Privacy Policy.
We have written this in plain English. We have done our best to make it short. We never sell your data, never share it with advertisers, and never use it to train external models.
The quick version.
- We collect what we need to run the app and nothing else.
- We never sell your data. We never share it with advertisers.
- You can delete everything we hold on you at any time, instantly, from Settings.
- Your selfie verification is processed by Persona and deleted. We store the verdict, not the image.
- When the Lab writes a message for you, your own profile is never sent to the model. Only the recipient profile.
Contents
Who we are.
Dating Lab is operated by Alenoss Inc, a company registered in England. We are the data controller for the personal data described in this policy. Our registered address is on file with Companies House. The Data Protection Officer can be reached at privacy@datinglab.com.
This policy applies to the Dating Lab iOS app, the website at datinglab.com, and any related services we provide. It does not apply to third-party services that you might access through Dating Lab; those are governed by their own privacy policies.
What we collect.
When you sign up
Your sign-in method (Apple, Meta, or phone number), your first name, your date of birth (used only for the 18+ check and to display your age), your gender, your sexuality if you choose to share it, your city, your photos, your prompt answers, and any interests you select.
When you use the app
What you do: likes, passes, saves, messages sent, profile views. The device you use: iPhone model, iOS version, and language. Your approximate location, used for distance calculations only; we never share precise coordinates with other users. Any reports you make about other users.
When you pay
Apple's transaction ID and the SKU you bought. We do not collect or store your card number. Apple handles that interaction directly.
When you verify
The verdict of the Persona selfie check (pass or fail) and the date. We do not store your selfie. Persona stores it briefly for the match, then deletes it. See Persona's privacy policy for their retention details.
When the Lab writes for you
When you use Crafted Icebreaker or Crafted Broadcast, we send the recipient's profile to our writing service (Anthropic) along with any optional sender notes and tone selection you provided. Your own profile is never sent. The output is returned and shown to you for editing before send.
Communications
If you email us, we keep the email so we can respond. If you message a match, that message is stored to deliver it.
How we use it.
We use your data for five things, and only five things:
- Matching. To recommend profiles to you and to other users, based on your preferences and theirs.
- Messaging. To deliver messages between you and your matches in real time and to keep a history of those conversations.
- Payments. To verify your purchases with Apple and to grant you what you paid for (coins, membership, refunds).
- Safety. To moderate photos and messages, to investigate reports, and to enforce the Community Guidelines.
- Improvement. To understand which features are used and which are broken, in ways that are aggregated and never identify individual users.
We never sell your data. We never share it with advertisers. We never use your profile, photos, or messages to train models that we sell or license. The Lab Membership pays for the product; we do not need ad revenue to run.
Where data lives.
Your account data, profile, photos, and messages are stored in Supabase Postgres, hosted in the United States (us-east-1). All data is encrypted at rest. Row Level Security policies enforce that you can only ever access your own data via the API.
If we expand to additional regions, we will publish that change here and notify users in materially affected regions.
How long we keep it.
- Active accounts: while you are using Dating Lab.
- Deleted accounts: hidden from everyone immediately. Permanently purged within 30 days.
- Messages: kept for two years after the last message in a match, then deleted. We retain them in that window to investigate any reports.
- Moderation records: kept for five years for legal compliance.
- Financial records: kept for seven years as required by tax law.
Your rights.
Under the UK GDPR, the EU GDPR, and equivalent laws in other jurisdictions, you have the right to:
- Access. Request a copy of the personal data we hold on you.
- Correction. Correct your data. You can do most of this from your profile and Settings.
- Deletion. Delete your account. Instant, from Settings. Purged within 30 days.
- Portability. Receive your data in a portable format (JSON). We send the export within seven days of your request.
- Restriction. Pause our processing of your data. Use the Pause profile option in Settings.
- Objection. Object to specific uses of your data. Email privacy@datinglab.com.
- Complaint. Complain to a regulator. UK: the Information Commissioner's Office (ico.org.uk). EU: your local Data Protection Authority.
To exercise any of these rights, use the relevant Settings option in the app or email privacy@datinglab.com. We respond to all requests within 30 days, usually much faster.
Security.
Your data sits in encrypted-at-rest Postgres on Supabase, protected by Row Level Security so you can only access your own data via the API. Your photos sit in encrypted storage with signed URL access. Your password is never stored anywhere because we do not use passwords; we use Sign in with Apple, Continue with Meta, or phone OTP. We use TLS 1.2 or higher everywhere.
If we ever experience a personal data breach, we will notify you and the relevant regulators within 72 hours, as the law requires.
Children.
Dating Lab is 18 and over only. We do not knowingly collect data from anyone under 18. We check the date of birth you provide at sign-up against your verified identity where possible. If we discover a user is under 18, we terminate the account immediately and delete the data. If you believe a minor is using Dating Lab, please report the profile in-app or email safety@datinglab.com.
International transfers.
Because Supabase is hosted in the United States, your data is transferred to and stored in the US. Where required by law, transfers from the UK, EU, or EEA are governed by the European Commission's Standard Contractual Clauses, supplemented by the UK Addendum. We rely on adequacy decisions where they apply.
Changes to this policy.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you in-app and by email (if you have given us one) at least 14 days before the changes take effect. Non-material changes (clarifications, formatting) are published silently. The "Effective date" at the top of this page always reflects the current version.
Contact.
For any privacy question, request, or complaint, email privacy@datinglab.com. We aim to respond within one working day, and always within 30 days as the law requires.
If you are unhappy with how we have handled a privacy matter, you can complain to your local data protection regulator. In the UK that is the Information Commissioner's Office at ico.org.uk. We would prefer to resolve the issue with you directly first, but you do not need to ask us before contacting them.