Suhrid Privacy Policy

Effective date: 2026-11-19 (published 2026-10-18) Version: 1.13

This is an English convenience translation. The German version (Datenschutzerklärung) is authoritative.

Suhrid is an app for meeting new people in person. You post what you want to do and where, nearby people who match your preferences can show interest, and once you accept someone you can chat. This policy explains, in plain language, what personal data we handle, why, and what rights you have. It is written to meet the transparency requirements of Articles 12–14 of the EU General Data Protection Regulation (GDPR).

Anyone aged 18 or over who lives or stays in the EU or EEA can register. Broadcasts and venues are currently available in Germany only. There is no location check at registration.

1. Who is responsible for your data (the "controller")

• Controller: Suhrid.de, Florian Berninger
• Address: Lehmkuhlen 4a, 25337 Elmshorn, Germany
• Email: support [at] suhrid [punkt] de
• Data protection contact: Florian Berninger, support [at] suhrid [punkt] de (no formal DPO is appointed; one is not required under Art. 37 GDPR / § 38 BDSG for an operation of this size)

The controller is the organisation that decides how and why your personal data is processed (Art. 4(7)).

2. The short version

• We only collect what the app needs to work. There are no third-party analytics, advertising or tracking SDKs — only our own data-minimising usage statistics (Section 3.14) in the app; for these the app reads nothing from your device. Crash reporting exists but is off unless you opt in (Section 3.8).
• Our website sets no cookies and embeds no analytics or tracking services — there is no cookie banner for you to dismiss (Section 3.13).
• Your chat messages are end-to-end encrypted. We do not read them and do not hand them over. So that your chats survive a forgotten password, we keep a sealed copy of your encryption key that only a separately secured recovery service can open (Section 7). Technically we could therefore decrypt messages in an exceptional case — we do not, and third parties cannot without both pieces (database and recovery key).
• Other users never see your exact date of birth — they see only your coarse age band (e.g. "26–35"). We store it in readable form for account administration and anonymous age statistics (Section 3.1).
• Your GPS position is never stored by us. To show you broadcasts nearby, the app sends a deliberately coarsened position (accurate to roughly 110 m) along with the feed request — it is used only to answer that request and is not saved (Section 3.3).
• Your profile includes one profile photo (exactly one, chosen by you). The check that it shows a face runs only on your device — there is no face recognition and no biometric matching, neither by us nor by third parties. Others see the photo on your profile, in requests and in chats, never in the broadcast feed (Section 3.1).
• Deleting your account immediately deletes your profile, profile photo, broadcasts, matches and messages. A few narrowly limited records are kept for a limited time (Section 4).

The rest of this policy is the detailed version of those statements.

3. What data we collect, why, and on what legal basis

The GDPR requires a legal basis for every use of personal data (Art. 6(1)). For most of what Suhrid does, the basis is that the processing is necessary to provide you the service you signed up for — Art. 6(1)(b) (performance of a contract). Where a different basis applies, we say so.

3.1 Account and profile data

When you register, we collect:

Legal basis: Art. 6(1)(b) — this data is necessary to create your account and provide matching, which is the core of the service.

Profile photo and face check: a profile photo is not required to register, but without a visible photo you cannot express interest in a broadcast — the person you would meet should know who is coming. Posting broadcasts works without one. Before a picture is uploaded, the app checks on your device that exactly one face is visible and that it is a colour photograph of a real face (not a drawing, cartoon, screenshot, statue or similar), crops the picture around the face and shrinks it. For this we use, on Android, Google's ML Kit face-detection and image-labelling libraries, which run entirely locally in the app (the models are delivered to your device through Google Play services); on iPhone and iPad the check is done by Apple's Vision framework built into iOS, likewise only on the device. On top of that comes a simple colour statistic of the face region; the picture does not leave your device for this. Face detection only returns the position of the face in the picture, labelling only generic picture categories (such as "drawing") — neither produces a biometric template or identifies anybody. We therefore do not process biometric data within the meaning of Art. 9(1) and perform no face recognition, neither on our servers nor through third parties. Pictures with no face or with several faces, and pictures that are not a photograph of a real face, are rejected by the app without being transmitted. The stored photo can only be fetched by signed-in users the app shows your profile to; users you have blocked or who have blocked you do not receive it, and the server authorises every fetch individually. When you replace the photo the previous one is deleted immediately, likewise when you remove it and when you delete your account. Our moderation team may view reported profile photos and remove them if they violate the Terms (Art. 6(1)(f) — platform safety, Child Safety Standards; for reports see Section 3.15). With Suhrid Plus you can hide your photo from everyone else (Section 3.9). Legal basis for the profile photo: Art. 6(1)(b).

Administration and statistics: your email address and date of birth are also stored in our profile database (alongside the sign-in system) so that our support/moderation team can administer your account and so we can compute aggregate, first-party statistics such as age distribution of our user base. Legal basis: Art. 6(1)(b) for account administration and Art. 6(1)(f) (legitimate interest in understanding and improving our own service) for the aggregate statistics. These fields are never visible to other users, are never shared with third parties, are included in the export from the app and in the copy we provide on request (Art. 15/20), and are deleted with your account (Art. 17). You may object to the statistics use at any time (Art. 21, Section 5) via support [at] suhrid [punkt] de.

Age confirmation: at registration you actively tick a checkbox confirming you are at least 18. Recording this confirmation serves as evidence that you meet the eligibility requirements (Art. 6(1)(b) and (f) — evidence and protection of minors; see Section 10). It is not consent: registration is not possible without the confirmation.

A note on personality answers and profile text: your free-text description and question answers are stored in readable form so matching can work, and both are visible to other users — your description and your answered questions (each answer picked from fixed multiple-choice options) appear on your profile. Please don't put sensitive information (for example about your health, religion, or sexual life — "special category" data under Art. 9) into free-text fields; we do not ask for it and do not want it.

3.2 Registration country

At registration the app sends a country once (two letters, e.g. "AT"): the country your app store account (Google Play or App Store) reports. If the store provides no country, no country is stored; since 30 September 2026 the app no longer reads the region set on your device for this. No location permission is needed and no location is determined. We also store where the value came from. For accounts created before 30 September 2026 this may still be the device region. The value is not verified.

Purpose: statistics on where new registrations come from, and documenting that registration is open to everyone in the EU/EEA (Regulation (EU) 2018/302). The country is never used to allow or refuse a registration.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Retention: on your profile until you delete your account or object (Section 5). In addition, the number of registrations per country and day is counted without any link to you; that number is kept permanently (Section 3.14).

