Privacy policy

DRAFT PENDING LEGAL REVIEW. This text describes accurately the data the app handles today, but it has not been reviewed by a lawyer and should not be taken as the final document. If you are reading this in a published release, tell us.

Last updated: 1 September 2026.

This policy explains what we collect, why, who it's shared with and what you can do about it. It's written to be understood on one read.

What we collect

Your phone number. It's the only thing needed to get in. It lives in the authentication system and is not copied into your profile: it's the most identifying piece of data we handle and there's no reason to hold it twice. No other person ever sees it.

What you put in your profile. Display name, date of birth, gender, who you want to meet, and your bio. The date of birth is used to check you're 18 and to work out the age shown; the exact day is never shown to anyone.

Your photos. Profile photos and the ones you send in chat.

Your approximate location. The app asks only for approximate location permission (COARSE), never precise. We never know what street you're on. It's used to order the deck by proximity and to show a distance. You can refuse the permission: the app still works, the deck is just worse.

Your activity in the app. Your swipes, your matches, your messages, who you block and what you report. Also when you were last active, used so you aren't shown abandoned profiles.

The verification selfie, temporarily. Only if you choose to verify. See below — it's special-category data and it gets its own section.

Proof of your subscription, if you buy Vexxy Plus. Google Play hands back a purchase token — a long, opaque identifier for that one purchase — along with the product bought and the date it expires. It gets its own section below.

A fingerprint of your device. The app generates an identifier for the phone and sends it to the server, where it is turned into an irreversible fingerprint before anything is stored; the original identifier is never kept anywhere. It's there to spot multiple accounts and abuse, and for nothing else. It gets its own section below.

The phone numbers in your address book, if you turn on contact blocking. It ships off and never turns itself on. The numbers become an irreversible code before anything is stored, and the originals are not kept. It has its own section below, because it involves data about people who don't use Vexxy.

Minimal technical data about connections and errors, the kind any service generates when it receives a request.

Today the app carries no advertising, no ad trackers, and no third-party analytics SDKs.

That stays true with Vexxy Plus. The Google Play billing library needed to charge for a subscription is not a tracker: it doesn't profile you, it doesn't follow what you do in the app, and it only comes into play when you buy or restore a purchase.

What we use it for

To make the app work: creating your account, showing your profile to the right people, serving your deck, delivering your messages.

To meet the legal requirement that only adults get in.

To keep the place safe: moderating images, handling reports, applying blocks and bans, and spotting multiple accounts opened to get around a block or a suspension.

And nothing else. We don't build an advertising profile of you and we don't sell your data to anyone.

Location: what other people see

We don't share your coordinates with other users. The server works out the distance and only hands over that rounded number; raw coordinates never leave for anyone's app, not even your matches'.

Photos and moderation

Every photo is uploaded first and sits pending: invisible to everyone. It's then sent to an automated image analysis service (Google Cloud Vision SafeSearch) that returns a rating for sexual, violent or otherwise inappropriate content. Only with that answer does it become approved or rejected.

Images you send in chat live in private storage. No public address is ever generated for them: they're delivered through short-lived signed links, so that forwarding a photo outside the app isn't as easy as copying a URL. They arrive blurred, and the moment the recipient chooses to view one is recorded, because that timestamp is the evidence if a report follows.

When a match is undone, the images from that conversation are really deleted from storage, not just hidden from view.

The verification selfie is biometric data

If you verify, the selfie is compared against your profile photo to check you're the same person. That comparison is done by an external face recognition service (Amazon Rekognition).

It's biometric data and we treat it as such:

It's used only for that one comparison. It isn't used to identify you anywhere else, and it isn't cross-referenced with anything.

The selfie is deleted from the server as soon as the comparison finishes, whether it passes or fails. No copy is kept, no facial template, no derived biometric signature.

All that remains is a yes or a no on your profile: verified or not.

And it's entirely voluntary. If you don't verify, you can use the app just the same.

The Vexxy Plus purchase token

If you subscribe, the one charging you is Google Play. Payment data doesn't come through here: we don't see your card, your billing name, your address or your Google account email. Google doesn't give them to us and we don't ask.

What we do handle is the purchase token: an opaque string Google generates for that purchase, which says nothing on its own. Alongside it we keep which product you bought, when it expires, whether it's set to auto-renew, what state Google has it in, and the answer Google gives us when we ask.

What we use it for, and nothing else: to ask Google whether that subscription is real and still live, so that Vexxy Plus turns on only for someone who paid. Without checking against Google, anyone could just say they paid. It gets checked again whenever Google tells us something changed — a renewal, a cancellation, a refund.

