PrideConnect respects your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, who we share it with, and the rights you have over it. Because PrideConnect serves LGBTQ+ adults, much of the data we handle is special-category sensitive personal data under GDPR Article 9 and equivalent provisions in the India DPDP Act, UK Data Protection Act 2018, and California Civil Code § 1798.140. We treat it with the highest standard of care.
This policy is written for PrideConnect operated by [Legal Entity Name — to be appointed before submission] ("we", "us", "our"). If anything in this policy conflicts with the laws of your country of residence, the local law prevails for residents of that country.
| Category | Examples | Why | Retention |
|---|---|---|---|
| Account identifiers | email address, hashed password (argon2id), date of birth, declared gender identity + sexual orientation | create + secure your account; verify 18+ age gate; serve identity-relevant content | until account deletion |
| Profile data | display name, photos, bio, preferences, looking-for filters | show your profile to other users you choose to be discoverable to | until account deletion |
| Coarse location | 500m grid cell only (never exact GPS) | show profiles within distance buckets ("<1 km", "1-2 km", etc.) for the Discover feature | session lifetime; not persisted at exact coordinates |
| Communication data | direct messages, voice / video call metadata (not content), reactions, reports filed | deliver messages; enforce safety policy | until account deletion or 90 days for soft-deleted messages; reports retained per legal hold |
| Device + technical | device fingerprint hash, app version, OS, IP address (truncated), crash logs (no personal content) | fraud / ban-evasion prevention; debugging; security audit | fingerprint: 1 year (India DPDP Act access logs); IP: 7 days max |
| Payment data | via Stripe / Razorpay / Apple / Google IAP — we never see card numbers | process Super Coins purchases or event commission payouts (when those features ship) | per processor; we keep only transaction id + amount |
| Special-category sensitive data | HIV status, health info you choose to disclose, orientation, gender identity | only if you voluntarily add it; column-level encrypted at rest (pgcrypto / AES-256 + libsodium) | until you remove it OR account deletion |
We do not collect: phone contacts, calendar, exact GPS, biometric identifiers (face / fingerprint scans), or government ID. We do not sell your data to anyone.
app.current_user_id set; cross-user reads are physically blocked by 12-table FORCE ROW LEVEL SECURITY policies (verified by integration test).The shortest possible list:
We never share your sexual orientation, HIV status, or special-category data with advertisers, data brokers, third-party trackers, or marketing partners. We will never use your face photos for facial-recognition training or sell them to any AI company. We do not participate in the IAB TCF or any cross-platform ad-tracking framework.
Depending on where you live, you have some or all of the rights below. Exercise any right by emailing privacy@prideconnect.lgbt or via in-app Settings → Privacy & Data → Manage My Data.
Your data may be processed in: India (primary infrastructure), the European Union (Cloudflare edge + EU users), and the United States (NCMEC reports, US users). Where data leaves your country of residence, we use Standard Contractual Clauses (EU SCCs 2021), the UK IDTA, or DPDP Act § 16 cross-border transfer rules as applicable. We do not transfer data to countries that criminalise same-sex relationships or LGBTQ+ identity, except where strictly necessary to fulfil your account access from those locations and where data is end-to-end encrypted in transit.
PrideConnect is exclusively for adults aged 18+ (see [Child Safety Policy § 2]). We do not knowingly collect data from anyone under 18. If we discover a minor's account, we delete it immediately and block the device fingerprint. If you believe a minor has registered, please report via safety@prideconnect.lgbt.
The PrideConnect mobile app does not use HTTP cookies (we use PASETO bearer tokens). The on-device app stores a Drift / SQLite database encrypted with SQLCipher AES-256, plus flutter_secure_storage entries (iOS Keychain / Android Keystore) for tokens. The web pages (prideconnect.lgbt/, /safety/, /privacy/, /terms/) are static and set no cookies; Cloudflare may set a __cf_bm bot-management cookie required for security — this contains no personal data and lasts 30 minutes.
In compliance with India IT Rules 2021 Rule 3(2)(a):
DPO: [TBD — appointed when we cross the GDPR DPO threshold (regular monitoring of subjects on a large scale, OR processing of special-category data on a large scale)]. Contact: privacy@prideconnect.lgbt. Even before formal DPO appointment, the privacy mailbox is monitored daily.
We will post material changes here at prideconnect.lgbt/privacy/ at least 30 days before they take effect, send an in-app notification, and email all users for whom we have a verified email address. The effective date at the top of this page reflects the most recent material change.
Privacy / Data Subject Rights: privacy@prideconnect.lgbt
Safety / Reports: safety@prideconnect.lgbt
Grievance Officer (India): grievance@prideconnect.lgbt
Legal: legal@prideconnect.lgbt