3.3 Broadcasts, interests and matches

• Broadcasts: an activity, a venue name and address, a 2-hour time window and, optionally, a short note (free text, at most 20 characters, e.g. "casual get-together"). The note is part of the broadcast and visible to the same users as the activity and venue — so do not put personal data in it (names, phone numbers, addresses; contact details are rejected anyway). When you post, the text is automatically checked against a list of prohibited terms (abusive, sexual, discriminatory); on a hit the broadcast is not accepted and nothing is stored. The note is deleted together with the broadcast. When you type the address, the app suggests real addresses in Germany (see "Address search" below); you pick one, and the picked venue's coordinates are stored with the broadcast. These are the coordinates of the public venue you chose — never your own GPS position. Broadcasts are shown to users who fit your gender/age-band criteria and whose chosen search radius (adjustable in Settings; up to 10 km, with Plus up to 50 km — enforced by the server) around their own position covers the venue.
• Scheduled broadcasts (Plus): with the Plus subscription you can set the 2-hour window to start up to 24 hours in the future ("dinner at 19:00"). A scheduled broadcast is visible to other users from the moment you post it — be aware that you are announcing where you plan to be in advance. Its data is stored from posting until the end of the scheduled window (at most about 26 hours) and is then deleted by the same cleanup described in Section 4, unless it led to a match.
• Address search: as you type a venue address, the typed text is sent to the geocoding service Photon (operated by komoot GmbH, Germany; based on OpenStreetMap data — see Section 8) to fetch address suggestions. To rank nearby venues first, the app may also send one deliberately coarsened point (accurate to roughly 1 km) derived from your device position, plus a search area derived from it. Photon returns matching addresses; nothing about this lookup is stored in your Suhrid profile. How komoot handles this data is described in komoot's privacy policy.
• Your position for the feed ("nearby"): to decide which broadcasts are within your radius, the app sends your device position — coarsened to roughly 110 m — together with the feed request. It is used only to answer that request; it is not stored in the database, not added to your profile, and no history of your positions exists. If you deny or revoke the location permission, no location is accessed at all and the feed is switched off; the app shows an in-app notice explaining this, and you can re-enable the feed at any time by granting the permission (on Android: Settings → Apps → Permissions; on iPhone and iPad: Settings → Apps → Suhrid → Location).
• Interests: when you tap "interested" on someone's broadcast, the broadcast owner sees that.
• Matches: when a broadcast owner accepts an interest, a match is created and chat opens.

Legal basis: Art. 6(1)(b) — posting broadcasts (including geocoding the venue address you enter), showing you nearby broadcasts, expressing interest and matching is the service you signed up for.

3.4 Chat messages

Messages between matched users are end-to-end encrypted (details in Section 7). Our servers store only the encrypted message data plus the metadata needed to deliver it: who is in the match, and when messages were sent. We do not read message content; it could be decrypted only with the separately secured recovery key (Section 7), which we use exclusively for your own password recovery.

Legal basis: Art. 6(1)(b) — delivering your messages is part of the service.

3.5 Emails we send you

We send five kinds of account emails, all from tanja [at] suhrid [punkt] de via Brevo (Sendinblue GmbH; see Section 8): a one-time welcome email right after you register (in German or English, matching the language your device was set to at registration), which also confirms that the contract for the free use of Suhrid has been concluded and carries the withdrawal notice and the model withdrawal form as a PDF attachment, a verification code for your email address (after registration and, when you change your address in the app or after a change made by support, to the new address), a notice to your previous address once your email address has been changed, password-reset (recovery) emails when you request them, and moderation emails with the statement of reasons when we take a measure concerning your account or content, review or lift it, or decide on your complaint (Section 3.15). Brevo processes the recipient address and message content as our processor for the sole purpose of delivering the email. We do not send marketing emails, and the welcome email deliberately contains no advertising.

Email verification: you have to confirm your address with the code within 3 days; after that, signing in is blocked until you confirm it, and nothing is deleted. For this we store when you confirmed, or since when the address has been unconfirmed, and until confirmation (the code is valid for at most 24 hours) only a hash of the code, never the code itself. At registration and on an address change we also check the domain of your address against a list of disposable-address providers; addresses at our own domains are accepted neither at registration nor on an address change.

Changing your email address: you can change your email address in the app (Settings → Account & profile). For this we store the new address together with a hash of the code we send to it, until you enter the code. Because your keys are also derived from your email address (Section 7), the app re-derives them for the new address with your password and re-encrypts your master key; only then do we switch your sign-in and account to the new address, which then counts as confirmed. Afterwards we send a notice to your previous address that shows the new address only partially (e.g. "a***@example.org").

Legal basis: Art. 6(1)(b) — the welcome email confirms the start of your account; that it confirms the conclusion of the contract and provides the withdrawal notice on a durable medium is also required of us by § 312f(2) of the German Civil Code (BGB) (Art. 6(1)(c)). The verification code makes sure the address is yours and that we can reach you there, and you need to be able to recover your account through a password reset. Moderation emails fulfil our legal duty to state reasons (Art. 6(1)(c) GDPR with Art. 17 DSA). The check for disposable addresses additionally rests on our legitimate interest in preventing abuse and multiple accounts (Art. 6(1)(f)). The notice to your previous address lets you notice a change you did not make yourself and so protects your account against takeover (Art. 6(1)(b) and (f)).

3.6 Quick-message usage stats

The chat screen offers ready-made "quick reply" messages (grouped by topic — timing, location, greetings, and so on) you can tap instead of typing. When you tap one, we separately record which canned message (by category and a fixed internal id — not its text) you picked, so we can see which quick replies are actually useful and improve the set over time. This is aggregate usage data, not a copy of your conversation: we do not record which match or conversation it was used in, and it is never linked back to you through the app itself. It is not shown in the app; it is part of your data export ("Download my data") and of the copy we send you on request.

Legal basis: our legitimate interest (Art. 6(1)(f)) in understanding which quick replies are useful, so we can improve them.

3.7 Presence information

To operate the service we keep one small piece of technical information on your profile:

• When you last used the app — an approximate timestamp, updated at most every few minutes while you use Suhrid. It is set with our server's clock when the app contacts us; nothing is read from your device for it. Only the most recent timestamp exists; we do not keep a history of when you were online.

We use this to see how many people are using Suhrid. It is not location data, it is not a usage history, and it is deleted together with your account.

No device model any more: until 29 September 2026 the app also sent your device's model and operating-system version here. Since 30 September 2026 it no longer does, and our server does not store the value even if an older app version still sends it. All device models stored until then were deleted on 30 September 2026.

Legal basis: our legitimate interest (Art. 6(1)(f)) in operating and supporting the service.

3.8 Crash reporting (optional — only with your consent)

If — and only if — you opt in, the app sends crash reports to Google Firebase Crashlytics (Google Ireland Ltd. / Google LLC) so we can find and fix bugs. A crash report contains technical information about the crash: stack trace, device model, operating system version, app version, and a Crashlytics-internal installation identifier. It contains no profile data, no messages, and no location.

