Privacy policy

Last updated: 26 September 2026.

This policy explains what we collect, why, who it's shared with and what you can do about it. It's written to be understood on one read.

Who handles your data

Vexxy is operated by Carlos Gonzalo Hernández Laurencio, acting as an individual, national ID 402-2611241-1, at Calle 2 #12, San Felipe, Santo Domingo 11201, Dominican Republic.

That is the person responsible for the data described here, and the one to contact about any of the rights explained below. The address is privacy@vexxyapp.com, and answers come from there.

What we collect

Your phone number. It's the only thing needed to get in. It lives in the authentication system and is not copied into your profile: it's the most identifying piece of data we handle and there's no reason to hold it twice. No other person ever sees it.

What you put in your profile. Display name, date of birth, gender, who you want to meet, and your bio. The date of birth is used to check you're 18 and to work out the age shown; the exact day is never shown to anyone.

Your sexual orientation, if you choose to add it. It's genuinely optional: it starts empty, nobody fills it in for you or works it out from who you're looking for, and leaving it empty changes nothing — the deck doesn't use it to order or to filter. It's picked from a closed list, with no free text, and you can remove it whenever you like from Edit profile. It's specially protected data and we treat it that way. If you add it, it travels with your profile to the phones of people who see you in Discover, Nearby and Featured, and staff with permission to look up profiles can see it, with every lookup logged.

Your photos. Profile photos, the ones you send in chat and the ones in your embers.

Your embers, if you post any. What you put on the rail — a text, a voice note, a photo or a video — shown with your display name and your age. And what you do on other people's: your likes, your comments, which embers you've been shown and which you've seen. Who liked or saw an ember only ever arrives as a number, never who. Your comments go through the same filter as messages; whoever posted the ember sees them with your name and photo and can open your profile as in Discover; everyone else sees your first name and a smear of four colours taken from another of your photos, never your main one, in which you can't be recognised; if you only have one photo, they see your initial. How each kind is moderated and how long it's kept is further down.

Your location. We ask for it to order the deck by proximity and to show a distance. On top of that, the admin team sees it on an internal map for moderation, rounded to about 200 metres and leaving a trace: see «Location: what the team sees». No other user ever receives more than whole kilometres — never your coordinates, never the street, never the neighbourhood.

On Android we ask for the approximate permission (COARSE), which is what the system offers. On iPhone that permission does not exist: iOS hands us the location in more detail than we need, and we store it as it arrives. That is why the App Store listing declares «precise location»: it is the honest answer, even though we never show it to any other user.

You can refuse the permission: the app still works, the deck is just worse.

Your activity in the app. Your swipes, your matches, your messages, who you block and what you report. Also when you were last active, used so you aren't shown abandoned profiles. And some per-photo counts — how often a photo was shown, how many likes it got, how often it was opened — which exist so we can tell you which of your photos is working. They are a running total and they never say who. You can switch them off in settings.

Your email address, if you choose to add one. It's optional, and it isn't a way to sign up: your phone number stays the root of the account. It gets its own section below.

The verification selfie, temporarily. Verifying is the last step of signing up. See below — it's special-category data and it gets its own section.

Your Spotify listening, if you connect the account. Optional. It gets its own section below.

Proof of your subscription, if you buy Vexxy Plus or Vexxy Ultra. The store hands back a purchase token — a long, opaque identifier for that one purchase — along with the product bought and the date it expires. It gets its own section below.

A fingerprint of your device. The app gets an identifier for the phone — on Android the system provides it; on iPhone the app creates it and keeps it in that phone's keychain — and sends it to the server, where it is turned into an irreversible fingerprint before anything is stored; on our servers the original identifier is never kept anywhere. It's there to spot multiple accounts and abuse, and for nothing else. It gets its own section below.

The phone numbers in your address book, if you turn on contact blocking. It ships off and never turns itself on. The numbers become an irreversible code before anything is stored, and the originals are not kept. It has its own section below, because it involves data about people who don't use Vexxy.

Minimal technical data about connections and errors, the kind any service generates when it receives a request. That includes a throttle so nobody can have SMS codes fired at someone else's number: for each attempt we store an irreversible code derived from your phone number and from the IP address the request came from, computed with a secret key of ours. That throttle never stores the original values: only the code, and there is no way back from it.

Your IP address. We never use it for advertising or for analytics. The only use it is meant for is spotting accounts created in bulk from a single connection and applying moderation measures.

Since 22 September 2026 that address is stored, linked to your account and with the first and last time we saw it and how many times. It is deleted after 180 days from the last time we saw it, and sooner if you delete your account; the one exception is an address someone on the team has marked by hand — as blocked, to watch, or as safe — which is kept with no account behind it so that the mark, a block for instance, doesn't quietly undo itself.

