Back

Privacy Policy

Effective: October 16, 2026 · Version 1.21

1. Controller

Lunchdate UG (haftungsbeschränkt)
c/o betahaus GmbH, Rudi-Dutschke-Straße 23
10969 Berlin
Germany

Email: privacy@lunchdate.io

(hereinafter “Lunchdate”, “we”, or “us”)

2. Scope

This Privacy Policy applies to the “Lunchdate” iOS app and the related website at lunchdate.io (together, the “Service”). It does not apply to an Android app or to third-party services to which we merely link. As an exception, the rules in Section 8.2 on server-side storage and synchronization of your optional choices also apply to Android.

Lunchdate is a platform for professional networking and in-person meetings. Use is restricted to persons aged 18 or older.

3. Principles and Legal Bases

We process personal data only where there is a legal basis. Where the General Data Protection Regulation (“GDPR”) applies, these bases include:

You may withdraw consent at any time with effect for the future. Processing that took place before withdrawal remains lawful. You may object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

4. Data We Process

4.1 Account and Sign-In

Registration and sign-in offered in the iOS Service use Sign in with Apple. We process:

Authentication data is processed in Firebase Authentication. To operate and display your profile, we also store required account fields, in particular display name and internal user identifier, in Cloud Firestore.

Sign-in requires the Apple identifier and the real or relay email address provided by Apple. Completing your profile requires a display name, job title, at least one profile photo, an industry, at least one language, and a networking goal. Without these details you cannot complete registration or your profile. Company information is optional. Device location, push notifications, calendar access, product analytics, and error diagnostics are optional; declining them does not prevent account use, but the respective optional feature will be unavailable or limited.

4.2 Profile and Settings

Depending on the information you provide, we process:

Before upload, the app locally removes EXIF metadata such as GPS coordinates, camera model, and capture date where technically present.

4.3 Photo and Content Moderation

We send uploaded profile photos and, on iOS, group photos from our servers to Google Cloud Vision to check them automatically for prohibited or inappropriate content. The recipient is Google Ireland Limited and its affiliated Google entities as described in Section 6.2.

The legal basis for this transfer and check is Art. 6(1)(b) GDPR, because checking uploaded profile and group photos is part of our service and implements the photo rules of the Terms of Service and the Community Guidelines; a profile photo is required to use the service (Section 4.1). We also rely on Art. 6(1)(f) GDPR; our legitimate interest is to protect users from unlawful and inappropriate content and to prevent abuse of the service. Insofar as the check is based on Art. 6(1)(f) GDPR, you may object to it under Art. 21 GDPR on grounds relating to your particular situation.

Before your first upload, the app separately asks for your express permission to send images to Google Cloud Vision, because Apple’s App Store guidelines require such permission before personal data is shared with third-party AI services. This permission is not consent within the meaning of Art. 6(1)(a) GDPR; camera or photo-library permission, accepting the terms, and acknowledging this privacy policy do not replace it. We store your decision on our servers together with the version of the notice. It applies across devices and platforms using the same account; we do not ask again while the current permission remains valid. Before every new upload and immediately before the transfer to Google, our server checks that the permission is in place. Without it, you cannot upload photos; because a profile photo is required, you then cannot complete registration. You can withdraw the permission at any time under “Account & Security → Privacy → Image checks”. You then cannot upload new photos, including a new profile photo; images already published remain available (Section 8.2), and text features remain usable.

For this content check we use only SafeSearch; we do not commission separate facial analysis or identification of people, and do not create or store biometric templates for recognition. We send the image data without additional profile details such as name or email address; the photo itself may contain personal data.

According to Google, the online API used for this check processes image data only in memory and does not persist it to disk. Google temporarily logs technical request metadata, such as the time and size of the request. Source: Google Cloud Vision: Data Usage FAQ. Approved photos remain stored by Lunchdate; quarantine and private moderation copies follow the retention periods in Section 8.

An automated result may cause an image not to be published, to be removed, or to be referred for human review. Section 10 explains the available review options.

All freely editable profile text that is visible to other users is checked automatically when saved using multilingual, rule-based matching of words and predefined text patterns across all 15 supported languages. No language model or comprehensive semantic analysis is used. This includes display name, bio, lunch objective, job title, company, professional topics, and role description, as well as goals and custom goals; personal and professional interests and custom entries; skills and custom skills; education and past work experience; and freely editable profile-photo captions. The profile-photo image file remains subject to the separate image-moderation process described above. If the check detects wording prohibited by our content policy, the affected field, list item, or caption may be cleared or removed automatically. Both detection and the decision to intervene are automated; no manual review takes place beforehand.

For each such measure, we create a user-readable decision record containing the affected fields, the specific measure, the contractual basis, the role of automation, the complete reason, and a Case ID. The record contains neither the original profile text, the matched word, nor any model or classifier score. You may request a free manual review by replying to the decision email or contacting support@lunchdate.io.

Every private text message sent through the iOS Service in a 1:1 or group chat is checked on the server before it is saved as a message and delivered to other participants. This is multilingual, rule-based matching of words and predefined text patterns across all 15 supported languages, not a language model or comprehensive semantic analysis. Before comparison, the server normalizes the text: it converts it to lower case, removes invisible characters and diacritics, applies Unicode normalization, and maps specified look-alike characters and leetspeak substitutions. If the check detects wording prohibited by our content rules, the send attempt is rejected; the message is neither saved nor delivered.