Crash reporting is off by default. You can enable it via the optional checkbox on the sign-in screen or in Settings → Privacy → Crash reporting, and you can withdraw consent at the same place at any time (Art. 7(3)); withdrawal also discards any crash reports queued on your device but not yet sent. The app sends nothing to Crashlytics while consent is absent.

Legal basis: your consent (Art. 6(1)(a)). Google acts as our processor (Art. 28); see Sections 8 and 9 for transfer details.

3.9 Plus subscription (Google Play / App Store)

If you subscribe to Suhrid Plus on an Android device, the purchase is handled entirely by Google Play: in the European Economic Area, Google Commerce Limited (Ireland) acts as the merchant of record and processes your payment and Google account data as an independent controller under the Google Play terms, the Google Privacy Policy and the Google Payments privacy notice. We never see or store your payment details (card numbers, bank data).

What we process ourselves, to give your account the Plus features and to prevent abuse:

• your pseudonymous account id, attached to the purchase as an "obfuscated account identifier" so Google's servers can tell ours which account a renewal belongs to
• the purchase token, order id, and subscription period Google reports to us — stored in a purchase ledger tied to your account
• the resulting Plus expiry date on your profile

We do not receive your name, address, or payment instrument from Google. For the data listed above that we receive from Google, we are the controller; Google is not our processor in this respect.

On an iPhone or iPad, Apple handles the purchase instead of Google. If you subscribe through the App Store, the purchase is handled entirely by Apple; in the European Economic Area, Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) acts as the merchant of record. Your payment contract is with Apple, and Apple processes your payment and Apple Account data as an independent controller under the Apple Privacy Policy. We never see or store your payment details. Apple is not our processor for the purchase either.

What Apple sends us, and what we process ourselves, is the same short list as for Google Play — only the names of the fields differ:

• a cryptographically signed transaction from Apple's servers, containing the transaction id, the original transaction id (the identifier of the first purchase in this subscription, which stays the same across renewals), the product identifier, and the expiry date of the current period
• the app account token — your pseudonymous account id, which our app attaches to the purchase before it is made, so that Apple's confirmations and renewal messages can be matched to your account
• the resulting Plus expiry date on your profile

We do not receive your name, address, payment instrument, Apple Account email address or any other Apple identifier. Our server checks Apple's signature itself, offline, against Apple's published root certificate; the Plus entitlement is granted by our server only, never by the app. Apple additionally notifies our server when the subscription renews, is cancelled, expires, or is refunded or revoked (App Store Server Notifications); those messages contain the same fields and no further personal data.

Because Apple, not we, is the merchant of record, only you can cancel an App Store subscription (Settings → your name (Apple Account) → Subscriptions). We have no interface at Apple to stop a renewal or issue a refund; refunds go through Apple's own request flow (reportaproblem.apple.com).

The purchase ledger (the same one for Google Play and App Store purchases) is deleted with your account (Art. 17). An administrator can also grant Plus free of charge for a limited period; in that case no data is shared with Google or Apple at all.

One of the Plus features is hiding your profile photo (Section 3.1): whether it is hidden is stored as a flag on your profile. A hidden photo is handed to no other user; it stays hidden after Plus ends until you make it visible again yourself.

Legal basis: performance of contract (Art. 6(1)(b)) — you asked for the subscription.

3.10 Inviting friends (referral links)

You can share a personal invite link (https://suhrid.app/share/<code>). The code is a random 8-character identifier tied to your account — it contains no personal data itself.

• Link clicks: when someone opens your link in a browser, we count one anonymous click — only the code and a timestamp are stored. No IP address, no browser information, nothing about the visitor. (As with any web page request, Cloudflare, which serves the invite page on suhrid.app, and our hosting provider Supabase technically process your IP address in doing so, Sections 3.13 and 8; we do not store it.)
• Registrations: if a new user installs the app through your link and registers, the new account is linked once to your code (pseudonymously, by account id) so we can count your successful invitations. Google Play passes the code to the app via the install referrer; we receive no data about the person from Google.
• On iPhone: if Suhrid is already installed, the link opens the app directly (universal link); the code is then only held on your device and linked at registration as described above. An install through the App Store cannot carry the code — Apple offers no install referrer; we receive no data about the person from Apple, and no attribution happens in that case.
• Campaign count: when we advertise Suhrid, we link to the app on Google Play and add campaign parameters (utm_source, utm_medium, utm_campaign, e.g. "instagram / social / autumn"). Google Play passes them to the app via the install referrer, just like the invite code. After you register, the app sends these three values and the platform (Android or iOS) to our server once; without such parameters the registration counts as "direct" (always on iPhone, except for an invite link). The server only increases an anonymous daily count per campaign from this, with no link to your account. So that the same registration cannot be counted twice, we only note on your account that it was counted, not which campaign; we delete this note 8 days after you registered. Click identifiers of ad networks (such as Google Ads' gclid) never leave your device, and the app still contains no advertising or tracking SDK. As with all daily counts: with very small numbers an inference via the registration date would theoretically be possible; we do not make such a link.
• Reward: once 5 friends have registered through your link, your account receives a one-time 30-day Plus period. This is granted automatically on our server.
• Deletion: if a referred account is deleted, its link to your code is removed immediately; only the anonymous count remains so an already granted reward stays accounted for. Your code and all its events are deleted with your account.

Legal basis: performance of contract (Art. 6(1)(b)) for operating the invitation feature you actively use. Click events without an IP address, device identifier or any other link to a person are not personal data (Art. 4(1)). The install referrer is handed to the app by Google Play on your device; Google does not process it on our behalf and is therefore not listed as a processor in Section 8. The same applies to Apple, which merely hands the link to the app on your device. For the campaign count the legal basis is our legitimate interest (Art. 6(1)(f)) in learning which advertising brings new users; only three campaign labels are processed, and only the anonymous daily count and the short-lived note are stored. You can object (Art. 21, Section 5); we then delete the note immediately.

3.11 Push notifications

If you allow notifications (the operating system asks for permission — on Android from version 13, on iPhone and iPad the first time; you can also control per-type toggles in Settings → Notifications), the app registers a push token with Google Firebase Cloud Messaging (FCM) so our server can notify you. Whether a notification is sent, and to whom, is decided by our server before sending — on Android just as on iPhone and iPad. The notifications themselves contain as little as possible:

• New message / new match: the notification contains only a type and the match id — no message text, no sender name. Google only learns "some message in some match"; your phone then fetches and decrypts locally.
• New broadcasts nearby: the notification contains only the type, the broadcast id, the activity and the venue name — neither who created the broadcast nor the venue's coordinates. Our server sends it only to people nearby whose criteria the broadcast meets and who are not blocked. We estimate the distance from a coarse area cell, so this is somewhat more generous than the feed — you may therefore be notified about a broadcast that your feed does not show you. In detail: the venue lies within their chosen radius (at most 10 km without Plus, at most 50 km with Plus; measured as described below), the person who created the broadcast matches the criteria the receiving person has set for meeting people, neither has blocked the other, and both accounts are active. From this Google only learns that this broadcast is relevant to the holder of this push token — that is, that their stored area is near the venue — but not who you are. You are not notified about your own broadcasts. This notification type is off by default.

