Romeo & Juliet — Privacy Policy

Who we are

We decide how and why your personal data is used in the App, which makes us the “controller” under the EU General Data Protection Regulation (GDPR).

• Name: Romeo & Juliet, Inc.
• Email: romeoandjulietdating@gmail.com — for questions, requests about your data, reports and appeals. We answer in English or Greek.
• Data protection officer: we have not appointed one; please write to the email address above

What other people can see

Everything here is part of your public profile. It is shown to other users of the App, because showing it is what the App is for. (If you turn on Only people I like can see me, your card is shown only to the people you have liked — see Your choices.)

• Name, age and photos.
• Bio, your prompt answers, and your interests.
• Gender and sexual orientation. You can hide your orientation — see What only you can see for what that does and does not do.
• What you are looking for. Your answer to “What are you looking for?” is shown on your profile unless you switch Show what I’m looking for off in Edit profile (“Casual hookup” starts switched off). Either way it stays part of your profile data, because other members’ copies of the App use it to apply their Looking for filter.
• About you: height, zodiac sign, job title, company, school, languages, education, family plans, pets, drinking, smoking, workout habits, communication style, love style and social-media habits. All optional.
• Roughly how far away you are, and your city. Your coordinates are rounded to about one kilometre before they are stored anywhere another user can read them, and the name of the city or town you are in is shown with them. Turn off Show distance and both are hidden from your profile.
• Whether you are active now, and when you were last active. While the App is open it records the time about once a minute, and once more as you close it, so other people see “Active now” or “Active 12m ago”. Turn off Show online status in Settings and we stop recording it.
• Your verified badge, if you have one.
• Your voice answer, if you record one: the question you picked and your spoken answer, up to 30 seconds. Anyone the App shows your profile to can play it. You can replace or remove it at any time in Edit profile, and the old recording is then deleted from our servers (see How long we keep it).
• Your note, if you post one: a line of up to 60 characters shown on your card, on your profile and in your matches’ Chats list for 24 hours. After that it is no longer shown, and our servers remove it within a day. You can take it down sooner: post a new note, delete it, turn off Notes in Settings › Privacy, or delete your account.
• That you liked them. When you like someone, your name, photo and profile appear on their “Who likes you” list straight away (if your profile is paused, when you are visible again). Their list leaves out people outside their own Discovery filters, such as their age range, so you may appear there later if they change them. Liking is not anonymous, and it cannot be taken back by hiding it — only by removing the like. If you liked one of their photos or answers, they see which one.
• A comment you send with a like. If you add a comment to a like or a Super Like (up to 150 characters), the person sees your words on their Likes page before you have matched — like a message from a stranger. If you match, your comment becomes the first message of your chat. If they report you, the report includes it (see Reports).
• That you blocked them, indirectly. Blocking tells the other person’s copy of the App to hide you, so a determined user could work out they were blocked. We are telling you this rather than implying blocking is invisible.
• That you opened their profile. Viewing someone records a profile view on their account, and they can see it. A view cannot be withdrawn once it is recorded.
• Links and screenshots. Your photos and your voice answer are stored as web links, and the App hands those links to the phones that show them. Anyone who copies a link can open it outside the App, and anyone can take a screenshot of what the App shows them.
• Your first name, passed on by someone else. Anyone shown your card can send a friend your first name and a link to the App on Google Play through their phone’s share menu. Nothing else of yours goes with it: the link carries only a label saying it was shared from the App.

What your matches see, and what they can do with it

Once you match, the other person also sees:

• Everything you send in your chat: messages, photos, voice messages, reactions and calls — and the comment you sent with your like, which becomes the chat’s first message.
• When your messages reached their phone; when you have read theirs; when you are typing. Turn off Read receipts or Typing indicators in Settings › Privacy (or in Chat info, for one chat) to stop sharing the last two.
• What they can do with photos you send. From the photo viewer, a match can save a photo you sent to their phone’s gallery, share it to other apps, forward it to another of their matches, or draw on it and send it back. You are not told when they do. Anything you send can also be screenshotted, so send only what you are happy for them to keep.
• Replies to your note. If a match replies to your note, their message quotes it in your chat.
• The question game. In the question game, answers are held on our servers, hidden from your match, until both of you have answered; then both answers are shown in your chat. Until then your match can see that you have answered, but not what.
• Asking to get verified. A verified member can ask a match to get verified. It is optional; your match only ever sees your badge, never your photos or ID.
• Your away status. While your profile is paused, you can show your matches a status (Travelling, Busy with work, Studying, Taking a break). It is part of your profile while you are paused, the App shows it only to your matches, and it is removed when you are visible again.

On your own phone:

• Blur photos from new matches (Settings › Privacy, on to start with): photos a match sends before you have replied arrive blurred until you tap them. This happens on your phone only.
• Share my date (Chat info): writes a short message with your match’s first name and when and where you are meeting, for you to send to a friend with an app you choose. If you share it, its date and time (and who it is with) stay on your phone, so the App can ask you the next morning how it went. Nothing is sent to us unless you choose to report.
• Name days: the App checks your matches’ first names against the Greek name-day calendar on your phone. Nothing is sent anywhere.
• Hidden words and “Send it like this?” Hidden words (Settings) hides the comments on likes and Super Likes that use crude words or words you choose. Before you send a message that might come across as hurtful, the App may ask “Send it like this?”, and under a hurtful message you receive it may ask “Does this bother you?”. Hidden words in likes and these checks run on your phone. Your messages and your own hidden words never leave it.
• Safety tips in chats are chosen on your phone. Your messages are not sent anywhere for this.

