Privacy policy
How BothInto handles personal information across our website, recipient web app and mobile app.
Who is responsible
Indent Studio Kft. is the controller responsible for personal data processed through the BothInto landing website, recipient web app and mobile app. Our address is 2094 Nagykovácsi, Farkas utca 17., Hungary.
Contact us about privacy or your data using the email below. This policy covers the features you use; synthetic demos and sample choices are temporary and are not submitted for a real comparison.
Information we process
Creator accounts: email address, account ID, authentication credentials and sessions, an adult declaration, and information supplied by your chosen sign-in provider. Apple, Google or Facebook/Meta may provide an identifier, email address and profile information such as a name or avatar, depending on your permissions. Authentication also uses provider tokens or grants. Recipients do not need an account.
Questionnaires and comparisons: saved creator answers and preferences, private nicknames, invitation identifiers and access links, submission status, timestamps and compatible results. Answers and results can reveal information about sex life or sexual orientation and are sensitive personal data. Questions are optional.
Subscriptions: account-linked subscription status, entitlements, product identifiers and transaction or purchase records. Apple or Google processes store payments; we do not receive your full payment-card details.
Notifications: device installation identifiers, notification tokens, permission status and delivery state. Support: your email address, message and any information you choose to include. Please avoid sending questionnaire answers or complete invitation links in support messages.
Technical data: network requests, IP addresses and device/browser information needed to deliver and secure the service, plus usage events and error or performance diagnostics where the relevant services are configured. The analytics and provider sections explain the differences between these services.
How matching and link access work
Connections use HTTPS. Saved creator profiles, private nicknames, re-share links, comparison inputs and results are encrypted at rest. Matching takes place on our server, which decrypts the required creator input and processes the recipient submission in memory. This is not end-to-end encryption: the service must process answers to calculate compatibility.
Both participants receive the same compatible answers. Neither receives the other person’s response sheet. Non-compatible answers are not disclosed individually. Recipient submissions are processed without server persistence; the matching transaction saves an encrypted result and deletes the matched creator input for that stage.
Anyone holding the complete invitation link can access its result while it remains available. Treat that link as confidential and share it only with the intended person. Deleting the comparison revokes service access, but cannot remove screenshots, copied results or messages already held by someone else.
Matching compares the answers you provide; it does not make decisions with legal or similarly significant effects. Shared interests are never consent to an activity.
Purposes and legal grounds
Under the GDPR, we process ordinary account, authentication, comparison-delivery and subscription data to provide the service you request (Article 6(1)(b)). We process data needed to meet accounting and other legal duties under Article 6(1)(c).
We rely on legitimate interests under Article 6(1)(f) for proportionate security, abuse prevention, troubleshooting, support and service improvement, balanced against your rights and the sensitivity of the service. Where consent is required for optional analytics or device access, the applicable ground is consent under Article 6(1)(a), not merely visiting or using BothInto.
Answers revealing sex life or sexual orientation require an additional special-category condition under Article 9. For this voluntary service, explicit consent under Article 9(2)(a) is required before such processing. This policy is information, not a request for consent, and using the service or declaring that you are 18+ does not by itself constitute explicit consent.
We ask for that consent separately before any answer is processed. In the mobile app, you tick an unticked consent box, separate from the 18+ declaration, when you register. In the recipient web app, a consent statement is shown before the first question, and choosing "I agree and continue" confirms that you are 18+ and gives explicit consent; choosing "I’m under 18" ends the visit without showing questions. We record when consent was given.
Where processing relies on consent, you may withdraw it at any time by contacting us; account holders can also delete their account in the app. Withdrawal does not affect processing already lawfully carried out. Without the data needed for an account or comparison, we cannot provide that feature.
Analytics, diagnostics and device storage
Landing and recipient web analytics use temporary, anonymous identifiers held in memory, without analytics cookies, browser persistence or person profiles. PostHog receives only approved events and bounded labels, such as the privacy-page label, rather than raw page URLs, queries or fragments. Answers, results, nicknames and invitation access credentials are excluded. Automatic capture and session replay are disabled.
Mobile PostHog analytics differs: signed-in activity is associated with the creator’s account ID, and the SDK manages device identifiers. Approved app events help us understand feature use and reliability. Questionnaire answers and result contents are not analytics properties.
Sentry provides error and performance diagnostics for configured web and mobile builds, including technical device, application and stack-trace information. Default personal-information collection and session replay are disabled; this does not make all diagnostics anonymous.
Firebase Cloud Messaging delivers notifications. Firebase Analytics, where enabled in a mobile build, may also collect app interactions and installation/device identifiers under Google’s policies. Android explicitly disables Firebase Analytics collection; the iOS configuration must not be assumed to have the same setting.
