Privacy Policy

1. Who we are

Touch ("Touch", "we", "us") is a proximity-based social discovery app. This policy explains what personal data the Touch mobile app and its backend collect, why, how long we keep it, who processes it, and the choices you have.

Contact: support@touchapp.app (privacy questions, data requests)

2. The data we collect

We do not collect your contacts, browsing history or advertising identifiers. We don't use facial recognition: the photo check only detects whether a face is present, and nothing about the face is kept.

Photos you send in a chat

• What we collect. The photos you choose to send to a match.
• Location and hidden details are removed first. Our servers make a fresh copy of every photo before anyone else can see it. The copy keeps the picture only: its location and other hidden details (metadata such as the camera, the date and the place it was taken) are removed. The file you uploaded is then deleted.
• An automated check. Google Cloud Vision checks each photo for adult or violent content (see §6). We keep only the result. A photo the check holds back is never delivered; it goes to our safety team instead, and it can lead to a warning or a pause on sending photos.
• Who can see it. Only you and your match, and only while the match lasts. The app shows a photo through a private link that stops working after 15 minutes. No one else can open it: not other users, and not anyone who finds the link later. Your phone keeps a copy to show the conversation; it is cleared when you sign out.
• Safety copies. If a photo is held back by the check, or someone reports a conversation, our safety team can see the photos involved. They are kept as safety records for the periods in §7, and only the safety team can see them. A report keeps copies of the reported person's photos only, never the photos of the person who reported.
• When it is deleted. Photos of a match that has ended (for example after an unmatch or a block) are deleted 30 days after it ends. If either of you deletes their account, the photos of every match that account was in are deleted with it, except the deleting person's photos among the last 10 messages of a conversation kept so the other person can still report it, which are kept for up to 30 days (§7, "When someone deletes their account").

Voice messages you send in a chat

• What we collect. The voice messages you choose to record and send to a match, up to 60 seconds each. Touch only uses your microphone while you're recording a voice message, and only after you allow it.
• Hidden details are removed first. Our servers make a fresh copy of every voice message before anyone else can hear it. The copy keeps the sound only: hidden details a recording file can carry (such as the device, the time or a location) are removed. The file you uploaded is then deleted.
• No automatic listening. Voice messages are delivered without an automated check of what you say, and we don't transcribe them as a matter of course.
• Who can hear it. Only you and your match, and only while the match lasts. The app plays a voice message through a private link that stops working after 15 minutes; your phone keeps a copy to play the conversation, cleared when you sign out.
• If a voice message is reported. A copy is kept as a safety record, and our safety team can listen to it. When they review the report, the reported voice message may be turned into text by Google Cloud Speech-to-Text (see §6) so they can read it. The text is seen by the safety team only, never by other users, and is deleted together with the report's other copies (§7). A report keeps copies of the reported person's voice messages only, never those of the person who reported.
• When it is deleted. Voice messages of a match that has ended are deleted 30 days after it ends. If either of you deletes their account, the voice messages of every match that account was in are deleted with it, except the deleting person's voice messages among the last 10 messages of a conversation kept so the other person can still report it, which are kept for up to 30 days (§7, "When someone deletes their account").

3. How we use your data

• To run the core feature: note the places where your day happens while the app is open, build your private Journey of Stations, and surface people you crossed paths with who fit what you're each looking for and who are discoverable.
• To enable connection: likes, mutual matches and 1:1 chat.
• To send notifications you'd want: a new match, a new message, or a new place worth a look. You can turn each one off. We do not send engagement, streak or "come back" nudges.
• For safety: to check photos (including photos sent in chats), act on reports and abuse (including transcribing a reported voice message for our safety team), detect location spoofing, and keep a record of admin access.
• To run and fix the service: sign-in, your account, crash and service diagnostics, and account deletion.

Lawful bases. Where privacy laws such as the GDPR apply, we rely on: providing the service you signed up for; your consent where we ask for it (for example your phone's location, notification and microphone permissions); and our legitimate interest in keeping the service safe and working.