What only you can see

Kept so the App works for you. Other users cannot read any of it.

• Your date of birth. Other people are shown your age, never the date. We keep the date so your age stays correct as time passes and so it survives reinstalling the App.
• Your precise location, used to work out the distances you are shown and, on our servers, to find the people near you. Only the rounded version above is ever visible to anyone else.
• Your phone number, used to sign you in by SMS. When you sign up, our servers also check a scrambled fingerprint of it (and of your sign-in email, if you have one) against the record of banned accounts (see Reports), and when you sign up or change your number, against the people other members blocked with Block contacts (see Your choices).
• Your email address, if you sign in with Google (or gave us one in an earlier version of the App). It is never shown on your profile.
• Your settings: your Discovery filters and switches, your notification switches, and which chats you muted. A copy of your notification switches and muted chats is kept with your account so our servers can respect them. (Your privacy switches — such as Show age, Show distance and Only people I like can see me — are kept with your profile, because other members’ copies of the App need them to apply them. They are never shown.)
• Who you have passed. The pass itself is invisible — nobody is told you passed on them. Your passes keep those people out of your deck until you choose Give second chances, and while Learn from my swipes is on they also help order your deck, as your likes do (see How your deck is ordered). Likes, blocks and profile views are not on this list; see above for what the other person is shown.
• What we learned from your swipes, while Learn from my swipes is on — counts of the profile details of the people you liked and passed (see How your deck is ordered).
• If you hide your age or your orientation. With Show age off, your age disappears from your profile and your card, but it stays stored with your profile and is still used to apply other people’s age filters, so their copy of the App receives it without showing it. With Show my orientation on my profile off, your orientation is removed from the profile other people can read and kept where only you and our servers can read it; our servers still use it to decide whom you see and who sees you (see Sensitive information).

How your deck is ordered

• Your filters come first. Who can appear in your deck is decided by your Discovery filters and by who you want to see, and only people whose gender settings fit yours both ways are shown. Nothing the App learns ever changes that.
• Activity and distance. People who were active recently come earlier. In Global mode, people within your distance come first, then everyone else, roughly nearest first. Your precise location is used, on our servers, to find the people near you; nobody else sees it.
• Super Likes. Someone whose Super Like on you still stands comes a little earlier in your deck, and their card shows a small “Super Liked you” star. Only that Super Like is used, whether or not Learn from my swipes is on.
• What you like (Learn from my swipes), only if you say yes. This is off until you turn it on. The App asks you once, on a card in your deck, and you can turn it on or off in Discovery at any time. While it is on, every like, Super Like and pass you make — including liking someone back or dismissing them on the Likes screen — is counted against the details the other person chose to show on their profile: what they are looking for, interests, education, family plans, communication and love style, pets, drinking, smoking, workout, social-media habits, star sign, height, their age and distance (only if they show them), how many photos and prompts they have, whether they have a bio, and whether they are verified. A Super Like counts three times; Rewind takes a swipe back out. People with details you tend to like move earlier in your deck. Gender, sexual orientation, the languages someone speaks and who someone wants to see are never used, and photos are never analysed — the App learns nothing about anyone’s looks. While it is off, nothing is counted and your deck is not ordered by it.
• Where it is kept. The counts are stored on your account in Google Firebase, can be read only by you and our servers, and are never shown to anyone. You are never shown a score. Your answer — yes or not now — is kept with your Discovery settings, so your other phones do not ask you again.
• Room for surprise. While Learn from my swipes is on, about one card in five is placed by recent activity alone (in Global mode, by distance too), so your deck does not narrow to one type of person.
• People who liked who you liked. This is built but switched off: today it uses nothing, and we will update this policy before we switch it on. When on, people that at least three other members — verified members who liked at least two of the same people you did — also liked may move a little earlier in your deck. It would be worked out on our servers once a day, from likes only (never passes), only from members who have Learn from my swipes on (you included, while yours is on), and it is built so that no one can tell who liked whom.
• When you run out. Once you have seen everyone who matches your filters, we can show people slightly outside them: up to 10 years either side of your age range (never under 18), and up to twice your distance or 20 km beyond it, whichever is further (never past 161 km, and never in Global mode), with Has a bio, Number of photos, Hide inactive profiles and Show me people looking for relaxed too. Only verified profiles never relaxes, and neither do who you want to see, your blocks or the people you passed. Someone who hides their age or distance is never shown because of a stretched age or distance. These people come after everyone who fits, after a card telling you so, and each carries an “Outside your filters” tag. Two switches in Discovery — one for age, one for distance — turn this off; both are on to start with.
• Why, and on what basis. We order your deck to show you people you are more likely to want to meet. Ordering by recent activity (and, in Global mode, by distance), moving people whose Super Like on you stands a little earlier, and showing people slightly outside your filters once you run out are part of providing the service you use the App for. Learning from your swipes happens only with your consent (GDPR Art. 6(1)(a)). Because the details it counts include what people are looking for — a casual hookup, for example — what it learns could say something about your sex life, so we ask for your explicit consent (Art. 9(2)(a)).
• Your choice. You choose whether your deck learns from your swipes, and you can withdraw this anytime: turn off Learn from my swipes in Discovery and we stop counting, stop ordering your deck by it and delete what was counted. Turn it on again and it starts from nothing. Withdrawing does not affect what was done before you withdrew. To see only people who fit your filters, turn off the two slightly out of my range switches in Discovery. You can also email us.

