Privacy Policy

1. Controller and Contact Information

The data controller responsible for the processing of your personal data described in this Privacy Policy is:

Akshat Mohiley
Hildebrandstraße 7, Apartment 906, 01219 Dresden, Germany
Email: hello@tonyte.app

Tonyte is operated by Akshat Mohiley as an individual data controller (a natural person), rather than a registered company. This satisfies the controller-identification requirement of Art. 13(1)(a) GDPR and § 5 DDG (the German Digital Services Act's provider-identification requirement, successor to § 5 of the former Telemedia Act, TMG).

If you have any question about this Privacy Policy or about how your personal data is processed, you can contact us at hello@tonyte.app. We aim to respond to all privacy-related inquiries within 30 days.

Data Protection Officer: Tonyte has not appointed a Data Protection Officer. Under Art. 37 GDPR, appointing a DPO is not currently mandatory for Tonyte's processing activities: Tonyte is not a public authority, does not carry out large-scale systematic monitoring of individuals, and — as explained in Section 3.6 below — does not process special categories of personal data at scale. We will revisit this position if the scope of our processing changes.

Competent supervisory authority: Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner), the independent supreme state authority responsible for data protection oversight of non-public bodies (including individuals and businesses) established in Saxony, per § 14(2) of the Saxon Data Protection Implementation Act (SächsDSDG). The authority's address is Maternistraße 17, 01067 Dresden, Germany (confirmed directly against the authority's own published contact page as of August 2026). Current officeholder: Juliane Hundert. See Section 15 for your right to lodge a complaint with this or another competent authority.

2. Scope of This Policy

This Policy covers personal data processed through:

• The Tonyte mobile application (React Native, iOS and Android — package/bundle identifiers com.triptribe.mobile and com.triptribe.ios), which is Tonyte's current, actively maintained mobile client;
• The Tonyte website at tonyte.app, including all public marketing pages;
• The Partner Dashboard, an authenticated area of the website used by event organizers and venue partners;
• Tonyte's backend infrastructure (Firebase/Google Cloud, and the supporting third-party services described in Section 4).

A legacy, Capacitor-based build of the Tonyte app (package ID com.triptribe.mobile) predates the current React Native app. It is no longer Tonyte's actively maintained or distributed client, but very old installations of it may still exist on some users' devices. Where its behavior differs materially from what is described in this Policy, that is noted explicitly (see Section 12).

3. Categories of Personal Data We Process, by Activity

This section describes, for every real processing activity carried out through the Services, the purpose, the categories of personal data involved, the legal basis under Art. 6 GDPR, who receives the data, how long it is kept, and whether it is transferred outside the European Economic Area (EEA). Only processing activities that are actually implemented are listed; nothing below is aspirational or planned-but-not-built.

3.1 Account Registration

Purpose: To create and administer your Tonyte account.
Categories of personal data: Email address, password (handled entirely by Firebase Authentication's infrastructure — Tonyte's own application code does not receive or store your raw password), display name, username, date you selected your age band, country, city/location label.
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract with you (providing the Tonyte service you sign up for).
Recipients/processors: Firebase Authentication (see Section 4.1 for the Google contracting entity).
Retention: For as long as your account exists, plus any period required after deletion as described in Section 8.
International transfers: See Section 6 (Firebase Authentication).

3.2 Login / Authentication

Purpose: To verify your identity each time you use the Services.
Categories of personal data: Email address and password (email/password sign-in); or, if you use social sign-in, the name, email address, and provider account identifier supplied by Google Sign-In or Sign in with Apple.
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract.
Recipients/processors: Firebase Authentication; Google Sign-In (Google LLC); Sign in with Apple (Apple Inc.), where used.
Retention: Session data persists on-device until you sign out or the session expires; underlying account data persists per Section 3.1.
International transfers: See Section 6.