4. Location, explained

Location is the heart of Touch, so we want to be especially clear.

• Only while the app is open. Touch asks your phone for location access while you use the app only. It never senses in the background, so there is no background process and no standing notification: when you leave the app, sensing stops.
• When it starts, and how to stop it. Sensing starts only when you choose it: by tapping Allow on the Location step while setting up, after reading what it does, or by turning on Settings → Location & sensing. Allowing location for something else, such as filling in your city, does not start it. You can switch it off at any time in the same place, or withdraw the permission in your phone's settings. If you never turn it on, the rest of the app still works; only your Journey stays empty.
• What is sent. Roughly every two and a half minutes while the app is open, your phone combines a few GPS readings into one estimated position and sends that estimate, with measures of its accuracy and whether you were moving. The individual readings stay on your phone. If you're offline, unsent estimates wait on your phone for up to 24 hours, then are discarded, and deleted the next time the app starts. Older versions of the app keep them for up to 7 days; updating the app applies the 24-hour limit.
• What we keep, and for how long. Precise positions are kept on our servers for 30 days and are used only by automated processing: to recognise the places you spent time and whether you and someone else were there at the same time. They are never readable by another user, or through the app.
• Your home is protected. We keep a record of approximate areas (about 150 m across) where you are often late at night, for up to 180 days. If an area looks like your home, it is never treated as a place to meet people and never becomes a Station, and once it is recognised as your home, your visits there are no longer sent to a place-naming service.
• Naming places. Our servers, not your phone, look up what kind of place an area is and what it is called (whether it is a café, a park or similar). They send only the location of an area about 150 m across, never your exact position, to public OpenStreetMap services. No lookup includes your name, account or anything else about who was there (see §6).
• Pictures of places. A Station shows an illustration of its kind of place (such as a café or a park), which comes with the app. Touch does not show photos of places, and does not ask Google or anyone else for them.
• Stations keep the place and time of an encounter for 30 days after the visit, then are deleted automatically, like the encounter records they come from (see §7).
• Discoverability is separate from sensing. Turning off Be discoverable in Stations means you stop appearing to other people (and they stop appearing to you), but it does not switch sensing off. Use Location & sensing for that.
• Choosing a city. If you set your city by typing, only the text you type is sent to Google to suggest city names. If you choose use my location instead, your phone's current position is sent once, through our servers, to Google to look up the city. We keep only the city name, filed under an area of about 1 km that is not linked to your account.

5. What we never do

• We never deliver one user's location to another user's device, and never show anyone a map of where you are or were.
• We never sell your personal data.
• We never use your data to build advertising or marketing profiles, and we run no third-party ad SDKs. Automatic event logging and advertising-ID collection in the Facebook SDK are switched off.
• We never show a public profile, a browsable user directory, an attendance list, or a "who liked you" surface.

6. Who processes your data

We don't sell or rent your data. We use a small number of service providers to operate the app:

• Google Firebase and Google Cloud (Authentication, Firestore, Storage, Cloud Functions, Cloud Messaging, Hosting, App Check): our backend and infrastructure. When you verify your phone number, Firebase Authentication sends the one-time SMS code on our behalf.
• Google Cloud Vision: checks each photo you upload to your profile, and each photo you send in a chat, for adult or violent content, and that your first profile photo shows a face. A chat photo reaches it only after its location and other hidden details have been removed. Vision reads the photo from our storage to check it, and we keep only the result, apart from the safety copies described in §7.
• Google Cloud Speech-to-Text: turns a reported voice message into text when our safety team reviews the report, and nothing else. It receives only that recording (already stripped of hidden details), processes it in the EU, and we keep the text with the report.
• Google Maps Platform (Geocoding, Places Autocomplete): to suggest and look up your city (see §4). These requests go through our servers.
• Google Crashlytics: receives crash reports (a per-install identifier, device model, OS and app version, and a stack trace). They contain no profile, message or location data.
• Google Sign-In and Meta (Facebook Login): if you link Google or Facebook as a sign-in method, the provider receives the sign-in request, and we receive your account identifier and email address. We do not ask for anything else.
• Meta's Facebook SDK: included in the app for Facebook Login, it starts with the app whether or not you use Facebook. Meta documents that the SDK collects technical device information (such as device identifiers, device model, operating-system and app version, and IP address). We have switched off the SDK's automatic event logging and its advertising-ID collection, and we send Meta no data about how you use Touch.
• Resend (email delivery, servers in Ireland): sends two kinds of email only: the confirmation when you add or change a recovery email address, and the confirmation or notice when a Google or Facebook sign-in is linked to your account (sent to that account's email address). It receives that email address and the message. It does not receive your phone number, profile, photos, location, Stations or messages. If you never add a recovery email or link a sign-in account, we never send it anything.
• Google reCAPTCHA: when you ask for a code by SMS, in the app and on our web page for deleting an account without the app (touchapp.app/delete-account/verify). It checks that the request comes from a person and is not SMS fraud; to do this Google receives the phone number and device or browser information, under Google's Privacy Policy. The rest of our website makes no requests to other companies.
• OpenStreetMap public services (Overpass): independent, publicly operated servers that tell us what kind of place an area is and what it is called (see §4). For places you visit, they receive the location of an area about 150 m across, and no account information. Our requests identify Touch and give a contact address, as these services' usage policies require. We do not control what they log.

These providers act on our instructions, with two exceptions: the OpenStreetMap services, which are public services we query without sending any account information; and Meta, which handles Facebook Login and what its SDK collects under its own data policy.

We may also disclose information if the law requires it, or where we believe in good faith that disclosure is reasonably necessary to comply with a legal process, enforce our terms, or protect the rights, safety or security of our users, the public or the service.

7. How long we keep it

Deleted files. When we delete a stored photo or voice message, our storage provider (Google Cloud Storage) keeps it in a protected recovery area for 7 days, so that an accidental deletion can be undone, and then erases it. Nothing in the app can reach it there, and no other user ever can.

Reporting window. Ending a conversation does not stop either of you from reporting it. For 30 days after a match ends (for example by an unmatch or a block), either of you can still report it, and the report includes the last few messages, with the reported person's photos and voice messages among them, just as it would while the match was open. These messages are attached to the first report from that chat each of you makes after it ends; a later report is still reviewed, without a new copy. In versions of the app released before this change, a report on a conversation that has ended is sent without the messages.

When someone deletes their account. Deleting an account does not erase the evidence of a conversation the other person may need to report. When you delete your account in version 0.1.0 (13) or later of the app, or on our web deletion page, we keep a short copy of each conversation that is open, or that ended in the last 30 days, if its last 10 messages include at least one of yours: those 10 messages, from both of you, with your photos and voice messages among them (the other person's photos and voice messages are deleted). The copy is kept on our servers for up to 30 days (for a conversation that had already ended, only until its reporting window ends), and it is seen by no one. In version 0.1.0 (13) or later of the app, the other person sees an entry in their Matches that names nobody, only the date you matched and the date until which they can report it, and can report the conversation from it until the date shown; only then does our safety team see it, as part of that report: the copy moves into the report and is kept as the copies kept with a report are (see the table). Nothing is kept if the other person's account has been banned or hidden by our safety team, or if they have already reported that ended conversation. The copy is deleted automatically when the period ends, or sooner if the other person deletes their account. In older versions of the app, deleting your account erases every conversation at once.

Safety-record exception. A small set of safety records (reports, moderation outcomes including photo-check results, the copies kept with a report from a chat (with any voice-message transcript), a conversation kept for up to 30 days so the other person can report it, messages and photos held back by our checks, copies of rejected profile photos, automated location-spoofing signals, rate-limit counters, and the admin access log) are kept even after an account is deleted, so that we can keep the community safe and meet our legal obligations. They are never readable by other users, and each is deleted automatically after the period in the table above. A report that has not been reviewed yet is kept until it is, so that no report is lost unread. When the law requires us to preserve a particular record (for example for a legal claim or an investigation by the authorities), we keep that record, and any photo or voice message it covers, beyond the period in the table only until the obligation ends. If we find suspected child sexual abuse material, we keep the material and the related records only as long as needed to investigate and report it as the law requires; only our safety team can access them, and every access through our moderation tools is logged.

