Privacy notice

Who is responsible

SexySwingers is the service name. Legal operator name: awaiting owner confirmation. Public correspondence address: awaiting owner confirmation. Privacy and support email: awaiting owner confirmation. No personal account-holder details have been substituted as public business details.

A working public rights-request and complaints contact must be supplied before this draft can become a final privacy notice. Do not send identity documents or sensitive evidence through ordinary profile messages.

Information in the application

• Account email, authentication credentials managed by Supabase Auth, confirmation/recovery events and session information.
• Profile handles, names, descriptions, each represented person's private date of birth, optional attributes, relationships, interests and Looking For selections.
• Profile photographs, private albums, access grants, posts, comments, reactions, friendships, follows and notifications.
• Conversation participants, message contents and read/delivery information; these messages are not end-to-end encrypted.
• Postcode district and optional Nearby matching settings. Nearby uses a district centre, not a full home postcode, address, live location or GPS position.
• Reports, blocks and operational/security records handled by the application and hosting services. Exact log fields and provider retention need confirmation.

How information is used

The application uses account data for sign-in and recovery; profile data for member pages and permitted discovery; photographs for chosen audiences; messages for conversations; and relationship/activity data for the feed and notifications. Permissions and bilateral blocks are checked on the server.

Proposed Article 6 bases, subject to legal approval: contract necessity for requested core account/conversation services; assessed legitimate interests for proportionate security and abuse prevention; consent for optional location/sensitive matching; and legal obligation only where a specific obligation actually applies. This is a proposed assessment, not a declaration that every existing activity has already been lawfully assessed.

Nearby is optional and requires both profiles to opt in. It applies approximate distance and existing feed preferences before returning permitted posts. Visible interests and searchable interests are separate choices. Hidden interests are not returned through the discovery projection. This is rule-based matching, not a claim of automated legal or similarly significant decision-making.

Sensitive information and consent

Sexual orientation and information about sex life can be special-category data. A profile's context, photographs or preferences may reveal sensitive information even without an explicit label. Add information about another represented adult only with their informed agreement.

The proposed approach is an appropriate Article 6 basis for each purpose, plus a separate Article 9 condition for special-category processing. Explicit consent is a candidate for optional sensitive preferences, not a blanket basis for everything. The operator must approve a purpose-by-purpose assessment, consent wording and any required DPIA before public launch.

Current controls let you remove interest selections, turn off orientation matching, hide permitted attributes, change profile/photo visibility and withdraw Nearby consent. Removing data from your profile cannot undo copies another person already made. Core sensitive profile fields need a complete consent/withdrawal review; existing controls alone are not presented as full legal compliance.

Providers and sharing

• Vercel hosts the application. Hosting and security infrastructure may process request metadata and logs.
• Supabase provides authentication, PostgreSQL data storage, private image storage and realtime messaging infrastructure.
• Postcodes.io receives only a postcode district when an opted-in owner needs a missing district reference resolved. It does not receive a profile ID, messages, interests or browser IP from that lookup.
• The transactional email transport, provider contracts, subprocessors, processing regions and backup arrangements need operator confirmation. No claim is made that all processing stays in the UK.
• Other members receive only information permitted by the relevant profile, post, message, friendship and photo permissions. Privileged operational access must be restricted; the current app does not establish a staffed support organisation.

Retention, deletion and transfers

Records and files remain in the configured database/storage until removed. Owners can remove supported content such as photos, posts and selected interests. Automated account erasure and a self-service data export are not implemented. No fixed retention period or immediate deletion from backups is promised.

The operator must set and document retention criteria for accounts, messages, reports, deleted files, security logs and backups, including legal-hold exceptions and a workable rights-request process. International transfer locations and any required adequacy/safeguard arrangements must be confirmed from the actual provider setup; contracts have not been verified here.

Your choices, rights and complaints

Depending on the circumstances, UK data-protection rights include access, correction, erasure, restriction, portability and objection. Consent can be withdrawn for future consent-based processing. Rights have conditions and exceptions; withdrawing consent does not make earlier lawful processing unlawful.

Use Edit profile and Account settings for the controls currently available. The public privacy contact and identity-checking process for rights requests are awaiting operator confirmation. You can raise a concern with the Information Commissioner's Office; you do not lose that option because the platform's contact route is unfinished.

Cookies, marketing and future changes

This application has no live advertising, optional analytics, paid membership checkout or marketing-subscription feature. Operational account emails are not marketing subscriptions. No marketing consent is bundled into registration or preselected. Any future marketing or optional tracking requires its own assessment and, where required, a separate opt-in.

This notice must be revised when the actual operator, providers or processing change. A visible date records this draft's revision, not a certification that all operational obligations are complete.