What nobody else sees

• Messages. What you write in a chat is visible only to you and the person you matched with, with two exceptions. Photos sent in chat are checked automatically — see Automated photo checks below. And if either of you reports the other, the report includes your conversation’s most recent messages — see Reports below. (A comment sent with a like is different: the person reads it before any match — see What other people can see. And a notification about a new message carries its text — see Notifications and reminders.)
• Verification photos. If you ask for the verified badge, the selfie and the photos of your ID document that you submit are stored for review by our review team and are never shown to other users. The live face check that guides the selfie runs on your phone; only the photos you choose to submit leave it. These photos are deleted 30 days after the decision, or with your account if that comes first. After that we keep only the outcome of the review (for example, whether you are verified). The badge stays while at least one photo we checked is on your profile; if every one is replaced, the badge is paused until a new selfie is checked by a person. While a badge lasts we keep which of your profile photo files were checked (not copies of them), deleted with your account.

Automated photo checks

• Since we switched the check on, early on 25 October 2026, every photo uploaded to the App is checked automatically by Google Cloud Vision as it is uploaded. This covers profile photos and photos sent in chat. Photos uploaded before the check was switched on were not checked automatically. If the check cannot run when a photo is uploaded (for example, if Google’s service fails), that photo stays unchecked. Nobody reads your conversations unless one of you reports the other (see Reports below) — the check looks only at the image, and only at the moment it is uploaded. Voice answers, voice messages and verification photos are not checked this way.
• Upload limit. Each check has a cost, so one account can upload only a limited number of photos an hour — far more than normal use needs (for example, 40 profile photos an hour). Photos uploaded past the limit are deleted at once, without being checked.
• A photo the check flags as adult, violent or explicit is deleted straight away and a report is created for human review. That report records your user ID (for a chat photo, the conversation’s ID), which file it was and how the check rated it, and is kept as a safety record. We also keep, with your account, a note of which of your profile photos were removed, so that an older copy of the App cannot put one back.
• You are told. The App shows you a notice saying what was removed (a profile photo or a photo you sent in a chat), that our automatic check removed it, and why (adult, violent or explicit content). If you think it was a mistake, email us — see Appeals in our Terms.

Reports

• When you report someone, the report holds who you are, who you reported and the name on their profile, your answers to the report questions, any of their profile photos you point at, and anything you write. We do not tell the person you report who reported them.
• A report about someone you have matched with also includes your conversation’s most recent messages: the text of the last 14, who wrote each one (you or them) and when. A report about one photo in your chat, or about a message the App asked “Does this bother you?” about, quotes the messages up to that one. A photo is recorded as a note that one was sent, with its caption if it had one; voice messages and calls only as a note that one was sent. The files themselves are not copied. A question-game card is quoted with its question and any answers already revealed. The same applies to your messages if the other person reports you.
• A report about someone who liked you with a comment also gets a copy of that comment and when it was sent. Our servers copy it from their like, so the review team can read what was written even if the like is taken back later. The same applies to your comment if the person you liked reports you.
• A report also keeps a copy of what the reported person’s profile showed everyone when it was filed — the bio, prompt answers, job, company and school, the note on show and the voice answer (its question and a link to the recording) — as part of the safety record. The same applies to your profile if someone reports you.
• Reports about a possible minor, threats or sextortion are marked urgent, and our review team is alerted at once. If one account sends more than 10 reports in 24 hours, we keep the later ones but review them separately, and they are not marked urgent.
• Reports are read only by our review team, are never shown to other users, and are kept as a safety record until we decide on them and for 12 months after that — even after the conversation is deleted, or either account is. They are then deleted within a week, with the messages they quote, any comment, the profile copy and our note. A report is kept longer only while another report about the same person by a member (not by our automatic photo check) is still being reviewed (or the evidence of their deleted account is held for one).
• If we find a report is right, we may warn the reported account (the warning is shown to that person in the app, without saying who reported them) or ban it. We keep a record of warnings with the account, and delete it if the account is deleted. A ban turns off the account’s sign-in and hides its profile from everyone; the person is told the account was banned when they try to sign in. A banned account’s data is kept while the ban stands, so the decision can be reviewed or appealed: the ban stands until we lift it, and what it was about (the reports, the messages they quote and our decision) is kept 12 months after the decision, like every report. When we ban an account we also keep a scrambled fingerprint of its phone number and sign-in email — made with a secret key, so the number or email cannot be read back from it. If a banned account is deleted, its sign-in and profile are deleted like any other account’s, but we keep that fingerprint, so a new account made with the same number or email is banned too; the reports about it, with what we decided and any note we made, are kept as a safety record like every other report. The fingerprint is deleted if the ban is lifted on appeal. How to report without the App, and how to appeal a decision, is in our Terms.

