Slingshot Privacy Policy

Data we collect

Data you give us

• Account data: the email address and account identifier from the Apple or Google account you sign in with. Slingshot does not collect your phone number or use usernames.
• Profile data: your name, date of birth, gender and profile picture, which are required, and your photo bios (photos with text and stickers you add to your profile).
• Verification data: the selfie you take during verification and the result of matching it to your profile picture.
• Personality quiz: your answers to the optional "This or That" quiz and the personality traits we work out from them.
• Preferences: your Discover filters, such as the genders you want to see.
• Chats: chat requests and whether they were accepted or skipped, and the messages, photos, videos, voice notes and replies you send.
• Reports, blocks and support: reports you submit or that concern you (including the optional message you add), users you block, and messages you send to us.

Data collected automatically

• Location: with your permission, your device location is turned into country, region, city and district names on your device. We store only these names, not your coordinates. Other users see your country and city (and district in a chat), never your exact position or your distance from them.
• Age range check: on iOS, whether Apple reports you as eligible by age. We do not store the age range itself.
• Activity: when you were last active (shown as online for a few minutes), which profiles you viewed or skipped in Discover, read receipts and typing status in chats, and when someone takes a screenshot of a chat or profile.
• Device and usage data: IP address and the country it indicates, device model, operating system, app version, push notification token, device identifiers, features used, and crash and performance reports.

Device permissions

The app may ask for access to your camera, microphone, photo library, location and notifications. You can change these at any time in your device settings, although some features may not work without them.

How we use your data

• Provide your account and the app, including your profile, chat requests, chats and photo, video and voice note sharing. (Contract)
• Show you people in Discover who fit your filters and age group, ranked by shared interests, personality quiz similarity and recent activity, and show the interests you share and your vibe match. (Contract)
• Use your location to show your country and city on your profile, and your district in chats. (Consent)
• Send notifications about new messages, chat requests and screenshots. (Contract; consent for push notifications)
• Keep the app safe: check age (date of birth, Apple's age range check, selfie verification and AI age verification), keep age groups apart, handle reports and blocks, moderate content (including automated analysis of reported profiles and conversations), prevent fraud and abuse, and enforce our Terms. (Legitimate interests; legal obligation; vital interests)
• Understand and improve the app with analytics and crash reporting. (Legitimate interests)
• Comply with the law and respond to lawful requests. (Legal obligation)

Legal bases

Each purpose above relies on one of these legal bases under Article 6(1) GDPR:

• Contract (Art. 6(1)(b)): processing needed to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)): for example keeping the Service safe, preventing fraud and abuse, and understanding how the Service is used so we can improve it. We only rely on this where our interests are not overridden by yours, and you can object at any time.
• Consent (Art. 6(1)(a)): for example optional device permissions, push notifications and non-essential analytics or marketing cookies. You can withdraw consent at any time without affecting earlier processing.
• Legal obligation (Art. 6(1)(c)): for example keeping accounting records, responding to lawful requests from authorities and reporting child sexual abuse material.
• Vital interests (Art. 6(1)(d)): to protect someone's life or physical safety, for example in an emergency involving a child.

Who we share data with

• Other users: people in Discover see your profile card: name, age, gender, photos, photo bios, country and city, the interests you share and your vibe match. The person you send a chat request to sees your first message. In a chat, the other person receives the messages and media you send and sees read receipts and typing status.
• Service providers that process data on our behalf under data processing agreements:
  • Supabase (database, authentication and file storage)
  • Google (Gemini API), which analyses reported profiles and conversations and verifies age from photos
  • Apple and Google (sign-in, Apple's age range check and push notification delivery)
  • Expo (push notification delivery)
  • Analytics and crash reporting providers
• Authorities: law enforcement, courts and bodies such as the National Center for Missing & Exploited Children (NCMEC), where the law requires it or to protect someone's safety.
• Successors: a buyer or successor if our business is reorganised, merged or sold, subject to this policy.

Slingshot does not use advertising pixels or show third-party advertising. You can ask us for the current list of service providers at any time.

International transfers

We store your data primarily in the European Economic Area (EEA). Some of our service providers are based in, or access data from, other countries such as the United States. When data leaves the EEA, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified providers) or on the Commission's Standard Contractual Clauses with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

How long we keep your data

We keep personal data only as long as needed for the purposes described above:

• Account and profile data: while your account exists. When you delete your account, we delete or anonymise it within 30 days.
• Chat messages and media: kept while the chat exists. If you delete a chat, it is hidden from you. If you delete your account, the other person keeps the messages you sent them, but they are no longer linked to your profile.
• Reported conversations and profiles: kept together with the moderation records described below.
• Backups: deleted data may remain in encrypted backups for up to 90 days before it is overwritten.
• Reports and moderation records: as long as needed to handle the report and any appeal and to prevent banned users from returning, normally no longer than 2 years after the account is closed.
• Analytics and diagnostic data: up to 24 months.
• Verification selfies: while your account exists, and deleted with it.
• Discover activity: profiles you viewed or skipped are hidden from your Discover feed for 30 days; this record is deleted with your account.
• Legal holds: longer where the law requires it or where we must preserve evidence, for example for law enforcement in a child safety case.

Security

We use technical and organisational measures to protect your data, including encryption in transit, access controls that limit who can see personal data, and monitoring for abuse. No system is completely secure, so please keep your device and login codes safe and tell us about any suspected unauthorised access.

Children

The Service is only for people aged 15 and over. We ask for your date of birth to check this. We do not knowingly collect personal data from anyone under 15. If we learn that we have, we close the account and delete the data, except where we must keep it to protect a child or meet a legal obligation. Parents or guardians who believe their child is using the Service can contact us at csam@vybe.social.

Your rights

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• correct inaccurate data;
• have your data deleted, including by deleting your account;
• restrict processing;
• receive data you gave us in a portable format;
• object to processing based on legitimate interests, and to object at any time to direct marketing;
• withdraw consent at any time.

To use these rights, email contact@vybe.social. We will reply within one month, and may ask you to confirm your identity. You can also change most profile data and permissions directly in the app and in your device settings.

You have the right to lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in the country where you live or work. If you live outside the EEA (for example in a US state with a privacy law), you may have similar rights, and you can use them by contacting us.

Selling data and automated decisions

We do not sell your personal data. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We may use automated tools to help detect spam, fraud or harmful content, but a person reviews decisions to close accounts.

In Slingshot, when a profile or conversation is reported, its content is analysed by an automated system using Google's Gemini AI so that we can respond quickly. We also verify each user's age from their photos using AI. Human moderators review the results and make decisions on account bans, and every appeal is handled by a person.

Changes to this policy

We may update this Privacy Policy from time to time. We will show the new effective date at the top and, for material changes, tell you in the app or by email before they take effect.

Contact us

If you have any questions about this Privacy Policy or your data, email us at contact@vybe.social or write to us at:

Vybe sp. z o.o.
Fasolowa 45/12
02-483 Warszawa
Poland