3.3 Password Reset

Purpose: To let you regain access to your account if you forget your password.
Categories of personal data: Email address; a single-use password-reset link.
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract; Art. 6(1)(f) GDPR — legitimate interest in account security.
Recipients/processors: A Tonyte Cloud Function generates the reset link via Firebase Authentication and sends it by email through Resend (see Section 4.3).
Retention: Reset links are single-use and expire automatically; no separate record of the link itself is retained beyond standard Firebase Authentication logs.
International transfers: See Section 6.

3.4 Email Verification

Purpose: To confirm you control the email address associated with your account.
Categories of personal data: Email address; a verification token.
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract; Art. 6(1)(f) GDPR — legitimate interest in preventing fraudulent accounts.
Recipients/processors: Resend (email delivery).
Retention: Verification tokens expire automatically after a short, fixed window and are not reused.
International transfers: See Section 6.

3.5 Student Verification ("StudiZone")

Purpose: To let you optionally verify that you are a student at a recognized Dresden-area university, unlocking student-specific features.
Categories of personal data: The university email address you submit; the email domain; the university name (matched against a fixed list of known institutions); verification status; timestamps; if reviewed by an administrator, the reviewing admin's user ID.
Legal basis: Art. 6(1)(a) GDPR — your consent, given by voluntarily choosing to submit a university email address for this optional feature. You may withdraw consent at any time by not using this feature further; withdrawal does not affect the lawfulness of processing already carried out.
Recipients/processors: Resend (verification email delivery); Tonyte administrators, for the limited set of submissions that require manual review because the domain is not on the automatic allow-list.
Retention: Retained for as long as your account exists and the verification status remains relevant to your profile. If you delete your account, your student verification request is deleted as part of account deletion (Section 8).
International transfers: See Section 6.
Note: No photo or identity document is collected for this feature — verification is based solely on control of a university email address.

3.6 Vibe Verified (Selfie) Verification

Purpose: To let you optionally verify that your profile represents a real person, displayed to other users as a trust badge.
Categories of personal data: A single selfie photograph you take specifically for this purpose (front-camera capture only; gallery uploads are not permitted), a pose indicator, verification status, timestamps, and — if reviewed — the reviewing administrator's user ID.
Legal basis: Art. 6(1)(a) GDPR — your explicit, freely given consent, provided by voluntarily choosing to submit a selfie for this optional feature. You may decline this feature entirely with no effect on your ability to use the rest of the Services (aside from not displaying the verification badge).
Special category data (Art. 9 GDPR): Tonyte's documented position is that this image does not constitute special category biometric data within the meaning of Art. 9(1) GDPR, because no facial-recognition algorithm, biometric template, or other technical process capable of uniquely identifying you is applied to it — the image is reviewed by a human administrator only, to confirm it plausibly shows a real person matching the requested pose. This image is nonetheless treated as sensitive and handled with the additional safeguards described below.
Recipients/processors: Tonyte administrators performing manual review. Your selfie is not shown to other users and is not displayed on your public profile; it is used only for this one-time human review and is not used for any other purpose. Other users can see whether you are "Vibe Verified" (a yes/no badge) — the underlying image itself is not exposed to them.

Retention:

• If your submission is reviewed (approved or rejected), the selfie image is permanently deleted from storage at the moment the review decision is recorded — retention after a decision is zero.
• If your submission is never reviewed, it is automatically deleted after 30 days by a scheduled cleanup process, and the request is marked expired.
• In neither case does Tonyte retain your verification selfie beyond these windows.

International transfers: See Section 6 (Firebase Storage, Firebase Cloud Functions).

