GameBuddy — Privacy Policy
Version 2026-08-07.
GameBuddy is operated from Finland and is subject to the GDPR.
1. What we collect, and why
To create your account
| Data | Why |
|---|---|
| Email address | Signing in, verification codes, and reaching you about your account |
| Password | Stored only as a bcrypt hash; we cannot read it |
| Username | How other people see you |
| Date of birth | Confirming you are 18 or over. We also store the age derived from it |
To match you with people
| Data | Why |
|---|---|
| Country and gender | Shown on your profile; used by the recommender |
| Favourite games and keywords | The basis of who you are matched with |
| Profile photograph | Shown to other account holders |
| Who you liked, passed and matched with | Making the feed work, and not showing you the same person twice |
| Which profiles you were shown | Improving the recommendations. Kept for 90 days, then deleted |
To make the app work
| Data | Why |
|---|---|
| Chat messages | Encrypted at rest. See section 3 |
| Device notification token | Sending push notifications. You can turn these off per category |
| Last active time | Showing whether somebody is online, and re-engagement notifications |
| Purchase records | Delivering what you bought and honouring refunds |
| Server logs | Diagnosing faults and investigating abuse. Kept for 7 days |
We do not collect your location, your contacts, or your browsing outside GameBuddy. We do not use third-party advertising or analytics trackers.
2. Your photograph
Your profile photograph is screened by an automated classifier before it becomes visible to anyone. The image is sent to a service we run ourselves — it is not sent to a third party — and the classifier’s score is stored alongside it. If the classifier is unsure, a moderator looks at the image. Deleting your account deletes the image from storage.
3. Your messages
Chat messages are encrypted before they are written to the database, so a stolen copy of the database does not yield readable conversations.
This is not end-to-end encryption, and we want to be straightforward about what that means: we hold the key, so we are technically able to read messages. We do so in one circumstance — when a message has been reported, so that a moderator can judge the report. There is no other route by which conversations are read, and messages are never used for advertising or training.
4. Who your data is shared with
- Other account holders see your username, photograph, age, country, gender, games and keywords, and anything you post.
- Our infrastructure providers hold data on our behalf: Cloudflare R2 (images), our hosting provider (the database and application), and Google Firebase (push notifications). They process it under contract and for no purpose of their own.
- Apple and Google process purchases. We never see your payment details.
- Authorities, where the law requires it, or where content involves the sexual exploitation of children.
We do not sell your data. There is nobody to sell it to who would not be a worse custodian of it than we are.
5. How long we keep it
- Your account: until you delete it.
- After deletion: your profile, photograph and personal details are removed immediately. Your messages inside other people’s conversations are anonymised rather than erased — the other participant keeps a record of a conversation they took part in, and it is no longer attributable to you.
- Impression history: 90 days.
- Server logs: 7 days.
- Records we must keep by law (purchases, and material relating to a report we acted on): as long as the law requires.
6. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to it — and you can ask for it in a portable form. Most of this you can do yourself in the app; for the rest, write to the address in section 9 and we will answer within 30 days.
You can complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) if you think we have handled your data wrongly.
7. Legal basis
- Performance of a contract — running the service you signed up for.
- Legitimate interests — keeping the service safe, preventing abuse, and improving recommendations.
- Legal obligation — retaining what the law requires us to retain.
- Consent — push notifications, which you can withdraw at any time in Settings.
8. Children
GameBuddy is for people aged 18 and over. We do not knowingly collect data from anybody under 18. If we discover an account belongs to a minor, we close it and delete its data. If you believe a child is using GameBuddy, write to the address below and we will act within 24 hours.
9. Who we are
Controller: Can Baturlar, Finland Data protection contact: [email protected]
GameBuddy is run by one person, not a company. There is no data protection officer, because the scale of processing does not require one under Article 37 — the address above reaches the controller directly.
10. Changes
If we change how we handle your data we will update this policy and tell you in the app before the change takes effect.