Privacy policy

Who answers for your data

The data controller is Gabriela Cintas, non-professional publisher of the matchy service.

A question, a request, a doubt: contact@matchy.fans. It is the only address, and it is read.

On the website

The website collects only what the waiting list needs:

• your email address, when you sign up;
• the result of your mirror test (a “tribe”), if you take it;
• the sign-up date, to manage the messages we send.

Your individual answers to the test are not stored: only the final result is. The website collects no name, no age, no location, and uses no advertising tracking cookies — only cookies strictly necessary to make it work may be set.

In the app: what we keep

Your account

Your email address, your first name, your @, your photo if you add one, and your tribe.

What you write for yourself

Your wellness check-ins, your notebook, your evening reflections.

What you share

Your moments and their photos, your answers to the question of the day, the places you suggest, your bio, and what you say you love.

What the product builds

Your Mirror archetype, your tribe, your glow, your XP, your bloomed flowers, your seals.

Your links to others

The girls you keep close, those whose moments you no longer wish to see, your reports. No one but you sees these lists, and no girl ever learns that she has been kept, hidden or reported.

The bare technical minimum

Error logs, approximate city if you turn on location, and your Event bookings. Your position is never tracked in the background nor kept as a movement history — and the app works just as well if you pick your city by hand.

What no one else sees

Your wellness check-ins are private. Always. Your glow, your mood, your energy, your sleep are visible to you alone. They appear on no profile, in no ranking, in no comparison — and there is no ranking between girls in matchy at all.

Your notebook is encrypted: it is unreadable by anyone, including us. Your “private” moments are private. A girl’s profile shows only her @, her archetype, her bio and what she loves — never her surname, never her glow, never her notebook.

What we never do with it

We sell nothing to anyone. No ads, no data brokers, no hidden profiling. Your content is not used to train an artificial-intelligence model.

Where it lives, and who else sees it

Your data is hosted on Supabase, on servers located in the European Union, with a daily technical backup kept for 7 days — just long enough to protect you from an outage, no more.

The third deserves one more sentence. When you search for a place to suggest, what you type goes to Google to fetch address suggestions. This happens only during that search, never in the background. Google may process those requests outside the European Union, under the safeguards laid down by the European Commission.

The website is hosted by Vercel. The app is distributed by Apple and its updates are delivered through Expo. None of these intermediaries receives the content of your account.

For how long

Waiting-list data is kept for as long as you are on the list, and deleted at the latest 12 months after the public launch — or immediately on request.

Your account data is kept for as long as your account exists. If you delete it, everything leaves with you — with one exception: the places you gifted to the tribe stay, without your name. Technical backups erase themselves within 7 days.

Reports are kept for as long as needed to handle them and to evidence any repeat behaviour, then deleted.

On what legal basis

On performance of the contract formed by the terms of use, for everything that makes the service work: your account, your content, your bookings.

On your consent, for what is optional: location, news by email. You can withdraw it at any time without the rest ceasing to work.

On our legitimate interest, for the security and moderation of the service — a space between women, some of them minors, cannot work without it.

Your rights

Under the GDPR and French data protection law, you have the following rights:

• access your data;
• rectify it;
• erase it;
• take it with you (portability);
• object to a processing operation;
• ask for it to be restricted;
• withdraw your consent at any time.

To erase, the button is in the app — no need to beg, no maze. For a copy of your data or any other request, write to contact@matchy.fans. We answer within one month.

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the supervisory authority of the country where you live.

If you are under 18

Your data gets a little extra gentleness. A parent or guardian can write to contact@matchy.fans to exercise your rights on your behalf, including asking for your account to be deleted.

The service is for 16 and over. In France, a person aged 15 or over may consent alone to the processing of her data for an online service: at 16, you decide for yourself.

Security

Your data is protected at the database level itself: every table applies rules that determine, row by row, what your account is allowed to read. Your notebook is encrypted. Private photos are reachable only through temporary links.

No system is infallible. Should a data breach be likely to concern you, we will notify the CNIL and, where the risk is high, we will tell you directly.

Changes

This policy may be updated to reflect changes in the service or in the law. You will be informed of any substantial change.