To document that decision and make it reviewable, we create a minimized moderation record bound to the specific account generation. It contains the internal user identifier and account creation time, the chat type, hashed conversation and send-attempt references, the reason and non-delivery decision, timestamps, the status and count of the violation counter, a moderation Case ID, and a user-readable decision receipt. Neither the original message text nor the matched word is copied into the case, evidence, or decision receipt. Evidence expires six calendar months after the decision; the case, event, and user-readable decision receipt after twelve calendar months; and the account-generation-bound content-policy violation counter on a rolling basis 365 days after the latest eligible rejected send attempt. Earlier deletion and documented legal holds are governed by Section 8.

4.4 Location, Availability, and Calendar

We process:

Only your own account can see your trips and home city. We use them to show you, in the Planner, open meetings in the trip city on travel days and meetings in your home city for the days after. If you choose a trip as your starting point in Discover, it counts as your travel location: Discover then searches from the trip city until the last travel day ends in the trip city's time zone, and afterwards automatically from your actual location again; if you delete the trip, Travel Mode ends immediately. Other users see the place label of a travel location only while Discover actually searches from there, that is, with Pro and, for a trip, until it is over; if a connection is formed during that time, the travel city is noted with that connection. Other users do not see your travel dates or your other trips. The legal basis is Art. 6(1)(b) GDPR.

If iOS denies or restricts location access for Lunchdate, the app reports this to our server; your profile then no longer appears in Discover until you allow access again. Your most recently stored location remains stored until it is changed or the account is deleted and continues to be used for the Planner, open meetings near you, and the related notifications; the legal basis for this is Art. 6(1)(b) GDPR. You can change the location in the app, for example by using your current location again. We continue to collect your current device location only with your consent through the iOS location permission (Art. 6(1)(a) GDPR).

The app requests the full calendar access provided by iOS. This is technically necessary because iOS only allows an app to retrieve an event it created itself if it holds full access, which we need in order to update or remove that event when a meeting is rescheduled or cancelled. We access only the events created by Lunchdate itself; existing calendar events are neither read nor transferred to us. An event created by Lunchdate contains the type, time, and place of the meeting, for one-to-one meetings the name of the other person, for group lunches their title, where applicable the meeting description, and a reminder. If the calendar used syncs with a cloud service such as iCloud, the event also reaches that provider. Signing out leaves the events in place; when you delete your account, the app removes the events it created, as far as iOS allows.

If you choose “Notify nearby contacts” when switching on your availability, we send existing contacts a push notification with your display name and the type of your availability (for example lunch, coffee, or afterwork). We only notify contacts who may see your status under your choice, who can receive such notices under their settings, and whose actual location is within about 25 km of both the location you are using when you switch it on and your actual location. The actual location is in each case the most recently stored device location, never a travel location chosen in Discover. Each contact receives at most one such notification every four hours. Your exact location is not shared. To enforce this limit, we store a sending record for each pair of contacts (the accounts involved and their connection, the activation and event identifiers, and the time of sending), which is deleted automatically about 24 to 48 hours after the last notification. The legal basis is Art. 6(1)(b) GDPR; delivery as a push notification requires the recipient’s consent (Section 5).

4.5 Discovery, Connections, Chats, and Meetings

We process in particular:

The Discovery cache contains internal user identifiers and numerical values, not complete profiles. Profile information is reloaded according to current visibility rules when retrieved. Profiles whose account has not been used for more than 30 days are not shown in “Discover”; what counts is when the app was last used or, for new accounts until then, the time of registration. With the next use the profile appears again.

New near you. If “Discover” shows you nobody, or nobody any more, even though your search without filters reaches the widest radius, you can tap “Notify me” to be notified as soon as someone new joins within your search radius. For this we store this request in your profile and, while it lasts, the filters of your last search, internal identifiers of the up to 50 people “Discover” last showed you, the time of the last such notification and internal identifiers of new people waiting for the next notification. When a new account becomes discoverable, our server checks by the same rules as in “Discover” whether that person would appear for you (including blocks, hidden companies, paused and long-inactive profiles, Stealth Mode, your filters and the radius of both sides). You are notified only once you have decided on all the people “Discover” last showed you, or they no longer appear there; until then the announcement waits, at the longest until the new person has been registered for 14 days. You receive at most one such notification within 24 hours and none between 9 p.m. and 8 a.m. your local time; it names the new person’s first name and job title and the nearest major city of your own search location. New people are announced only to those for whom they would also appear in “Discover”, and with no details beyond what their profile card there shows anyway; for each new account we note that its arrival has been announced, so that this happens only once. Your request stands until you switch it off in the settings under “Notifications” with “New near you” or delete your account; when you switch it off, we delete the data stored for it. Without push notifications enabled we send nothing. The legal basis is Art. 6(1)(b) GDPR, because you request this feature and, for new people, because it is part of being visible in “Discover”; push delivery is governed by section 5.

4.6 Venue Search and Contributions

In iOS version 1.0, we process search text, search area, coordinates, and the selected venue record for venue searches and meeting-place selection. When you add a venue, we process its name, type, location, any address and opening hours, your internal user identifier, source, timestamps, contribution status, and necessary integrity and moderation data.

Version 1.0 does not offer venue-photo or menu uploads, scanning/OCR features, Gemini venue-image analysis, or contribution rewards. Profile photos, group images on iOS, and reports remain available. Where older venue photos or analysis working copies already exist, we process them only for necessary administration, moderation, and deletion under the periods in Section 8; this does not make those upload or analysis features available in version 1.0.

