forrealz! Privacy Policy
Version: 2026-07-06
This is a courtesy translation. The German version at go.forrealz.de/legal/privacy.de.md is the legally binding version; in case of any discrepancy, the German text prevails.
1. Data Controller
The data controller under the GDPR is Manuel Rorarius, Berlin, Germany (info@forrealz.de).
2. What Data We Collect
Account/profile data: first name, date of birth, phone number or email address, profile photos, interests, languages, relationship status. Optional, and only with your explicit consent: gender identity and sexual orientation (special category data under Art. 9 GDPR).
Activity data: content you create ("drops"/"picks"), connections to other users, app settings, in-app transactions.
Location data: with your consent, revocable at any time in the app settings, we collect your approximate or precise location to show you relevant drops nearby.
Technical data: device information, IP address (anonymized where possible), log data, error reports, push notification tokens.
Verification data: for optional age/identity verification, we send your first name, date of birth, and a selfie photo to our verification provider, Didit (see Section 3). The selfie itself is processed only by Didit — forrealz! does not store it and has no access to it. We store only the verification result (approved/declined) and a reference to your existing, non-biometric profile photo.
3. Recipients and Processors
We use the following external service providers, which process data on our behalf or as independent controllers:
| Provider | Purpose | Data processed |
|---|---|---|
| Didit | Identity/age verification | First name, date of birth, selfie photo (processed transiently at Didit only, never stored by us) |
| RevenueCat | Subscription and payment management | User ID, transaction/product IDs, purchase history |
| Google Firebase | Push notifications (Android), phone-number sign-in | Device token; for phone login: phone number |
| Apple (APNs) | Push notifications (iOS) | Device token, notification content |
| Google Sign-In | Sign-in with Google account | Google user ID, email, first name, profile picture, locale |
| Apple Sign-In | Sign-in with Apple ID | Apple user ID, email (if shared), first name |
| Google Maps/Places | Showing nearby venues | Location data (proxied server-side; the client never sees the API key) |
| Email delivery (SMTP) | Sending login codes | Email address, one-time code |
| S3-compatible object storage | Storing profile photos | Profile photos |
| AWS (analytics pipeline) | See Section 5 | Pseudonymized usage data |
We have data processing agreements under Art. 28 GDPR with all providers that process data on our behalf.
4. International Data Transfers
Some of the providers above (including Google, Apple, RevenueCat, and Firebase) are based, or operate servers, outside the EU/EEA — primarily in the United States. Transfers of personal data to these providers are based on the EU Standard Contractual Clauses (Art. 46 GDPR) or, where applicable, an EU Commission adequacy decision (e.g., the EU–U.S. Data Privacy Framework). A copy of the relevant safeguards can be requested at info@forrealz.de.
5. Analytics
We collect product usage statistics (e.g., which features are used) to improve the app. Your user ID is pseudonymized before analysis using HMAC with a random, per-user key; only coarse, bucketed attributes (e.g., age and tenure ranges rather than exact values) are analyzed. If your account is deleted, your individual pseudonymization key is also deleted, permanently severing the link between the pseudonymized records and you. We do not use third-party advertising trackers. The legal basis is our legitimate interest in improving the product (Art. 6(1)(f) GDPR).
6. Legal Bases
- Art. 6(1)(b) GDPR: performance of a contract (e.g., account management, showing drops)
- Art. 6(1)(a) GDPR: consent for optional data (e.g., location)
- Art. 6(1)(f) GDPR: legitimate interest (technical operation, fraud prevention, analytics per Section 5)
- Art. 9(2)(a) GDPR: explicit consent for special category data (gender identity, sexual orientation)
7. Consent
We obtain your explicit consent for location data and for the optional gender identity and sexual orientation fields. You can disable location sharing at any time in the app settings and delete optional profile fields at any time.
8. Retention
We retain your data for as long as your account is active. After account deletion, your data is deleted within 30 days, unless a legal retention obligation requires otherwise.
9. Your Rights
You have the right to access, rectify, erase, and restrict processing of your data, as well as the right to data portability and to object to processing based on legitimate interest (Art. 15–21 GDPR). To exercise these rights, contact info@forrealz.de. You also have the right to lodge a complaint with a data protection supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information.
10. Contact
info@forrealz.de