So that our server can decide this, it stores next to your push token:

• your per-type choices — which of the three types are switched on, nothing more. We need them in order to be able not to send you something. They are deleted together with the token (on logout, when you switch every type off, and with your account).
• for "new broadcasts nearby", a coarse area cell and your chosen radius — the cell is a grid square of roughly 20 × 39 km (a 4-character geohash) that your app computes from your feed position coarsened to about 110 m; your actual position is never stored. Cell and radius are stored only while this notification type is switched on; switch it off and they are deleted immediately, as they are on logout and on account deletion. A new broadcast is compared against the centre of that grid square, not against where you are; so that you do not miss anything near the edge of your grid square, our server adds about 22 km (half the square's diagonal) to your radius.

The push token is a pseudonymous identifier stored on your profile (only you and our backend can access it); it is removed on logout and when every notification type is off, and deleted with your account.

Older app versions: until 2 October 2026, broadcast notifications on Android were sent over an FCM topic, and whether a broadcast was nearby was checked on the device. We no longer use that topic: an Android app version from before 3 October 2026 no longer receives broadcast notifications, and the current app unsubscribes from the topic after the update.

iPhone and iPad — Apple Push Notification service (APNs) as an additional transport: as on Android, we hand the notification to Google Firebase Cloud Messaging, which passes it on to Apple's push service, which delivers it to your device. Because Apple's push service cannot suppress a notification once delivered, its text is already part of the message: for new message and new match only a key such as "new message", and your device inserts the wording itself; for a nearby broadcast additionally the activity and the venue name, so they can be shown in the notification. On Android the app composes the text from the same details itself. Delivery to Apple devices is only possible through APNs; Apple (Apple Distribution International Ltd., Ireland, and Apple Inc., USA) operates this service under its own developer terms and is a recipient in doing so, not our processor (Sections 6, 8 and 9).

Legal basis: Art. 6(1)(b) — delivering the messages, matches and broadcast alerts you asked for; broadcast notifications (including cell and radius) are off until you enable them. Google acts as our processor for delivery (Sections 8 and 9); passing notifications on to Apple is necessary for delivery on iPhone and iPad.

3.12 Tester programme (form on suhrid.de)

If you sign up as a tester through the form on our website, we store your email address, the operating system you chose (Android or iOS), the city you entered and the language of the form. We use these details solely to send you access to the test version and to spread test places sensibly across cities and platforms. For every new sign-up our server notifies our team by email at bittedanke [at] suhrid [punkt] de — with your email address, platform, city, language and the time of sign-up; your address is set as the reply-to address so that we can answer you directly. This email is sent through Brevo (Section 8). The legal basis for storing and using your sign-up details is your consent given by submitting the form (Art. 6(1)(a)); you can withdraw it at any time by emailing bittedanke [at] suhrid [punkt] de — we will then delete your entry and also remove you from the tester list at Apple or Google.

When we invite you to test, we enter your email address as a tester with the respective platform — for iPhone and iPad in Apple's TestFlight, for Android in the tester list of a Google Play testing track; Apple or Google receive only this email address, no other details from your sign-up. Apple (Apple Distribution International Ltd., Ireland, and Apple Inc., USA) and Google (Google Ireland Ltd. and Google LLC, USA) each run their test programme as independent controllers under their own terms and privacy policies, not as our processors (Sections 6, 8 and 9). The legal basis for passing your email address on to Apple or Google when we invite you is Art. 6(1)(b): by signing up you asked to take part, and without this entry we cannot give you test access.

To prevent abuse we also process, for at most 24 hours, a salted hash of your IP address (not the address itself) to limit the number of sign-ups per connection (Art. 6(1)(f)). We delete sign-up data no later than three months after the test programme ends and by then also remove you from the tester list at Apple or Google; a test account in the app is then governed by this policy like any other account.

3.13 Website: cookies and browser storage

Our website suhrid.de sets no cookies. There is no analytics tool, no tag manager, no advertising or tracking pixel, and no embedded third-party content. The fonts are served from our own server too — opening the page makes no connection to Google Fonts or any other outside provider. That is also why there is no cookie banner here: there is simply nothing we would need to ask your consent for.

The website does keep three small entries in your browser's storage (localStorage and sessionStorage). They are strictly necessary for the features you asked for and are therefore exempt from consent under § 25(2) no. 2 TDDDG (the German implementation of the ePrivacy Directive). None of them contains an identifier, none is transmitted to us or to anyone else, and none allows you to be recognised:

You can delete these entries at any time through your browser settings ("clear site data"). The site keeps working exactly as before — it has simply forgotten your language choice and will show the tester form again.

Campaign parameters (utm_source and similar): if you reach us through a link carrying such parameters, they travel along in the address bar as you move between our pages; nothing is stored on your device for this. If you submit the tester form they are sent with it, so that we can see which campaign brings sign-ups. Our server keeps only an anonymous daily count per campaign from this — with no link to your sign-up, your email address or your device. How campaign parameters are counted when you register in the app is described in Section 3.10.

How the site is served: suhrid.de and suhrid.app (home of the invite pages from Section 3.10) are delivered through Cloudflare Pages (Cloudflare, Inc.). Like any web server, Cloudflare processes the connection data technically required to do so — in particular your IP address — in order to deliver the page to you and to fend off attacks; Sections 8 and 9 set out the detail. We do not evaluate this data and keep no access statistics. To block automated attacks Cloudflare may set its own, purely technical cookies (such as __cf_bm or cf_clearance); these serve security only, never analysis of your behaviour.

Legal basis: Art. 6(1)(f) — our legitimate interest in operating the website securely and reliably. The browser entries listed above are additionally covered by § 25(2) no. 2 TDDDG, which requires no consent for strictly necessary storage.

3.14 App usage statistics

To see whether Suhrid actually works — whether people come back, whether they find anyone, and where the app is too empty to be useful — we count how it is used. We do this without building a record of what you personally did.

What is stored about you: for each calendar day on which you used the app, two numbers on your account — how often the app contacted us because you brought it to the foreground, and how many separate sessions that was (a new session starts after a 30-minute break). Our server counts both with its own clock when the app contacts it; the app reads nothing from your device for this. Nothing else: no times of day, no sequence of actions, no screens you visited, no location, no time spent in the app, no device model. These numbers are deleted automatically after 90 days, and immediately if you delete your account.

