1. Information we collect
We collect information you provide and information generated through your use of the Hearthly mobile app and website.
- Personal information: Name, email address, date of birth, gender identity, sexual orientation
- Profile data: Photos, bio, interests, preferences, questionnaire responses
- Location data: The location you enter and, when permitted, GPS coordinates used for proximity matching and location features
- Messages and interactions: Chat messages between matched users, likes, matches, blocks, and reports
- Device information: Device type, operating system, IP address, browser type
- Operational data needed for core features, service security, and troubleshooting. Optional page-view, marketing, and performance analytics is not collected
- Camera access: QR code scanning when you choose to use this feature (no photos stored from QR scanner)
- Optional activity-map signals: If you turn contribution on, eligible searches and mutual match acceptances are converted to a coarse map cell without storing your user ID, match ID, or exact coordinates in the signal
- Google Play Premium purchase data when you make or restore a purchase: product, hashed purchase-token reference, order reference, subscription status, renewal status, expiry, and verification history. Hearthly does not receive or store your payment-card or bank-account details
- Vipps login: If you choose Vipps, we receive your verified name, email address, and date of birth, the gender you selected in Vipps, a pseudonymous technical login identifier, and the time of your latest authentication. We do not store the raw Vipps subject or Vipps tokens. We do not ask Vipps for your phone number, address, or national identity number. Vipps Login is used for sign-in, not payment
2. How we use information
We use your information to operate, improve, and personalize Hearthly.
- Provide core dating services and facilitate connections
- Run our compatibility matching algorithm and, where enabled, generate AI-assisted profile, match-insight, and game content
- Display your profile to other users based on match criteria
- Enable chat messaging between matched users
- Send push notifications about new matches and messages (with your permission)
- Provide safety features including reporting and blocking
- Personalize your experience and recommend relevant matches
- Improve service stability and features using necessary operational data. Optional page-view, marketing, and performance analytics is disabled until we can obtain consent
- Prevent fraud, abuse, spam, and violations of our Community Guidelines
- Comply with legal obligations and respond to legal requests
- Communicate important updates, security alerts, and support messages
- If you opt in, show coarse activity bands after a 30–45 minute delay and only where at least 10 different contributors are represented
- Process purchases, deliver Premium or tickets, and handle renewals, refunds, and related customer support
- Use information from Vipps to sign you in and check that you meet the age requirement. On first sign-in, the verified email address may be used to recognize and connect one existing, confirmed Hearthly account. Your verified name may initialize a new profile but never replaces an existing name. Date of birth and gender are retained in the protected Vipps login record; they are copied into your profile or questionnaire only after you confirm them in onboarding
3. How we share information
We share your information only as described below. We never sell your personal information to third parties.
- With matched users: Your profile information, photos, and messages are visible only to users you match with
- Service providers: Supabase (authentication, database, and private chat-media storage), Cloudinary (profile imagery), Firebase (push notifications), and DeepSeek (AI-assisted processing where enabled)
- Optional analytics: Disabled until a prior-consent control is available; no optional analytics data is shared with analytics partners
- Security partners: To detect and prevent fraud, spam, and abuse
- Legal compliance: When required by law, court order, or to protect rights and safety
- Business transfers: In the event of a merger or acquisition (with notice to users)
- Maps and location search: MapLibre GL JS renders maps in your browser. By default, your browser requests map styles and tiles from OpenFreeMap, using OpenStreetMap-derived data. Coarse reverse-geocoding requests may go from our server to Nominatim. Google Places may receive a place name and coordinates when we retrieve images for place cards. These providers receive the technical request data needed to return the requested content.
- Payments: If you buy Premium on Android, Google Play processes the payment method, renewal, cancellation, and refunds under its own privacy terms. Hearthly receives purchase and subscription metadata from Google Play to verify the purchase, provide Premium, prevent fraud, and support your account
- Sign-in: If you choose Vipps Login, Vipps MobilePay shares the information you approve with Hearthly. Supabase creates and maintains your signed-in session. This is separate from Google Play billing
Your data is never shared with advertisers. We do not use advertising networks or sell data to third parties.
When Google Places is used, it is also subject to the Google Maps End User Additional Terms of Service and the Google Privacy Policy.
4. Your rights and controls
You have control over your data and privacy settings.
- Update your profile information and preferences at any time
- Control location sharing: Enable or disable location features in app settings
- Manage push notifications: Control which notifications you receive
- Block users: Prevent specific users from contacting you
- Delete your account: Request full account deletion, which removes your data within 30 days
- Access your data: Request a copy of your personal information
- Correct inaccurate data: Update or correct your information
- Activity map: Contribution is off by default. You can turn it on or off in Privacy settings; Hide me also turns it off and stops matching searches
- When you turn contribution off or enable Hide me, your raw activity signals are deleted and recent rebuildable aggregates are invalidated. Older k-anonymous aggregates may remain until their 30-day expiry; they contain no user or match ID and no exact location
- You can revoke information sharing in Vipps. This stops new data from Vipps but does not delete your Hearthly account or information you have already confirmed. Use account deletion or contact us if you want it removed
Additional privacy rights may be available depending on your location (GDPR, CCPA, etc.)
5. Data retention
We retain your information only as long as necessary to provide services and comply with legal obligations. Information received through Vipps Login is retained while your account exists. Your verified name may initialize a new or blank profile; unconfirmed date-of-birth and gender suggestions are not stored as profile or questionnaire answers. Raw coarse activity-map signals expire after 8 days; k-anonymous aggregate history expires after 30 days. For deleted accounts, personal data is removed within 30 days of the request except where certain data must be kept for legal, security, or fraud-prevention purposes. A hashed Google Play purchase-token reference, order reference, subscription state, and provider-action history may be retained for refunds, dispute handling, fraud prevention, and accounting for up to five years after the end of the relevant accounting year, or longer only where law requires it.
6. Security
We use industry-standard security measures to protect your information including: data encryption in transit (HTTPS/TLS), secure authentication via Supabase Auth, row-level security policies in our database, regular security audits and updates, and access controls limiting employee access to user data. However, no system is 100% secure. Please use a strong password and report any security concerns to support@hearthly.net.
7. International transfers
We may process data in countries other than your own.
- Cross-border processing
- Standard contractual clauses
- Regional data storage where possible
- Vendor due diligence
- Compliance monitoring
We take steps to ensure an adequate level of protection.
8. Children’s privacy
Hearthly is not for individuals under 18.
9. Changes to this policy
We may update this policy to reflect changes to our practices.
10. Your rights
Depending on your location, you may have rights under data protection laws (GDPR in EU/EEA, CCPA in California, etc.) including: the right to access your personal data, the right to correct inaccurate information, the right to delete your data (with some exceptions), the right to restrict or object to certain processing, the right to data portability, and the right to withdraw consent. To exercise these rights, contact us at support@hearthly.net.
11. Contact us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using the information below.
12. How to reach us
The data controller is Hearthly AS, org. no. 936 184 987. You can reach us via:
- Email: support@hearthly.net
- Phone: +47 90 92 66 19
- Krusebyveien 78A, 1542 Vestby, Norway