1. CONTROLLER and CONTACT
Controller: Rattlestork UG (haftungsbeschränkt), Sternstraße 23, 39104 Magdeburg, Germany.
Email: support@rattlestork.org · Contact form.
Supervisory authority: State Commissioner for Data Protection of Saxony-Anhalt.
2. WHAT DATA DO WE COLLECT?
Information you provide
- Account data (email, username, date of birth, password data).
- Profile and UGC (text, images, preferences, messages, matches, reports).
- Support (requests, attachments, diagnostic data).
- Billing metadata (plan, renewal status, transaction IDs; we do not store full card numbers).
Automatically collected information
- Log and usage data (timestamps, pages/screens, feature usage, crashes/errors).
- Device data (identifiers, OS, app version, language, network).
- Location information (places entered or selected and associated coordinates).
- Cookies/SDKs as described in the Cookie Policy.
3. SPECIAL CATEGORIES (SENSITIVE DATA)
Profiles and messages may contain information about health, sexuality and family planning, such as allergies, hereditary conditions, blood group, semen analyses or infection tests. This information may be displayed to other users in profiles or shared by you in messages. Do not share sensitive data about others without their authorization.
4. HOW DO WE PROCESS YOUR DATA?
- Provision: accounts, profiles, matching, messaging, moderation, support.
- Improvement and security: troubleshooting, analytics (with consent), anti-spam/fraud, abuse prevention.
- Communication: service and notification emails through Google/Gmail (SMTP), push notifications through Firebase Cloud Messaging. You can disable push notifications in your device settings.
- Compliance: tax/accounting, consumer law,DSA, government requests.
- Campaign attribution: determining the source of a visit or registration using campaign parameters.
5. LEGAL BASES
- Contract (Art. 6(1)(b)): provision of requested core features.
- Consent (Article 6(1)(a) GDPR): optional usage analytics and campaign attribution.
- Legal obligation (Art. 6(1)(c)): tax, consumer law, DSA, retention.
- Legitimate interests (Article 6(1)(f) GDPR): service security, fraud prevention and protection against abuse.
Health data and other special categories are additionally subject to Article 9 GDPR. Accepting terms of use or acknowledging this policy does not replace any explicit consent required for this processing.
6. PAYMENTS and SUBSCRIPTIONS
Web payments are processed through PayPal; in-app purchases use the Apple App Store or Google Play, with RevenueCat for subscription management. We process plan, status and transaction identifiers to manage access, rather than full card numbers. Offers are listed on the subscription page.
9. GOOGLE-APIs and ANALYTICS
With your analytics consent, we use Google Analytics (GA4) and PostHog for usage and error analytics. Usage data may be associated with pseudonymous identifiers and, when you log in, your account. Withdrawing consent in Settings stops further analytics collection.
We use Google Places and Geocoding for place search and location resolution. Search text or place identifiers are transmitted to Google.
10. NOTICE-AND-ACTION (EU-DSA)
You can report suspected illegal content through the contact form or the reporting feature on profiles. Reports contain your contact details, information about the profile concerned and your description; they are forwarded to our support team.
11. HOW LONG DO WE RETAIN DATA?
You can delete your account profile and associated profile images in Settings. This does not automatically remove all messages held by conversation partners, support correspondence or billing and deletion records. Pseudonymous data used to improve search results is limited to 180 days. For further deletion requests, use the contact form.
12. HOW DO WE PROTECT DATA?
We use transport encryption and access controls to protect personal data. Absolute security of electronic transmission or storage cannot be guaranteed.
13. CHILDREN and MINORS
Services for adults 18+. No intentional collection of data from anyone under 18. If you become aware of such data, please contact us to request deletion.
14. YOUR PRIVACY RIGHTS
Subject to applicable data protection law, you have rights of access, rectification, erasure, restriction, objection and data portability. You may withdraw consent with effect for the future; the lawfulness of previous processing is unaffected. Send requests to support@rattlestork.org or the contact form. You may complain to a data protection supervisory authority.
15. US STATE PRIVACY NOTICES
Where the law of your US state applies to our processing, additional rights of access, copying, correction and deletion, and rights to opt out of certain processing may apply. These may include targeted advertising, sale or sharing of personal data, and certain forms of profiling.
The data categories processed include account and contact data, profile information, images, messages, selected places, purchase and subscription metadata, and usage data. Profile information and messages may contain health data and other sensitive information.
You can submit requests and ask for reconsideration of a decision through the contact form or support@rattlestork.org. Identity information may be needed to verify your entitlement. Applicable rights may also be exercised through authorized representatives.
16. INTERNATIONAL TRANSFERS
Use of the international services named above may involve processing outside the European Economic Area, particularly in the USA. Such transfers are also subject to the requirements of Chapter V GDPR.
17. DO-NOT-TRACK
Due to the lack of an accepted industry standard, we do not currently respond to DNT signals. If a standard is established, we will update this notice.
18. UPDATES TO THIS NOTICE
Changes will be dated above; significant updates may be highlighted in the app or elsewhere. Please check regularly.
19. CONTACT
Rattlestork UG (haftungsbeschränkt)
Sternstraße 23, 39104 Magdeburg, Germany
Email: support@rattlestork.org
Contact and reports: rattlestork.org/contact
8. SOCIAL LOGINS
We use Google Firebase Authentication for login. When you sign in through Google or Apple, we receive the identifiers and contact details released for account login. The selected provider's privacy notices also apply to its processing.