4.7 Reports, Security, and Moderation

If you report a user, content, photo, or venue data, we process, depending on the report:

The number of reports does not automatically result in account suspension or a permanent account ban. It may increase the priority of human review. Details are provided in Section 10.

If we remove a Lunchdate Tag (@username) as part of moderation, the string remains blocked without any link to an account so that it cannot be claimed and misused again. We store only the string, the reason for the block, and the time of the block. The block remains until it is released manually; a person whose name is contained in a blocked tag can request its release at privacy@lunchdate.io. The legal basis is Art. 6(1)(f) GDPR.

For the accountless privacy and image-removal form, we process the contact name and email address, relationship to the depicted person, stated content location, description and requested action, good-faith confirmation, and receipt, handling, security, connection, rate-limit, and abuse-prevention data. We obtain this information directly from the requester. Where the requester acts for another depicted person, the submission may also contain information about that person and the identified content from the source “requester or visible Lunchdate content” for the purposes of Art. 14 GDPR.

Until submission is confirmed, the browser stores locally only a random request ID and a SHA-256 fingerprint derived from the form content for a safe idempotent retry; it does not store the clear-text form payload locally. The backend also processes the usual connection and rate-limit data described in this policy.

We use the information to verify authority, reliably identify the content, assess the request and its scope, implement any required measure, respond, prevent abuse, and evidence our handling. The legal basis is Art. 6(1)(c) GDPR in conjunction with Arts. 12–17 GDPR; where necessary, we additionally rely on Art. 6(1)(f) GDPR to protect the Service, prevent abuse, and establish, exercise, or defend legal claims.

A content location entered as free text is solely a review pointer and never a direct deletion path. Before taking a measure, we resolve the canonical internal content reference and verify authority and scope. Section 8 states the standard periods for intake data, case records, events, receipts, and evidence.

Recovery after account takeover: To restore access securely, we process the internal user identifier, account generation, identity-verification method (such as an ID check by video call, a support video call, verified business email, or account history), a hashed evidence reference, hashed and redacted old/new contact details, and handling, security, and notification status. The technical operation record contains no ID or video recording. This serves contract performance and our legitimate interest in protecting accounts against takeover (Art. 6(1)(b) and (f) GDPR). Records are retained for 730 days after completion or cancellation, including where the account is deleted earlier.

Authority requests: To assess, handle, and document lawful disclosure and preservation requests, we process affected account and content references, the scope and period of the request, authority and verification details, legal assessments, and approval, disclosure, and preservation records. The legal bases are Art. 6(1)(c) GDPR and, where necessary, our legitimate interest in lawful handling and legal defense under Art. 6(1)(f) GDPR. The standard evidence period is four years from closure or release of preservation; specifically necessary legal holds remain possible.

4.8 Pro, Purchases, Spotlight, and Rewards

For in-app purchases and free rewards, we process:

A person who uses a referral code receives their reward on completing onboarding. The referring person receives their reward only when the referred person then forms their first connection. For this, we automatically check whether the other person has an eligible account (for example, not deleted or suspended, and with completed onboarding). The referring person learns that and when onboarding was completed and the first connection was formed, but not with whom. The legal basis is Art. 6(1)(b) GDPR; for checking the contact person's data, Art. 6(1)(f) GDPR, our legitimate interest in a referral program free of abuse.

Apple processes payment instruments, full billing address, and Apple Account payment details. We do not receive that information. The Apple entity that is legally the merchant for a particular Store transaction is identified in the purchase dialog, receipt, and Apple Media Services Terms.

If you use the app to electronically withdraw from the Lunchdate account/use contract, we process the name you provide; either the email address of the signed-in account or the email address you provide as the contract identifier and confirmation medium; the fixed contract type; the complete declaration text; a random receipt ID; a technical retry identifier; the server-recorded receipt time; and the confirmation delivery status. Where the supplied address can technically be linked to an existing account, we also store its internal user identifier; whether such a link exists is not disclosed to the submitter. The function is available without signing in. The declaration and email task are stored together before the first delivery attempt. This is required to receive and immediately confirm the declaration under § 356a BGB, administer the contract, and prove its content and timing. The legal bases are Art. 6(1)(b) and (c) GDPR and, for necessary legal defense, Art. 6(1)(f) GDPR.

To securely assign and process the consequences of a publicly submitted declaration, we may send a one-time code to the supplied email address. Submission, receipt, and timely filing of the declaration do not depend on entering the code; the code is used only to verify control of the mailbox and to securely assign and follow up the declaration. The server-side account lookup is performed only after the code has been entered successfully. For this purpose, we process a hash of the code, random challenge and verification IDs, a secret retry binding, the number and times of attempts, the 15-minute validity period and scheduled deletion after 24 hours, verification status and time, a hash of the contact address, the result and time of the server-side account lookup and, where linked, evidence of the exact account generation. The code and client secret are not stored in plain text. Neither the response nor the verification email discloses whether the address is linked to a current account.

For email, the stated confirmation status records only the sending attempt and, where returned, acceptance by the provider; it is not proof of final delivery to the recipient.

4.9 Device, Log, Diagnostic, and Push Data

Depending on the feature and your settings, we process:

Firebase Remote Config supplies technical configuration, compatibility requirements, and the current contract version. Google processes Firebase installation IDs (FIDs) and technically necessary request information for this purpose. This processing is independent of optional product analytics and provides and protects the Service (Art. 6(1)(b) and (f) GDPR; § 25(2) no. 2 TDDDG for necessary device access). It is not used for advertising.

