What the Service collects, why, and what you can do about it.
Last updated: 17 September 2026
The Service is a dating platform for gamers and VR users, currently published under the working title “GamerDate”. For data protection purposes the Operator is the data controller.
Outstanding: the Operator's legal identity and contact address must be stated here before any public launch, and the final product name settled. Both are mandatory disclosures and cannot be omitted.
A dating service necessarily processes information most services do not. Your profile can include your gender identity, whether you are transgender, your sexual orientation, and the relationship structures you are open to.
Under Article 9 of the GDPR this is special category data, and processing it is prohibited by default. The only realistic basis for processing it here is your explicit consent under Article 9(2)(a). That means a separate, specific choice — not a consequence of accepting these terms, and withdrawable at any time by removing the information from your profile or deleting your account.
Outstanding: the app does not yet present a separate explicit-consent step for these fields. Until it does, do not supply them.
Everything held about you is listed below. It is not a representative sample: the data export described in section 7 returns exactly this set, so the two cannot drift apart.
| Category | What exactly |
|---|---|
| Account | Email address, a hash of your password (never the password itself), account creation date |
| Profile | Display name, age, date of birth, a free-text location you type yourself, avatar image, bio, tagline, gaming platforms, top games, interests, VR flag, prompt answers, social links |
| Special category | Gender identity, transgender status, sexual orientation, relationship structures — see section 2 |
| Activity | Likes, passes and super likes; matches; messages you send and receive; when you were last online |
| Safety | Accounts you block or mute, reports you file or that name you, and any suspension or ban applied to your account |
| Technical | IP addresses you connect from — see section 5. Push notification subscriptions, if you enable them |
| Consent | The time you accepted these terms |
No analytics or tracking of any kind is performed. There is no advertising, no third-party analytics, no behavioural profiling and no tracking cookies. Device type, operating system and app version are not collected.
Your location is not tracked. The location on your profile is a free-text field you fill in yourself. No GPS, no IP geolocation, and no distance calculation of any kind is performed.
| Purpose | Basis |
|---|---|
| Running your account and showing you profiles | Performance of a contract, Art. 6(1)(b) |
| Gender identity, orientation and related fields | Explicit consent, Art. 9(2)(a) — see section 2 |
| Messaging between matched users | Performance of a contract, Art. 6(1)(b) |
| Blocks, reports, moderation, rate limiting | Legitimate interest, Art. 6(1)(f) — keeping the service safe |
| Recording IP addresses | Legitimate interest, Art. 6(1)(f) — investigating abuse and account takeover |
| Push notifications | Consent — only if you enable them, withdrawable in your browser at any time |
One record is kept per address you connect from: the address, when it was first and last seen, and how many times. Individual requests are not logged, and your activity is not reconstructed from it. It exists to investigate abuse, fraud and account takeover.
These records are deleted automatically after 90 days, and immediately if you delete your account.
| Recipient | What they receive | Why |
|---|---|---|
| Bunny.net | Your avatar image | Serving it quickly worldwide. Avatars are public to signed-in users. |
| Discord (only if you sign in with Discord) | That you are signing in to GamerDate. Discord sends us your Discord account id and the email address on it. | Signing you in without a password. Nothing else about your profile goes to Discord. |
| Your browser's push service (Google, Mozilla or Apple, depending on your browser) | An encrypted notification, and an identifier for your browser installation | Delivering notifications when the app is closed. The notification content is encrypted; the push service cannot read it. |
Everything else — the database, authentication, messages and images — runs on infrastructure operated directly by the Operator. Your data is not sold, rented, or shared with advertisers. There are none.
Outstanding: data processing agreements with the above must be in place before launch, and any provider outside the EU/EEA requires a documented transfer mechanism.
Four of these are built into the app and work immediately:
You also have the right to object to processing based on legitimate interest, to withdraw consent, to request restriction, and to complain to a supervisory authority. To exercise any of these, contact the Operator.
| Data | Kept for |
|---|---|
| IP address records | 90 days |
| Avatar upload records (rate limiting) | 2 days |
| Everything else | Until you delete your account |
Outstanding: no retention limit is currently applied to messages or to inactive accounts. Both should have one.
If your account is banned, one record is kept after it is deleted: a keyed cryptographic hash of your email address, the date, and the reason for the ban. It contains nothing readable — the address cannot be recovered from it, and it identifies you to nobody. Its only use is to be compared against the address given at sign-up, so that a banned account cannot immediately be recreated.
This is kept on the basis of our legitimate interest in enforcing a ban and keeping the service safe (Art. 6(1)(f) GDPR), and it is retained despite an erasure request under Art. 17(3)(e). If you believe a ban was applied in error, contact the Operator: an administrator can remove the record, after which the address can be used again.
Nothing else is kept after deletion. In particular, we do not hold deleted accounts, their messages or their reports for any period “in case” they are asked for by an authority; we have no legal obligation to do so and no legal basis for doing it.
Traffic is encrypted in transit. Passwords are stored only as hashes. Access to your data is enforced at the database level rather than only in the app, so a modified client cannot read what it should not. Avatar uploads are checked by content rather than by filename, size-limited and rate-limited.
This service is for adults. You must be 18 or older. Age is currently self-declared and not independently verified.
Material changes will be notified in the app. The date at the top of this page reflects the most recent revision.