A person reads it, not an automation. Nothing decides anything on its own from your address: it is there so that whoever moderates can see whether many accounts come from the same connection.

What we do NOT do yet. There is a part, built and switched off, that would work out which country, city and provider that address belongs to and whether it comes from a VPN or a data centre. That would come from IPQualityScore, a reputation service that would be sent the IP address and nothing else. It is not switched on today: IPQualityScore receives nothing, and your address does not leave our servers. If it is ever switched on, we will say so here.

And there is advertising. The app carries Google's AdMob ads kit. It gets its own section, which is the next one, because it's the first thing people want to know and it deserves telling in full.

Advertising: which formats there are, and what goes to AdMob

There are two ad formats and no others. There are no banners.

Rewarded ads are ones you ask for. They live on the credits screen: you see an ad because you chose to watch one in exchange for credits, and if you never ask, one never appears. Nothing forces you to watch any; credits are obtainable without them too.

And the reward is granted by the server, not by your phone. When the ad finishes, AdMob calls our server independently with a cryptographically signed request, we check that signature against Google's public keys, and only then are the credits added. If the app itself said "I watched it", we wouldn't believe it: anyone modifying the app could mint credits for themselves.

What travels to AdMob in that check is your profile identifier. That exactly, and nothing else: the internal identifier of your profile, a random string containing no name, no phone number and nothing readable, which is what makes it possible to know who to credit when the signed call reaches our server. Without it the reward would arrive with no recipient and be discarded.

There is no ad you didn't ask for. There was one — full-screen, between deck cards — and it was removed on 3 September 2026. Today, inside the deck, what can turn up is a Vexxy card offering you an ad in exchange for credits. Swiping past it costs nothing and doesn't even start the ads kit: that only happens if you tap it.

On Ultra none appear at all. On Plus they appear half as often as without paying. That's decided by the server reading your plan, not by a flag stored on the phone.

The ads kit doesn't start up until there's an ad to show. It isn't initialised when the app opens: until somebody asks for an ad or a slot comes due, it opens no connections and collects no identifiers.

What we do NOT send to AdMob. Not your name, your photos, your bio, your location, your age, your interests, your messages, or who you match with. The ad request goes out with no targeting data of ours attached to it.

What Google collects on its own. The AdMob kit uses your phone's advertising identifier and technical device data to choose which ad to show you and to measure it. Google does that under its own privacy policy, not this one, and we don't see any of it.

On iPhone that doesn't happen on its own: we ask you. Before the first ad, Apple's dialog asks for permission to track your activity, and if you say no, you are not tracked.

That dialog is App Tracking Transparency, and what a yes authorises is for Google to combine your advertising identifier (IDFA) with data it collects in other apps and websites, to choose ads. That is why the App Store listing declares that the app does track you: it does, and only if you allowed it. Saying no costs you nothing inside Vexxy — the ads are still there, they just stop being personalised.

On Android you can delete the advertising identifier, or ask that it not be used to personalise ads, from your phone's settings.

We build no advertising profile of you and we don't sell your data. Nothing in your profile, your messages or your location feeds advertising.

And there are no third-party analytics trackers beyond the ads kit described above. No Google Analytics, no product analytics tool, no separate measurement SDK: apart from AdMob's own measurement of its own ads, the app carries none. If one ever arrives, this policy will say so first.

What we use it for

To make the app work: creating your account, showing your profile to the right people, serving your deck and the ember rail, delivering your messages.

To meet the legal requirement that only adults get in.

To keep the place safe: moderating images, audio and video, handling reports, applying blocks and bans, and spotting multiple accounts opened to get around a block or a suspension.

To charge for the subscription and the extras, if you buy anything.

To show you ads, in the two formats and within the limits set out above.

To email you, if you've given us an address: the notices that have to be sent and — only if you switch it on yourself — the occasional product news.

To remind you about embers with a notification: when the last one you lit is about to go out — sometimes with how many likes and comments your glowing embers add up to — and when it's been a day, a week, two weeks or a month without you lighting one. To decide who gets one and when, we look at the date of your last ember (or of your sign-up, if you've never lit one) and your time zone. They're switched off with their own toggle, «Ember reminders», in Settings → Notifications.

And nothing else. We don't sell your data to anyone.

Location: what other people see

We don't share your coordinates with other users. The server works out the distance and only hands over that number, rounded to whole kilometres; raw coordinates never leave for anyone's app, not even your matches'.

And one exception worth knowing: the ember rail is not limited by distance. The deck only shows you people inside your radius; the ember rail is global by default, so what you post there can be seen by anyone, wherever they are, not just by people near you. Narrowing it to your radius is an Ultra setting, and it changes what you see, not who sees you.