3.7 Chat

Purpose: To let you message other users in 1:1 matches, event group chats, plan group chats, and private chats.
Categories of personal data: Message text, sender name/photo/ID, timestamps, and, if you choose to send them, image attachments, voice-note audio, and shared-event previews.
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract (chat is a core feature of the Services).
Recipients/processors: Firebase Firestore (message storage) and Firebase Cloud Storage (image/voice-note attachments); GIF search terms you enter are sent directly from your device to Giphy (Section 4.7).
Retention: Chat messages are retained for as long as the underlying conversation exists. If you delete your account: messages in 1:1 matches and 1:1 private chats are deleted entirely (since the conversation cannot meaningfully continue with only one party); your messages within group chats (event chats, plan chats) are anonymized — your name/photo are replaced with a generic "deleted user" placeholder, while the message content itself remains visible to the other participants who received it, consistent with how any message-based communication works once sent to a group.
International transfers: See Section 6.
Security note: Chat messages are protected by encryption in transit (TLS) and by Firestore access-control rules restricting reads to chat participants. Messages are not end-to-end encrypted.

3.8 Plans

Purpose: To let you create, join, and manage informal social plans with other users.
Categories of personal data: Plan title/description/location/time (as entered by the creator); participant list (user IDs); join requests; associated plan chat messages (Section 3.7).
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract.
Recipients/processors: Firebase Firestore.
Retention: For as long as the plan exists. If you delete your account, plans you created are deleted as part of account deletion (Section 8); your participation in other users' plans is removed.
International transfers: See Section 6.

3.9 Events

Purpose: To let event organizers (including partners) publish events, and to let users discover, express interest in, and attend them.
Categories of personal data: Event details (as entered by the organizer); your interactions with events (interest/attendance, if you choose to record them); associated event chat messages (Section 3.7).
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract, both for organizers publishing events and for users interacting with them.
Recipients/processors: Firebase Firestore; publicly visible event content is, by design, visible to other users and, for public events, to visitors of the website.
Retention: For as long as the event exists in the Services. Events created by Partner Dashboard organizers are not automatically deleted when a separate consumer account is deleted (see Section 3.12).
International transfers: See Section 6.

3.10 Event Analytics

Purpose: To give event organizers and partners aggregate insight into how their events are performing (views, shares, expressions of interest).
Categories of personal data: Aggregate interaction counters (tap counts, share counts, "interested" counts) computed server-side. Based on the Cloud Functions that generate these figures, they are aggregate counts, not an attendee-level, individually identified list.
Legal basis: Art. 6(1)(f) GDPR — Tonyte's and organizers' legitimate interest in understanding event performance, balanced against the fact that the figures shown to organizers are aggregated counts rather than data that identifies individual attendees to the organizer.
Recipients/processors: Firebase Firestore/Cloud Functions; visible to the organizer/partner who owns the event, within the Partner Dashboard.
Retention: Tonyte's retention policy for event analytics data is 12 months from the date the underlying event ends, a conservative default appropriate for an early-stage platform, chosen over a longer period since organizer-facing performance figures have diminishing practical value the further removed they are from the event itself. This is Tonyte's adopted policy target; no automated deletion currently enforces it, so this period is not yet a technical guarantee.
International transfers: See Section 6.

3.11 Map / Location Features

Purpose: To show you nearby events and plans, and to power address search and map display.
Categories of personal data: Your device's live GPS coordinates (used only on-device to compute distance/proximity — not written to Tonyte's servers for this purpose); free-text location search queries you type.
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract (location-based discovery is a feature you use intentionally); your device's operating system additionally requires your explicit permission grant before any location data is accessed.
Recipients/processors: Google Maps/Places API (address and venue search text); OpenStreetMap Nominatim (used as a fallback for address search — receives your search query and IP address); CARTO (provides the background map tiles you see — receives map viewport coordinates and your IP address, standard behavior for any map-tile request).
Retention: Live GPS coordinates are not stored by Tonyte's backend for the nearby-discovery feature.
International transfers: See Section 6.
Precision and scope: Location access is foreground-only on both platforms — Tonyte does not request "Always" location permission on either platform, and location tracking pauses automatically when the app is in the background. Your exact live location is not shown to other users; other users see only a proximity indicator or a computed distance value.