Notifications and reminders

• How they travel. Notifications go from our servers to your phone through Google’s Firebase Cloud Messaging, using a push token your phone gives us.
• What they carry. A new-message notification carries the sender’s first name, the text of the message (or just “Photo”, “Voice message” or “Missed call”; for a question-game card, only “Question game”) and a link to their first profile photo, so your phone can show it. A new-match notification carries the other person’s first name; an incoming call carries the caller’s name and photo link; a match reminder carries your match’s first name. Notifications about likes, Super Likes and comments, New people near you, a request to get verified, the answers of a question game, a warning, a removed photo, an unsent message or your profile being visible again carry no name and no words — only what kind of alert it is, and the App writes the line on your phone.
• When. A Super Like is told at once (at night, silently), but only once for each person who sends one, and at most one every 20 minutes; one sent within those 20 minutes is told like an ordinary like. Other likes are told at most once every 4 hours, between 09:00 and 23:00 Greek time. “Say hi” goes to both of you a day after a match if nobody has written; “Your turn” goes to the one who owes an answer when a message has waited a day — each once, at 18:00 Greek time. New people near you comes at most every 3 days, when someone new could appear in a deck that had run out.
• Your switches. Settings › Notifications turns each kind off (new matches, messages, new likes, Super Likes, reminders, New people near you), and Android’s own settings can turn off all of them. When you switch a kind off in Settings › Notifications, our servers stop sending it to your phone. For a message they still send a signal with no name and no words, only so the sender sees that it was delivered (the second tick). Muting a chat does the same for that chat’s messages, and stops its reminders. Calls, and notices about your account and safety (verification, a warning, a removed photo, your profile being visible again), are always sent. Older versions of the App (before 9.11.1, or before 9.11.7 for muted chats) only stop the phone showing what was sent.
• The records behind them. Our servers keep a few records for this. Only our servers can read them, and all of them are deleted with your account:
  • Notification bookkeeping: when we last sent you each kind of alert, whether a likes alert is waiting, and short one-way codes made from each sender’s account ID (never the ID itself) for the last 50 people whose Super Like we told you about, so the same person can never make your phone ring twice, and for the matches who asked you to get verified, so each can tell you only once; and the times of your last few reports, for the report limit (see Reports).
  • Match reminders: for each match, who wrote last, who owes an answer and since when. Deleted when the match ends.
  • The “new people” waiting list: while your deck is empty, your gender, your sexual orientation (even if you hide it), who you want to see, your Discovery filters, and the roughly 5 km grid square you are in — never your exact location. Removed as soon as your deck has someone in it again, or once you have been told.
  • Search and use limits: how often your App searched for people this hour, and the roughly 5 km grid squares it searched from today, so nobody can use the search to pinpoint people who hide their distance; counts of the photos you uploaded, the call-relay requests, the question-game answers and the Match in person codes and scans you used this hour, and of the people you blocked by number or email today; and, for Match in person, who you liked by scanning on the last day you did. While you are paused, it also holds the people you liked, so they can be told when you are visible again.
  • The deck’s search index: your roughly 5 km grid square and the profile facts the deck filters on (age, gender, orientation if you show it, who you want to see, what you are looking for, verified or not, number of photos, whether you have a bio, the day you were last active, paused or not).
  • Warnings, photo-removal notices, the note of removed photos described above, and the record of which photos your verified badge was checked on.

Device and diagnostic data

• A push token, so we can send you notifications (see above).
• Crash and error reports — always on. When the App crashes, or an important action fails (for example a like, a message or a photo upload that our servers refused), a report goes to Firebase Crashlytics. The report carries technical details such as the phone model, the Android version, the App version and what failed, and where in the App’s code. The App never adds your account ID to it, and removes links, email addresses, phone numbers, long IDs and anything quoted (where a name or a message’s words would usually appear) from every line it writes into it. We use these to find and fix faults.
• Usage statistics — only if you say yes. After you sign in, the App asks you once whether to share usage statistics; you can change your answer any time in Settings › Privacy › Share usage statistics. Until you say yes, Firebase Analytics collects nothing. If you say yes, it receives events such as: a like, Super Like or pass, a match, a message or voice message sent, and the reason chosen when deleting an account — never what you write, your photos or who you talk to — along with what Firebase Analytics records by itself, such as when the App is opened and for how long, and the phone model and country. Saying no later stops it and clears what Analytics kept on your phone. The answer is kept on your phone, so each phone asks. The App has no advertising and does not use your advertising ID.
• Counting totals. We count totals — how many accounts are created, finish their profile, come back, get a match, or find nobody new to see — from information our service already holds (sign-up dates, profiles, matches). These totals never name anyone.
• Checking the App is genuine. Before our servers answer, the App asks Google Play Integrity (through Firebase App Check) to confirm it is a genuine copy on a genuine phone. Google receives information about your phone and the App for this.
• Your town’s name. Your phone’s own place-name service (on most Android phones, run by Google) turns your coordinates into the name of your city or town.
• Faces in photos. Finding the face to frame a new profile photo, and the live face check for verification, run on your phone with Google’s on-device face detection. Nothing is uploaded for this.
• Camera, microphone, location and contacts. The App can use these only after you allow it when Android asks, and you can say no or change your answer later in Android’s settings: the camera to take a profile photo, for the verification selfie and ID, and to scan a Match in person code; the microphone for voice answers, voice messages and calls; your location for distances and to find people near you; and your contacts only for Block contacts (see Your choices).
• Rating the App. We may ask you to rate the app through Google Play. Your rating and review go to Google Play under Google’s terms; we don’t receive them from the app.