Location: what the team sees

There is an internal map that only the admin team can open: no other role can be given that permission. We use it for moderation, and on it each person shows up as a point on a grid of about 200 metres, with their name and their first approved photo.

That point is where you last opened the app, not where you live. It is overwritten every time you open it, so the map keeps no trail.

The map leaves out suspended or banned accounts, anyone whose profile is paused, and anyone with travel mode on.

Every time someone on the team opens the map or looks at its faces, it is logged who did it and which people they saw. That entry goes into the same log as conversation reads, and it can't be edited or deleted.

Photos and moderation

Every photo is uploaded first and sits pending: invisible to anyone else. It's then sent to an automated image analysis service (Google Cloud Vision SafeSearch) that returns a rating for sexual, violent or otherwise inappropriate content. With that answer it becomes approved, rejected or held for a person to look at. And if a person's first ember photo comes back clean, it isn't published without someone on the team looking at it.

Since 26 September 2026, before approving a photo we remove the location your phone stores inside the file. Many cameras record inside the photo where it was taken; the server deletes that, and the details that identify the device, from every profile, chat or ember photo before approving it. The image itself doesn't change, and a photo it can't clean isn't published.

What that analysis stores, besides the verdict. A yes or a no to the question of whether the image contains any face at all — not whose, not where, no facial measurement of any kind: a single true-or-false, used to pick which photo the verification compares against — and some technical measurements of the file: size, sharpness, grain, dominant colours. Those are properties of the image, not of you, and they're used to reject unusable photos and to flag likely machine-generated ones.

And if a profile or ember photo has text written on it, that text is read — in case someone tries to slip in a phone number or another network's handle — and run through the same word filter as messages. None of that text is stored: only which rule fired, if any did.

And a destroyed thumbnail. When a photo is approved, the server generates a 24 by 30 pixel thumbnail and keeps it in a separate private store. It's a smear of colour in which nobody is recognisable, and it's the only thing of your face shown in the Activity carousel to people who don't pay. There's more on that below, under "What leaves and what doesn't".

Images you send in chat live in private storage. No public address is ever generated for them: they're delivered through short-lived signed links, so that forwarding a photo outside the app isn't as easy as copying a URL. They arrive blurred, and the moment the recipient chooses to view one is recorded, because that timestamp is the evidence if a report follows.

When a match is undone, the images from that conversation are really deleted from storage, not just hidden from view.

If someone screenshots your conversation, we record it and tell the other person. We store who took it, in which conversation and when — not the screenshot itself, which we never see and could not see. The server writes that record, not the phone of whoever took it, because a device that could decide to write it could also decide not to.

This happens on iPhone only, and not by choice: on Android the system lets us block the screenshot outright, so there is nothing to record. On iOS there is no way to block it, and we would rather tell you than let it happen in silence.

The texts and photos in an ember

A text goes through the same word filter as messages, and a photo through the same image analysis as profile photos. The first of each kind that each person posts doesn't reach the rail without someone on the team looking at it, even if the filter finds nothing.

After that, a text the filter catches something in is not rejected: it's held and a person decides it. A photo the analysis rates as inappropriate is rejected on its own; if the analysis is unsure, it's held for someone to look at.

The voice notes in an ember

A voice note is uploaded just like a photo, and other people cannot hear it until there is a verdict. You always hear your own, approved or not: you have to be able to know what is still waiting.

The audio is sent to an automatic transcription service, Google Cloud Speech-to-Text, in the same Google project as the image analysis. It is sent so we can know what it says, not to be kept there.

The transcript is not stored and is not returned to anyone. It lives in memory only as long as it takes to ask the word filter what it caught, and it goes away with the answer. Keeping it would mean storing exactly the phone number we just decided not to pass on.

What does get written down is which rule fired, not what you said. The name of the rule and the verdict are stored. Your words are not.

Nobody else hears the first voice note each person posts before someone on the team does. After that, if the filter finds nothing, the note is approved on its own; if it finds something — or if the audio couldn't be transcribed — a person on the team decides it with the audio in front of them: it reaches a moderation card that carries the audio, and somebody listens to it. Nothing is rejected on its own.

The audio lives in private storage and is served through short-lived signed links. When the ember goes out, the audio is deleted, unless there is an open report about it or an open moderation case about your account that isn't a routine one —that is further down, under "How long things are kept"—.

The videos in an ember

A video is uploaded just like a photo, and other people cannot see it until there is a verdict. It is recorded without sound, unless you choose to include it when recording. No automatic service analyses it and it goes to no third party: every video is looked at — and, if it has sound, listened to — by a person on the team before it reaches the rail. It lives in private storage and is served through short-lived signed links.