3.12 Partner Dashboard and Organizer Accounts

Purpose: To let approved partners (venues, event organizers) manage their events and view engagement analytics through a dedicated dashboard.
Categories of personal data: Partner organization name, contact email, city, partner type, account status, and any optional profile fields you add (address, website, Instagram handle).
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the partner agreement between you and Tonyte.
Recipients/processors: Firebase Authentication/Firestore; Resend (for partner invitation and account-setup emails).
Retention: For as long as the partner account is active, plus a reasonable period thereafter for administrative and dispute-resolution purposes.
International transfers: See Section 6.
Access: Partner accounts are invitation-only — an administrator creates the invitation, and the partner sets their own password through a dedicated activation link. There is no public self-service partner signup.

3.13 Public Profiles and User-Generated Content

Purpose: To let you present a profile to other users and share content (photos, bios, interests) as part of using the Services.
Categories of personal data: Display name, username, profile/cover photo, bio, interests, hashtags, preferred language, verification badges (Sections 3.5–3.6).
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract; providing a visible profile is intrinsic to a social-discovery service.
Recipients/processors: Visible to other authenticated users of the Services, consistent with the product's design; stored in Firebase Firestore/Storage.
Retention: For as long as your account exists; deleted as part of account deletion (Section 8).
International transfers: See Section 6.
Image metadata note: Uploaded photos may retain embedded technical metadata (such as EXIF data written by your device's camera, which can include GPS coordinates) if present in the original file at the time of upload. We recommend reviewing your device's camera/photo-sharing settings if you wish to avoid sharing this metadata.

3.14 Reports and Moderation

Purpose: To let you report other users or events for content or conduct that violates our terms, and to let Tonyte review and act on reports.
Categories of personal data: Reporter's user ID, reported user/event ID, reason selected, free-text details you provide.
Legal basis: Art. 6(1)(f) GDPR — Tonyte's and the community's legitimate interest in platform safety and content moderation.
Recipients/processors: Tonyte administrators/co-administrators reviewing reports.
Retention: Tonyte's retention policy for reports is 12 months from the date the report is filed, except where a report is connected to an active enforcement action (e.g., a suspension under appeal) or a genuine legal claim, in which case it may be retained until that matter is resolved. This is in addition to, not instead of, the pseudonymization on account deletion described below, which applies regardless of how much of the 12-month period has elapsed. This is Tonyte's adopted policy target; no automated deletion currently enforces the 12-month figure. If a reported or reporting user deletes their account, the report is not deleted outright but is pseudonymized — the identifying user reference is replaced with a stable, one-way, non-reversible token, so moderation history remains internally consistent without retaining your identity.
International transfers: See Section 6.

3.15 Blocking

Purpose: To let you prevent a specific user from contacting or matching with you.
Categories of personal data: The blocking user's and blocked user's IDs.
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract (user safety controls are part of the Services); Art. 6(1)(f) GDPR — legitimate interest in user safety.
Recipients/processors: Firebase Firestore; enforced automatically to prevent messaging between blocked pairs.
Retention: Until you remove the block or delete your account.
International transfers: See Section 6.

3.16 Account Deletion

Purpose: To let you permanently delete your account and associated personal data.
Categories of personal data: N/A (this is an erasure activity, not a collection activity) — see Section 8 for the full description of what is deleted, anonymized, or retained, and why.
Legal basis: Art. 6(1)(c) GDPR — compliance with Tonyte's legal obligation to give effect to erasure requests under Art. 17 GDPR. (The one category of data that is pseudonymized rather than deleted — reports, per Section 3.14 — is processed under the legitimate-interest basis described in that section, not under this one.)
Recipients/processors: Firebase Authentication, Firestore, and Cloud Storage, via the Cloud Function that executes the deletion.
Retention: N/A.
International transfers: See Section 6.

