Privacy Policy

1. Who we are

NoPhoto is operated by Ping Media Group Ltd, the controller responsible for the personal information described here. This policy covers the NoPhoto dating app and its associated website.

The app is currently an early release with written profiles, Pings, private conversations and safety reporting. We explain material changes to how information is used before introducing them.

2. Information we collect

• Account information: email address, password authentication records, verification status and sign-in sessions. Supabase Auth handles your password securely; passwords are not stored as readable text.
• Profile information: first name, private date of birth, gender and written profile answers. We calculate your displayed age from your date of birth.
• Preferences: who you want to meet, minimum and maximum age, and your search distance in miles.
• Approximate location: your latest saved area and refresh time, used to find nearby profiles.
• Account controls: blocks and a record of your privacy choice, its wording version and acceptance or withdrawal times.
• Connections: Pings, copies of the answers they respond to, acceptance records, messages and sending counts. Before sending or accepting your first Ping, we ask for a separate messaging consent choice.
• Safety reports: your explanation, the reported profile or Ping, or the latest 20 messages in a reported conversation, plus restricted review notes and outcomes.
• Contact and technical information: information you send us, and service logs such as IP addresses, browser details, request times and errors, where recorded by our hosting and authentication services.

We do not request photographs, surnames, contact lists or social-login data. Avoid putting contact details, an exact address or sensitive information you do not want to share in your profile answers.

3. Why we use information

We use account details to provide sign-in, email verification, password recovery and account management. We use basic profile details, age and distance settings to provide the service you request. Our lawful basis for these activities is performance of our contract with you.

Your gender and gender preference together may reveal sexual orientation. We ask for your explicit consent before using them for discovery. That choice also covers storing and sharing sensitive information you choose to include in your written answers. We rely on consent under Article 6(1)(a) and, where special-category information is involved, explicit consent under Article 9(2)(a) of the UK GDPR.

We deliver Pings and messages to provide the connection you request. We obtain an additional explicit consent for sensitive information you choose to include in them. A recipient sees only your initial until acceptance; accepting a Ping reveals both first names to that pair. Message content is not end-to-end encrypted.

We use necessary security records and blocks to protect accounts and prevent unwanted contact, relying on our legitimate interests in a safe, reliable service. We use correspondence to respond to requests and resolve concerns. We retain a minimal consent record to demonstrate your choice and comply with our data-protection obligations. Where the law requires processing, we rely on that legal obligation.

Submitted reports go to the restricted operator inbox for investigating safety concerns. We minimise the material used for that investigation. Sensitive information in a report requires an additional applicable legal condition, assessed for the particular concern; for example, necessity for establishing, exercising or defending legal claims where that condition applies. Ordinary dating consent is not treated as permission to retain sensitive report material indefinitely.

Discovery applies the preferences members choose. Gender and age must match both ways; distance uses the searcher’s limit. This determines which profiles appear, rather than making a decision with legal or similarly significant effects about you.

4. Your location and what members see

Device location is required to set up a dating profile. Your browser asks permission, then NoPhoto reduces the position to a fixed area roughly three to four miles across in the UK before saving it. The database enforces that reduction too. We use the approximate position for search filtering and distance bands.

We display a nearby qualifying town, a county or similar broad area, or an approximate distance band. Labels come from downloaded place data; we do not send members’ positions to a map provider to obtain them. Labels are not statements of residence.

We refresh your area when you open or return to the app while dating-data consent is active. A failed refresh keeps the previous area. The application stores the latest area, not a location-history table.

Eligible members can see your initial, calculated age, gender, broad area and answers. Discovery responses exclude your full first name, date of birth, email and coordinates. You can correct your first name without changing your account or removing blocks.

After a Ping is accepted, each member can see the other’s current first name and profile within their conversation. First names remain hidden from unrelated members. A name correction does not change the account or create a new connection.

These measures reduce disclosure but cannot guarantee anonymity. People may recognise your writing, infer movements between areas or keep screenshots. Read Privacy & Safety Explained for the limits.