The verification selfie is biometric data

If you verify, the selfie is compared against your profile photo to check you're the same person. That comparison is done by an external face recognition service (Amazon Rekognition).

It's biometric data and we treat it as such:

It's used only for that one comparison. It isn't used to identify you anywhere else, and it isn't cross-referenced with anything.

The selfie is deleted from the server as soon as the comparison finishes, whether it passes or fails. No copy is kept, no facial template, no derived biometric signature. On top of that, an hourly sweep clears anything that somehow got left behind.

All that remains on your profile is a yes or a no: verified or not. Of the attempt itself we also keep, in our own database and nowhere else, the outcome, the date and a number summarising how alike the two faces were. No image.

Verification is the last step of signing up. And even once you're verified, the app can ask for it again before letting you carry on: that's covered under "Automated decisions about your account".

Your email, and the ways into your account

The phone number is the root and it can't be removed. A Vexxy account is born from a phone number verified by SMS, and there is no other way to create one. Email and a Google account are extra doors into a house that already exists, never a way to sign up. That isn't a statement of intent: the database itself refuses to let an account exist without a phone number.

Email and password. You can add an email address and a password to your account. They're held in the authentication system, the same as the phone number. It's optional and it can be removed.

Signing in with Google. You can connect your Google account. The flow opens in the browser and it's Google that asks your permission. What Google hands back — your address, your name and that account's picture — is stored in the authentication system. Of all that, the only thing we use is the address, so we can show you which account is connected. We don't publish it on your profile, we don't show it to anyone, and we don't cross-reference it with anything.

And the same caveat as with Spotify, because it applies here too. These two doors may not be switched on in your version of the app, and today neither of them is a way of *getting in*: signing in to Vexxy is by SMS and only by SMS. What you add here is stored on your account; what it doesn't yet do is open the door. The section gets written before the switch, not after.

Which emails we send. Seven are service messages, sent because something happened: the welcome, a purchase receipt, a notice that a payment failed, a notice that your plan has ended, a warning about your account, a suspension notice, and the confirmation that your account has been closed. There's an eighth, promotional, with product news: it ships switched off and only turns on if you turn it on, at which point the date you gave that permission is recorded alongside it.

There's always a way out. Every promotional email carries its unsubscribe link, and the page behind it works with no session at all: you don't need to open the app, or even have it installed, to stop receiving them.

Our own server sends it. Email goes out from the mail server of the vexxyapp.com domain, at our hosting provider. There is no bulk-sending middleman in the path: no SendGrid, no Mailchimp, nothing of the kind.

How long an email sits in the queue. So that it can be sent, the address is held inside the message's own row. That row is deleted 7 days after it is sent, and after 30 days if sending failed. There's an honest consequence of this under "How long we keep it" — read it, because it affects account deletion.

Connecting Spotify

It's optional. It exists to show what you're listening to on your profile, and it's needed for nothing else.

How it connects. Spotify opens in the browser and it's Spotify that asks your permission, on its own screen. We request one single scope, the one to read your most-played artists and tracks, and nothing more.

What we pull in. Up to five artists — name, image, link and at most two genres — and one track — name, artist, image and link. That's all of it.

What we deliberately don't pull in. Not your Spotify email, not your country, not your account name, not your playlists, not your listening history. Nothing historical is kept: the snapshot is overwritten whole every week and never accumulates. There is no database here of what you listen to.

The credentials we hold. To be able to refresh that snapshot we store two credentials Spotify issues for your account. No app can read them, including yours: they live in a table to which the app is granted not a single column. They are used only to ask Spotify for your most-played artists.

Who sees your music. Your matches, and anyone within 100 kilometres of you even without a match. With the same exclusions as everywhere else: not banned accounts, not anyone who blocked you, not anyone you blocked, and if you're in incognito mode, nobody who isn't already a match.

It doesn't affect the deck. Your music doesn't change the order you appear in, or who you appear to. It's profile decoration, not a matching signal.

Disconnecting deletes, at once and completely: the credentials and the snapshot go in the same operation, with no "switched off but kept" state. Deleting your account does the same.

And one honest caveat. Spotify offers no way for us to revoke the permission from our side. When you disconnect, the credentials are deleted here and can no longer be used, but the permission will still be listed among the apps on your Spotify account (spotify.com/account/apps) until you remove it there. Telling you that "disconnecting removes everything" would be easier and it wouldn't be accurate.

If you can't find this feature in your version of the app, it isn't available yet: the section gets written before the switch, not after.

Your subscription's purchase token

If you subscribe, the one charging you is the store you installed Vexxy from: Google Play on Android, the App Store on iPhone. Payment data doesn't come through here: we don't see your card, your billing name, your address or your Google or Apple account email. The store doesn't give them to us and we don't ask.