3.17 AI Translation

Purpose: To let you translate content within the app into your preferred language.
Categories of personal data: The text you choose to translate (which may include personal data if the text itself contains it, such as a chat message).
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract, as translation is a feature you actively invoke.
Recipients/processors: OpenAI, L.L.C. (the text is sent to OpenAI's API to generate the translation).
Retention: Tonyte does not separately store translation requests or responses beyond the underlying content they were derived from (e.g., the original chat message, retained per Section 3.7). OpenAI's own retention of API inputs is governed by OpenAI's own privacy policy and API data-usage terms.
International transfers: See Section 6 (OpenAI).

3.18 AI Chat Assistant

Purpose: To provide an in-app AI assistant you can optionally converse with.
Categories of personal data: The messages you send to the assistant, and a user identifier associated with the conversation.
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract for this specific, user-initiated feature; alternatively Art. 6(1)(a) consent, to the extent you regard engaging with the assistant as a discrete opt-in choice.
Recipients/processors: OpenAI, L.L.C.; the backend service that relays your message to OpenAI is hosted on Render.com, which sees the message content and your user ID in transit and in its own request logs.
Retention: No separate long-term retention of assistant conversation content by Tonyte beyond standard request logs; OpenAI's retention of API inputs is governed by OpenAI's own terms.
International transfers: See Section 6.

3.19 Push Notifications

Purpose: To send you notifications about activity relevant to you (e.g., new messages, event updates), where enabled.
Categories of personal data: A device push notification token, associated with your account.
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract for the notification features you have enabled at the operating-system permission level; your device's OS separately requires your explicit permission before any push token is generated.
Recipients/processors: Firebase Cloud Messaging (Google).
Retention: For as long as your account exists and the associated device registration remains active; stale/invalid tokens are not actively used once a device un-registers.
International transfers: See Section 6.

3.20 Logging

Purpose: To operate, secure, and debug the Services.
Categories of personal data: Depending on the flow, application logs may include your user ID and, in some flows, your email address. The backend service supporting the AI chat assistant (Section 3.18) generates its own hosting logs, which include your user ID and a preview of message content in transit.
Legal basis: Art. 6(1)(f) GDPR — Tonyte's legitimate interest in operating, securing, and debugging the Services.
Recipients/processors: Firebase/Google Cloud logging infrastructure; Render.com, for the AI chat assistant backend specifically (Section 4.9).
Retention: Tonyte's retention policy for application and hosting logs is 30 days, which we consider an appropriate balance between the operational need to debug and secure the Services and the data-minimization principle (Art. 5(1)(c) GDPR), and a practical, conservative default for an early-stage service without a dedicated security-operations function that would justify longer security-log retention. This is Tonyte's adopted policy target, not yet a verified technical setting — it requires configuring an explicit 30-day retention rule in Google Cloud Logging, and confirming Render.com's own platform-default log retention against this figure (Render's default retention period was not identified from its published documentation during this review and should be checked directly in Render's dashboard or support documentation, since Tonyte does not control Render's own platform logs beyond what its account plan allows).
International transfers: See Section 6 (Render.com).

4. Infrastructure and Third-Party Processors

The processing activities in Section 3 are carried out using the following infrastructure and processors. This section names every third party actually integrated into the Services, based on a code-level review — no third party is listed here that is not genuinely in use, and no third party in genuine use is omitted.

4.1 Firebase / Google Cloud (Firebase Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Scheduler, Cloud Messaging, Hosting)

Tonyte's backend runs on Google's Firebase platform. Firebase Authentication manages sign-in and passwords; Cloud Firestore is Tonyte's primary database; Cloud Storage holds uploaded images and audio; Cloud Functions run Tonyte's server-side logic (including the account-deletion, verification-review, and notification logic described throughout this Policy); Cloud Scheduler triggers the automatic, timed cleanup jobs described in Sections 3.6 and 8 (e.g., the 30-day expiry of unreviewed verification selfies); Cloud Messaging delivers push notifications; Firebase Hosting serves the website. Google acts as Tonyte's data processor for all of these services.

