Privacy policy

Soulmates is a service for adults looking for a Life Partner, run from India. We decide why and how your information is used, and we are responsible for it under India’s Digital Personal Data Protection Act, 2023, and, where they apply to you, the EU and UK General Data Protection Regulation.

What you give us

• Your email address, which is how you sign in: by a code we email you, or with Apple or Google, which tell us the address (Apple’s may be a private relay address that forwards to yours) and, the first time, your name. We never ask for a password.
• Your profile: your name, date of birth, gender, marital status, where you live and grew up, height, religion, mother tongue and languages, diet and habits, education, work and income, family, your hopes for life together, your bio and your photos.
• When you hope to settle down, whether you would move for it, and what you are looking for in a Life Partner.
• If you allow it in our app, your phone’s approximate location, rounded to about a kilometre, to find people near you. We keep only the latest one, never a history, and you can turn it off in Settings at any time, which deletes it.
• What you agreed to: the version of our Terms of use, that you are 18 or over and here to find a Life Partner, and when.
• If you join on an iPhone, whether the App Store says your Apple Account is 18 or over, under 18, or not shared, and when; Apple tells us the age range only, never your date of birth.
• Anything you add to be verified: a selfie, the domain of a work email address (we keep the address itself only while its code is waiting), a work document such as a payslip, and the handles of accounts you link.
• The requests you send and answer, your messages, and any report or block you make.
• What you write to support.

What we record as you use Soulmates

• Who you were shown, what you decided, and when you were last active.
• Your sign-in sessions, and a random id for each device you sign in on, which is how a ban holds.
• For each phone you let our app notify, the token that reaches it, until you sign out there or it goes unused for 30 days.
• Whether you are on Pro and until when, and the store’s record of a subscription.
• Your IP address and browser in our hosting provider’s logs, and error reports when something breaks.

Information that needs extra care

Your religion, and the gender of the partner you are looking for, are special kinds of information under data protection law. We use them only to choose who you are introduced to, which you agreed to when you joined. A selfie check compares faces, which is biometric information: it happens only when you ask for it and agree to it, and nothing else about you goes with the images.

• To introduce you to people you both fit, one at a time, and to show you to the people you are introduced to.
• To let two people who both said yes talk, and to keep their conversation.
• To check the selfie, work and income you ask us to verify, and to show what is verified as a badge.
• To keep members safe: reading reports, closing accounts that break our Terms, and stopping fraud and misuse.
• To email you sign-in codes and, unless you switch them off, news about your requests and messages, and to send the same news to your phone when you let our app notify you.
• To run Pro, which you buy and manage in the App Store or Google Play.
• To fix errors and to understand, in numbers, how the app is used.
• To meet our legal duties, and to answer the police or a court when the law requires it.

We never sell your information, show you advertising, train any AI model on what you give us, or let anyone search for members. There are no public profiles.

• The people you are introduced to see your first name and the first letter of your last name, your age, where you live (as a city or an area, which you choose), your photos, your bio and the facts on your profile, and what is verified, including your verified selfie.
• Once you both say yes, the other person also sees your full name, your whole profile and the accounts you linked.
• No member ever sees your email address, a phone number, your phone’s location or your date of birth. An introduction says roughly how far apart you live, rounded (such as “About 20 km away”), worked out once by us when you are introduced.
• We read a conversation only when one of the two people in it reports the other, and we see the rest of your information only to run and support the service.

The services that work for us

These handle your information on our behalf, under their own data processing terms, and only for the purposes below.

• Vercel. Runs the app and the website, so it sees every request, including your IP address, and keeps the servers’ logs for a day.
• Supabase. Hosts our database, in Singapore: your account, profile, preferences, introductions, requests, messages and reports.
• Cloudflare R2. Stores your photos, any selfie or work document you upload for a check, and our encrypted nightly backups.
• Resend. Delivers our emails: your sign-in codes and the notifications you have not switched off.
• Zoho Mail. Holds our support and reports inboxes, so it holds what you write to us and the reports members send.
• Amazon Web Services (Amazon Rekognition). Compares a selfie with your profile photos, only when you ask for the check and agree to it. It compares the faces and tells us whether they are the same person. Nothing else about you goes with them.
• Anthropic (Claude). Reads a work document you upload, and writes bio drafts from your facts, each only after you agree to it. Anthropic does not train its models on what we send.
• RevenueCat, the App Store and Google Play. Sell and manage a Pro subscription bought in our app. The store takes the payment; RevenueCat tells us your subscription’s status under a random id. We never see your card details.
• Apple and Google sign-in. Confirm who you are when you choose Continue with Apple or Continue with Google, and tell us your email address and your name (Apple gives the name only the first time). We keep none of the tokens they return but one from Apple, encrypted, only so that deleting your account can also end our app’s access at Apple.
• Expo, Apple and Google. Deliver the notifications our app sends to your phone: Expo’s push service passes each one to Apple’s or Google’s, with the token that names your phone’s install, the notification’s title and line, and the page it opens. A notification names the other person by first name and never carries a message’s text.
• Sentry. Receives error reports from the app, with no email address, name, photo, profile text or message in them.
• PostHog. Receives a handful of product events, such as a sign-up or a request sent, under a random id, in the European Union, so we can see how the app is used. No email address, name, photo, profile text or message.

They process information in Singapore, Australia, Japan, the European Union and the United States. Where the law requires a safeguard for a transfer abroad, we rely on the protections in their terms.

• Your account, profile, photos, preferences and anything you uploaded for a check: until you delete your account.
• Messages: after a connection ends, and after an account is deleted, for as long as a report about them may still need looking into; nobody can read them in the app.
• Reports and blocks: for as long as we need them to keep members safe.
• Sign-in codes: ten minutes. Server logs: a day. Our encrypted backups: 30 days each.
• Your phone’s approximate location: until a newer one replaces it, you turn it off, or 14 days after your phone last sent it.
• The Apple token behind Sign in with Apple: until you delete your account, when we ask Apple to end the access it gave.
• What we keep after you delete your account, and why, is on Privacy choices.

You can see and correct your profile at any time, switch notification emails off, ask for a copy of your data and delete your account in the app. You may also ask us to correct or erase anything, object to how we use something, or withdraw an agreement you gave. How to do each is on Privacy choices.

If you are unhappy with our answer, you may complain to the data protection authority where you live: in India, the Data Protection Board of India; in the European Union or the United Kingdom, your national supervisory authority.

Soulmates is only for people aged 18 and over. We do not knowingly collect information about anyone younger, and we close any account we find belongs to a child. How we keep children safe is on our Child safety page.

• Everything travels encrypted, and photos and documents sit in private storage that hands out a link for a minute at a time.
• Backups are encrypted with a key only the founder holds.
• Only the people who run Soulmates can reach the systems, and limits on sign-in codes, reports and uploads slow down misuse.
• If a breach puts your information at risk, we will tell you and the authorities the law names.

We use only the cookies the app needs to work: one that keeps you signed in, one that names your device so a ban holds, and two that remember your light or dark choice and your time zone. There are no advertising or tracking cookies, so there is nothing to accept.

When this policy changes we update it here and change the date at the top. If a change matters to how we use your information, we tell you in the app before it takes effect.