No longer collected since 30 September 2026: until 29 September 2026 the app also measured how long it was open and sent that duration and the device model to us. Both were determined on your device and were not needed for the service (§ 25 TDDDG); the app no longer sends them, our server discards them if an older app version still does, and all time-in-app values and device models stored until then were deleted on 30 September 2026.

What is stored without any link to you: daily totals — registrations, broadcasts, interests, matches, messages, sign-ins, and, for broadcasts, the hour of day and the nearest larger city to the venue. We also keep a count of broadcasts per roughly 5.5 × 5.5 km square, for at most 90 days, to see which regions are active. These totals contain no identifier of any kind and we do not attribute them to anyone, which is why we keep the daily totals permanently.

Also counted, each without any link to you: registrations per country, account deletions per country, quick replies used, spam rules triggered, and how many accounts reached an activation step (opened the app, posted a broadcast, showed interest, matched, sent a message) for the first time. For the activation steps your profile remembers which steps have already been counted (so each counts only once); that marker is deleted with your account. Each night, daily figures (active accounts per day/week/month, activity distribution, weekly return rate per sign-up week) are also recorded as plain totals and shares. From the period up to 29 September 2026, plain totals on device models (only the first one per account) and on daily time in the app (distribution, median) also remain; no new values are added to them. None of these figures contains an identifier, we do not attribute them to any person, and they are kept permanently, also after you delete your account. Values below 5 are shown in the admin area only as "< 5". For very small numbers an inference cannot be ruled out entirely: a daily count of 1 (for example one account deletion in one country on one day) could in theory be connected with the deletion record (Section 4) or with an account's registration date. We do not make any such connection, and we delete the deletion record after 3 years.

Deliberate limits. The grid squares are never combined with the time of day, so no "who was where, when" can be reconstructed. Venue coordinates themselves are still deleted with the broadcast (Section 4) — only the anonymous square count remains. When we display the regional map internally, squares with fewer than five broadcasts are withheld entirely. And the sign-in count is taken from the authentication logs our hosting provider already keeps (Section 4); we copy only the daily total, never an IP address.

No third-party analytics. All of this is counted on our own database. No analytics SDK, no tracking pixel, no advertising identifier, and nothing is shared with anyone.

Legal basis: our legitimate interest (Art. 6(1)(f)) in understanding and improving a service we operate. Processing personal data for statistical purposes is expressly a compatible further purpose under Art. 5(1)(b) and Art. 89(1), and the safeguards Art. 89(1) requires are the ones described above: counters instead of event logs, a 90-day limit, and aggregation. Because the app neither stores anything on your device nor reads anything from it for these statistics, no consent under § 25(1) TDDDG is required. You can object at any time under Art. 21 (Section 5), without having to give reasons: write to support [at] suhrid [punkt] de. We then set an objection flag on your account; this deletes the per-account counters described above, stops recording them for your account and also deletes the marker of which activation steps have already been counted for your account. Your account is then no longer counted in the activation steps either. (The anonymous daily totals carry no link to you, so there is nothing in them to withdraw.)

3.15 Reports, blocks and abuse protection

Reports. If you report a profile, a chat or a broadcast, we store who reported whom or what, the reason, the context (profile, chat with its match id, or broadcast), the time and your optional comment (at most 500 characters); for a broadcast also its public details (activity, venue name, short note, start time, no coordinates), because the broadcast itself is deleted after a short time. Message content is never part of a report. The reported person does not learn who reported them. Reports about you come from other users (Art. 14); only our moderation team sees them.

Blocks. If you block someone, we store who blocked whom and when, so that you no longer see each other and can no longer write to each other.

Automated abuse protection. Our server detects spam patterns — for example contact details in a username, profile text or venue, or very many broadcasts, interests or messages in a short time — and records the triggered rule together with the triggering details on your account. Such a hit suspends the account automatically and provisionally. An account is likewise suspended automatically and provisionally when reports from other users reach a set threshold: each report is weighted by its reason ("underage" highest), only reports from the last 30 days by accounts that are themselves active count (after a suspension has been lifted, only those received since), and each person can report an account only once. A broadcast reported by several users is automatically taken out of the feed. Section 11 explains how to have such a decision reviewed by a human.

Moderation decisions and statements of reasons. For every measure we take against your account or your content (suspension, hiding or deleting a broadcast, removing the profile photo, changing the username or profile text) and for every lift we store a decision record: decision ID, account ID, type and object of the measure, rule and Terms section, the facts communicated to you, whether reports were involved and whether the decision was automated, its status (provisional, confirmed, lifted), who on our moderation team decided or reviewed it (when, with an internal note), the delivery status of the email, and your complaint (date received, summary, outcome). We send you the statement of reasons by email via Brevo (Section 8); for an account suspension the app shows it as well, and measures concerning your content also appear in your in-app inbox. No statement of reasons ever names who reported you.

Evidence preservation when an account is deleted. If your account is deleted after a report about you or a moderation decision in the last 6 months, we keep an extract: account ID, username and profile text at the time of deletion, the reports about you (reason, context, comment, a broadcast's public details, time — without the identity of the reporting persons) and the IDs of the decisions. Profile photo and chats are never part of it.

Legal basis (moderation): Art. 6(1)(c) GDPR with Art. 17 DSA for the decision record and the statement of reasons; Art. 6(1)(f) for handling complaints and for preserving evidence (defence of legal claims, Art. 17(3)(e) GDPR).

Retention (moderation): decision records and evidence extracts are deleted automatically 6 months after the last event (decision, review, delivery, complaint; for an extract no earlier than 6 months after the account was deleted) — also if your account has already been deleted. A suspension still in force and an open complaint keep the record for as long as they last. Longer only if we must preserve it for specific legal proceedings (legal hold, until the proceedings end).

Legal basis: Art. 6(1)(f) — our and our users' legitimate interest in a safe platform, in protecting minors and in enforcing the Terms; for automatic suspension see Section 11 (Art. 22(2)(a)).

Retention: reports until we dismiss them as unfounded or one of the accounts involved is deleted (for the evidence extract see above); blocks until you lift them or one of the two accounts is deleted; spam records until your account is deleted.

3.16 Acceptance of the Terms of Service and this Privacy Policy

When you register, confirm a new version of the Terms of Service or of this policy in the app, or keep using Suhrid after the effective date of a non-material change, we store on your account which version you accepted or acknowledged, when, and how (registration, notice, blocking screen, continued use). For accounts that already existed when this feature was introduced, we recorded the versions then in force (Terms 1.9, Privacy Policy 1.8) as the starting point.

Purpose: proof of which terms apply to you. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) (our legitimate interest in being able to prove the applicable version). Retention: until you delete your account.