Sensitive information

Sexual orientation is personal. It is optional; it is stored only if you enter it; and you can clear it (choose Prefer not to answer), or delete your account entirely, at any time. Unless you hide it, it is part of your public profile. Hidden or not, our servers use it to decide whom you see and who sees you, and keep it in the “new people” waiting list while your deck is empty (see Notifications and reminders). What you are looking for — a casual hookup, for example — could say something about your sex life. It is shown on your profile unless you switch it off (“Casual hookup” starts switched off), and other members’ copies of the App use it for their Looking for filter either way.

If you turn on Learn from my swipes, the App counts, among other details, what the people you like and pass on are looking for. That could say something about your sex life, so it happens only with your explicit consent, and turning the switch off deletes it (see How your deck is ordered).

The photos of your ID document that you submit for verification are identity documents. They are seen only by our review team and are deleted 30 days after the decision (see What nobody else sees).

Why we use your data, and on what legal basis

What you must give us. To use the App you sign in with a phone number or a Google account, and answer the sign-up questions the App does not let you skip: your first name, date of birth (you must be 18 or over), gender, who you want to see, what you are looking for and at least two photos. Without them we cannot run your account or show your profile. The sexual orientation question can be answered with Prefer not to answer, and everything else, including your location, is optional.

• Performing our contract with you — Art. 6(1)(b): your account and sign-in; showing your profile; your deck, likes, matches, chat and calls; notifications about your matches and messages; using your location for distances and to find people near you; ordering your deck by activity and distance and by a Super Like on you, and showing people slightly outside your filters; Match in person; pausing for a set time and your away status; the question game; asking a match to get verified.
• Your explicit consent — Art. 9(2)(a) — which you withdraw by choosing Prefer not to answer (as well as Art. 6(1)(b)): your sexual orientation, when you choose to enter it.
• Performing our contract with you — Art. 6(1)(b) — and your explicit consent — Art. 9(2)(a) — given when you choose your answer; to withdraw it, email us or delete your account: what you are looking for (sign-up asks for it; you can change it in Edit profile, or hide it with Show what I’m looking for, but not clear it).
• Your consent — Art. 6(1)(a) — and, because it may say something about your sex life, your explicit consent — Art. 9(2)(a): Learn from my swipes.
• Your consent — Art. 6(1)(a): usage statistics.
• Your consent — Art. 6(1)(a) — which you withdraw by emailing us: we then delete your selfie and ID photos within 30 days (see our delete-account page): verification (your selfie and ID photos).
• Our legitimate interests in keeping members safe, preventing abuse and fraud, and keeping the App working — Art. 6(1)(f) — and our legal obligations as a hosting service under the EU Digital Services Act — Art. 6(1)(c): automated photo checks and the upload limit; reports, the report limit and the copy of a reported profile; warnings and bans, and the record of a ban kept after the account is deleted; keeping reports after an account is deleted, and holding the evidence of a report that is still being reviewed when the reported person deletes their account; Block contacts; checking the App is genuine; search limits; the record that an account was deleted; crash and error reports; backups.
• Our legitimate interest in knowing how the App is doing, from totals that name nobody — Art. 6(1)(f): counting totals (accounts created, finished profiles, people coming back, matches, empty decks).
• Our legitimate interest in telling you about activity that concerns you — Art. 6(1)(f); each one can be switched off: likes alerts, reminders and New people near you.
• Our legal obligations — Art. 6(1)(c): answering your requests about your data, and keeping a record of them.
• Your consent — Art. 6(1)(a): the website’s waitlist.
• Our legitimate interest in running it — Art. 6(1)(f): hosting the website.

Where we rely on your consent, you can withdraw it at any time; this does not affect what was done before. Where we rely on our legitimate interests, you can object (see Your rights).

Where it is stored, and who handles it

We use the providers below. Unless we say otherwise below, they process your data for us, under contract and on our instructions, and not for their own purposes. We do not sell your data, and we do not hand it to third parties for their own purposes. The App is free; there is nothing to buy.