What we do handle is the purchase token: an opaque string the store generates for that purchase, which says nothing on its own. Alongside it we keep which product you bought, when it expires, whether it's set to auto-renew, what state the store has it in, and the answer it gives us when we ask.

What we use it for, and nothing else: to ask the store whether that subscription is real and still live, so that your plan turns on only for someone who paid. Without checking against the store, anyone could just say they paid. It gets checked again whenever the store tells us something changed — a renewal, a cancellation, a refund.

Who it's shared with: the store that issued it — Google or Apple — and nobody else. The token is the store's to begin with and we hand it back to the store to ask about its state. It doesn't go to other users or to any third party.

The token never reaches the app, not even yours: in the database it's restricted column by column, the same as raw coordinates. Your phone can read when your plan expires, but not the receipt that proves it.

How long it's kept: as long as the subscription and its history exist on your account. Delete the account and that record goes with it. The financial record of the charge stays with the store, which made it, and isn't ours to hold.

Your device fingerprint

Some of the abuse on a dating app isn't done by an account: it's done by a person who opens a new one every time you close theirs. Seeing that requires being able to tell that the phone is the same, and that's what this fingerprint does.

How it's stored. The app sends an identifier for the device. The server runs it through a cryptographic function together with a secret key of ours and stores only the result: a string that can't be reversed back into the identifier it came from. The original identifier is never written to any column, not even temporarily.

On iPhone, the app keeps that identifier in the phone's own keychain. It isn't copied to other devices or to iCloud, and it stays on the phone even if you uninstall the app or delete your account: it only goes when the whole iPhone is erased. It's a random value derived from nothing of yours, and no other app can see it.

We still treat it as personal data. Being a fingerprint rather than the original number doesn't change what it does: it identifies you just the same, which is precisely what it's for. Calling it "anonymous" because there's a hash on top would be untrue, and we'd rather say so.

The secret key is ours, so the fingerprint only means something inside Vexxy. It doesn't match the one any other app would compute for the same phone, it can't be used to recognise you outside here, and nobody on the outside can match it against anything of theirs.

What it's used for: spotting that one person is running several accounts at once, and recognising that someone is signing up again from a device that already had an account removed.

What it is not used for, and won't be: advertising, measurement, commercial profiling, or any kind of tracking of what you do. It isn't shared with anyone: not with other users, not with advertisers — AdMob included — not with data brokers, not with any outside provider. It lives in our database and no app reads it, including yours.

What's kept alongside it: when that device was first and last seen, which accounts have been used on it, and — if it has a history — the date its mark runs out.

A marked device doesn't get anyone removed. Phones get inherited, sold, shared within a family and used in public places, and punishing whoever holds one next would be punishing someone who did nothing. So a new account opened from a device with a history isn't blocked: it goes to review, and a person looks at it. You can use the app in the meantime.

How long it lasts. The link between your account and the device is deleted when you delete your account, along with the rest of your data. A device's mark expires on its own after 180 days. The device record itself may remain — the bare fingerprint, with no account attached; with nothing linked to it, it says nothing about you, and past that date it has no effect at all.

Contact blocking: hiding from your address book

It's optional, it ships off, and nothing happens unless you turn it on.

What it does. It keeps the people saved on your phone from finding you here. If someone in your address book has a Vexxy account, the two of you disappear for each other: they're not in your deck and you're not in theirs, nor in the likes list, nor in Activity, nor in Nearby, nor in Featured, nor on the ember rail, and neither of you can like the other.

What we read. Only the phone numbers in your address book. No names, no photos, no emails, no notes, no groups, and nothing about who you call. The app asks for permission to read contacts and nothing else: it never writes to your address book, and it can't. Your phone asks for permission first, and the app explains what it's for before that dialog appears.

What gets stored, and this is the part that matters. The numbers travel to our server, which runs them through a cryptographic function together with a secret key of ours and stores only the result: a string that can't be reversed back into the number. The original numbers are never written to any table, any log or any file, not even temporarily: they exist for the duration of that single request and disappear with it. They aren't stored on your phone either.

Why the secret key isn't in the app. A phone number is ten or eleven digits. A code with no key can be undone by trying every combination, so storing one would be almost the same as storing the number. That's why the server computes the code with a key that never leaves it, and why the numbers have to leave your phone: if the key lived inside the app, anyone could pull it out.

Other people's data. We're aware this involves data about people who have never used Vexxy and never agreed to anything. That's exactly why the feature is optional, why only numbers are read, why none of them is kept, and why what remains can't be read back as a phone number — not even by us. We don't use your address book for anything else: not to suggest people, not to invite anyone, not for advertising, not for measurement. It isn't shared with anyone.