3.17 What we do NOT collect

• No third-party analytics or ad SDKs; crash reporting only with your explicit opt-in consent (Section 3.8)
• No advertising identifiers
• No background or continuous location tracking
• No contacts, no device model (since 30 September 2026, Section 3.7) and no other device data — except in voluntary crash reports (Section 3.8); of your photos only the one profile photo you pick yourself through the system picker — the app does not access your gallery (Section 3.1)

4. How long we keep your data (retention)

We keep personal data no longer than necessary (Art. 5(1)(e)):

• Almost everything is tied to your account. When you delete your account (Settings → "Delete account"), your profile, profile photo, all your broadcasts, all interests and matches, and all your messages are permanently and immediately deleted from the database and the file store, as are the push token, purchase ledger, usage counters, reports, blocks and spam records relating to your account. This is a hard delete — there is no soft-delete or grace period, and it cannot be undone.

• What remains after account deletion: (a) your username on a block list for 28 days, so that nobody immediately re-registers under your name and is mistaken for you by your former contacts; (b) a deletion record consisting of the pseudonymous account id, the registration and deletion time and how the account was deleted (by you or by us); (c) entries in the log of our admin portal showing which administrator took which action on your account and when, without the changed content; (d) if there was a report about you or a moderation decision in the last 6 months, the moderation decisions and an evidence extract (Section 3.15), which we delete 6 months after the last event. We delete (b) and (c) after 3 years (the standard limitation period, § 195 BGB). Purpose: evidence of the deletion and defence against claims (Art. 5(2), Art. 17(3)(e) GDPR); legal basis Art. 6(1)(f). In addition your country remains part of the anonymous daily count of account deletions per country (Section 3.14).

• Profile photo: kept until you replace it (the previous photo is deleted immediately), remove it, or delete your account.

• Broadcasts: a broadcast disappears from active listings when its 2-hour window ends, and an hourly cleanup job then actually deletes the expired record (including the venue name, address and coordinates) unless the broadcast led to a match. A matched broadcast is kept as part of the match's history and is deleted together with the match or your account. For a scheduled broadcast (Plus, Section 3.3) the same applies at the end of its scheduled window — total storage from posting is at most about 26 hours (up to 24 hours lead time plus the 2-hour window); the maximum window length is enforced by the server.

• Messages: encrypted messages are kept so your chat history works, until the account (or the match's data via account deletion) is deleted.

• Confirmation records (e.g. your 18+ confirmation) are kept for the life of the account as evidence of eligibility.

• Email verification (Section 3.5): the hash of a verification code is deleted immediately on successful confirmation, and an expired code (valid for at most 24 hours) no later than 7 days after it expired; the time of confirmation is kept for the life of the account.

• Email address change (Section 3.5): the new address you entered and the hash of the code are deleted as soon as the change is complete; an unfinished request no later than 7 days after the code expired (valid for at most 24 hours), and in any case with your account.

• Reports, blocks, spam records and moderation decisions: see Section 3.15.

• Technical authentication logs: our hosting provider's sign-in system (Supabase Auth) keeps internal technical logs of authentication events (e.g. sign-ins, password resets) for up to 28 days before automatic deletion. They contain no profile content and are used only for security and operations.

• Campaign count (Section 3.10): the note that your account was counted is deleted 8 days after you registered, at the latest with your account. The anonymous daily counts per campaign contain no personal data and are kept without time limit.

• Usage counters (Section 3.14): the two per-day counters held on your account are deleted automatically 90 days after the day they describe, and immediately when you delete your account or object under Art. 21. The regional grid counts are also deleted after 90 days. Anonymous daily totals and nightly figures (Section 3.14) contain no personal data (Art. 4(1), Recital 26) and are kept without time limit, also after you delete your account.

• Device model and time in app (Sections 3.7 and 3.14): no longer collected since 30 September 2026; all values stored until then were deleted on 30 September 2026.

• Acceptance of the Terms and this policy (section 3.16): until you delete your account.

5. Your rights

Right to object (Art. 21 GDPR). Where we process data on the basis of legitimate interests (Art. 6(1)(f) — in particular Sections 3.1 age statistics, 3.2 registration country, 3.5 disposable-address check, 3.6, 3.7, 3.14 and 3.15), you may object to that processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. For the statistics (Sections 3.1, 3.2, 3.6 and 3.14) we do not require you to give reasons. Just write to support [at] suhrid [punkt] de. We implement an objection to the usage statistics (Section 3.14) through an objection flag on your account, which deletes the per-account counters and stops them from being recorded; for the other processing we will tell you how we comply with your objection.

You have the following rights under the GDPR, all free of charge. We will respond within one month (Art. 12(3)); if a request is unusually complex we may extend by up to two further months and will tell you why within the first month.

• Access (Art. 15): ask us what data we hold about you and get a copy.
• Rectification (Art. 16): have inaccurate data corrected. You can edit most profile data directly in the app, including your email address.
• Erasure / "right to be forgotten" (Art. 17): have your data deleted. The in-app Settings → "Delete account" does this yourself, immediately, at any time; Section 4 lists the few records that remain for a limited time afterwards.
• Data portability (Art. 20): receive your data in a portable, machine-readable format. The in-app Settings → Account & profile → "Download my data" export contains everything we store on our servers for your account — profile, broadcasts, interests, matches, blocks, reports, moderation decisions, acceptances of the Terms of Service and this Privacy Policy, inbox, purchases, referrals, usage counters, spam and quick-reply records, push settings, and admin actions on your account — plus your profile photo and your own decrypted messages. Reports against you contain the reason, area and date, but no information about the reporting person; blocks by others appear only as a count. Data we still keep after account deletion (deletion record, moderation decisions and evidence, admin portal log) is provided on request at support [at] suhrid [punkt] de.
• Restriction of processing (Art. 18): ask us to freeze processing of your data, e.g. while a dispute about its accuracy is resolved.
• Objection (Art. 21): object to processing based on legitimate interests (e.g. the usage statistics, Section 3.14) — details in the highlighted notice above.
• Withdraw consent (Art. 7(3)): where processing is based on consent, you can withdraw it at any time; this does not affect processing that happened before withdrawal.
• Complain to a supervisory authority (Art. 77): you can lodge a complaint with a data protection authority, in particular the authority of the German federal state where you live. The competent authority for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, www.datenschutzzentrum.de.

To exercise any right you cannot handle in-app, email support [at] suhrid [punkt] de. We will verify that the request really comes from the account holder (proportionately — Art. 12(6)) before acting on it.

Important limitation we want to be honest about: messages are end-to-end encrypted; they are decrypted only inside the app on your device. We, the operator, do not provide your messages in readable form outside the app; the export from the app contains them in plain text — keep the file safe. "Forgot password" restores your key after confirmation by e-mail code, so your chats are kept (Section 7). If you lose access to your e-mail address, encrypted content may be permanently unrecoverable.