• Google (Firebase and Google Cloud) — Google Cloud EMEA Limited (for Cloud Firestore, Cloud Storage and Cloud Functions) and Google Ireland Limited (for the other Firebase services), both in Dublin, Ireland:
  • The database — profiles, likes, matches, messages, reports and settings — is in Google’s “eur3” location, in Belgium and the Netherlands (EU). Its daily backups are kept in the same place.
  • Our server code runs in Belgium (EU), with two exceptions in the United States: the automatic photo check, and a sign-in check kept for very old versions of the App.
  • Stored files — profile photos, voice answers, photos and voice messages sent in chat, verification selfies and ID photos, and the copies of chat photos and voice notes we hold for a review when a reported person deletes their account (see Your choices) — are in Google Cloud Storage in the United States (us-east1, South Carolina). These leave the EU.
  • Sign-in (Firebase Authentication, which also sends the SMS codes), notifications (Firebase Cloud Messaging), crash reports (Crashlytics), usage statistics (Analytics, only with your yes), App checks (App Check and Google Play Integrity) and photo checks (Cloud Vision) are global Google services, which may process data in the United States and elsewhere.
• Cloudflare — the call-connection and call-relay services described under Voice calls below; a global network.
• Netlify and EmailJS — our website (see Our website).
• jsDelivr and cdnjs — public networks our home page loads code libraries from. We have no contract with them: they are not our providers, and they see your IP address and what your browser asks them for under their own privacy policies.

Transfers outside the EU. Where data goes to the United States or another country outside the EU, it is protected by the EU–U.S. Data Privacy Framework (for providers certified under it) and by the European Commission’s standard contractual clauses in each provider’s data-processing terms. You can ask us for a copy of these safeguards.

Authorities. We give data to the police, courts or other authorities only when the law requires it, in answer to a lawful request.

Voice calls. When you call a match, their phone can receive your phone’s IP addresses as soon as it starts ringing, even if they never answer; when a match calls you, yours go to them only if you answer. An IP address can show roughly where you are, even with Show distance off. To stop this, turn on Protect my IP in calls (Settings › Privacy, on each phone; off to start with): your calls then always go through Cloudflare’s call relay, so the other phone sees only the relay’s address, never yours, and if no relay can be reached the call does not start. These addresses pass through our servers, which delete them about a day later. The call goes directly between the phones whenever it can. Each phone also contacts public servers run by Google and by Cloudflare that tell it its own network address, and Cloudflare’s call-relay service, which carries the call when the two phones cannot reach each other directly. These services see your phone’s IP address. The call’s audio is encrypted between the two phones, so the relay passes it on without being able to hear it. We do not send Cloudflare your name, phone number or account.

How we protect it

• Everything between the App and our servers travels encrypted (HTTPS), and Google stores our database and files encrypted.
• Our database and file-storage rules decide what each member’s App can read: your own data, and of other people only what this policy says members can see. The records we call server-only — reports, the ban and Block contacts fingerprints, Match in person codes, and the notification and search records — cannot be read by any member, and no member can open a verification photo. Only our review team reads reports and verification photos.
• The fingerprints of phone numbers and emails (for bans and Block contacts) are made with secret keys kept apart from the database, in Google Secret Manager.
• Our database and file storage answer only a genuine copy of the App, confirmed by Firebase App Check (see Device and diagnostic data).
• One exception: photos and voice recordings, including those sent in chat, are stored as web links. The App gives them only to the people this policy says can see them, but anyone who has a link can open it outside the App (see Links and screenshots).

