history and ratings: while your account exists, and deleted or anonymised within 30 days after you delete it.
• Legal holds: longer where the law requires it or where we must preserve evidence, for example for law enforcement in a child safety case.

Security

We use technical and organisational measures to protect your data, including encryption in transit, access controls that limit who can see personal data, and monitoring for abuse. No system is completely secure, so please keep your device and login codes safe and tell us about any suspected unauthorised access.

Children

The Service is only for people aged 16 and over. We ask for your date of birth to check this. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we close the account and delete the data, except where we must keep it to protect a child or meet a legal obligation. Parents or guardians who believe their child is using the Service can contact us at csam@vybe.social.

Your rights

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• correct inaccurate data;
• have your data deleted, including by deleting your account;
• restrict processing;
• receive data you gave us in a portable format;
• object to processing based on legitimate interests, and to object at any time to direct marketing;
• withdraw consent at any time.

To use these rights, email contact@vybe.social. We will reply within one month, and may ask you to confirm your identity. You can also change most profile data and permissions directly in the app and in your device settings.

You have the right to lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in the country where you live or work. If you live outside the EEA (for example in a US state with a privacy law), you may have similar rights, and you can use them by contacting us.

Selling data and automated decisions

We do not sell your personal data. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We may use automated tools to help detect spam, fraud or harmful content, but a person reviews decisions to close accounts.

In Slingshot, when a profile or conversation is reported, its content is analysed by an automated system using Google's Gemini AI so that we can respond quickly. Only reported content is analysed this way. Human moderators review the results and make decisions on account bans, and every appeal is handled by a person.

Changes to this policy

We may update this Privacy Policy from time to time. We will show the new effective date at the top and, for material changes, tell you in the app or by email before they take effect.

Contact us

If you have any questions about this Privacy Policy or your data, email us at contact@vybe.social or write to us at:

Vybe sp. z o.o.
Fasolowa 45/12
02-483 Warszawa
Poland