Your own number becomes a code too. It has to, for the comparison to work: without it, someone who has you in their address book couldn't hide from you. It's computed the same way, with the same key, and it replaces nothing — your phone number still lives only in the authentication system, as always.

We don't tell you who from your address book is here. The app never tells you how many of your contacts have an account, or which ones. If it did, anyone could upload a single number to find out whether that person is on a dating app, and that would be worse than not having the feature at all. For the same reason there's a minimum number of contacts per upload and a limit on how many times a day you can refresh.

What it doesn't do. It doesn't touch conversations you already have: if you were already talking to someone from your address book, that chat stays where it is. To cut things off with one specific person there's the normal block, which also undoes the match. And a contact saved without its country code can't be compared, so it isn't hidden.

Turning it off deletes it. When you turn it off, the codes from your address book and the hidden pairs are deleted right then. No copy is kept "in case you come back". Deleting your account does the same.

Automated decisions about your account

This needs saying even though it isn't pleasant to read: part of Vexxy's moderation is automated, and in some cases a decision about your account can be taken by the system without a person having looked first.

How it works. The system keeps an internal assessment of every account that summarises safety signals already held in the database and the moderation decisions that have been made about it.

You won't see it, and we're not going to explain what moves it. A visible score stops measuring behaviour and starts measuring skill at raising it; and publishing the list of what adds and subtracts would be, quite literally, the manual for dodging it. What you do see are the consequences, which is the only part you can need.

There are four consequences, and only four:

Human review. The account joins a queue for a person to look at. You'll see inside the app that your account is under review — except for the routine checks done at random, which aren't announced. It isn't a punishment: it restricts nothing in the meantime and the app keeps working as normal.

Suspension. The account stops appearing and stops being able to write. Every suspension carries a reason and an end date — 30 days in the automated case — and lifts itself when that date arrives. The only removals with no end date are the irreversible ones: accounts belonging to minors, and the serious cases already set out in the house rules.

Verifying again. If your profile changes a lot since it was last reviewed — or if someone on the team decides so when reviewing your account — the app asks you for a new selfie and won't let you keep using it until you verify again. This one we do tell you as soon as it happens, and when the system is the one deciding, a card also opens for a person to look at it.

Not being shown. For a while, your profile may stop being shown to other people, and you aren't told. The system can apply it on its own, through rules the team writes.

Automatic suspension is reserved for the unequivocal. A false positive throws out a real person, so the machine only acts on its own when a signal admits no other reading and is preceded by moderation decisions a human already made. Everything doubtful — however doubtful — goes to the review queue, which is reversible. When in doubt, review.

And every suspension ends up in front of a person. Suspending an account automatically opens a review card, without anyone having to ask for it. That holds for suspensions we apply by hand too.

Your rights here. You can ask for a person to review the decision, put your side of it, and contest it. Write to privacy@vexxyapp.com or hello@vexxyapp.com and we'll look. If you think we got it wrong and we don't put it right, you can complain to the data protection authority in your country.

When someone on our team reads a conversation

This is the most uncomfortable section to write, which is why it's here in full.

Your messages are not end-to-end encrypted. The server sees what you write, and it has to, both to filter it and to be able to act on a report. Everything is encrypted in transit, but that is not the same thing and we're not going to imply that it is.

And there is one case where a person on our team reads a private conversation: when one of the two people in that conversation reports the other and the case is opened for moderation. There's no way to judge harassment otherwise, because a single message almost never says what happened.

Here is exactly what fences that access in:

It takes an open case assigned to that specific person. It isn't a permission that comes with a job title: anyone without that case claimed sees nothing, and that includes the administrator and the owner of the project. Resolving the case closes the window, and the claim expires on its own.

Only the conversation between whoever reports and the person reported is read. There is no way to ask for "show me this person's chats": no other conversation of yours is in that query.

It starts at the reported message, and it can reach the whole conversation. If the report points at a message, reading starts there, with the ones before and after it; if it points at none, it starts from the end. From there it can go on backwards and forwards, because judging harassment sometimes means seeing how it began. After 200 messages read from that conversation, the reason has to be written down to carry on, and that reason is logged.

Every read is logged. Who did it, on which case, exactly which messages came back, and when. Not "there was an access": the read itself, with the list.

That log holds none of your messages' content, only identifiers, plus the reason when whoever reads has had to write one. If it held the text it would be a second copy of your conversations, with wider access than the first.

And it can't be edited or deleted. Not by the administrator, not by whoever maintains the database: the database itself rejects any change or deletion of that log.

Nobody can open a case about themselves, see one in the queue, or claim one.

Whoever handles payroll or invoices holds not a single permission that touches user data. That's not an internal rule someone could bend: those permissions cannot be granted to them.

