Privacy Policy

HeartSync ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights under applicable data protection law, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

1. What Data We Collect

1.1 Information you provide

Category	Examples
Account data	Email address, phone number, password (hashed)
Profile data	Display name, date of birth, gender, city, country, bio, photos, interests, lifestyle answers
Communication data	Messages you send to matches
Payment data	Transaction ID, plan purchased (card/bank details processed by Stripe or PayPal — we do not store raw card numbers)
Reports & feedback	Reports you submit about other users

1.2 Information collected automatically

Category	Examples
Usage data	Pages visited, features used, swipe actions, login timestamps
Device data	Browser type, operating system, screen resolution
Network data	IP address (used for approximate location and fraud prevention)
Cookies	Session identifiers, preference cookies (see Section 4)

2. How We Use Your Data

We use your data for the following purposes and on the following legal bases:

Providing the Service — matching, messaging, profile display (contract performance);
Age verification & safety — ensuring all users are 18+ (legal obligation / legitimate interest);
Personalisation — improving match suggestions based on your preferences (legitimate interest);
Account & security — detecting fraud, banning prohibited accounts (legitimate interest);
Payment processing — fulfilling Premium subscriptions (contract performance);
Legal compliance — responding to lawful requests from authorities (legal obligation);
Marketing — sending you relevant updates if you have opted in (consent; withdraw at any time).

We do not sell your personal data to third parties.

We may share your data with:

Other users — profile information you choose to make visible (name, age, photos, bio) is shown to potential matches;
Payment processors — Stripe and/or PayPal for subscription billing;
Cloud/hosting providers — servers and storage necessary to run the Service;
Law enforcement — where required by valid legal process or to protect user safety;
Business transfers — in the event of a merger or acquisition, subject to appropriate confidentiality obligations.

4. Cookies & Tracking

We use the following types of cookies:

Strictly necessary — session management (cannot be disabled);
Preferences — remembering your language or settings;
Analytics — aggregated usage statistics to improve the Service (opt-out available in Settings).

We do not use third-party advertising cookies. You can manage cookies through your browser settings; note that disabling strictly necessary cookies will prevent the Service from functioning.

5. Data Retention

We retain your personal data for as long as your account is active. After account deletion:

Profile data, photos, and messages are deleted within 30 days;
Transaction records are retained for 7 years for tax and legal compliance;
Safety-related records (ban logs, abuse reports) may be retained for up to 5 years to prevent re-registration by banned users.

6. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

TLS encryption for all data in transit;
Password hashing using bcrypt with salt;
Access controls limiting which employees can access personal data;
Regular security reviews.

No system is 100% secure. Please use a strong, unique password and report any suspected breach to tony@synapex.io.

7. Your Rights (GDPR / CCPA)

Depending on your location, you may have the following rights:

Access

Request a copy of all personal data we hold about you.

Rectification

Correct inaccurate or incomplete data via your profile settings.

Erasure

Delete your account and personal data (subject to retention obligations).

Portability

Receive your data in a structured, machine-readable format (JSON).

Objection

Object to processing based on legitimate interests, including profiling.

Restriction

Request that we limit how we process your data in certain circumstances.

How to exercise your rights

Download your data: Settings → Privacy → Request Data Export;
Delete your account: Settings → Privacy → Delete Account;
Email request: tony@synapex.io — we will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your national DPA in the EU).

CCPA (California residents)

California residents may request disclosure of categories and specific pieces of personal information collected, and may request deletion of personal information, subject to certain exceptions. We do not discriminate against users who exercise their CCPA rights. To submit a request, email tony@synapex.io with subject "CCPA Request".

8. Children

HeartSync is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a user is under 18, we will immediately delete their account and all associated data. If you believe a minor has registered, please contact tony@synapex.io.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the Service at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

10. Contact & Data Controller

HeartSync operates as the data controller for information collected through this Service.

General enquiries: tony@synapex.io
Privacy & data rights: tony@synapex.io
Security issues: tony@synapex.io
Child safety: tony@synapex.io