8. Your choices and rights

In the app you can, at any time:

• Switch Location & sensing off or on.
• Turn Be discoverable in Stations off or on. Off means you stop appearing in other people's Stations and they stop appearing in yours (sensing is a separate switch).
• Choose which notifications you get (matches, messages, new places).
• Block, report or unmatch someone. Blocking ends any match with that person, and they won't appear in your Stations or matches again. Occasionally it can take a short time for this to reach all your devices, and a notification sent before you blocked them may still appear. After an unmatch or a block, the other person may still see a row saying the conversation has ended, with your first name and the main photo you had at that moment, until they clear it. Clearing applies to that device only, so the row can show again if they reinstall the app or use another device. It doesn't say who ended the match or why. Neither of you can open the other's profile or other photos in Touch any more. We can't recall what already reached their device, including anything they saved and links to your other photos. A link to one of those photos normally stops working within about 15 minutes.
• Edit or remove your profile information, and remove your recovery email.
• Sign out.
• Delete your account. Deletion removes your profile and photos; your Journey (Stations, location estimates, visits, encounter records and home areas); your likes and "Not for me" choices; your blocks; every match you are in, with its messages, photos and voice messages, for both participants (except a short copy kept for up to 30 days so the other person can still report a conversation, §7); your recovery email and linked sign-in accounts; your device tokens; and your service diagnostics. It also removes you from every other user's Stations. Some short-lived records in our matching pipeline can still refer to your account for up to 30 days before they expire automatically. Safety records are kept as described in §7. For step-by-step instructions, and how to ask for deletion if you can no longer sign in, see How to Delete Your Account & Data.

Depending on where you live, you may also have rights to access, correct, delete or port your personal data, and to object to certain processing. Account deletion is self-service in the app; for any other request (including a copy of your data), contact us at the address in §1 and we will respond within a reasonable time.

9. Security

Your data is encrypted in transit (HTTPS), and Google Cloud encrypts it at rest. The app's requests to our servers require a signed-in account with a verified phone number, and we use Firebase App Check to help make sure they come from the genuine app. (Links in our emails work on their own, with a single-use code that expires.) Our backend logs are designed to leave out names, contact details and coordinates. No record that another user can read ever contains your location.

10. Children

Touch is for adults. You must be 18 or older to use it. Age is entered by you and we don't verify it, but we act on reports. We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it.

11. Where your data is processed

Touch launches first in Israel. Our database, file storage (your photos) and backend run in Google Cloud's Tel Aviv region. Some Google services we use (Firebase Authentication, Google Sign-In, Cloud Messaging, Crashlytics, Cloud Vision, Maps and reCAPTCHA) operate across Google's global infrastructure, so data they handle may be processed in other regions where Google operates, with appropriate safeguards for any cross-border transfer.

Four exceptions are worth naming plainly:

• A reported voice message is transcribed in the EU. Google Cloud Speech-to-Text is not offered in the Tel Aviv region, so when our safety team reviews a reported voice message, that recording is processed in Google's EU region. Voice messages that are not reported are never sent there.
• Emails we send through Resend are handled on servers in Ireland. That covers recovery-email confirmations and sign-in-link notices only; nothing else about your account is sent there.
• Place lookups go to public OpenStreetMap servers operated by independent organisations. For places you visit, they receive only the location of an area about 150 m across, and no account information.
• Meta handles Facebook data on its own infrastructure. If you link Facebook as a sign-in method, the sign-in goes through Meta. Meta's Facebook SDK, which starts with the app for everyone, sends Meta technical device information (see §6). Meta handles both under its own data policy, on its own servers, which include servers outside Israel.

12. Changes to this policy

If we make material changes, we'll update the effective date above and, where appropriate, tell you in the app. We'll notify users of material changes where required by applicable law.

13. Contact

Questions, concerns or data requests: support@touchapp.app.