Privacy Policy

1. Who controls your data

The controller currently identified in Adam & Eva's existing legal materials is Pavlo Olehovych Konoshchenko, operating the Adam & Eva service. Privacy enquiries and requests may be sent to admin@adam-eva.app. The controller's registered legal form, registration number and service address are not available in the application source and must be confirmed in the service imprint. We do not claim that a data protection officer has been appointed.

This Policy explains the processing actually implemented by the Adam & Eva website and Android application. It is information about processing; it is not a request that you waive privacy rights or give blanket consent.

2. Service and age

Adam & Eva is an 18+ faith-oriented dating and communication service. We do not knowingly permit anyone under 18 to create an account. If you believe a minor uses the service, contact us so we can investigate and take proportionate action.

3. Data we process

• Account and authentication: internal user ID, email address, Google account identifier when Google sign-in is used, login codes, session and refresh-token records, account creation and activity times.
• Profile and preferences: name, age (not a full date of birth in the inspected implementation), sex, height, body type, country and city, languages, education, marital and family information, lifestyle, character, relocation preferences, biography and other answers you choose to provide.
• Special-category information: religion, confession or denomination, church, church attendance, baptism, ministry, Bible verse, a health/disability-related indicator, and information that may reveal or permit an inference about sexual orientation through dating preferences.
• Photos: original and processed profile photos, thumbnails, crop coordinates, moderation status, and face-presence/rectangle results. The inspected service does not create a face identity template or perform facial recognition.
• Location and network: country/city you select; public IP observed by the server; and IPinfo-derived approximate city, region, country, coordinates, time zone, network/ASN and security signals such as proxy, VPN or Tor indicators. The inspected clients do not request GPS location permission. The people map uses aggregated, coarsened location data rather than a person's precise live position.
• Interactions: profile views, likes, matches, blocks, chat text, photo/voice/video attachments, reactions, delivery/read/edit/delete states and gifts.
• Premium and purchases: entitlement, product, price-reference, billing-period and status data; Google Play purchase tokens and verification results; Stripe customer, checkout, subscription, invoice, price and event identifiers. Adam & Eva's code does not store full payment-card numbers.
• Safety, moderation and support: reports, categories, messages, evidence attachments, moderation decisions, restriction/ban reasons, appeals, audit events, support tickets and ratings. Anonymous landing support also collects the email you enter.
• Referral and rewards: referral codes and relationships, registration attribution, Android install-referrer metadata, reward and anti-abuse events.
• Device, notification and diagnostics: platform, operating-system/app version, device model/manufacturer, random app installation ID, push token, language, login IP, correlation/request IDs, route/method, failure and performance telemetry. We do not require IMEI, MAC address, advertising ID or a browser/device fingerprint for legal acceptance.
• Web storage: local or session storage for authentication state, a random installation ID, language/theme, referral state, filters, limited cached app data and dismissed notices. The inspected public Web application does not include an advertising or Google Analytics SDK.

4. Why we process data and our legal bases

• Contract: create and secure your account; show and edit your profile; provide discovery, likes, matches, chat, gifts, Premium, referrals, support and notifications; and process steps you request before entering the contract.
• Explicit consent: process the special-category information you choose to provide for faith-based profile presentation, discovery and relevant preferences. This consent is separate from accepting Terms. You can withhold or withdraw it without losing the basic service. Features needing that information will stop, and withdrawal clears the relevant profile and discovery values.
• Legitimate interests: prevent fraud, spam and abuse; protect users and systems; moderate content; investigate reports; maintain service reliability; measure non-advertising operational performance; defend legal claims; and operate a safe, relevant feed. We consider necessity, user impact and safeguards and do not use this basis where your rights override the interest.
• Legal obligation: comply with valid law-enforcement/court requests, accounting/tax duties, consumer obligations and applicable online-platform duties.
• Legal claims: preserve a minimal, access-restricted record where necessary to establish, exercise or defend claims, including after account deletion where GDPR Article 17(3)(e) applies.

Where consent is the basis, refusing it does not retroactively affect other lawful processing. Contract and required account/security data may be necessary to provide the basic service; we explain the consequence when a field is optional.

5. What other users can see

Depending on profile configuration and your settings, other users may see your name, age, main and additional photos, country/city, online or last-active status, biography, faith/confession and other profile answers. A health-information choice is exposed only as a privacy-safe indicator that you wish to discuss something before meeting, not as diagnosis details. Likes, matches, messages and private support/moderation material are not public. Invisible/privacy settings and blocking rules restrict visibility but cannot remove data another person already saved outside the service.

6. Discovery, ranking and profiling

The service filters and ranks profiles using information such as age, sex, country, profile completeness, preferences, activity, Premium/promotions and safety/privacy eligibility. It also derives aggregate map counts. These processes recommend who appears; they do not make a solely automated decision producing legal or similarly significant effects within the inspected implementation. Moderation or account restrictions involve configured rules and/or authorized review. Contact us if you want meaningful information about a result affecting your account or wish to contest it.

7. Messages, photos and moderation

Messages and attachments are stored to deliver conversations, synchronise devices and apply blocks/read state. Authorized personnel may access relevant content when a user reports it, support is requested, safety or fraud is investigated, or law requires it. We do not promise that every conversation is proactively read.

Profile photos are stored in Microsoft Azure Blob Storage and processed locally for resizing. Photo bytes may be sent to Microsoft Azure OpenAI for safety-policy classification and to Azure Face to detect a face rectangle/presence. The configuration reviewed requests no Face ID and performs no identity matching. Moderators may review photos and decisions. Future biometric identification or a materially different AI purpose requires a new assessment and, where applicable, new consent.

