Version 2026-11-01
Privacy Policy
Draft for legal review. This text describes how Good Timing actually works, but it is not final until a lawyer has reviewed it.
This policy explains what personal data Good Timing processes, why, for how long, and what you can do about it. Good Timing is a dating app for adults (18+). We don't sell data, we don't show ads, and we don't use tracking or advertising tools.
1. Who is responsible
The controller under the GDPR is [Your full legal name], [Street and number, postcode, city, Austria]. Contact: privacy@goodtiming.me.
2. What we process
| Data | Details |
|---|---|
| Account | Email address and the sign-in methods you use (email code, Sign in with Apple, Google). For Apple and Google we keep the account identifier they send us. |
| Age | Your date of birth, to make sure you're 18 or older. It can't be changed later. Others only see your age. |
| Profile | Name, photos, bio, interests, gender identity (and whether to show it), what you're looking for, and your pace for a first meet. |
| Preferences (sensitive) | Who you want to meet, age range and distance. Together with your gender this can reveal your sexual orientation, so we ask for your explicit consent. Who you want to meet is never shown on your profile. |
| Location | An approximate position from your phone (with your permission) or the city you pick. We never store your exact location: positions are rounded to about 1 km and shifted. Others only see a distance range, like “about 5 km”. |
| Activity | Likes and passes you give, matches, when you were last active. |
| Messages and Mutual Plans | Messages you send and receive, your Mutual Plan picks, suggestions and the private feedback you give after a plan. |
| Safety | Reports you make or that are made about you (with a snapshot of the reported content), blocks, moderation decisions, appeals, and safety signals from simple text checks (for example asking for money). |
| Device and technical | Signed-in devices (platform and device name), push notification tokens, app version, language. Your IP address is used to protect sign-in against abuse; we store it only as a keyed hash. |
3. Why, and on what legal basis
- Running the service (contract, Art. 6(1)(b) GDPR): your account and profile, showing you people and you to them, likes, matches, chat, Mutual Plan, notifications.
- Gender and who you want to meet (explicit consent, Art. 9(2)(a) and 6(1)(a)): to show you relevant people. You can withdraw consent by deleting your account; Good Timing can't work without this information.
- Safety and moderation (legitimate interests, Art. 6(1)(f), and legal obligations such as the EU Digital Services Act): reports, blocks, decisions, ban evasion checks, abuse prevention.
- Security (legitimate interests): sessions, rate limits, logs.
- Legal obligations (Art. 6(1)(c)): answering valid orders from authorities, keeping records we must keep.
4. Automated decisions
Discover orders profiles by recent activity, how complete a profile is, distance, and a bit of randomness. This has no legal effect on you. A few safety decisions are automated: an account is suspended if the birth date entered is under 18, and a new account using the sign-in details of a banned account starts banned. Both come with an explanation, and you can appeal: a person reviews every appeal. Text checks only flag messages for a person to look at.
5. Who sees your data
- Other members see your profile (photos, name, age, distance range, interests and what you chose to show). Matches see the messages you send them. In a Mutual Plan, they only see what you both picked.
- Our moderation team sees what's needed to handle reports; private messages only when they're part of a report. Every look is recorded.
- Service providers who process data for us under a data processing agreement: Hetzner Online (hosting and file storage, Germany/Finland), [email delivery provider, to be confirmed], Expo (push notifications, which reach your phone through Apple and Google). Sign in with Apple and Google sign-in are provided by Apple and Google under their own terms. We'll update this list before adding anyone.
- Authorities, only when the law requires it.
Some providers may process data outside the EU (for example push notifications). In that case we rely on an adequacy decision or standard contractual clauses. [To be confirmed per provider.]
6. How long we keep it
| Data | Kept |
|---|---|
| Account, profile, photos, preferences, likes, matches | Until you delete your account. After you ask, your profile is hidden at once and everything is erased 30 days later (sign in during those 30 days to cancel). |
| Messages and Mutual Plans | Until you or your match deletes their account. Unmatching hides the conversation for both of you. |
| Reports and moderation decisions about you | Until your account is erased, unless they must be kept longer as evidence (for example a police request). |
| Reports you made | With the report; the link to you is removed when you delete your account. |
| Ban records | If an account is banned, keyed hashes of its sign-in details, as long as the ban stands (also after deletion), so the ban can't be evaded. |
| Sign-in codes | Valid for 10 minutes; erased with your account. |
| Staff audit log | 2 years, with account IDs only. |
| Your data downloads | 7 days. |
| Backups | [Up to 30 days, to be confirmed with the backup setup.] |
7. Your rights
You have the right to:
- Access and portability: download a copy of your data in the app under Settings → Download my data.
- Rectification: edit your profile in the app at any time.
- Erasure: delete your account in the app under Settings → Delete account, or on the account deletion page.
- Restriction and objection, and to withdraw consent at any time (this doesn't affect what happened before).
- Complain to a supervisory authority. Ours is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.
For anything else, write to privacy@goodtiming.me. We answer within one month.
8. Adults only
Good Timing is only for people aged 18 and over. If we learn that someone under 18 has an account, we suspend it and delete the data.
9. Security
Data is encrypted in transit, photos are stored privately and shown through short-lived links, sign-in codes and tokens are stored only as hashes, and staff accounts need two-step sign-in.
10. The waitlist
If you join the waitlist on our website, we use your email address only to tell you when Good Timing launches near you.
- What we store: your email address, the city you chose, which consent text you agreed to and when, and when you signed up, confirmed and left.
- Legal basis: your consent (Art. 6(1)(a) GDPR). You give it by ticking the box and confirm it with the link in our confirmation email.
- How long: if you don't confirm, we delete your signup after 7 days. Once confirmed, we keep it until 30 days after we launch in your city, or until you leave, whichever comes first.
- Withdrawing consent: every email we send has a link to leave the waitlist. Leaving deletes your email address at once; what remains (a city and dates) identifies nobody. You can also write to privacy@goodtiming.me.
11. Changes
When this policy changes, the app shows you what changed and asks you to agree again before you continue.