Contracting entity: Per Google's published Firebase Data Processing and Security Terms and Google Cloud's Data Processing Addendum, Firebase/Google Cloud services are provided under agreements involving Google LLC, Google Ireland Limited, or another Google affiliate, depending on the customer's location and account configuration. For Tonyte's specific Firebase/Google Cloud account, the confirmed contracting entity is Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland.

4.2 OpenAI

Used for the AI translation feature (Section 3.17) and the AI chat assistant (Section 3.18). OpenAI processes the text you submit to these features as Tonyte's processor, under OpenAI's own API data-usage terms.

4.3 Resend

Used to deliver transactional emails: partner invitations, password resets, email verification, and student-verification correspondence (Sections 3.3–3.5, 3.12). Resend receives the recipient's email address, name (where applicable), and the email content.

4.4 Google Maps / Places API

Used for address and venue search (Section 3.11). Receives the search text you enter.

4.5 OpenStreetMap Nominatim

Used as a fallback address-search provider when Google Maps/Places is not used (Section 3.11). Receives your search query and IP address, per Nominatim's standard request handling.

4.6 CARTO

Provides the background map tiles displayed in the app and website (Section 3.11). Receives map viewport coordinates and your IP address, standard behavior for any tile-serving request.

4.7 Giphy

Used for in-chat GIF search (Section 3.7). GIF search terms are sent directly from your device to Giphy, not proxied through Tonyte's own servers.

4.8 Google Fonts

Tonyte's website loads fonts from Google's font content delivery network rather than hosting them ourselves. This means your device requests font files directly from Google when you visit the website, which transmits your IP address to Google at that time — this is the one third-party network call every website visitor makes, independent of any cookie.

4.9 Render.com

Hosts the backend service supporting the AI chat assistant (Section 3.18). Sees message content and your user ID in transit and in its own request/hosting logs.

4.10 Cloudflare

Tonyte does not currently use Cloudflare for any part of the Services described in this Policy — Tonyte's website and app backend are hosted on Firebase Hosting and Google Cloud, not Cloudflare. If this changes in the future, this Policy will be updated accordingly before any such change takes effect.

4.11 Not Used

For clarity, and based on a full code-level review, Tonyte does not use: Stripe, Twilio, SendGrid, Algolia, Sentry, Mixpanel, Segment, Cloudinary, Meta/Facebook Pixel, Google Tag Manager, Hotjar, Microsoft Clarity, or any advertising or tracking pixel, on the website or in the app.

5. Firebase Region and Data Residency

Tonyte's primary database, Cloud Firestore, is hosted in the europe-west3 (Frankfurt, Germany) Google Cloud region.

Tonyte's server-side logic (Cloud Functions) is in the process of being migrated from the us-central1 (United States) region to europe-west3. As of the date of this Policy, both regions are simultaneously in operation: newer function deployments run in europe-west3, while the original us-central1 deployments remain active in parallel to support users who have not yet updated to the latest app version. This dual-region period is temporary and exists specifically to avoid any service interruption during the transition; the us-central1 functions will be retired once adoption of the updated app version reaches the threshold described in Tonyte's internal migration plan.

Tonyte's Cloud Storage bucket (which holds uploaded images, including profile photos, chat attachments, and — until deletion per Section 3.6 — verification selfies) remains hosted in the us-central1 (United States) region. Migrating Storage to the EU has not yet begun.

In practical terms, this means: your core account and app data (Firestore) is processed in the EU; server-side processing logic (Cloud Functions) is currently split between the EU and the US during this migration, converging toward the EU; and uploaded files (Storage) are currently processed in the US.