5. Cookies and communications

The app uses essential authentication cookies and browser storage to maintain your session. Blocking these may prevent sign-in. The current app has no advertising, affiliate-tracking or optional analytics integration.

If you choose Light or Dark in Settings, we save that appearance preference in this browser so it applies on your next visit. The preference is not sent to our servers or shared with other members. Clearing browser storage removes it.

To support the installable web app, we store a generic offline page on your device. This offline cache contains no profiles, Pings or conversations, and we do not queue messages to send when your connection returns. Clearing site data removes this cache.

Verification and password-reset emails are service messages. Creating an account does not sign you up to marketing. We will explain any future optional tracking or marketing and obtain consent where required before enabling it. Other websites reached through links have their own policies.

6. Hosting, providers and international processing

• Hetzner Online GmbH: the planned NoPhoto.com information website will be hosted on our Hetzner VPS, separately from the app. Website requests may generate server and security logs.
• Vercel: hosts and delivers the app using its infrastructure and cloud providers, including Amazon Web Services.
• Supabase: provides authentication, account emails and the application database. Our current primary database region is London, UK.

Hosting the database in London does not mean all processing stays in the UK. Providers and their subprocessors may process technical, support or account data internationally. Applicable transfer safeguards may include an adequacy decision or approved contractual clauses with the UK Addendum. Contact us for information about the arrangements applying to your data.

Provider information: Hetzner privacy information, Vercel privacy information and Supabase data-processing terms.

We do not sell or rent your personal information. Access is limited to what is needed to run the service, respond to you, address abuse or meet legal obligations. We may disclose necessary information to authorities when legally required or to address a serious safety issue.

7. Retention, withdrawal and deletion

We keep account information while you maintain an account and it is needed to provide the service. The current app does not automatically delete an account simply because you have not signed in recently.

You can withdraw dating-data consent through Privacy choices. This hides your profile, stops discovery and location refresh, removes your gender preference and profile answers, and closes your connections. Ordinary Ping and conversation content is removed for both members. Your login, basic details, previous approximate area and blocks remain. Consenting again does not restore removed content.

Unaccepted Pings are available for seven days from sending. Passing removes their ordinary content immediately; expired content is removed by an hourly cleanup. Conversations have no inactivity deadline. Ending a conversation or blocking a member removes its ordinary messages for both members. Minimal account-pair and sending records prevent repeated approaches and enforce daily allowances while the accounts exist.

Account deletion requires your password and confirmation. It removes active account, profile, answer, preference, location, consent, block, Ping and conversation records, including shared ordinary messages, and revokes refreshable sign-in sessions.

Already submitted safety reports are handled separately from ordinary conversations. The reporting form explains the copied evidence. Reports and review notes are scheduled for removal after 90 days by the hourly cleanup; irrelevant sensitive material should be removed sooner during review. Account deletion removes live account links from a retained report but does not automatically erase its copied evidence. Contact us about a report or a request to remove information from it.

Correspondence is kept for as long as needed to resolve the enquiry and any related complaint, safety issue or legal obligation. The period depends on the issue, whether a dispute remains open and applicable legal requirements. We do not maintain an indefinite separate archive of deleted dating profiles.

Provider logs and recovery copies may outlast active records until their retention or overwrite cycles finish. Those cycles depend on the service and plan; deletion is not a promise that every backup disappears immediately. Recovery copies are not used to restore deleted profiles to discovery. Deletion cannot erase information another person has copied.

8. Your choices and rights

You can edit your name, details, answers and preferences in the app. You can request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. These rights depend on the circumstances. Withdrawing consent does not change the lawfulness of earlier processing.

Contact contact@pingmedia.net with “NoPhoto privacy” in the subject. We may request proportionate information to confirm the request concerns your account. We normally respond within one month, with extensions only where the law allows.

You can complain to the Information Commissioner’s Office. You do not have to contact us first.

9. Children and changes

NoPhoto is for people aged 18 or over. If you believe a child has an account, contact us so we can investigate. We will publish a new date when this policy changes and draw material changes to members’ attention. A new purpose requiring consent will need a new choice.