Data Protection

Last updated: 18 September 2026

This privacy notice is structured for the transparency requirements of the GDPR and explains the main categories of personal data processed through the 2XiDES website and app.

1. Data we process

Account and authentication data

Email address or phone number where used, authentication identifiers, account status, verification state, security events and related technical identifiers.

Profile and preference data

Profile text, photos, age/date-of-birth information, gender, dating preferences, relationship goals, interests, lifestyle information, city or region, discovery settings and other information you choose to provide.

Location and distance data

Location information may be used to support matching and distance eligibility. Exact coordinates are not intended to be displayed to other members. We use only the level of location information reasonably necessary for the feature being provided.

Interaction and communication data

Likes, passes, Matches, Conversation membership, messages, Roses, Direct Introductions, profile views where enabled, blocks, reports and other product interactions.

Purchase and entitlement data

App-store and entitlement systems may provide product identifiers, purchase events, subscription state, renewal or expiry status, refund events and related transaction references. 2XiDES does not need your full payment-card details to provide app-store entitlements.

Safety and moderation data

Reports, block relationships, moderation state, account restrictions, relevant reported evidence and security or fraud signals may be processed to investigate abuse and protect members. Blocking is private. Reports create a controlled moderation case rather than unrestricted access to private communications.

Technical data

App version, device/platform information, push tokens, IP/security signals, crash diagnostics and technical logs may be processed for delivery, security, fraud prevention and troubleshooting.

Support, testing and web-form data

When you use our Help & Safety form, we process the name, email address, request category and message you submit so we can respond. When you request access to 2XiDES closed testing, we process the Google Play email address you submit so we can send and manage your tester invitation and related testing communications. The current static website uses FormSubmit to transmit these submissions to support@2xides.com and to send the requested tester instructions. Do not submit passwords, full payment-card data or suspected CSAM through a website form.

2. Purposes and legal bases

• To create and secure accounts, profiles and sessions and provide the app (Art. 6(1)(b) GDPR).
• To provide discovery, matching, messaging and member-request features (Art. 6(1)(b)).
• To administer subscriptions, credits and paid visibility entitlements (Art. 6(1)(b), and Art. 6(1)(c) where legal record-keeping applies).
• To operate safety controls, reports, moderation and anti-fraud systems (Art. 6(1)(f), Art. 6(1)(c) where required, and other applicable bases).
• To provide support and handle account, deletion and data-rights requests (Art. 6(1)(b), (c) or (f) depending on the request).
• To send service, security and user-controlled notifications (Art. 6(1)(b), (f), or consent where required).
• To comply with legal obligations and establish, exercise or defend legal claims (Art. 6(1)(c) and (f)).

3. Sensitive and special-category data

Dating services can involve information about sexual orientation, sex life or other sensitive aspects of a person’s private life. Where processing falls within Article 9 GDPR, 2XiDES requires an additional legal condition, such as explicit consent where appropriate, together with suitable safeguards and controls.

4. Recipients and processors

We use service providers to operate and secure the service. Depending on the active production configuration, these may include Supabase for backend/database/storage, Cloudflare for website delivery and security, Google/Google Play and Apple for app distribution and billing, RevenueCat for subscription entitlement management, Expo-related services for app delivery or notifications, and FormSubmit for the static website support form. Providers receive only the data needed for their function and are subject to applicable contractual and security obligations.

5. International transfers

Some providers may process data outside Germany or the EEA. Where GDPR transfer rules apply, we use an appropriate legal transfer mechanism such as an adequacy decision, Standard Contractual Clauses or another lawful safeguard, together with supplementary measures where required.

6. Retention

We retain personal data only for as long as needed for the relevant purpose and applicable legal obligations. Active-account data is generally retained while the account is active. A permanent deletion request makes the profile non-discoverable and starts a controlled deletion process. Some information may be retained for accounting, fraud prevention, chargebacks, safety investigations, legal claims or security obligations and is restricted to those purposes.

7. Your rights

Depending on applicable law, you may have rights of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. You may also lodge a complaint with a competent data-protection supervisory authority. Withdrawal of consent affects future processing and does not make earlier lawful processing unlawful.

8. Account deletion and data requests

You can request account deletion through the app or the Delete Account page. Other privacy requests can be submitted through Help & Safety or by email to support@2xides.com.

9. Automated ranking and recommendations

2XiDES may use automated signals to order or filter discovery results, such as member preferences, distance eligibility, profile completeness, recent activity and safety eligibility. Paid visibility may improve placement only for otherwise eligible profiles. These systems are intended to organise discovery and are not intended to make legal or similarly significant decisions about you.

10. Website storage, cookies and consent

The current landing page is designed without advertising cookies or optional analytics. If optional analytics, marketing technologies or similar access to user devices are introduced, they will be activated only with an appropriate legal basis and any consent required under GDPR and § 25 TDDDG. Current consent information is available at Consent Settings.

11. Security

We use technical and organisational controls appropriate to the service, including encrypted transport, access controls, server-side authorization, environment separation, rate limiting, audit logging and security monitoring. No online system can be guaranteed completely secure.

12. Children

2XiDES is for adults aged 18 and over. If we become aware that an underage person has created an account, we may restrict and remove the account and take appropriate safety steps. See our Child Safety Standards.

13. Changes to this notice

We may update this notice when our product, providers, processing activities or legal requirements change. Material changes will be communicated appropriately.

14. Contact

Privacy questions and rights requests can be sent through Help & Safety or to support@2xides.com.