6. International Data Transfers

Where personal data is transferred outside the European Economic Area — currently including Cloud Storage (Section 5) and the US-based processors OpenAI, Resend, Giphy, and Render.com (Section 4) — such transfers are made only where Tonyte has a valid legal transfer mechanism in place, such as the vendor's Standard Contractual Clauses (SCCs) or an applicable adequacy decision (including the EU-US Data Privacy Framework, "DPF," where a vendor is certified under it).

Based on each vendor's own published documentation, the transfer mechanism per processor is:

On relying on the EU-US Data Privacy Framework (Resend, Render.com): as of the date of this Policy, the DPF remains a valid adequacy mechanism under the European Commission's 2023 adequacy decision, and survived its first judicial challenge (the General Court dismissed the Latombe case on 3 September 2025). That dismissal has been appealed to the Court of Justice of the EU (Case C-703/25 P), with no hearing date set as of this writing, and on 31 July 2026 the European Data Protection Board asked the European Commission to review the DPF's continued validity in light of a change in U.S. law affecting the independence of its oversight body. The DPF is therefore currently valid but not free of ongoing legal uncertainty. Tonyte will monitor this and update this section, and if necessary the underlying vendor arrangements, if the DPF's status changes.

Tonyte's own acceptance of the relevant Google Cloud Data Processing Addendum, and confirmation that OpenAI's, Resend's, and Render's DPAs have been formally executed (not merely available) for Tonyte's specific accounts, should still be verified directly in each vendor's admin console before this section is treated as fully closed out.

7. Data Retention — Summary

Individual retention periods are stated alongside each processing activity in Section 3. As a summary:

The periods marked "policy target" above are Tonyte's adopted retention commitments as of the date of this Policy. They are not yet enforced by automated deletion logic in the underlying system — closing that gap is tracked as follow-up engineering work, separate from this Policy. Until implemented, Tonyte will honor these periods on request (Section 9) even where automatic enforcement is not yet in place.

8. Account Deletion — What Happens

When you delete your account through the app, Tonyte performs a comprehensive automated cleanup, which includes:

• Deleting your user profile document and Firebase Authentication account;
• Deleting your matches, private chats, and their messages entirely;
• Anonymizing your identity (name/photo replaced with a generic placeholder) within event chats and plan chats you participated in, while the messages themselves remain visible to other participants who already received them;
• Deleting plans you created, and your participation in others' plans;
• Deleting your swipes, blocks, notifications, follows, and check-in records;
• Deleting your student verification and Vibe Verified (face verification) requests, including any associated files still in storage;
• Deleting your Day Vibe responses/matches and your own analytics records;
• Deleting uploaded files associated with your account in Cloud Storage;
• Pseudonymizing (not deleting) reports you filed or were named in, so that platform safety/moderation history remains internally consistent without retaining your identity (Section 3.14).

Not deleted by this process: events or venues you published as a Partner Dashboard organizer are not removed by a consumer account deletion — these are handled through a separate partner-offboarding process, since partner-owned public content (e.g., a published event page) is not solely "your" personal data in the same sense as your private profile.

This deletion process is idempotent and designed to run to completion even if interrupted; if any step cannot be completed, it is safely retried rather than left partially done.

9. Your Rights Under GDPR

You have the following rights regarding your personal data, subject to the conditions and exceptions set out in the GDPR:

• Right of access (Art. 15) — to obtain confirmation of whether we process your personal data, and a copy of it.
• Right to rectification (Art. 16) — to have inaccurate personal data corrected. Most profile fields can be edited directly in the app; for anything else, contact us.
• Right to erasure (Art. 17) — to have your personal data deleted. This is implemented as the self-service account deletion feature described in Section 8; you may also request erasure by contacting us.
• Right to restriction of processing (Art. 18) — to request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20) — to receive certain personal data you provided to us in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) — to object to processing based on legitimate interests (Art. 6(1)(f)), on grounds relating to your particular situation.
• Right to withdraw consent (Art. 7(3)) — where processing is based on your consent (Sections 3.5, 3.6), you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

How to exercise these rights: Tonyte does not currently offer a self-service data-export or data-restriction tool beyond account deletion. To exercise the access, rectification, restriction, portability, or objection rights, please contact hello@tonyte.app. We will respond within one month of receiving a verifiable request, as required by Art. 12(3) GDPR, and may extend this by a further two months for complex requests, with notice to you.