How long we keep it

• Your profile, settings, date of birth, phone number, email address, precise location and what was learned from your swipes: until you change or delete them, or delete your account.
• Profile photos you remove from your profile: deleted from our storage within minutes (we can still recover them for 7 days, then they are gone), unless a report about you from another member is still being reviewed, or a report points at that photo; such photos are kept until your account is deleted.
• Your voice answer: until you replace or remove it, or delete your account. The old recording is then deleted within minutes (we can still recover it for 7 days, then it is gone), unless a report about you from another member is still being reviewed, or a report points at it, which keeps it while that report needs it. A weekly check also removes recordings left behind by a failed save.
• Your note: shown for 24 hours, then removed from our servers within a day; sooner if you post a new one, delete it, turn off Notes, or delete your account.
• Likes you sent, with any comment: until you take the like back (Rewind, unmatch or block) or delete your account; the copy on the other person’s Likes page goes with it.
• Passes and blocks: until you delete your account, or unblock (Give second chances lets passed people back into your deck).
• People you blocked with Block contacts (fingerprints only): until you unblock them or delete your account. The record that two accounts are kept apart goes when either account is deleted, or when you unblock them (unless they blocked you this way too).
• Your match-in-person codes (fingerprints of the last two only, each with a fingerprint of who scanned it first): until you next open My code (newer ones then replace them); deleted with your account.
• If you scanned someone’s match-in-person code: the fingerprint of you kept with that code: until they next open My code, or delete their account (not when you delete yours).
• Who you liked by scanning a code, on the last day you did (for the daily limit): until you next like someone new by scanning on a later day (the list then starts again); deleted with your account.
• Profile views of you: until you delete your account.
• Matches, messages, and photos and voice messages sent in chat: until either of you unmatches or blocks, or deletes their account. A message you unsend is deleted for both of you (to clear it from the other person’s notifications, our server keeps only which chat and when — no words — for at most a day). Delete conversation in Chat info clears it from your phone only.
• A question-game answer: held on our servers, hidden, until both of you have answered (then it is part of your chat, like a message); deleted sooner if the card is unsent, the match ends or either account is deleted.
• When a timed pause ends: until the pause ends or you end it; deleted with your account.
• Your away status: while you are paused; removed when you are visible again.
• Call records (who called, the call’s connection details and IP addresses): about a day; the call’s line in your chat stays like a message.
• Verification selfie and ID photos: until reviewed, then 30 days after the decision, or until you delete your account if that comes first; after that only the outcome of the review.
• Which of your profile photo files your verified badge was checked on (not copies of them): while the badge lasts (also while it is paused); deleted with your account.
• Reports, with any quoted messages, comments and profile copy, and our decision: until decided, then 12 months (deleted within a week after that), even after either account is deleted; longer only while another report about the same person by a member (not by our automatic photo check) is being reviewed, or the evidence of their deleted account is held.
• If you delete your account while a report about you from another member is being reviewed: your profile photos and voice answer, and your chats with the people who reported you (every message, photo and voice note in them): never shown to anyone in the App, only for the review; kept until every report about you is decided, at most 180 days, then deleted.
• Warnings, photo-removal notices, the note of removed photos, and the notification, reminder, search and deck records described under Notifications and reminders: until you delete your account (a match’s reminder record goes when the match ends).
• A banned account: the ban stands until we lift it; what it was about (the reports, the messages they quote and our decision) is kept 12 months after the decision, like every report.
• The record of a ban: a scrambled fingerprint of the banned account’s phone number and sign-in email (never the number or email itself): as long as the ban stands, even after the account is deleted; deleted if the ban is lifted.
• The record that an account was deleted (its internal ID only): 30 days.
• Why you left, if you tell us while deleting your account: kept without your name or account.
• Daily backups of the database: 7 days.
• Deleted files (photos, voice recordings, verification photos): can still be recovered by us for 7 days after deletion, then gone.
• Our servers’ technical logs, which can contain your account’s internal ID: 30 days.
• Crash and error reports: 90 days.
• Usage statistics, if you said yes: 2 months for individual events; 14 months for user-level data, counted from your last activity.
• Website waitlist addresses: Until launch, then deleted.
• Emails with you about requests: 3 years after we answer the request.
• On your phone: your chats, settings and session: until you log out or uninstall the App (a few of your switches, such as Read receipts and Protect my IP in calls, and your hidden words stay on that phone for your next sign-in).
• On your phone: a date you shared with Share my date (its time and who it is with): until you answer the App’s question about how it went, or 3 days after it asks; removed when you log out.
• On your phone: the names of the people you blocked from your contacts: until you log out, delete your account or uninstall the App.

Our website (romeoandjulietdating.com)

• Hosting. The site is hosted by Netlify, which receives your IP address and the pages you ask for, as any web host does.
• Fonts and code libraries. Its fonts are served by the site itself. The home page loads code libraries from the jsDelivr and cdnjs networks, so your browser also contacts those services, which see your IP address.
• The email waitlist. If you join the waitlist on the home page, the email address you type is sent from your browser to EmailJS, the service that sends our waitlist emails; it never reaches the App’s own servers. We use it only for waitlist emails, such as telling you when the App launches; email us to be taken off the list.
• The site has no analytics or advertising, and sets no cookies of its own.