Who it's shared with

Only the providers needed to make this work, and each one gets only what it needs:

Supabase — hosting for the database, file storage and authentication. It's where everything lives.

Twilio — sending the SMS with your login code. It receives your number.

Google Cloud Vision — automated image moderation. It receives the image to analyse.

Google Cloud Speech-to-Text — automatic transcription of ember voice notes. It receives the audio of the note; the transcript it returns is not stored.

Amazon Rekognition — face comparison for verification. It receives the selfie and the profile photo, for that moment only.

Google Gemini — a first opinion in profile reviews. When your profile comes up for one of the routine checks, it receives its text: display name, bio, education, travel label, your social handle if you've added one, and your answers to the profile prompts. No photos, no phone number, no messages, and not your profile identifier. It decides nothing: its opinion only orders the queue for whoever reviews, and a person makes the call.

Google Play (Android) and the App Store (iPhone) — billing and management of the subscription, only if you subscribe. The store receives the purchase token when we ask about its state. The store holds your payment details, we don't.

Google AdMob — advertising. Its kit collects your phone's advertising identifier on its own account, and when you finish a rewarded ad it also receives your profile identifier, which is what allows the credits to be paid to you. Nothing else.

Ferozo, the hosting provider for vexxyapp.com — outbound email and the public web pages. The mail server receives your address and the contents of the message we send you.

Spotify — only if you connect your account. What travels there are your own credentials, so we can ask it for your most-played artists. We send it no data about you that Spotify didn't already have.

Firebase Cloud Messaging (Google) — notifications. It receives your phone's notification identifier and the text of the alert; in match, new-message and screenshot alerts, that text carries the other person's name. Never the content of a message: the alert says who it's from, not what it says. On iPhone, Firebase delivers the alert through Apple's notification service.

And two that receive nothing at all today, written here because each is switched on with a piece of configuration and we'd rather say so before than after: IPQualityScore, which on the day it's switched on would receive the IP address and nothing else — it's covered above, under "Your IP address"; and Cloudflare Turnstile, which on the day the anti-bot check goes live on the public deletion page will receive the IP address of whoever uses it.

Your device fingerprint and your account's internal assessment go to none of them: they're safety data, computed and kept in our own database.

We don't sell data to anyone and we don't pass it to data brokers. And nothing from your profile, your messages, your location or your interests goes to AdMob: only the advertising identifier its own kit collects, and your profile identifier when there's a reward to pay you.

We will hand data to the authorities where there's a legal obligation, and on our own initiative in cases of serious risk to someone — a suspected minor, credible threats, non-consensual sexual content.

What leaves and what doesn't

Your swipes don't leave the server. Who passed on you is never disclosed, not even indirectly, and who you liked is seen by nobody until there's a match from both sides.

What is visible without paying, and you should know it. The Activity screen has a carousel of people who have interacted with you, and it shows their name, their age and their distance, alongside the destroyed thumbnail described in the photos section. That is visible without Vexxy Plus.

And why that isn't "the list of who liked you". Because the carousel mixes into one pool the people who liked you, the people who sent you a Flare and the people who merely visited your profile, and it doesn't say which is which. It doesn't say when it happened either: the order isn't by date but a shuffle that's stable per viewer, precisely so that position can't become a timestamp in disguise.

What Vexxy Plus unlocks, today: seeing the face undestroyed and being able to respond — opening the profile, liking back, writing — and seeing the full list. With no live subscription, the query for that list comes back empty on the server, not on the screen.

What never leaves through there, under any circumstances:

Your raw location. What leaves is the distance in whole kilometres, the same precision as the deck, and not one metre finer.

Your date of birth. What leaves is the age, already calculated.

Your real photo. Only the 24 by 30 pixel thumbnail, destroyed on the server: the good photo is never sent out to be blurred on someone else's phone, because that would be paint, and anyone reading the network response would walk away with the face intact.

And nobody who chose not to appear: not banned accounts, not anyone who blocked you, not anyone you blocked, not anyone who switched their activity off, and not anyone in incognito mode.

How long we keep it

For as long as you have the account. When you delete it, your files go from storage first — your photos, their thumbnails, your chat images, your voice notes, your ember photos and your ember videos — and your database row second, which cascades through the profile, photos, swipes, matches, messages, blocks and reports, and your embers, along with what you did on other people's: your likes, your comments, what you've been shown and what you've seen.

When an ember expires it stops being served to anyone else: the server no longer returns it to anyone but you, and if it had a file — a voice note, a photo or a video — the file permission won't open it for them either.

If it was a voice note, a photo or a video, it is also deleted: the file and the whole ember, shortly after it expires. There are two exceptions: if there is an open moderation case about your account other than a routine review, or if someone reported that ember or one of its comments and the report is still open. Either way it is kept until that is resolved, so whoever reviews it can see or hear it. And anything held back for review does not expire: it is kept while it is being reviewed.

