Privacy Policy

Last updated: 23 July 2026 · Valid as of launch. Also available in German on request.

1. Controller

The controller responsible for processing your personal data is:
Magnus Pucknato
Leinsamenweg 114, 50933 Köln, Deutschland
E-Mail: pucknat.zestyjuice@gmail.com

A Data Protection Officer (DPO) is not legally required at this time. For any data-protection concerns, please contact us at the address above.

2. Special-category data (GDPR Art. 9)

Information about your sexual orientation and erotic interests is “special category” data under Art. 9 GDPR. We process it only with your explicit consent (Art. 9(2)(a) GDPR), which you give when you complete registration and onboarding. You can withdraw consent at any time by deleting your account.

3. What we collect and why

3.1 Account data

Data: e-mail address, hashed password (we never store your password in plain text), or OAuth identifier (Discord, Reddit, Google — only a user ID and display name, no social graph).
Purpose: Authentication and account security.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract.
Retention: Until you delete your account.

3.2 Profile data

Data: Display name (pseudonym), roles, interests, bio, pronouns, gender identity, relationship style, approximate location (city / region, never exact coordinates), date of birth (used to verify 18+).
Purpose: Matching and community features you signed up for.
Legal basis: Art. 6(1)(b) GDPR + Art. 9(2)(a) GDPR (explicit consent for special-category data).
Retention: Until you delete your account.

3.3 Media

Data: Photos and other media you upload to your public profile or private albums.
Purpose: Displaying your profile; sharing private content with people you grant access to.
Legal basis: Art. 6(1)(b) GDPR + Art. 9(2)(a) GDPR.
Retention: Until you delete the media or your account. All uploads are scanned for illegal content (CSAM) as required by law — scan results are discarded immediately after the check passes.

3.4 Messages and activity

Data: Chat messages between matched users, match events, likes/passes, reports you submit.
Purpose: Core service functionality; safety and moderation.
Legal basis: Art. 6(1)(b) GDPR; moderation data also based on Art. 6(1)(f) GDPR (legitimate interest in platform safety).
Retention: Messages are deleted when either party deletes their account. Moderation records may be retained for up to 12 months to prevent re-registration by banned users.

3.5 Payment data

Data: We do not store payment card details. Payment is handled entirely by our payment processor (Stripe). We receive only a confirmation that payment succeeded and an anonymised customer reference.
Legal basis: Art. 6(1)(b) GDPR.
Retention: Payment confirmation records are kept for 10 years as required by commercial and tax law.

3.6 Identity verification (optional)

If you choose to obtain a Verified badge, an optional third-party provider processes a selfie/ID document. We receive only a pass/fail result — we never see, receive, or store your identity document.
Legal basis: Art. 6(1)(a) GDPR (consent) — this is entirely optional.

3.7 Cookies and technical data

We use a single session cookie (HTTP-only, secure) to keep you logged in. No advertising, analytics, or tracking cookies are set. Server logs (IP address, browser type, page accessed) are kept for up to 30 days for security purposes and then deleted automatically.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure service).

4. Location data

Your location is stored at city/region level only. Any coordinates used for distance calculation are coarsened (rounded to ~10 km) before being saved — we cannot pinpoint where you live. Exact GPS is never requested.

5. Third-party service providers (processors)

We share data with the following processors under Data Processing Agreements:

• Stripe — payment processing (US, covered by EU–US Data Privacy Framework).
• Object storage provider (S3-compatible) — media hosting.
• Transactional e-mail provider — sending verification and notification e-mails.
• OAuth providers (Discord, Reddit, Google) — only if you choose social login; we receive only a user ID and display name.

We do not sell your data. We do not share it with advertisers or data brokers.

6. International transfers

Some processors operate servers in the United States. Transfers are covered by adequacy decisions, standard contractual clauses (SCCs), or the EU–US Data Privacy Framework as applicable.

7. Your rights

Under GDPR you have the right to:

• Access (Art. 15) — request a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate data (most profile data you can edit directly).
• Erasure (Art. 17) — delete your account; this permanently removes your profile, photos, messages and all associated data.
• Restriction of processing (Art. 18) — ask us to restrict how we use your data pending a dispute.
• Data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest (Art. 6(1)(f)).
• Withdraw consent — at any time, without affecting the lawfulness of prior processing. The easiest way is to delete your account.

To exercise any right, e-mail pucknat.zestyjuice@gmail.com. We will respond within 30 days.

8. Right to lodge a complaint

You have the right to complain to a supervisory authority. If you are in the EU, you may contact the authority in your country of residence or in the country where the alleged infringement took place. For Germany: Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI).

9. Children

wubby.love is strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, please contact us immediately at pucknat.zestyjuice@gmail.com.

10. Changes to this policy

If we make material changes we will notify you by e-mail and/or an in-app notice at least 14 days before the changes take effect.