Optional error diagnosis is disabled by default and separate from product analytics. We activate Firebase Crashlytics and Apple MetricKit only after you give your own express diagnostics consent. Crashlytics receives pseudonymized and sanitized crash and error reports. MetricKit makes aggregated performance metrics and, where available, symbolicated diagnostic call trees available locally to the app; we transfer such diagnostic data only after this consent.

We configure our own error reporting so that plain-text user IDs, names, email addresses, initials, localized error descriptions, and underlying NSError objects are not knowingly attached as custom data. Native crash reports may nevertheless contain function or method names, the exception class and message, and other technical stack information; despite sanitization, unintended identifiability cannot be completely excluded.

The legal bases are your diagnostics consent under Art. 6(1)(a) GDPR and, for diagnostics-related access to or storage on the device, § 25(1) TDDDG. You can withdraw this consent separately from product analytics in the app under “Account & Security → Privacy → Error diagnostics”. Our own error reporting and MetricKit forwarding then stop immediately; unsent local reports and diagnostic caches and the diagnostics-related installation-bound salt are removed. As specified by the SDK, the Crashlytics runtime switch takes effect only on the next app launch. Until then, our own interfaces submit no further error data. A transfer that has already technically begun cannot be recalled; any native crash report still recorded locally afterwards is removed before a later transmission. Data already lawfully transmitted to Crashlytics is not immediately erased solely by changing the setting; Section 8 and your rights under Section 11 continue to apply.

We use neither Firebase Analytics nor Firebase Performance Monitoring in the iOS app and do not access Apple’s IDFA.

If you enable push notifications, the payload may contain display names, group or venue names, meeting type and time, and a message preview of up to 100 characters. iOS may display this information on the lock screen. You can restrict or disable previews in iOS settings.

4.10 Optional Product Analytics with TelemetryDeck

Product analytics is disabled by default. Only after you expressly consent in the app do we process usage events such as app launch, areas viewed, feature use, session and onboarding steps, and technical device and app metadata. Individual events may contain broad profile categories such as industry or career level; free text, message content, names, and email addresses are not transferred for analytics.

Each event also contains, where available, your industry, whether Pro is active (is_premium), which version of onboarding was completed on the device, the month in which product analytics began on this device (cohort), and the number of days since then. The app stores the date of this start on the device only after your consent; it is deleted when you withdraw consent. Performance events (perf_*) contain the app’s loading and response times, for example when loading Discover or saving a decision, together with related technical values such as the number of profiles loaded, excluded, or already interested, the search radius, the type of decision, and whether a connection resulted.

An internal identifier is cryptographically hashed on the device using a random, installation-bound key. TelemetryDeck hashes this identifier again before storage. The identifier therefore cannot be used across different devices or apps. As a precaution, we treat the data as pseudonymized.

The legal bases are your consent under Art. 6(1)(a) GDPR and, for storing or accessing analytics-related information on the device, § 25(1) TDDDG. You may withdraw consent at any time in the app under “Account & Security → Privacy → Usage analytics”. No new analytics events will then be transmitted, and any unsent local queue will be removed.

4.11 Website

When you access lunchdate.io, the IP address, time, requested file, HTTP status, and browser and device information are technically processed in hosting logs. The website does not use analytics or advertising cookies. It may store your selected language locally in the browser (lunchdate_lang) so that a language version you expressly requested can be opened.

4.12 Voluntary Product Feedback

If you voluntarily send product feedback, a feature request, a language-error report, or other feedback through the app, we process the selected type and the free text you enter, any rating and locale (language/region setting) provided, the app version and build, the operating-system version, the server-recorded receipt time, and your internal user identifier together with the account generation. The account generation is a technical marker tied to that account creation, which prevents feedback from a deleted account from being associated with a later recreated account that has the same internal identifier.

We use this data for product improvement, investigating language errors, prioritizing feedback, and support triage. The legal basis is our legitimate interest in improving and supporting the Service under Art. 6(1)(f) GDPR; where the feedback requires us to handle a contract-related support request, Art. 6(1)(b) GDPR additionally applies.

We retain the feedback for 365 days from receipt. When the account is deleted, we delete it immediately and generation-safely regardless of this standard period.