A text ember is not deleted when it expires: what you wrote stays stored and goes when you delete your account, unless it is rejected. Stopping being shown and being deleted are two different things, and it's easy to take the second for granted.

An ember that is rejected is kept for 180 days and then deleted, counted from the rejection: the file and the whole ember, a text one included. It is kept that long in case the same person does it again. If there is an open moderation case about your account that isn't a routine one, or an open report about that ember or its comments, it is kept until that is resolved.

The team can take down an ember that has already been published, for instance after a report: it stops being shown and counts as rejected, so it is deleted 180 days after it was taken down, unless a report on it is still open, in which case it waits until that is resolved. A comment that is taken down stops being visible to anyone, but its text is kept as evidence for the report: it is deleted with its ember, or earlier if whoever wrote it deletes their account.

There are two exceptions to deleting the account, and both have a deadline.

The first is your email address. The message confirming that your account has been closed has to be sendable after the account no longer exists, so that address stays inside the mail queue's own row. That row is deleted 7 days after the message is sent, and after 30 days if sending failed. Past that, no address of yours remains anywhere.

The second is a report that is still open. If, when you delete the account, there's an unresolved report you appear in — it makes no difference whether you filed it or someone filed it against you — we keep just enough to be able to review it: the reason, what state it's in, what the person reporting wrote, and what they flagged — a message, an ember or a comment — with its text. It exists for one concrete reason: if deletion took the report down with it, closing the account would be the way to destroy it, and anyone could do that before a person got to look.

What's kept there is not your profile: not your name, not your date of birth, not your phone number, not your profile photos. An internal reference to the account remains, and it leads nowhere, because the profile it pointed at has stopped existing.

And if what was flagged carried a file — a chat image, or an ember's photo, video or voice note — that file stays too, for the same reason: a report without the evidence can't be judged, or handed to an authority if it comes to that. Inside the app it is out of everyone's reach — the conversation or the ember no longer exists — and only whoever reviews the case sees it. It is deleted shortly after the record is.

The record is deleted as soon as a person closes the case and, in any event, after 180 days, looked at or not.

Chat images go earlier: when the match is undone. The one exception, again, is an image that backs a report still open.

Your subscription record lasts as long as your account does and leaves with it. Be aware that deleting the account does not cancel the subscription: that is done from the store — on Android from Google Play, on iPhone from your Apple Account settings — and it's explained in the Terms of use.

Your Spotify link, if you have one, goes with the account, credentials included. Remember the caveat in its own section: the permission also has to be removed from your Spotify account.

The link between your account and the devices you used it on goes with the account. A marked device's mark expires after 180 days; the bare fingerprint left behind isn't attached to any person.

The codes from your address book, if you turn on contact blocking, last as long as you keep it on: turning it off deletes them right then, and they go with the account just the same.

The sign-in throttle's records — the irreversible codes derived from the phone number and the IP address — hang off no account, because they count attempts by people who haven't got in yet, and they can't be read back as a phone number or an IP. They're only ever queried to look at the last hour.

Apart from what's just been set out — those two exceptions, the bare device fingerprint, the sign-in throttle's records and, if someone on the team marked an IP address by hand, that address with no account behind it — the only thing kept longer is what the law requires us to keep.

Your rights

See and correct. Your profile data is in the app and you can edit it whenever you want.

Delete. From Settings → Delete account inside the app, and also from a public web page with nothing to install. Deletion is real: storage files go first, the database row second.

Object, restrict processing, or ask for a copy of your data. Write to us and we'll handle it.

Withdraw permissions one at a time. Contact blocking, the Spotify connection, promotional email and location each switch off on their own, without touching the rest of the account.

Ask for a person to review an automated decision. If the system has suspended your account or put it under review, you have the right to have a human look at it, to explain your side, and to contest the decision. It's set out above, under "Automated decisions about your account".

If you think we're handling your data badly, you can complain to the data protection authority in your country.

Minors

Vexxy is 18+ only and we don't knowingly collect data from minors. If we detect or are told about an account belonging to a minor, it's deleted.

Security

Every database table has row-level access rules: even if someone got to talk to the database directly, they'd only see the rows meant for them. Sensitive columns — raw location, the purchase token and the Spotify credentials among them — are additionally restricted column by column. Every file store — images, audio and video — is private and served only through signed links. Everything travels encrypted in transit.

No system is perfect. If a breach affects you, we'll tell you.

Changes

If anything changes, we publish the new version here with its update date at the top. If what changes are the terms you accepted, the app will ask you to accept them again when you open it.

Contact

For anything about your data: privacy@vexxyapp.com.