1. Information we collect
We collect information you provide and information generated through your use of the Hearthly mobile app and website.
- Personal information: Name, email address, date of birth, gender identity, sexual orientation
- Profile data: Photos, bio, interests, preferences, questionnaire responses
- Location data: The location you enter and, when permitted, GPS coordinates used for proximity matching and location features
- Messages and interactions: Chat messages between matched users, likes, matches, blocks, and reports
- Device information: Device type, operating system, IP address, browser type
- Operational data needed for core features, service security, and troubleshooting. Optional page-view, marketing, and performance analytics is not collected
- Camera access: QR code scanning when you choose to use this feature (no photos stored from QR scanner)
- Optional activity-map signals: If you turn contribution on, eligible searches and mutual match acceptances are converted to a coarse map cell without storing your user ID, match ID, or exact coordinates in the signal
- Purchase data if payments are approved and opened: Product, price, order and transaction references, payment status, and any subscription agreement. Hearthly will not receive your payment-card or bank-account details from Vipps MobilePay if the service is activated
- Vipps login: If you choose Vipps, we receive your verified name, email address, and date of birth, the gender you selected in Vipps, a pseudonymous technical login identifier, and the time of your latest authentication. We do not store the raw Vipps subject or Vipps tokens. We do not ask Vipps for your phone number, address, or national identity number. Vipps Login is used for sign-in, not payment
2. How we use information
We use your information to operate, improve, and personalize Hearthly.
- Provide core dating services and facilitate connections
- Run our compatibility matching algorithm and, where enabled, generate AI-assisted profile, match-insight, and game content
- Display your profile to other users based on match criteria
- Enable chat messaging between matched users
- Send push notifications about new matches and messages (with your permission)
- Provide safety features including reporting and blocking
- Personalize your experience and recommend relevant matches
- Improve service stability and features using necessary operational data. Optional page-view, marketing, and performance analytics is disabled until we can obtain consent
- Prevent fraud, abuse, spam, and violations of our Community Guidelines
- Comply with legal obligations and respond to legal requests
- Communicate important updates, security alerts, and support messages
- If you opt in, show coarse activity bands after a 30–45 minute delay and only where at least 10 different contributors are represented
- Process purchases, deliver Premium or tickets, and handle renewals, refunds, and customer support when payments are open
- Use information from Vipps to sign you in and check that you meet the age requirement. On first sign-in, the verified email address may be used to recognize and connect one existing, confirmed Hearthly account. Your verified name may initialize a new profile but never replaces an existing name. Date of birth and gender are retained in the protected Vipps login record; they are copied into your profile or questionnaire only after you confirm them in onboarding
3. How we share information
We share your information only as described below. We never sell your personal information to third parties.
- With matched users: Your profile information, photos, and messages are visible only to users you match with
- Service providers: Supabase (authentication, database, and private chat-media storage), Cloudinary (profile imagery), Firebase (push notifications), and DeepSeek (AI-assisted processing where enabled)
- Optional analytics: Disabled until a prior-consent control is available; no optional analytics data is shared with analytics partners
- Security partners: To detect and prevent fraud, spam, and abuse
- Legal compliance: When required by law, court order, or to protect rights and safety
- Business transfers: In the event of a merger or acquisition (with notice to users)
- Maps and location search: MapLibre GL JS renders maps in your browser. By default, your browser requests map styles and tiles from OpenFreeMap, using OpenStreetMap-derived data. Coarse reverse-geocoding requests may go from our server to Nominatim. Google Places may receive a place name and coordinates when we retrieve images for place cards. These providers receive the technical request data needed to return the requested content.
- Payments: If the payment service is approved and activated, the customer, order, and subscription details needed to process a purchase are shared with Vipps MobilePay for payment, payment-agreement management, fraud prevention, and refunds. Vipps MobilePay also processes information under its own privacy terms
- Sign-in: If you choose Vipps Login, Vipps MobilePay shares the information you approve with Hearthly. Supabase creates and maintains your signed-in session. This is separate from any future payment service
Your data is never shared with advertisers. We do not use advertising networks or sell data to third parties.
When Google Places is used, it is also subject to the Google Maps End User Additional Terms of Service and the Google Privacy Policy.
4. Your rights and controls
You have control over your data and privacy settings.
- Update your profile information and preferences at any time
- Control location sharing: Enable or disable location features in app settings
- Manage push notifications: Control which notifications you receive
- Block users: Prevent specific users from contacting you
- Delete your account: Request full account deletion, which removes your data within 30 days
- Access your data: Request a copy of your personal information
- Correct inaccurate data: Update or correct your information
- Activity map: Contribution is off by default. You can turn it on or off in Privacy settings; Hide me also turns it off and stops matching searches
- When you turn contribution off or enable Hide me, your raw activity signals are deleted and recent rebuildable aggregates are invalidated. Older k-anonymous aggregates may remain until their 30-day expiry; they contain no user or match ID and no exact location
- You can revoke information sharing in Vipps. This stops new data from Vipps but does not delete your Hearthly account or information you have already confirmed. Use account deletion or contact us if you want it removed
Additional privacy rights may be available depending on your location (GDPR, CCPA, etc.)
5. Data retention
We retain your information only as long as necessary to provide services and comply with legal obligations. Information received through Vipps Login is retained while your account exists. Your verified name may initialize a new or blank profile; unconfirmed date-of-birth and gender suggestions are not stored as profile or questionnaire answers. Raw coarse activity-map signals expire after 8 days; k-anonymous aggregate history expires after 30 days. For deleted accounts, personal data is removed within 30 days of the request except where certain data must be kept for legal, security, or fraud-prevention purposes.
6. Security
We use industry-standard security measures to protect your information including: data encryption in transit (HTTPS/TLS), secure authentication via Supabase Auth, row-level security policies in our database, regular security audits and updates, and access controls limiting employee access to user data. However, no system is 100% secure. Please use a strong password and report any security concerns to support@hearthly.net.
7. International transfers
We may process data in countries other than your own.
- Cross-border processing
- Standard contractual clauses
- Regional data storage where possible
- Vendor due diligence
- Compliance monitoring
We take steps to ensure an adequate level of protection.
8. Children’s privacy
Hearthly is not for individuals under 18.
9. Changes to this policy
We may update this policy to reflect changes to our practices.
10. Your rights
Depending on your location, you may have rights under data protection laws (GDPR in EU/EEA, CCPA in California, etc.) including: the right to access your personal data, the right to correct inaccurate information, the right to delete your data (with some exceptions), the right to restrict or object to certain processing, the right to data portability, and the right to withdraw consent. To exercise these rights, contact us at support@hearthly.net.
11. Contact us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using the information below.
12. How to reach us
The data controller is Hearthly AS, org. no. 936 184 987. You can reach us via:
- Email: support@hearthly.net
- Phone: +47 90 92 66 19
- Krusebyveien 78A, 1542 Vestby, Norway