Privacy Policy

The short version

1. Who we are

Slowburn is a dating app for adults (18+) published by nStudio (Nagy Tamás, Hungary, nstudio.hu). nStudio is the data controller for the personal data described here.

Contact for any privacy question or request: [email protected].

2. What we collect

Data	Why
Email address and password (the password is stored only as a secure hash)	To create and secure your account and let you sign in.
Birthdate	To confirm you are 18 or older and to show your age on your profile. Other users see your age, never your birthdate.
Name, gender, who you are interested in, bio, interests, city (optional)	To build your profile and to show you people you might match with, and show you to them.
Photos (1–6, chosen from your photo library or taken with your camera)	To show on your profile.
Likes and passes	To create a match when two people like each other, and to avoid showing you the same person twice. Nobody can see who liked them.
Matches and messages	To let you chat 1:1 with your matches.
Reports and blocks (who reported or blocked whom, the reason, optional details, and the reported message if any)	To keep the community safe, review reports and remove abusive users.
Push notification token (only if you allow notifications)	To notify you about new matches and messages. Notifications never include the text of a message.
Automated photo screening results	Every profile photo is checked automatically for nudity. A flagged photo is hidden from other users until a person on our team reviews it.
Acceptance of the Terms (a timestamp)	To record that you agreed to our Terms of Use.
Technical data (IP address and request logs kept by our hosting provider)	To operate, secure and debug the service.

We only access your photo library or camera when you choose to add a photo, and only the photos you pick are uploaded. We do not collect your precise location, contacts, advertising identifiers, or health data. The app contains no advertising, analytics or tracking SDKs. It includes OneSignal's push notification SDK only to deliver notifications, with its location features disabled.

3. Sensitive data and your explicit consent

Your gender and the genders you are interested in can reveal information about your sex life or sexual orientation, which is a special category of data under Article 9 of the EU General Data Protection Regulation (GDPR). We process it only because you choose to provide it, on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give when you create your profile. This data is used only to match you with people, and is never used for advertising or shared for any other purpose.

You can withdraw consent at any time by changing these fields or by deleting your account. Because matching cannot work without them, withdrawing consent completely means deleting your account.

4. Legal bases

• Contract (Art. 6(1)(b) GDPR): running your account, profile, matching and chat.
• Explicit consent (Art. 9(2)(a) GDPR): gender and interest-in preferences (see section 3).
• Legitimate interests (Art. 6(1)(f) GDPR): keeping the service safe, handling reports and blocks, preventing abuse and fraud, and security logs.
• Legal obligation (Art. 6(1)(c) GDPR): responding to lawful requests from authorities.

5. Who can see your data

• Other users who are shown your profile see your name, age, gender, bio, interests, city (if given) and photos. Only your matches can message you or see the messages you send them.
• Photos are stored at long, random, unguessable web addresses so the app can load them quickly. Anyone who obtains the exact address of a photo could open it, so only upload photos you are comfortable showing on a dating profile.
• Users you block no longer see you, and you no longer see them.
• Us, when reviewing reports or answering your requests.
• Our processor, Supabase (Supabase, Inc.), which hosts our database, authentication, and file storage. Your data is stored in Supabase's European Union region (Ireland). Supabase acts only on our instructions under a data processing agreement. Where Supabase staff or sub-processors outside the EU/EEA could access data (for example for support), the transfer is protected by the European Commission's Standard Contractual Clauses.
• OneSignal (OneSignal, Inc., USA), which delivers push notifications. It receives your push token, an internal user ID and the notification text (for example "It's a match!"), never your messages. Transfers to the USA are covered by the EU–US Data Privacy Framework and Standard Contractual Clauses. When you delete your account we delete your OneSignal record too.
• Our photo-screening server, run by us on Hetzner in the European Union, which receives each new profile photo, checks it and keeps nothing.
• Resend (Resend, Inc., USA), which sends our account emails such as password-reset codes. It receives your email address and the email content. Transfers are covered by Standard Contractual Clauses.
• Authorities, only where the law requires it.

We do not sell or rent your personal data and we do not share it with advertisers or data brokers.

6. How long we keep it

• While your account exists, we keep your account, profile, photos, likes, matches and messages.
• When you unmatch someone, the match and the whole conversation are deleted for both of you.
• When you delete your account, your account, profile, photos, likes, matches, messages and blocks are deleted immediately. Backups held by our hosting provider roll over and are overwritten within about 7 days (longer only if our provider's backup schedule requires it).
• Reports are kept for up to 12 months after they are resolved so we can recognise repeat abuse, but once your account is deleted they are no longer linked to your account.
• Server logs are kept by our hosting provider for a short period (typically days) for security.

7. Deleting your account

Open the app and go to the Me tab → Delete account. Confirm, and your account and data are deleted as described above. If you can no longer access the app, email [email protected] from the address you signed up with and we will delete it for you.

8. Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time (without affecting processing done before). Most of this you can do in the app yourself (edit your profile, delete your account). For anything else, email [email protected]; we will answer within one month.

You also have the right to lodge a complaint with a supervisory authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu), or the authority in the EU country where you live.

9. Age limit

Slowburn is only for people aged 18 or over. We check your birthdate when you sign up and do not knowingly collect data from anyone under 18. If you believe a minor is using Slowburn, report the profile in the app or email us, and we will remove the account.

10. Security

All traffic between the app and our servers is encrypted (HTTPS/TLS). Access to data is restricted by database-level security rules so each user can only reach what the app is meant to show them. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the authorities as the law requires.

11. Changes

If we change this policy, we will update the date above and, for significant changes, tell you in the app before they take effect.

12. Contact

nStudio – Nagy Tamás
Email: [email protected]
Web: nstudio.hu