Privacy Policy

Last updated: October 25, 2026. Template to adapt by the publisher before release — replace every bracketed field and check it against the laws that apply to you (GDPR, CCPA, LGPD…).

This policy explains which personal data the LustDare app (the “App”) processes, why, and what your rights are. The data controller is Marion Burgraeve EI, 1 rue Lorem Ipsum, 00000 Dolor (“we”, “us”). Contact: [email protected].

1. Data we process

• Account: e-mail address (or the identifier provided by Apple or Google), sign-in metadata, the date you confirmed being 18 or over.
• Profile: nickname, gender (man, woman or not specified — used only to pick suitable challenges), language, time zone, categories you blocked.
• Game data: your pairs (who you are paired with and since when), the challenges you send and receive (category, drawn challenge, the text of custom challenges you write, status and dates), invitation codes (deleted after 24 hours or once used).
• Notifications: the push tokens of your devices, used only to deliver notifications.
• Purchases: your premium status, the product purchased and its expiry date. Payments are processed by Apple or Google; we never receive your payment details.
• Device settings: the app lock settings (PIN code stored only on your device, in its secure storage) are never sent to us.

We do not use advertising trackers and do not sell your data.

2. Why we use it (legal bases)

• To provide the service you request: account, pairing, drawing and delivering challenges, history, premium features (performance of the contract).
• To send notifications you allowed (consent, which you can withdraw in your device settings).
• To secure the service and prevent abuse, e.g. limiting invitation code attempts (legitimate interest).
• To comply with legal obligations (e.g. accounting for purchases).

3. Who receives it

Your nickname is visible to your partners only. The content of a drawn challenge is only revealed to its sender once you confirm having done it; if you pass, it stays hidden.

Our processors, bound by contract:

• Supabase (database, authentication, server functions) — hosting region: European Union (Ireland).
• Expo (push notification delivery) — receives push tokens and the neutral text of notifications, never challenge content.
• RevenueCat (purchase management) — receives your app user identifier and purchase information.
• Apple / Google (sign-in if you use it, payments, notification delivery).
• Infomaniak (delivery of the sign-in code e-mails) — hosting in Switzerland.

Some processors may be located outside your country; transfers rely on appropriate safeguards (e.g. European Commission standard contractual clauses).

4. Retention

• Your data is kept as long as your account exists.
• Unpairing immediately deletes the history shared with that partner.
• Deleting your account (Settings > Delete my account) immediately deletes your profile, pairs, history, push tokens and premium status, and asks RevenueCat to delete your customer record. Technical backups are purged within 7 days.
• Invitation codes expire after 24 hours and are deleted shortly after.

5. Security

Data is encrypted in transit, access to the database is restricted per user by row-level security rules, the challenge catalogue is never exposed to the App, your session is stored in the secure storage of your device, and you can lock the App with a PIN code or biometrics.

6. Your rights

Depending on your country, you can access, correct, delete or export your data, object to or restrict some processing, and withdraw your consent at any time. You can edit your profile and delete your account directly in the App. For any other request, write to [email protected]. You may also lodge a complaint with your data protection authority (in France: CNIL).

7. Minors

The App is strictly reserved for adults. We do not knowingly process data of people under 18 and delete any such account we become aware of.

8. Changes

We may update this policy. Material changes will be announced in the App.