6. Who receives your data

• Other users: your username, profile photo (if you have one and do not hide it), age band, gender, profile description, your answers to the matching questions (with your favourites marked) and a match percentage comparing the viewer's answers with yours are visible to other signed-in users the app shows you to; your broadcasts are visible to nearby users matching your criteria.
• Supabase (our hosting/backend provider) — see Sections 8 and 9.
• Brevo (email delivery) — your email address and the content of the account emails we send you (welcome email with contract confirmation, verification codes, the notice after an address change, password resets, moderation emails), and, after a tester sign-up, the internal notification to our team (Sections 3.5, 3.12 and 8).
• Cloudflare (delivery of our websites and our admin portal) — when you open suhrid.de or an invite page on suhrid.app in a browser: the connection data technically required for each page request, in particular your IP address (Sections 3.13, 8 and 9). Also, when our support or moderation team opens or edits your account in our admin portal: the account, profile and report data displayed (Section 8). The app's own requests do not go through Cloudflare.
• Google (Firebase Cloud Messaging) — if you enabled notifications: the pseudonymous push token and the notifications described in Section 3.11 (content-free for messages and matches; for broadcasts, the activity and venue name).
• Google (Firebase Crashlytics) — only if you opted in to crash reporting (Section 3.8), and only the technical crash data described there.
• Apple (push delivery on iPhone/iPad) — if you allow notifications there: the push token and the notification content described in Section 3.11, passed via Firebase Cloud Messaging to the Apple Push Notification service.
• Google or Apple as merchant — only if you buy Plus: the stores are independently responsible for the purchase; we receive from them only the purchase data listed in Section 3.9.
• Apple or Google for the tester programme — only if we invite you to test after you signed up through our website form: your email address, entered in TestFlight or in the Google Play tester list; both are independently responsible for this (Section 3.12).
• komoot (Photon address search) — only when you type a venue address while creating a broadcast: the typed search text and, optionally, one coarsened (~1 km) point for ranking (Section 3.3).
• Nobody else. We do not sell data, share it with advertisers, or pass it to analytics companies.

We would disclose data to authorities only where legally obliged (Art. 6(1)(c)). Message content is stored with us exclusively in encrypted form; decryption would be conceivable only with the separately secured recovery key (Section 7) and only under a legally binding order.

7. Security (Art. 32)

• End-to-end encryption of messages: chats are sealed with modern, audited encryption (libsodium XChaCha20-Poly1305). In plain terms: each message is locked on your phone before it is sent, and only your match's phone has the key to unlock it. Our servers only ever see locked boxes — the sole exception is the sealed key copy for password recovery (below).
• Keys derived from your password: your encryption keys are derived on your device from your own password (and your email address) using Argon2id — a deliberately slow mathematical process that makes password-guessing attacks impractical. If you sign in with your email address, your password itself never leaves your device in usable form for decryption purposes. If you sign in with your username, the app sends the password over an encrypted connection (TLS) to our own server function for username sign-in, which checks it before returning your account's email address to the app, and neither stores nor logs it. If you change your email address in the app, the app sends not your password but the two sign-in keys derived from it (for the old and the new address) and your re-encrypted master key to our own server function for the address change, which checks the old sign-in key and registers only the new one with the sign-in system.
• Device-bound keys: per-device master and identity keys are stored only on your device, protected by the Android Keystore (hardware-backed secure storage where available) or, on iPhone and iPad, by the iOS Keychain.
• Key recovery for a forgotten password: so that your chats are not lost, the app additionally seals your master key to a Suhrid recovery public key (libsodium sealed box) and stores that copy in your profile. The matching private key exists only in a separately secured recovery service, not in the database. It is used only when you use "Forgot password" and have confirmed the code sent to your e-mail address — and only within a few minutes of that confirmation. Legal basis: performance of the contract (Art. 6(1)(b)), to preserve your chat history. Consequence: anyone with access to your e-mail mailbox could obtain your key this way — protect your mailbox accordingly. The sealed copy is deleted together with your account (Art. 17).
• Date of birth: your exact birth date is additionally stored end-to-end encrypted in your profile record; the server keeps a readable copy for account administration and age statistics (Section 3.1). Other users only ever see your coarse age band.
• Profile photo: like your username, description and answers, your profile photo is not end-to-end encrypted, because we could not review reported pictures otherwise (Child Safety Standards). It lives in a private file store that authorises every fetch individually: only signed-in users the app shows your profile to receive the current photo; hidden, replaced and deleted photos cannot be fetched. The face check runs only on your device (Section 3.1).
• No trackers: no third-party analytics/ad/tracking SDK is integrated. Crashlytics is disabled by design until you opt in (Art. 25 — data protection by design and by default). The picture check (face, picture category) runs on Android with the locally running ML Kit libraries and on iPhone and iPad with Apple's built-in Vision framework; it transmits nothing.
• Transport encryption (TLS) protects all communication between the app and our servers.

8. Our service providers (processors) and other recipients

We use Supabase (Postgres database, authentication, realtime infrastructure, file storage for profile photos) to run Suhrid's backend. Supabase processes data on our behalf as a processor under a data processing agreement (Art. 28).

• Hosting region: our Supabase project runs in the EU (AWS region eu-west-1, Ireland); Amazon Web Services acts as Supabase's hosting sub-processor there. Supabase Inc. is a US company — for any access from outside the EEA (e.g. support), the safeguards in Section 9 apply.

We use Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany) as a processor (Art. 28) for email delivery: welcome emails, verification codes, notices after an address change, moderation emails and password-reset emails are sent as tanja [at] suhrid [punkt] de through Brevo's SMTP relay, under Brevo's Data Processing Agreement. Brevo also delivers the internal notification about new tester sign-ups to our team (Section 3.12). Brevo processes your email address and the email content only to deliver the message, on servers located in the EU.

We use Google (Google Ireland Ltd., with Google LLC as sub-processor) as a processor (Art. 28) for two Firebase services, both under the Firebase Data Processing and Security Terms: push notification delivery (Firebase Cloud Messaging — the pseudonymous push token and the notifications described in Section 3.11: content-free for messages and matches; for broadcasts, the activity and venue name) and crash reporting (only if you opted in, Section 3.8) via Firebase Crashlytics.

We use Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) as a processor (Art. 28) for two purposes, both under the Data Processing Addendum incorporated into the Cloudflare terms for our account:

• Delivering our websites suhrid.de and suhrid.app via Cloudflare Pages. In doing so Cloudflare processes the connection data technically required for every page request — in particular your IP address, the address requested, the time and your browser identification — in order to serve the page and to fend off attacks.
• Our internal admin portal for support and moderation, which runs on Cloudflare Workers and is secured by Cloudflare Access (only individually authorised administrators can sign in). When an administrator opens or edits an account there, the account, profile and report data displayed (e.g. email address, username, date of birth, profile photo, reports, data exports) passes through Cloudflare. Cloudflare processes it only to deliver it; technical logs of the admin portal (such as the address requested and the time) are kept by Cloudflare for only a few days.