Who it's shared with: Google, and nobody else. The token is Google's to begin with and we hand it back to Google to ask about its state. It doesn't go to other users or to any third party.

The token never reaches the app, not even yours: in the database it's restricted column by column, the same as raw coordinates. Your phone can read when your Plus expires, but not the receipt that proves it.

How long it's kept: as long as the subscription and its history exist on your account. Delete the account and that record goes with it. The financial record of the charge stays with Google, who made it, and isn't ours to hold.

Your device fingerprint

Some of the abuse on a dating app isn't done by an account: it's done by a person who opens a new one every time you close theirs. Seeing that requires being able to tell that the phone is the same, and that's what this fingerprint does.

How it's stored. The app sends an identifier for the device. The server runs it through a cryptographic function together with a secret key of ours and stores only the result: a string that can't be reversed back into the identifier it came from. The original identifier is never written to any column, not even temporarily.

We still treat it as personal data. Being a fingerprint rather than the original number doesn't change what it does: it identifies you just the same, which is precisely what it's for. Calling it "anonymous" because there's a hash on top would be untrue, and we'd rather say so.

The secret key is ours, so the fingerprint only means something inside Vexxy. It doesn't match the one any other app would compute for the same phone, it can't be used to recognise you outside here, and nobody on the outside can match it against anything of theirs.

What it's used for: spotting that one person is running several accounts at once, and recognising that someone is signing up again from a device that already had an account removed.

What it is not used for, and won't be: advertising, measurement, commercial profiling, or any kind of tracking of what you do. It isn't shared with anyone: not with other users, not with advertisers, not with data brokers, not with any outside provider. It lives in our database and no app reads it, including yours.

What's kept alongside it: when that device was first and last seen, which accounts have been used on it, and — if it has a history — the date its mark runs out.

A marked device doesn't get anyone removed. Phones get inherited, sold, shared within a family and used in public places, and punishing whoever holds one next would be punishing someone who did nothing. So a new account opened from a device with a history isn't blocked: it goes to review, and a person looks at it. You can use the app in the meantime.

How long it lasts. The link between your account and the device is deleted when you delete your account, along with the rest of your data. A device's mark expires on its own after 180 days. The device record itself may remain — the bare fingerprint, with no account attached; with nothing linked to it, it says nothing about you, and past that date it has no effect at all.

Contact blocking: hiding from your address book

It's optional, it ships off, and nothing happens unless you turn it on.

What it does. It keeps the people saved on your phone from finding you here. If someone in your address book has a Vexxy account, the two of you disappear for each other: they're not in your deck and you're not in theirs, nor in the likes list, nor in Activity, nor in Nearby, nor in Featured, and neither of you can like the other.

What we read. Only the phone numbers in your address book. No names, no photos, no emails, no notes, no groups, and nothing about who you call. Android asks for permission first, and the app explains what it's for before that dialog appears.

What gets stored, and this is the part that matters. The numbers travel to our server, which runs them through a cryptographic function together with a secret key of ours and stores only the result: a string that can't be reversed back into the number. The original numbers are never written to any table, any log or any file, not even temporarily: they exist for the duration of that single request and disappear with it. They aren't stored on your phone either.

Why the secret key isn't in the app. A phone number is ten or eleven digits. A code with no key can be undone by trying every combination, so storing one would be almost the same as storing the number. That's why the server computes the code with a key that never leaves it, and why the numbers have to leave your phone: if the key lived inside the app, anyone could pull it out.

Other people's data. We're aware this involves data about people who have never used Vexxy and never agreed to anything. That's exactly why the feature is optional, why only numbers are read, why none of them is kept, and why what remains can't be read back as a phone number — not even by us. We don't use your address book for anything else: not to suggest people, not to invite anyone, not for advertising, not for measurement. It isn't shared with anyone.

Your own number becomes a code too. It has to, for the comparison to work: without it, someone who has you in their address book couldn't hide from you. It's computed the same way, with the same key, and it replaces nothing — your phone number still lives only in the authentication system, as always.

We don't tell you who from your address book is here. The app never tells you how many of your contacts have an account, or which ones. If it did, anyone could upload a single number to find out whether that person is on a dating app, and that would be worse than not having the feature at all. For the same reason there's a minimum number of contacts per upload and a limit on how many times a day you can refresh.

What it doesn't do. It doesn't touch conversations you already have: if you were already talking to someone from your address book, that chat stays where it is. To cut things off with one specific person there's the normal block, which also undoes the match. And a contact saved without its country code can't be compared, so it isn't hidden.

Turning it off deletes it. When you turn it off, the codes from your address book and the hidden pairs are deleted right then. No copy is kept "in case you come back". Deleting your account does the same.