5. Overview of Purposes and Legal Bases

Purpose Data categories Legal basis
Account, authentication, and contract administration account and metadata Art. 6(1)(b) GDPR
Electronic contract withdrawal and receipt confirmation name, contact details, declaration, receipt, sending, and provider-acceptance data Art. 6(1)(b) and (c) GDPR; additionally Art. 6(1)(f) GDPR for legal evidence
Profile, Discovery, connections, chats, and planning profile, location, interaction, and content data Art. 6(1)(b) GDPR
Collection of your current device location GPS data Art. 6(1)(a) GDPR
Continued use of the most recently stored location for the Planner, open meetings nearby, and related notifications; hiding the profile in Discover when location access is denied stored location, status of location access Art. 6(1)(b) GDPR
Travel location, trips, and home city chosen by you location, travel, and profile data Art. 6(1)(b) GDPR
Availability status, visibility choice, and notifying contacts availability, visibility, and location data, display name, activation identifier, and sending record Art. 6(1)(b) GDPR; push delivery to the recipient Art. 6(1)(a) GDPR
Push notifications push token and notification content Art. 6(1)(a) GDPR; technical delivery additionally Art. 6(1)(b) GDPR
“New near you” notification (4.5) request, filters of the last search, identifiers of the people last shown in “Discover”, time sent, identifiers of waiting new people; for new people their first name, job title and arrival note Art. 6(1)(b) GDPR; push delivery as for push notifications
Calendar export planning data and event ID Art. 6(1)(b) GDPR
Venue search and venue contributions in version 1.0 search, location, venue, and contribution data Art. 6(1)(b) GDPR; quality assurance and abuse prevention additionally Art. 6(1)(f) GDPR
Pro, Spotlight, referrals, and rewards purchase and reward data; hash values against multiple rewards Art. 6(1)(b) GDPR; statutory records Art. 6(1)(c) GDPR; checking the first connection and protection against multiple rewards Art. 6(1)(f) GDPR
Product analytics pseudonymized usage data Art. 6(1)(a) GDPR and § 25(1) TDDDG
optional error diagnosis and stability sanitized crash, error, and MetricKit data Art. 6(1)(a) GDPR and § 25(1) TDDDG
Storing and synchronizing your product analytics and error diagnostics choices choice, platform, time of change, notice version Art. 6(1)(b) GDPR; proof of consent Art. 6(1)(c) in conjunction with Art. 7(1) GDPR
IT security, abuse prevention, and protection against repeated unwanted contact requests IP, App Check, rate-limit, and security data; notes on declined Direct Connect requests Art. 6(1)(f) GDPR
Google Cloud Vision (4.3) uploaded image data Art. 6(1)(b) GDPR; protection against unlawful and inappropriate content and abuse prevention additionally Art. 6(1)(f) GDPR
Other Content review, reports, and moderation content, reports, evidence, and measures Art. 6(1)(f) GDPR; where legally required Art. 6(1)(c) GDPR
Accountless privacy and image-removal requests contact, relationship to the depicted person, content location, description, good-faith confirmation, handling, connection, rate-limit, and abuse-prevention data Art. 6(1)(c) GDPR in conjunction with Arts. 12–17 GDPR; where necessary additionally Art. 6(1)(f) GDPR
Legal enforcement and authority requests required evidence and log data Art. 6(1)(c) or (f) GDPR
Product feedback and support triage type, free text, any rating/language and region setting, app version/build, operating-system version, receipt time, internal user identifier, and account generation Art. 6(1)(f) GDPR; for contract-related support requests additionally Art. 6(1)(b) GDPR
Website delivery connection and log data Art. 6(1)(f) GDPR; § 25(2) no. 2 TDDDG for necessary device access

6. Visibility and Recipients

6.1 Other Users

Depending on the feature and your settings, other users can see profile fields, photos, approximate or displayed distance, availability status, contributions, messages, and information about shared or open meetings. Email address, internal user identifier, and exact coordinates are not displayed as part of your profile. For a referral, the referring person learns only the information described in Section 4.8, not with whom the referred person forms their first connection.

6.2 Google Firebase and Google Cloud

We use Google Ireland Limited and affiliated Google entities, in particular Google LLC, for the following services:

Service Purpose and data
Firebase Authentication Apple user identifier, email address, authentication and session tokens
Cloud Firestore account, profile, connection, chat, meeting, purchase, contribution, and moderation data
Cloud Storage profile, chat, group, and private moderation images; any older venue media under Section 4.6
Cloud Functions server-side business, security, purchase, and deletion logic
Firebase Crashlytics only after separate diagnostics consent: pseudonymized and sanitized crash/error data
Firebase Cloud Messaging push token and notification payload
Firebase App Check short-lived app attestation and integrity tokens
Cloud Vision automated content checks of uploaded images
Firebase Hosting website and technical access logs
Firebase Remote Config / Firebase Installations technical configuration, compatibility and contract versions; installation IDs and request information

Firestore, Storage, and our Cloud Functions primarily use EU regions, in particular eur3 and europe-west1 (Belgium). The location of individual products may differ: according to Google’s product information, Firebase Authentication operates in US data centers; other Firebase services may use global infrastructure. Depending on the service, Google acts as a processor or independent controller.

We do not link Firebase Analytics, Firebase Performance Monitoring, or the Google Ads On-device Conversion SDK into the distributed iOS app target.

Further information: https://firebase.google.com/support/privacy and https://policies.google.com/privacy

6.3 TelemetryDeck

After you consent, we use TelemetryDeck GmbH, Von-der-Tann-Straße 54, 86159 Augsburg, Germany, as a product analytics service provider. TelemetryDeck processes the events described in Section 4.10 on European infrastructure. According to the provider, IP addresses are not stored for app analytics. There is no cross-app or cross-device tracking.

Further information: https://telemetrydeck.com/privacy/ and https://telemetrydeck.com/docs/guides/privacy-faq/

6.4 Apple Services

Depending on the feature, we use:

Apple receives the technically required device, account, location, map, push, or purchase data. Apple is generally an independent controller for processing within Apple services.

Further information: https://www.apple.com/legal/privacy/

6.5 OpenStreetMap and Maps

Venue master data comes in particular from OpenStreetMap and Geofabrik extracts. We import this data server-side into our own database. Regular venue searches are therefore not sent to OpenStreetMap servers. Apple MapKit renders the map view; venue points supplied by us are overlaid on it.

OpenStreetMap data is available under the Open Database License 1.0. Further information: https://www.openstreetmap.org/copyright

6.6 Link Previews

If a message contains a web link, the app sends the URL to our Cloud Function. It retrieves the title, description, and image metadata; the target site sees our Cloud Function’s IP address. Metadata may be cached for up to seven days. The app may load the preview image or favicon directly from the target or CDN domain. That domain then technically receives your IP address, timestamp, and requested URL. We do not append a Lunchdate user identifier.