The mobile app keeps creator profiles and history on the server, with working copies in memory; local application storage retains authentication credentials and device preferences. An unfinished live recipient questionnaire may keep answers and progress in browser session storage to survive a refresh, with an in-memory fallback. This is a temporary draft, separate from server retention and analytics. Drafts are cleared when the flow completes or becomes unavailable; browser session restoration may prolong tab storage, so clear site data on a shared device. Sample choices remain ephemeral.
Service providers and other recipients
Cloudflare hosts and delivers our public websites and handles network traffic and security information. Supabase provides the database, server functions, authentication and authentication-email delivery, processing account and service data on our behalf.
PostHog provides product analytics. Sentry provides diagnostics. Google Firebase provides push delivery using installation identifiers and notification tokens, and Analytics where enabled. Results-ready push messages contain a generic alert and comparison identifier, not answers, results or private nicknames.
RevenueCat manages subscriptions and purchase entitlements using an account-linked app user ID and purchase information. Apple and Google distribute the app, process store purchases and may supply sign-in services. Facebook/Meta supplies optional social sign-in. Store and sign-in providers also process data for their own purposes under their privacy policies.
Providers receive data needed for their roles, not unrestricted access to every category listed above. We may also disclose information where legally required, to protect rights and security, or to professional advisers subject to confidentiality. We do not sell questionnaire answers or use them for advertising.
Retention and deletion
The table describes operational service data. Deleting a comparison does not delete the reusable creator profile; deleting the account removes its profile and comparison payloads and starts completion of authentication and provider-grant deletion. Store subscriptions must be managed separately.
Our database uses Supabase Free in Ireland. Point-in-time recovery (PITR) is disabled, and we do not maintain external database backups. This describes our configuration, not a guarantee that providers have no internal recovery copies. Their own recovery, security and legal-retention lifecycles can differ from deletion in the live service.
PostHog Free provides a one-year event query window. This is not a promise that events are automatically deleted after one year. Sentry Developer retains event data for 30 days; its backup lifecycle is separate, with event-data backups deleted 90 days after creation. Provider retention documentation is linked below.
Account and notification records are kept as needed to operate the account and deliver permitted notifications; deletion removes account payloads and device access. Support correspondence is kept as needed to resolve requests and related disputes. Billing and transaction records may remain for applicable accounting, tax or legal obligations, including at stores and RevenueCat. Provider security logs and recovery copies follow their respective retention policies. Contact us for details or a deletion request.
| Data | How long it remains |
|---|---|
| Saved creator profiles | Until the profile or account is deleted; matching a comparison does not delete the reusable profile. |
| Unmatched comparison inputs | Expire seven days after comparison creation. Access ends at the deadline; scheduled cleanup deletes expired inputs, including unsubmitted Advanced inputs. |
| Matched comparison inputs | Deleted for the matched stage in the same transaction that saves its result. |
| Recipient submissions | Processed in memory without server persistence. Temporary browser drafts are described above. |
| Completed results | No automatic time-based expiry; remain until the creator deletes the comparison or account. |
International transfers
The database location in Ireland does not mean that all processing stays in Ireland or the European Economic Area. Our providers and their subprocessors may process data elsewhere, including the United States, for service delivery, support and recovery.
Transfers requiring GDPR safeguards must use an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, with supplementary measures where needed. The EU–US Data Privacy Framework may apply where the recipient is certified and the transfer is covered. Contact us for information about the safeguards applicable to your data or to request a copy.
Your rights and privacy requests
Subject to applicable law, you can request access to your personal data, correction, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests and withdraw consent where it is the legal ground. These rights also apply to account-free recipients.
Email bothinto@indentstudio.io to make a request. Tell us which service you used and what you need, without sending sensitive answers or a complete invitation link. We may ask for proportionate information to verify your authority and locate the relevant data. We cannot supply another person’s response sheet and may be unable to identify temporary anonymous activity.
We normally respond within one month. If a lawful extension is needed because of complexity or the number of requests, we will explain it within that month. Some information may need to remain to satisfy legal obligations or protect legal claims.
You may complain to Hungary’s National Authority for Data Protection and Freedom of Information (NAIH), or the supervisory authority where you live or work or where an alleged infringement occurred. You do not have to contact us first.
Adults only and policy updates
BothInto is for adults aged 18 and over. Adult declarations are self-declarations, not identity or age verification. If you believe a child has provided personal data, contact us so we can investigate and remove it as appropriate.
We may update this policy when the service or our data practices change. The date at the top identifies the latest version. We will provide additional notice of material changes where required.