Privacy Policy

1. What we collect

To run the Service we collect the following categories of personal data:

• Account data: phone number or email address, hashed verification codes, date of birth, gender, country, city, and language preference.
• Profile data: name, photos, bio, interests, matching intent, occupation, education, and any other field you choose to fill in.
• Usage data: likes, matches, messages, blocks, reports, push notification subscriptions, and the timestamps at which they occur.
• Location data: when both users opt in, the coarse (neighborhood-level) coordinates at which they crossed paths. Crossings are historical only — never real-time. Live coordinates of other users are never stored or transmitted.
• Technical data: IP address, device type, browser, app version, and crash diagnostics (via Sentry).
• Billing data: handled directly by Stripe — we receive only the subscription status, plan, and the last four digits of the card.

2. Why we use it and the legal basis

We process personal data on the following legal bases under the EU General Data Protection Regulation (GDPR) and the UAE Personal Data Protection Law (PDPL):

• Performance of contract — to create your account, match you with users that fit your filters, deliver messages and notifications, and process subscriptions.
• Legitimate interests — to prevent fraud and abuse, secure the Service, and improve features. These interests are balanced against your rights, and you may object at any time.
• Consent — for marketing emails (if any) and for optional features such as location-based crossings or push notifications. You may withdraw consent at any time.
• Legal obligation — to respond to lawful requests from public authorities and to comply with tax, accounting, and consumer-protection law.

3. Who we share it with

We share personal data only with the following processors and recipients:

• Stripe Payments Europe, Ltd. (Ireland) — to process subscription payments. Stripe receives your email and payment details directly; we never store your card number.
• Apple Push, Google FCM, and Mozilla Web Push services — when we send you a notification.
• OpenStreetMap / Nominatim — when you tap a crossing pin we send only the pin coordinates to look up the street name. Your identity is never sent.
• Sentry (sentry.io, Functional Software, Inc.) — to receive crash diagnostics. We scrub personal identifiers from error reports.
• Our hosting provider in Germany — to operate the servers that store your data.
• Competent authorities — only when compelled by valid legal process or to protect users from imminent harm.
• [If applicable] Our CDN provider (e.g. Cloudflare, Inc. or Bunny.net d.o.o.) — to cache and accelerate delivery of static assets including photos. The CDN sees the request URL, IP address, and standard request headers, but no profile or message content.

We do not sell personal data, and we do not share it with advertising networks.

4. International transfers

Your data is primarily stored on servers located in Germany (European Union). Some processors (Stripe, Sentry, Apple, Google, Mozilla) may process data in the United States or other countries. Such transfers rely on the European Commission's adequacy decisions or on Standard Contractual Clauses with appropriate supplementary measures.

5. Retention

Account, profile, and usage data are kept for as long as your account is active. When you delete your account, we remove your profile, photos, likes, matches, and messages within 30 days, except where retention is required for legal or fraud-prevention purposes (typically up to 7 years for billing records).

Crash diagnostics in Sentry are retained for 90 days. Server access logs are retained for 30 days.

6. Your rights

Under the GDPR (if you are in the EEA), the UK GDPR (if you are in the UK), and the UAE PDPL (if you are in the UAE), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data — most fields are editable in Settings.
• Delete your account and associated data — available in Settings.
• Restrict or object to specific processing, including profiling.
• Receive a portable copy of your data — email [email protected].
• Withdraw consent (e.g. for push notifications or location features) at any time.
• Lodge a complaint with a supervisory authority — for EEA residents, your national data-protection authority; for UAE residents, the UAE Data Office.

7. Security

All connections to Linkamoon use TLS encryption. Authentication uses JSON Web Tokens stored in HttpOnly cookies, never exposed to client-side scripts. We do not store passwords — sign-in is passwordless via one-time codes. Photos and other media are stored on origin servers in the European Union. If we use a content delivery network (CDN) to accelerate delivery, the CDN may cache and serve media from points of presence outside the EU. CDN processing is governed by a data processing agreement and, where data leaves the EU, by Standard Contractual Clauses. Any CDN provider in use is listed in Section 3. Access to production systems is restricted to authorised engineers and logged.

8. Children

Linkamoon is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected such data, we will delete it promptly. Parents and guardians may contact [email protected] to request immediate removal.

9. Automated decision-making

We use automated systems to rank discovery results and to detect spam or abusive behaviour. None of these systems produce legal or similarly significant effects without human review. You may request human review of any account action by emailing [email protected].

10. Changes to this policy

We may update this Privacy Policy. Material changes will be announced in-app and on this page, and the "Last updated" date above will reflect the change.

11. Contact

Data Protection point of contact: [email protected]. Postal address: RACKSET LLC, Shams Media City, Sharjah, United Arab Emirates.