10. Children and Age Restrictions

Tonyte is intended for users who are at least 16 years old. We do not knowingly collect personal data from anyone under 16, and registration is blocked for users who indicate they are below this age. Sixteen is the age of consent for information-society services under German implementation of Art. 8 GDPR. If we become aware that we have collected personal data from a user under 16, we will take steps to delete it.

This 16+ threshold assumes Tonyte's user base is limited to Germany (or jurisdictions where 16 is the applicable digital age of consent). If Tonyte is or becomes available to users in EU member states with a lower digital age of consent (as low as 13, depending on the state), this section should be revisited.

11. Automated Matching ("Day Vibe")

Tonyte's "Day Vibe" feature computes a similarity score between users based on responses you provide, and may automatically create a private chat between users whose scores match, without human review of that specific pairing decision. This is a form of automated processing under Art. 22 GDPR. We consider this feature's effect on you to be limited — it results in a chat becoming available, not any binding decision, denial of service, or legal effect — but we disclose it here for transparency. You are not obligated to respond to or continue any conversation created this way, and you may block or report any user regardless of how a chat was created.

Retention: Tonyte's retention policy for your Day Vibe responses and match records is 90 days from the date of your response, reflecting the feature's inherently short-lived, day-scoped nature — there is limited legitimate purpose in retaining a specific day's responses long after that day has passed. This is Tonyte's adopted policy target; no automated deletion currently enforces it. If you delete your account before 90 days elapse, your Day Vibe data is deleted immediately as part of account deletion (Section 8), which takes priority over this general period.

12. Legacy Capacitor App

An earlier, Capacitor-based build of the Tonyte app was Tonyte's original mobile client before being superseded by the React Native app referenced throughout this Policy. This legacy build is no longer actively distributed or maintained, but very old installations may still exist on some devices that have not updated. Such installations may, for a transitional period, continue to communicate with the us-central1 Cloud Functions region described in Section 5, consistent with the dual-region operation explained there, and may not yet reflect the most recent version of this Policy's description of app behavior. We recommend updating to the current app whenever prompted to ensure you benefit from the latest privacy and security improvements.

13. Cookies and Local Storage (Website)

The Tonyte website does not use cookies. It uses browser storage instead: localStorage, to remember your language preference, and, within the authenticated Partner Dashboard only, sessionStorage, to preserve an in-progress event draft. Both are strictly necessary for the functioning of the feature they support and do not require consent under § 25 TDDDG (the successor provision to § 25 TTDSG, renamed 14 May 2024; the section number is understood to carry over unchanged, but this should be given a final check by German counsel), which applies to non-essential storage/access to your device.

The website does not use any analytics, advertising, or tracking script (see Section 4.11). The one non-essential-feature network request made by every visitor is the request to Google's font CDN described in Section 4.8.

14. Security

We take reasonable technical and organizational measures to protect your personal data, including: encryption in transit (TLS) for all Firebase and third-party API traffic; storage of third-party API credentials in Google Secret Manager rather than in application source code; and access-control rules (Firestore/Storage security rules) restricting who can read or write sensitive data such as verification requests and private chats. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. Your Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement, if you consider that our processing of your personal data infringes the GDPR. The supervisory authority competent for Tonyte specifically is identified in Section 1.

16. Changes to This Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our processing activities (such as the completion of the Cloud Functions and Storage region migration described in Section 5) or in applicable law. Material changes will be reflected by updating the "Last updated" date above, and, where required by law, we will provide additional notice.

17. Contact

For any question about this Privacy Policy or your personal data, contact us at hello@tonyte.app.