Privacy Policy

This policy explains what data deeph processes, why, on what legal basis and for how long. We wrote it to match what the app actually does. The German version is legally binding; this translation is for your convenience.

1. Who is responsible

Use this address for any privacy question and to exercise your rights.

2. The key points

• No tracking, no ads, no analytics tools. We do not sell data.
• We don't store your exact location. For posts we only store an area of about one square kilometre, and only while the post is visible.
• Others see a rounded distance, never your position.
• Our servers and databases are in Frankfurt am Main. We use services from Google (Firebase and Google Cloud) and Apple.
• You can delete your account in the app at any time.

3. Account and sign-in

You sign in with an email address and password or with “Sign in with Apple”. We process your email address, an account ID and sign-in details (e.g. time). We never see your password; the sign-in service only stores it in encrypted form. With Apple you can hide your real address, in which case we receive a relay address from Apple. We only email you to confirm your address (with a code), to welcome you after you sign up, to reset your password or to change your address. We send these emails through our mailbox at STRATO. We store the confirmation code only as a checksum, and for no longer than one day beyond its validity of 15 minutes.

Legal basis: performance of the user agreement (Art. 6(1)(b) GDPR).

4. Profile and age check

• Visible to signed-in users: username, profile picture and, if you choose, your age and what you're looking for (e.g. “New people”).
• Only for you: your date of birth. We need it because deeph is for people aged 18 and over. We only show your age if you turn that on.
• Consents: we store when you accepted which version of the Terms of Use and this policy.

Profile pictures and story photos are resized on your iPhone and stripped of metadata such as the location where they were taken before they are uploaded.

Legal basis: Art. 6(1)(b) GDPR; for the age check also our legitimate interest in protecting minors (Art. 6(1)(f)).

5. Location

deeph shows posts from near you. For this, the app asks for your location while you use it. You can change this at any time in your iPhone settings.

• Feed and search: the app sends your current position to our server to find matching posts. This position is not stored.
• When you post: we only store an area of about 1.2 × 0.6 km and its centre with your post, not your position. As soon as the post expires or you end it, we delete that too.
• Place name: the app determines the name of the city (or district) and the country on your iPhone using Apple's map service. Your position is sent to Apple for this. Street names and house numbers are never used. The place name and country stay with your archived post.
• Abuse prevention: we keep the centre of the area of your last post and its time, so we can detect impossible jumps (such as 500 km in one minute). This value is overwritten with every post.
• What others see: a rounded distance (e.g. “under 1 km”, “8 km”) plus the place name and country.

Legal basis: Art. 6(1)(b) GDPR; abuse prevention under Art. 6(1)(f). You grant location access on your iPhone yourself.

6. Posts, audio, stories and reactions

• Posts: text, colour, highlighted words, duration and, where applicable, the answer to the question of the day. For search we store word beginnings from the text. We don't store what you search for.
• Audio with posts (up to 30 seconds): before it is published, it is automatically converted to text (Google Cloud Speech-to-Text, processed in the EU) and checked against a word list. We don't store the transcript.
• Stories: one photo, visible for 24 hours. Only you see how many people viewed it; nobody sees who.
• Reactions: others don't see who liked which post. The author only sees the count.
• Automatic checks: we automatically check profile pictures, stories and chat photos for nudity and violence (Google Cloud Vision, processed in the EU). We check texts against a word list. If something is rejected, you see this immediately and can change it.

Legal basis: Art. 6(1)(b) GDPR; automatic checks under Art. 6(1)(f) (protecting users, meeting legal obligations).

7. Requests and chats

We store requests, messages, photos and voice messages so that they can be delivered and displayed. Messages are only visible to the two people in the chat. We don't read chats. We only look at a chat if someone reports it (see section 9).

• Photos in chats are visible for 48 hours; then we delete the file.
• Voice messages stay until the chat is deleted.
• If you delete a chat, it disappears for you. The other person keeps their history until they delete the chat too. Then we delete everything, including the files.
• We store whether there are unread messages and when someone last typed. There are no read receipts and no online status.

Legal basis: Art. 6(1)(b) GDPR.

8. Notifications (push)

If you allow notifications, we store a device identifier from Apple or Firebase, the app language and your settings (requests, messages, reactions, weekly reminder). Notifications never contain the content of a message, but they do contain the username of the person who wrote to you. They are delivered via Firebase Cloud Messaging and the Apple Push Notification service.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your iPhone settings and in the app.

9. Reports, moderation and security

• Reports: if you report a post, story, profile or chat, we store the report with its reason and a copy of the reported content. For chats, that is the last 20 messages you could see, including photos and voice messages. Only we, as moderators, see this.
• Automatic steps: if several people report the same content, we hide it until it has been reviewed. If many different people report the same account within 7 days, we automatically suspend it for 24 hours. You can object, and a person will review the decision (see Help with suspensions).
• Blocking: we store whom you block, so that you no longer see each other.
• App Check: we use Apple App Attest to check that requests to our server come from the genuine app. No personal content is transmitted.
• Spam limits: we store the times of your requests over the last 7 days and of your messages over the last minute.
• Logs: our server writes technical logs (e.g. account ID, time, errors) to detect faults and abuse.

Legal basis: Art. 6(1)(f) GDPR (security and protection of users) and Art. 6(1)(c) (obligations under the Digital Services Act).

10. Pro

If you buy Pro, Apple handles the payment. We don't receive payment data, only whether your Pro is active. Once purchases are connected, we will name the service that passes this information to us here.

Legal basis: Art. 6(1)(b) GDPR.

11. On your iPhone

The app stores only a few settings on your device: the place chosen for the feed, whether you answered the question of the day and how often we asked about notifications. There are also the usual caches for sign-in and the database. Deleting the app removes them.

12. This website

This website sets no cookies and uses no analytics. When you visit it, our hosting provider (Firebase Hosting by Google) processes technically necessary data such as your IP address, the time and the page requested, to deliver the page and protect it from attacks (Art. 6(1)(f) GDPR).

13. Service providers and recipients

Google and STRATO process data on our behalf (Art. 28 GDPR). We cannot completely rule out that Google or Apple transfer data to the USA. Both companies are certified under the EU-US Data Privacy Framework; the European Commission's standard contractual clauses also apply.

Other people in the app only see what sections 4 to 7 describe as visible. We only share data with authorities where the law requires us to.

14. How long we keep data

If you delete your account, we immediately delete your profile, profile picture, all posts including the archive, stories, reactions, requests, blocks, push identifiers and your username. In chats the other person hasn't deleted yet, your previous messages remain readable for them, shown as “Deleted account”.

15. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15 to 21 GDPR). You can withdraw consent at any time. Write to us at info@getdeeph.com.

You can also lodge a complaint with a data protection authority, for example in your country of residence or with the authority responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.

16. Minimum age

deeph is only for people aged 18 and over. If we learn that an account belongs to a younger person, we delete it.

17. Changes

If the way deeph processes data changes, we will update this policy. For significant changes we will ask for your consent in the app.

Last updated: 10 November 2026