Cloudflare normally answers a request from the nearest data centre, so for Europe usually one inside the EU; we have not booked a contractual guarantee of EU-only data centres, so access from the USA cannot be ruled out (Section 9). The app's own requests do not go through Cloudflare — they go straight to Supabase.

We use Photon (a geocoding service operated by komoot GmbH, Potsdam, Germany, based on OpenStreetMap data) for the venue address search when you create a broadcast (Section 3.3). What reaches Photon: the address text you type, optionally one coarsened (~1 km) ranking point, and — technically unavoidable for any web request — your IP address. Processing takes place in the EU. komoot operates Photon as a public, free-of-charge service on its own responsibility (an independent controller under Art. 4(7), not a processor — there is no instruction relationship and no Art. 28 contract). We transmit only the data listed, keep nothing from the response except the address you select, and rely on Art. 6(1)(b) for the transmission (the address search is part of the broadcast creation you initiated). Details: komoot's privacy policy.

Apple is not our processor, but receives data in three cases — in the first two when you use Suhrid on an iPhone or iPad:

• Push delivery (Section 3.11): to deliver push notifications to iPhone and iPad, Firebase Cloud Messaging passes the notification on to the Apple Push Notification service (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, and Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA). Apple operates this service under its own developer terms; delivery to Apple devices is only possible this way. The legal basis is Art. 6(1)(b).
• Buying Plus in the App Store (Section 3.9): Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) is an independent controller as merchant of record.
• Tester programme (Section 3.12): if we invite you to test on iPhone and iPad, we enter your email address in Apple's TestFlight; Apple is an independent controller for TestFlight. The legal basis is Art. 6(1)(b).

Google receives your email address outside its role as our processor when we enter you as an Android tester in the tester list of a Google Play testing track (Section 3.12); Google is an independent controller for the Google Play test programme. The legal basis is Art. 6(1)(b).

The face check with Apple's Vision framework and key storage in the iOS Keychain run only on your device; Apple receives no data from us in doing so.

9. International data transfers

Where our service providers, their sub-processors or the recipients named below process data outside the European Economic Area, we rely on the safeguards of GDPR Chapter V (Art. 44–49) — an adequacy decision (Art. 45) or Standard Contractual Clauses (Art. 46(2)(c)), as applicable.

• Database and backend hosting (Supabase): all data is stored in the EU (AWS eu-west-1, Ireland). Supabase Inc. (USA) is bound by Standard Contractual Clauses (Art. 46(2)(c)) for any access from outside the EEA.
• Website and admin portal delivery (Sections 3.13 and 8): Cloudflare, Inc. is a US company. A request from Europe is usually answered by a data centre in the EU, but access from the USA cannot be ruled out. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework (adequacy decision, Art. 45); the Standard Contractual Clauses (Art. 46(2)(c)) in the Cloudflare Data Processing Addendum apply as fallback. This concerns visits to our websites and our team's access through the admin portal, not the app's requests.
• Email delivery (Section 3.5): Brevo (Sendinblue GmbH) is a German company and processes email data on servers in the EU — no third-country transfer.
• Venue address search (Section 3.3): Photon is operated by komoot GmbH, a German company, and processes lookups in the EU — no third-country transfer.
• Push notifications (Section 3.11) and crash reporting (only with your consent, Section 3.8): Google may process this data in the USA. Google LLC is certified under the EU–US Data Privacy Framework (adequacy decision, Art. 45); Standard Contractual Clauses (Art. 46(2)(c)) apply as fallback: should the adequacy decision lapse, the transfer continues without interruption on those clauses.
• Push delivery on iPhone and iPad (Sections 3.11 and 8): Apple may process this data in the USA (Apple Inc.). According to Apple, transfers of personal data from the EEA are governed by Standard Contractual Clauses (Art. 46(2)(c)). For App Store purchases (Section 3.9) Apple is an independent controller; Apple's own statements in the Apple Privacy Policy apply.
• Tester programme (Sections 3.12 and 8): Apple and Google are independent controllers for their test programmes and may process the email address in the USA (Apple Inc., Google LLC). Google LLC is certified under the EU–US Data Privacy Framework (adequacy decision, Art. 45); for Apple, Apple's own statements in the Apple Privacy Policy apply.

Note that even in a transfer scenario, your message content remains end-to-end encrypted; the recovery key (Section 7) is not transferred, so the content is unreadable to the recipient.

10. Children and minimum age

Suhrid is strictly for adults: you must be at least 18 years old. Age is self-declared via your date of birth at registration, together with an explicit confirmation checkbox. We do not knowingly process data of anyone under 18; if we learn that a user is under 18, we will delete the account. Parents or guardians who believe a minor is using the service should contact support [at] suhrid [punkt] de.

11. Automated decision-making

Matching suggestions are based on the criteria and question answers you provide. The match percentage shown in the app is a simple, transparent calculation: the share of questions you and the other user answered identically, among the questions you both answered, where a question counts once, plus once more for each of you who marked it as a favorite (it is hidden when you share fewer than three answered questions; on feed cards and in request lists it is additionally hidden below 70%, while a person's profile page shows the full value). It is informational only — it does not rank, filter, or hide anyone, and every decision (showing interest, accepting a match) is made by you.

Automatic provisional suspension. If reports from other users (weighted by reason — "underage" highest — counting only reports from the last 30 days by active accounts) or automatically detected spam patterns bring an account to a set threshold, the account is suspended automatically and provisionally; a human reviews the suspension within 7 days and confirms or lifts it, and you learn the reasons by email and in the app (Section 3.15); a broadcast reported by several users is hidden automatically (Section 3.15). This is necessary to protect users and to perform the contract (Art. 22(2)(a)). You can at any time ask at support [at] suhrid [punkt] de for a human to review the decision, express your point of view and contest the decision (Art. 22(3)). Beyond that, Suhrid does not make solely automated decisions with legal or similarly significant effects on you within the meaning of Art. 22.

12. Changes to this policy

We announce new versions of this policy in the app at least 30 days before their effective date, with a short summary and a link to the full text, and update the date at the top. We store which version you acknowledged and when, as described in Section 3.16.

13. Contact

• Controller: Suhrid.de, Florian Berninger, Lehmkuhlen 4a, 25337 Elmshorn, Germany
• Support: support [at] suhrid [punkt] de
• Data protection contact: Florian Berninger, support [at] suhrid [punkt] de