Your choices

• Pause: hide your profile from discovery at any time in Settings — until you turn it back on, or for a set time. When you pause your profile for a set time (24 hours, 3 days or a week), we keep the end time on our server only — never on your profile — so we can make you visible again automatically, and we tell you when you are. Likes you send while paused reach people when you are visible again. While paused, you can also show your matches an away status (see What your matches see).
• Privacy toggles: hide your online status, your distance, your age or your orientation from other users (see What only you can see for what hiding your age and orientation does and does not do).
• Only people I like can see me (Settings › Privacy): your card is shown only to people you have liked. Your matches and likes stay as they are; your profile is not secret, it is just not shown to anyone else.
• Notes (Settings › Privacy): turn it off to hide everyone’s notes on your phone and take your own note down.
• Share usage statistics (Settings › Privacy): on only if you said yes.
• Read receipts, typing indicators, Photo Verified Chat, blurred photos from new matches and Protect my IP in calls: Settings › Privacy.
• Notifications: Settings › Notifications, one switch per kind; mute a chat in Chat info to stop that chat’s notifications.
• Hidden words (Settings): hide the comments on likes and Super Likes that use crude words or words you choose.
• Block & report: stop all contact with any user.
• Block contacts (Settings). Your contact list is read on your phone only, and it is never uploaded or stored by us. The App asks for access to your contacts only when you tap Import contacts, and you can also block someone by typing their number or email. When you block someone this way (picked from your contacts, or a number or email you type), our server receives that person’s phone number(s) and/or email only for the moment it takes to check whether each one belongs to an account here and to turn it into a keyed one-way fingerprint. It stores only the fingerprint, whether it was a phone number or an email, and the date — never the number, the address or the name, which stays on your phone. If one of them belongs to an account, now or later (when they sign up or change their number), our server also records that your two accounts are kept apart (never the number), so that neither of you sees the other in discovery, Likes or New people near you, and you cannot match. They are not told. People you have already matched with stay in your chats (block them there). All of it is deleted when you unblock them or delete your account, and the record that you are kept apart also when they delete theirs (it stays after you unblock them only if they blocked you this way too).
• Match in person. Settings › Match in person shows a QR code that holds no name and no account number — only a random code our server makes. It works for only a few minutes (while My code is open, a new one replaces it every two minutes), and each code works for one person: the first to scan it. Our server keeps only a one-way fingerprint of your last two codes (and, for each, a one-way fingerprint of who scanned it first), until you next open My code (newer ones then replace them) or delete your account. Anyone else who scans a code that was already used is told it has expired, and your phone may be told that one of your codes was scanned — never by whom. If you scan someone’s code, the fingerprint of you stays with their code until they next open My code or delete their account. Scanning someone’s code counts as a like from you; if you both scan each other’s code, or they had already liked you, you match. A match made in person ignores your discovery filters and earlier passes, but never the genders you chose to see, a block, an unmatch, Block contacts or our safety rules. When a scan does not count (for one of these reasons, or because the person whose code it is has paused their profile), the person who scanned gets the same answer as for a like that is waiting, though nothing appears in their own Likes sent; they are never told why. The camera is used only on the Scan tab, only after you allow it, to read the code on the other phone; no picture is kept or sent — only the code it reads, and only if it is one of ours. For the daily limit we keep which people you liked by scanning on the last day you did; that list is replaced the next time you like someone new by scanning on a later day, and deleted with your account.
• Learn from my swipes: off until you say yes; the App asks you once, and you can turn it on or off in Discovery at any time. Turn it off and we stop counting your swipes, stop ordering your deck by them, and delete what was learned; while it is off, your likes are never used to order anyone else’s deck either. Turn it on again and it starts from nothing.
• Show people slightly out of my range when I run out: two switches in Discovery, for age and for distance, both on to start with. Turn them off to see only people who fit your filters.
• Delete your account: Settings › Delete account (the button at the bottom) permanently removes your profile, photos, voice answer, note, matches, messages, likes (with any comments, and the copy on the other person’s Likes page), passes, blocks (Block contacts too), match-in-person codes, verification photos and sign-in — from our servers too. A few things survive: safety reports, including any messages, comments or profile copy a report quotes (see Reports); if your account was banned, a scrambled fingerprint of its phone number and sign-in email (see Reports); profile views you made, and other members’ own records that they passed on you, dismissed your like, unmatched or blocked you, which stay on their accounts as your account’s internal ID and a time; if someone blocked your number or email with Block contacts, the fingerprint our server made of it for them, kept with their account; short one-way codes in other members’ notification records (for a Super Like or a request to get verified you sent) and, if you scanned someone’s Match in person code, the fingerprint of you kept with that code until they next open My code; and, if you tell us why you are leaving, that answer, without your name or account. If you delete your account while a report about you from another member is still being reviewed, we delete your sign-in, your profile and everything else at once, but keep — never shown to anyone in the App, only for the review — your profile photos and voice answer, and your chats with the people who reported you (every message, photo and voice note in them). They are kept until every report about you is decided, at most 180 days, then deleted. Our delete-account page has the full list.
• Download my data: Settings › Account › Download my data gives you a summary — your name, email address and phone number, your city, bio and who you want to see, your profile details, what you are looking for (and whether it is shown), your Discovery filters, your deck switches with what was learned from your swipes, your pause (when a timed pause ends, and your away status), and, for each person you blocked by number or email, whether we hold a number or an email and the day. It does not include everything we hold (for example your photos, voice answer, prompts, note, date of birth, likes and comments, matches, messages or verification status). For a complete copy, see Your rights.

Your rights

Under the GDPR you can ask us for a copy of your personal data (access), to correct it, to delete it, to restrict how we use it, to receive the data you gave us in a portable format, and you can object to what we do on the basis of our legitimate interests. You can withdraw any consent at any time.

• In the App you can do most of this yourself, straight away: edit or clear your profile, use the switches above, download the summary, or delete your account.
• By email: write to romeoandjulietdating@gmail.com from the email address on your account (the Google address you sign in with). A phone number written in an email is not proof — anyone can type someone else’s number — so we cannot act on that alone. If your account has no email address, we will ask you to confirm the request from inside the App (for example by posting, as your Note, a short code we send you) before we act or send anything.
• We answer within one month. If a request is complex we may need up to two more months, and we will tell you so within the first month.
• Decisions made automatically. These happen without a person deciding first: our photo check deletes a photo it flags; photos uploaded past the hourly limit are deleted; and a new account whose sign-in phone number or email matches the record of a banned account is banned as soon as its profile is made. Every photo the check removes also creates a report for our review team. You can ask for a person to look again at any of these decisions, give your side and contest it — email us (see Appeals in our Terms). The order of your deck is also worked out automatically (see How your deck is ordered); it decides only the order in which you see people.
• You can complain to a data protection authority. In Greece this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, www.dpa.gr. You can also complain in the EU country where you live or work, or where you think the problem happened. We would be glad to hear from you first.

Children

The App is for users 18 and over. If we learn that an account belongs to someone under 18, we ban it at once: it can no longer sign in and its profile is hidden from everyone (see Reports).

Changes to this policy

When we change this policy we update the date at the top, and the summary in the App with the next version of the App. Wherever a change needs your consent, we ask you again.