6.7 Email, Operational Alerts, and Internal Moderation

6.8 Other Recipients

Where required, we also disclose data to advisers and auditors bound by professional confidentiality, payment and IT service providers, and courts or authorities if we are legally required to do so or if disclosure is required for legal enforcement.

7. International Transfers

Some recipients or subprocessors process data outside the EU/EEA, in particular in the United States. Where no adequacy decision under Art. 45 GDPR applies, we use appropriate safeguards under Art. 46 GDPR, in particular the European Commission’s Standard Contractual Clauses, and assess additional technical and organizational measures where required. For certified US recipients, the adequacy decision for the EU-US Data Privacy Framework may apply in addition.

You can request a copy of the relevant safeguards or further information at privacy@lunchdate.io. Statutory disclosure powers of foreign authorities cannot be completely excluded despite these safeguards.

8. Retention and Deletion

We retain data only for as long as required for the relevant purpose. We then delete or anonymize it unless a statutory retention obligation or a specific legal reason requires longer retention.

Data category Standard period or criterion
Google Cloud Vision (4.3, 8.2) latest decision on the image-check permission and receipt until account deletion; image and moderation retention remains as stated in this section
Account, authentication, and profile until account deletion or earlier removal of individual information
Sign in with Apple revocation credentials and status token and retry data until Apple confirms revocation; thereafter a minimized blocked status for no more than 30 days
Most recently stored location, travel location, and availability, including your choice of who may see your status until changed, disabled, or the account is deleted
Trips and home city until changed or the account is deleted; past trips are removed with the next change to your trips
Report that iOS has denied or restricted location access until you allow access again or delete your account
Sending record for availability notices to contacts (per pair of contacts) deleted automatically about 24 to 48 hours after the last notification; earlier if an account is deleted
Connections, chats, and 1:1 media while the connection and communication remain available to the participants; on account deletion, own content is deleted or de-personalized. If a 1:1 archive remains available to the other person, direct identifier fields are replaced; an immutable historical document identifier may remain as a restricted pseudonymous technical key until the archive is deleted or a specific legal-evidence purpose ends
Group lunches and group chat until deletion/archiving after the end and expiry of operational follow-up periods; on account deletion, membership and own content are deleted or de-personalized
Direct Connect and QR tokens until redemption or short technical expiry; associated requests until completion, rejection, or account deletion
Note on declined Direct Connect requests 30 days from the decline, then deleted automatically; earlier if the person who declined sends a request themselves, both connect via QR code, or either account is deleted
older published venue photos, where present until deletion, replacement, deletion of the contributor’s account, or automatic volume-limited rotation
confirmed venue facts for as long as required for a current venue listing; the personal association is removed on account deletion, while factual non-personal information may remain
private upload and analytics working copies generally immediately after processing; failed/quarantined uploads and technical upload intents no later than 30 days
private photo attachments to venue reports no later than 30 days after receipt
reports rejected due to rate limits 30 days
content-policy violation counters rolling 365 days after the latest eligible hit; deleted earlier when the account is deleted
evidence in completed moderation cases six months after the decision
case, decision, and receipt records for completed moderation cases twelve months after the decision
history of moderation measures for deleted accounts (type of measure, time, case reference, and reason code; without name, email address, account ID, or free text, linked to the moderation cases only through a pseudonym) twelve calendar months from account deletion; longer only while a specifically documented legal hold or an open appeal against the measure requires it
Lunchdate Tags blocked as part of moderation (string, reason, and time of the block only; without account reference) until released manually, for example at the request of the person named
intake data, case records, events, and receipts for accountless privacy and image-removal requests no more than twelve calendar months from receipt; longer only where a specific legal hold is documented as necessary
evidence for accountless privacy and image-removal requests for completed requests, six calendar months from the decision, always capped at no more than twelve calendar months from receipt; for open requests only until that twelve-month backstop; longer only for a specifically documented legal hold
older reports from the previous reporting system no more than three years from creation; free text and direct identifiers are removed or replaced earlier upon account deletion
open moderation cases arising from reports; other open legal cases moderation cases until the decision, but no longer than twelve calendar months from receipt; other legal cases until completion; the above periods then apply unless a specific legal hold is required
moderation, withdrawal, and other notification outbox data (sending and provider-acceptance status; not proof of final delivery) 90 days after provider acceptance, cancellation, or final sending failure
electronic withdrawal declarations and receipt records until expiry of the regular limitation period, generally the end of the third calendar year following receipt; longer where required for a specific legal dispute
Spotlight activation history until account deletion or earlier operational cleanup
pending referral (the referred person's first connection is still outstanding) until the first connection; lapses if the referred person deletes their account first
hash values created with a secret key against multiple rewards in the referral program three years from the reward, including after account deletion
purchase and transaction records while personal only for contract, fraud, and statutory evidence purposes; documents relevant under commercial and tax law are generally retained for six, eight, or ten years, depending on document type
optional crash and error diagnostic data unsent local reports, diagnostic caches, and the diagnostics-related installation-bound salt until withdrawal or earlier technical cleanup; according to the provider, data received by Firebase Crashlytics is stored for 90 days, after which removal from live and backup systems begins
our own server and security logs, including IP addresses generally up to 60 days; longer only for a specific security incident
TelemetryDeck event data Withdrawal does not automatically erase previously transmitted events at the provider. TelemetryDeck distinguishes queryable data from archive storage (cold storage); it states no guaranteed deletion period for the latter. We therefore do not promise a fixed maximum provider deletion period. Section 8.2 and your statutory erasure rights apply.
product feedback 365 days from receipt; deleted immediately and generation-safely when the account is deleted
link-preview metadata up to seven days
data exports seven days from availability
Discovery cache no more than 24 hours; replaced earlier on refresh
“New near you” request with the filters of the last search, identifiers of the people last shown in “Discover”, the time last sent and identifiers of waiting new people until you switch the request off, at the latest until account deletion; identifiers of waiting new people at most until 14 days after their registration; identifiers of a deleted account are removed from all queues and lists immediately; the note that your own arrival was announced until account deletion
daily backups rolling retention of up to 35 days; no standard restoration of individual deleted accounts
Account-takeover recovery records 730 days after completion or cancellation, including after account deletion
Authority requests and disclosure/preservation records four years from closure or release of preservation; longer only for a specifically necessary legal hold
Saved optional analytics and diagnostics choices (per platform, time of change, and notice version) current choice until changed or the account is deleted