8. Payments, gifts and subscriptions

Stripe processes Web checkout/subscriptions; Google Play processes Android purchases and subscriptions. They receive the data required to perform and verify the transaction. Adam & Eva stores processor identifiers and entitlement/status records, not complete card details. The payment provider may act under its own legal duties for payment, fraud and accounting. Purchases are also governed by the checkout/provider terms and mandatory consumer law.

9. Notifications, support and security

Firebase Cloud Messaging receives push tokens and delivery payload metadata to deliver notifications. Azure SignalR supports real-time updates. Anonymous support requires an email so support can understand and respond to the request; creating a fake account is not required and we do not use that email to reveal whether an account exists. The basis is performing your requested support step and our legitimate interest in complaint handling and security, not marketing consent.

We use authentication/session data, rate limits, IP/network signals, moderation records, logs and alerts to prevent abuse and diagnose incidents. Acceptance evidence records the authenticated account, exact legal version/hash, server UTC, platform/client version, session and correlation ID. It deliberately avoids aggressive device fingerprinting and full request bodies.

10. Recipients and service providers

Data is disclosed only as needed to other users, authorized support/moderation/operations personnel, payment providers and these evidenced providers:

• Microsoft Azure (hosting, SQL, Blob Storage, SignalR, Communication Email, Application Insights, Azure OpenAI and Azure Face);
• Google (Identity, Firebase Cloud Messaging, Google Play Billing/Developer API and Android Install Referrer);
• Stripe (Web checkout, billing and subscription handling);
• IPinfo.io (IP-derived approximate location/network/security attributes);
• OpenStreetMap tile infrastructure used by Android osmdroid when the people map is opened.

We may disclose data to competent authorities or professional advisers only where lawfully required or necessary for rights, safety and legal claims. We do not describe an unverified contractor or analytics provider as a recipient.

11. International transfers

Core Azure application/SQL/storage resources inspected are in West Europe, while configured Azure Face and Azure OpenAI resources are in East US; global providers can also process operational data outside the EEA. A technical resource location alone does not prove the contractual transfer safeguard. For a restricted transfer, the controller must ensure an applicable adequacy decision, approved contractual clauses or another lawful GDPR Chapter V mechanism and supplementary measures where needed. You may request information about the mechanism relevant to your data. The controller must verify the current provider agreements before relying on a named safeguard.

12. Retention

• Active account, profile, photos, interactions and device tokens: while the account/feature is active, then removed through the deletion workflow unless a narrow exception applies.
• Login codes and sessions: until their technical expiry or revocation; refresh sessions are configured with a maximum 90-day lifetime.
• Chats/support/moderation: while needed to provide the conversation/case and for the proportionate safety, complaint and applicable legal-claims period. Attachments and cached copies follow the case/deletion cleanup workflow.
• IPinfo and login/security records: while the account exists and only for the approved security/moderation window; the controller must maintain and enforce a shorter reviewed schedule where continued detail is unnecessary.
• Payment records: for entitlement/dispute handling and any statutory tax/accounting period that applies; payment providers retain their own records under their policies.
• Legal acceptance/consent evidence: while the account exists and afterward only for the applicable compliance or legal-claims limitation period, then erased or irreversibly anonymised.
• Azure HTTP/blob diagnostic logs observed in the deployment: 3 days. Application Insights, database backups and provider backup retention follow configured provider schedules, which the controller must confirm in its retention register.

We do not retain an entire deleted profile “just in case.” A documented legal hold may suspend deletion only for the narrow data and period necessary.

13. Account deletion

Use the in-app account-deletion control or contact support. The workflow removes the active profile, photos/blobs, chats, likes, matches, device/push/auth records and other account-linked product data. Backups may persist temporarily until overwritten under the provider schedule. Minimal security, accounting, moderation or legal-evidence records may be retained only when a real legal obligation, safety need or establishment/exercise/defence of claims justifies it, with restricted access. Legal acceptance is never backfilled from account creation and deletion does not rewrite historical evidence.

14. Your rights

Subject to the GDPR and applicable limits, you may request access, correction, erasure, restriction, portability, and information about processing; object to legitimate-interest processing; withdraw consent at any time as easily as it was given; and contest a relevant automated or moderation outcome. Withdrawal does not make earlier lawful processing unlawful. We may need proportionate verification and must explain any lawful refusal or extension.

Contact admin@adam-eva.app. You may complain to the supervisory authority where you live, work or believe an infringement occurred. If the controller's relevant establishment is Denmark, the authority is Datatilsynet, datatilsynet.dk. You may also seek a judicial remedy.

15. Security and incidents

We use access controls, authenticated sessions, encryption in transit, restricted administrative roles, rate limiting, content moderation, audit/correlation records, token protection and provider security controls. No online service is risk-free. If a personal-data breach creates a legal notification duty, we will notify the relevant authority and affected users as required without undue delay.

16. Changes

Each published Policy keeps a fixed version, exact content hash, publication date and effective date. Old versions are retained. A notice update is not treated as blanket consent. If a new purpose needs consent—especially Article 9 consent—we will request it separately before that processing. Material Terms changes are handled through the Terms acceptance flow.

Illegal-content notices

If you use the public form to report potentially illegal content, we collect the email and name you provide, the exact electronic location of the content, your explanation of why it is illegal, additional information, and your good-faith accuracy declaration. We use these data to assess the notice, communicate about it, protect affected users, meet applicable platform-law duties, and establish, exercise or defend legal claims. The legal basis is the requested complaint-handling step, compliance with applicable legal obligations, and our legitimate interests in platform safety and claims. The notice is retained only for the case and a proportionate complaint, safety and legal-claims period; access is restricted. A notice does not itself cause an automatic restriction.