Automated decisions about your account

This needs saying even though it isn't pleasant to read: part of Vexxy's moderation is automated, and in some cases a decision about your account can be taken by the system without a person having looked first.

How it works. The system keeps an internal assessment of every account that summarises safety signals already held in the database and the moderation decisions that have been made about it.

You won't see it, and we're not going to explain what moves it. A visible score stops measuring behaviour and starts measuring skill at raising it; and publishing the list of what adds and subtracts would be, quite literally, the manual for dodging it. What you do see are the consequences, which is the only part you can need.

There are two consequences, and only two:

Human review. The account joins a queue for a person to look at. You'll see inside the app that your account is under review. It isn't a punishment: it restricts nothing in the meantime and the app keeps working as normal.

Suspension. The account stops appearing and stops being able to write. Every suspension carries a reason and an end date — 30 days in the automated case — and lifts itself when that date arrives. The only removals with no end date are the irreversible ones: accounts belonging to minors, and the serious cases already set out in the house rules.

Automatic suspension is reserved for the unequivocal. A false positive throws out a real person, so the machine only acts on its own when a signal admits no other reading and is preceded by moderation decisions a human already made. Everything doubtful — however doubtful — goes to the review queue, which is reversible. When in doubt, review.

And every suspension ends up in front of a person. Suspending an account automatically opens a review card, without anyone having to ask for it. That holds for suspensions we apply by hand too.

Your rights here. You can ask for a person to review the decision, put your side of it, and contest it. Write to privacy@vexxyapp.com or hello@vexxyapp.com and we'll look. If you think we got it wrong and we don't put it right, you can complain to the data protection authority in your country.

Who it's shared with

Only the providers needed to make this work, and each one gets only what it needs:

Supabase — hosting for the database, file storage and authentication. It's where everything lives.

Twilio — sending the SMS with your login code. It receives your number.

Google Cloud Vision — automated image moderation. It receives the image to analyse.

Amazon Rekognition — face comparison for verification. It receives the selfie and the profile photo, for that moment only.

Google Play — billing and management of the Vexxy Plus subscription, only if you subscribe. It receives the purchase token when we ask about its state. Google holds your payment details, we don't.

Your device fingerprint and your account's internal assessment go to none of them: they're safety data, computed and kept in our own database.

We don't sell data to anyone, and we don't pass it to advertisers or data brokers.

We will hand data to the authorities where there's a legal obligation, and on our own initiative in cases of serious risk to someone — a suspected minor, credible threats, non-consensual sexual content.

What never reaches the app

Your swipes don't leave the server. Who passed on you is never disclosed, not even indirectly, and who you liked is seen by nobody until there's a match from both sides.

Who liked you, on the other hand, is the special case: it's exactly what Vexxy Plus unlocks. Without Plus the server doesn't send the app that list, or an exact number, or a hint of who it is. With Plus, and only then, it sends it. The check lives on the server, not on the screen: with no live subscription the query comes back empty.

How long we keep it

For as long as you have the account. Delete it and everything of yours goes.

Chat images go earlier: when the match is undone.

Your subscription record lasts as long as your account does and leaves with it. Be aware that deleting the account does not cancel the subscription in Google Play: that's done from Google, and it's explained in the Terms of use.

The link between your account and the devices you used it on goes with the account. A marked device's mark expires after 180 days; the bare fingerprint left behind isn't attached to any person.

The codes from your address book, if you turn on contact blocking, last as long as you keep it on: turning it off deletes them right then, and they go with the account just the same.

The only things kept longer are what's attached to an open report — so it can be reviewed — and what the law requires us to keep.

Your rights

See and correct. Your profile data is in the app and you can edit it whenever you want.

Delete. From Settings → Delete account inside the app, and also from a public web page with nothing to install. Deletion is real: storage files go first, the database row second.

Object, restrict processing, or ask for a copy of your data. Write to us and we'll handle it.

Ask for a person to review an automated decision. If the system has suspended your account or put it under review, you have the right to have a human look at it, to explain your side, and to contest the decision. It's set out above, under "Automated decisions about your account".

If you think we're handling your data badly, you can complain to the data protection authority in your country.

Minors

Vexxy is 18+ only and we don't knowingly collect data from minors. If we detect or are told about an account belonging to a minor, it's deleted.

Security

Every database table has row-level access rules: even if someone got to talk to the database directly, they'd only see the rows meant for them. Sensitive columns — raw location among them — are additionally restricted column by column. The chat image and selfie buckets are private and only served through signed links.

No system is perfect. If a breach affects you, we'll tell you.

Changes

If this policy changes in a meaningful way, we'll tell you inside the app before the change takes effect.

Contact

For anything about your data: privacy@vexxyapp.com.