The periods of up to 30 days for cleanup of active account data and up to 35 days for rolling backups concern the data stores we manage. Providers also apply their documented deletion procedures to their technical data stores: Google removes Firebase Authentication data from live and backup systems within 180 days of a deletion instruction. According to Google, Firebase installation IDs for Remote Config and Cloud Messaging are retained until deleted through the API; removal then takes place within 180 days. Firebase Hosting retains IP data for a few months according to Google. These provider periods do not extend Lunchdate’s use of data for a purpose that has ceased. Further information: https://firebase.google.com/support/privacy

8.1 Account Deletion

You can delete your account in the app settings. Access ends immediately; cleanup of production data starts automatically and, because the Service uses distributed systems, may take up to 30 days in exceptional cases. Data in rolling backups disappears when those backups expire. The statutory and moderation-related exceptions in the table remain, but are reduced or pseudonymized to the extent required. In particular, a withdrawal receipt already submitted may be retained with the name, account email address, declaration, and receipt time until the end of the stated legal-evidence period. Likewise, the history of moderation measures taken against the account is pseudonymized on deletion (without name, email address, account ID, or free text) and kept for twelve calendar months from the deletion so that we can evidence those measures in appeals, complaints, and requests from authorities and establish, exercise, or defend legal claims (Art. 17(3)(e) and Art. 6(1)(f) GDPR). Hash values against multiple rewards in the referral program remain stored until the end of their period of three years from the reward (Section 4.8).

After cleanup of active account data is complete, we send a confirmation to the email address most recently stored in the account. Residual data reduced to the extent required for legal or security reasons, as well as rolling backups, are not covered by that confirmation; they expire according to the periods stated in this Policy.

After that confirmation, a minimal UID-bound deleted-user stub and blocked deletion markers for signed uploads may remain until the next daily cleanup run. Late private uploads are not published.

Important: Deleting your account does not cancel an automatically renewing subscription purchased through Apple. Apple may continue billing until you cancel the subscription in your Apple Account settings. Manage the subscription before account deletion at https://apps.apple.com/account/subscriptions. Immediate account deletion ends access to account-bound Pro features and unused Spotlight credits unless mandatory law requires different treatment.

8.2 Withdrawal of Consent

You may withdraw your permission to send images to Google Cloud Vision (Section 4.3) separately at any time in the app under “Account & Security → Privacy → Image checks”. We then stop new image uploads and their transfer to Google Cloud Vision; a transfer already started cannot be recalled. Previously published images are not automatically deleted by withdrawal: you can remove them or delete your account, and the retention rules in Section 8 continue to apply. We store your latest grant or refusal, its server-confirmed time, notice version, provider, purpose, and technical account and operation references to apply your choice (Art. 6(1)(b) GDPR) and to be able to evidence it (Art. 6(1)(f) GDPR). This receipt is included in your data export and deleted with your account; earlier choices are not kept as a separate history.

Withdrawing consent ends the relevant processing for the future but does not automatically delete data that we still need on another legal basis, such as your most recently stored location (Section 4.4). Location and push consent can also be withdrawn in iOS settings. You can change the consents for product analytics and error diagnosis independently in the app under “Account & Security → Privacy”.

We store your product analytics and error diagnostics choices (consent or refusal for each) separately on our servers for your account and platform (iOS or Android), including the time of change and version of the consent notice. Your choice applies to all devices of the same platform on which you use this account and is restored when you sign in again. iOS uses TelemetryDeck for product analytics; Android uses Firebase Analytics. Choices are not transferred between platforms, and this does not unify analytics identifiers across installations. Existing device-only consents are not automatically extended: we ask once for a new express choice covering your account. We store your choice, including the time of change and notice version, to apply your decision on your devices (Art. 6(1)(b) GDPR) and to be able to demonstrate that consent was validly given (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Signing out deactivates optional collection; the saved account choice is retained and is not inherited by another account. Changes and withdrawals are synchronized to other devices of the same platform when the app reconnects there and reconciles the settings. A local copy preserves your known choice for the same account during temporary network failures. Account deletion removes the stored choice as part of account cleanup.

After withdrawal of product analytics consent, no new analytics events are transmitted; the unsent local queue and the stored date on which analytics began (Section 4.10) are removed. After withdrawal of diagnostics consent, our own error reporting and MetricKit forwarding stop immediately; unsent local reports, diagnostic caches, and the diagnostics-related installation-bound salt are removed. The qualification in Section 4.9 applies to the technical effect of the Crashlytics runtime switch and transfers that have already begun. Data already lawfully transmitted to Crashlytics is not immediately and automatically erased by switching it off; the retention information in Section 8 and your statutory erasure rights apply.

The product analytics switch does not automatically erase events already sent to TelemetryDeck. Withdrawal does not permit further analytics based on the withdrawn consent. Personal event data remaining without another legal basis must be erased; send related requests to privacy@lunchdate.io. We handle them under Section 11. Technical provider periods do not replace a legal basis. Provider information: https://telemetrydeck.com/docs/guides/privacy-faq/

9. Special Data and Minors

We do not request information about religion, health, political views, trade-union membership, sex life, or other special categories under Art. 9 GDPR and do not use profile or behavioral data to infer such characteristics. Free text, photos, or dietary information may nevertheless inadvertently reveal such information. Please do not provide it unless it is required for professional networking and you want other users to see it.

The Service is available only to persons aged 18 or older. If we learn that an account belongs to a minor, we will promptly suspend and delete it, except where records are temporarily required for safety or legal reasons.

10. Recommendation System and Automated Processing

10.1 Connection Suggestions

We automatically calculate which profiles appear in Discovery and the order in which they are suggested. The factors include distance, industry, networking goals, shared interests, activity and engagement, availability today, existing incoming interest, and a small daily-changing ordering component. Active Spotlight is displayed before the regular order. Visibility, blocking, distance, and language filters may exclude profiles entirely. Profiles whose device has denied or restricted location access are not shown in Discover.

These suggestions do not create or terminate a contract and do not have legal or similarly significant effects within the meaning of Art. 22 GDPR.

10.2 Automated Safety and Moderation Steps

Automated systems may:

Each eligible rejected message attempt increments this account-generation-bound counter by one. At three entries, the system emits a warning-level security signal. At five, it opens a high-priority case recommending that an authorized person review whether a proportionate restriction is necessary; at ten, it opens a critical human-review case and alert. The counter itself does not throttle messages, suspend the account, or permanently ban it. Separate technical rate limits may delay further send attempts independently of that counter. Suspension or permanent ban remains a decision by an authorized person.

The number of reports alone does not automatically result in suspension or a permanent ban. Suspensions and permanent account bans are decided by an authorized person. In urgent safety or legal cases, a provisional restriction without a prior hearing may be necessary; we provide the reason and review option where legally and operationally possible.

We currently make no solely automated decision that produces legal effects concerning you or similarly significantly affects you. You may request a free manual review of a content or moderation decision by replying to the decision email, contacting support@lunchdate.io, or using the form at https://lunchdate.io/moderation-appeal, and present your point of view.

11. Your Data Protection Rights

Where the statutory conditions are met, you have the right to:

The authority responsible for our registered office is:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Germany
https://www.datenschutz-berlin.de

You may also contact the authority for your habitual residence or workplace. To exercise your rights, email privacy@lunchdate.io. We may request additional information where necessary to verify your identity and protect data against unauthorized access.

Additional rights may apply under the law of your place of residence. We do not sell personal data or share it for cross-context behavioral advertising.

12. Cookies and Device Access

12.1 Website

The website does not use analytics or advertising cookies. The language preference lunchdate_lang is stored only where necessary for the language routing you requested (§ 25(2) no. 2 TDDDG). Technical browser and network operations are required to deliver the website.

12.2 iOS App

For app features you request, we store or access in particular:

Entries in iOS search and local reminders stay on your device. For Siri and Shortcuts, the app stores no information in advance but provides it only on your request. So that iOS can suggest suitable shortcuts, the app only tells iOS which app features you use, without names or places. When you sign out, switch accounts, or delete your account, the app removes the entries in iOS search and the reminders; Siri and Shortcuts then no longer receive any information.

Where these operations are required for a feature you expressly requested, they are carried out under § 25(2) no. 2 TDDDG. Analytics-related installation, session, pseudonymization, and queue data is stored or accessed only after your product analytics consent under § 25(1) TDDDG; this also applies to the date on which analytics began on the device (Section 4.10), which is removed when you withdraw consent. Diagnostics-related reports, caches, identifiers, and access are used only after your separate diagnostics consent under § 25(1) TDDDG. Details are provided in Sections 4.9 and 4.10.

We do not use App Tracking Transparency tracking or the IDFA. Our Privacy Manifest declares NSPrivacyTracking = false.

13. App Permissions

Permission Purpose
Location current location for local suggestions and distance display; if you deny or restrict access, your profile is hidden in Discover (Section 4.4)
Camera taking profile photos and group photos (iOS) and scanning Direct Connect QR codes
Photo Library selecting corresponding images
Notifications visible push notifications
Calendar (full access) writing confirmed meetings to the device calendar and updating or removing the events created by Lunchdate when a meeting changes or is cancelled; other events are not evaluated
Face ID or device passcode confirming the deletion of a suspended account; iOS performs the check, and the app receives only the result and no biometric data

Denying a permission restricts only the dependent feature to the extent the permission is required for the action you requested.

14. Data Security

We use technical and organizational measures appropriate to the risk, in particular transport encryption, access controls, role-based permissions, Firestore and Storage rules, App Check, logging, monitoring, rate limits, separated private upload areas, and regular backups. No system can guarantee absolute security.

15. Changes, Language, and Contact

We update this Privacy Policy when processing, providers, or the law changes. We notify you of material changes in an appropriate manner in the app or by email. You can request previous versions at privacy@lunchdate.io.

This Policy is available in several languages. In the event of inconsistencies, the German version controls unless mandatory law provides otherwise.

For questions and privacy requests, contact:

Lunchdate UG (haftungsbeschränkt)
Email: privacy@lunchdate.io