Postmatch

Privacy Policy

What we collect, what we do with it, who else touches it, and how to make us delete it.

Last updated: 1 July 2026

1. Who we are

Postmatch is operated by Tilen Mlakar, a sole proprietor based in Slovenia (EU). For the purposes of the EU General Data Protection Regulation (GDPR), Tilen Mlakar is the data controller. You can reach us at [email protected].

2. What we collect

Three categories. Nothing outside them.

2.1 Account information

• Your email address (either your real one, or the relay address Apple gives us when you choose "Hide my email" in Sign in with Apple).
• The display name we derive from that email.
• An Apple-issued identifier (the SIWA sub claim) so we can look you up when you sign in again. We don't see your Apple password.

2.2 Your Tinder data

When you connect Tinder, the app opens tinder.com inside an embedded browser that you log into, and reads your data directly from Tinder, the same data you'd see in the Tinder app. What happens to each part:

• Your profile: bio text, prompts, descriptors, interests, your profile photos, verification status, and your date of birth (used only to derive an age band). This is sent to our server so we can score your profile and, if you ask for it, run the AI review.
• Your photos: we read your profile photo URLs; our server then fetches and stores those images while the analysis exists. Deleted when you clear your data or delete your account.
• Your matches and conversations: read to compute chat analytics (reply rate, opener quality, which threads went cold). These stay on your device. We do not upload your matches, the people you matched with, or the contents of your conversations to our server. The one exception is opt-in AI (see §3): if you tap "Review my chats", a stripped, aggregated summary plus a few of your own opening messages (with @handles, links, and phone numbers removed) is sent for critique, never the other person's messages.
• Activity counts: aggregate totals like matches, two-way conversations, and how many likes you sent in Tinder's rolling recent window. Numbers only; we never see who you matched with.

2.3 App usage events

• Timestamps of your scans, AI runs, and account actions, kept in an audit log so we can investigate abuse and respond to GDPR requests.
• The session cookie (pulse_session) that keeps you signed in, HttpOnly, Secure, scoped to postmatch.dev.

3. What we use it for

Six things, in order of how often they happen:

1. Analytics on your own data: your funnel (matches, two-way conversations, active threads), reply rate, profile-health score, chat depth, and comparison against your previous scans. Computed deterministically (it's just math), no AI involved.
2. Anonymized peer comparison: your numbers are compared against an anonymous histogram of users in roughly your gender, age band, and country. See §11 below for exactly how this works and what happens to your contribution when you delete your account.
3. AI review of your insights (optional, opt-in per surface), if you tap "Review my …" on a tab, we send a short summary of the relevant numbers to OpenAI, which turns the deterministic findings into readable prose and concrete suggestions. We do not send personal identifiers, and on the Chats tab we strip @handles, links, and phone numbers and never send the other person's messages.
4. AI photo critique (optional, opt-in), if you tap "Review my profile", we resize each of your profile photos to 768px on the long edge and send it to OpenAI's vision model for critique.
5. AI chat critique (optional, opt-in), part of the chat review above: a sample of your own opener messages (stripped as described) is sent to OpenAI for critique.
6. Authentication and security: to keep you signed in, rate-limit abuse, and respond to incidents.

4. Who else processes your data (sub-processors)

We use a small set of service providers. Each one only receives the minimum data needed for its specific role.

We do not use any analytics, advertising, or tracking SDKs. No Google Analytics, no Meta Pixel, no Mixpanel, no Firebase, nothing. We don't have a Facebook page that we cross-reference, and we don't sell anyone's data to anyone, ever.

5. International data transfers

Our database is hosted on Fly.io in Ashburn, Virginia (US). When you use the AI features, data is also processed by OpenAI in the US. These transfers are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses included in our agreements with both providers.

6. How long we keep your data

• Account info: until you delete your account.
• Your profile and derived analytics: until you tap "Clear my data" or delete your account. Each tap deletes that scan's stored profile, photos, and any AI summaries permanently.
• Photos: same retention as the scan they came from; they live in our database until you clear them.
• Matches and conversations: these never leave your device, so they're gone when you clear the app's data, disconnect Tinder, or delete the app.
• Audit log entries: kept for 12 months for security and abuse investigation, then deleted.
• Session cookies: 7 days from last sign-in, then expired automatically.

7. Your rights under GDPR

If you're in the EU/EEA (and even if you're not, we'll honor these for everyone), you have the right to:

• Access what we hold about you. Email us and we'll send you a JSON file with everything we store on our server.
• Correct anything inaccurate. Email us, most fields are read straight from your Tinder profile, so usually the fix is to update Tinder and re-scan.
• Delete your account and everything associated with it. The "Delete my account" button in Settings does this immediately and irrevocably; it's also enforced server-side via cascade on every table that references you.
• Restrict or object to processing in specific cases.
• Withdraw consent for AI features at any time by simply not running them again. Past AI summaries can be cleared via "Clear my data".
• Lodge a complaint with your local supervisory authority. In Slovenia that's the Information Commissioner.

8. Children

Postmatch is not intended for anyone under 18 and we don't knowingly collect data from minors. Tinder itself requires users to be 18+, so a Tinder export by definition belongs to an adult.

9. Changes to this policy

If we make a material change, a new sub-processor, a new data category, or anything affecting what we share, we'll update this page and email everyone at the address on file. The "Last updated" date at the top always reflects the current version.

10. Contact

Questions, GDPR requests, or anything else: [email protected]. We reply to GDPR requests within 30 days; usually within a week.

11. How peer comparison works (and what survives deletion)

The "how do I compare to peers in my age band and country" feature is built on an anonymous histogram, not a copy of other users' data. We explain it in detail here because the data flow is unusual and matters for what happens when you delete your account.

11.1 What we store

When you run a scan, we compute six numbers from it: reply momentum, total matches, photo count, bio length, prompt count, and interest count. We then increment a counter in a histogram bucket for each one , for example, "+1 in the 'man, 23 to 27, Slovenia, reply momentum 40%' bucket". The histogram itself contains no user identifier of any kind: no email, no internal ID, no hash. It is just a table of summed counts per (gender, age band, country, metric, value) cell.

We do keep one small personal record alongside the histogram: a memo noting which buckets your last scan incremented. We need it so that when you re-scan, we can subtract your previous contribution and add the new one, otherwise users with many scans would get counted multiple times. This memo is the only personal data tied to the histogram, and it cascades like everything else.

11.2 What happens when you tap "Clear my data" or delete your account

Your personal memo (§11.1) is deleted immediately and cascade-deleted everywhere it appears. The histogram bucket counts you incremented are not rolled back, they stay in the aggregate forever. This is deliberate, and it is the reason the aggregate is anonymous: after deletion there is no record anywhere of which buckets you ever incremented, so the surviving counts cannot be traced back to you. They are pure summed integers at that point, contributing to the reference range shown to other users in your demographic cell.

Under GDPR, this is the difference between pseudonymous data (still personal, deletable on request) and anonymous data (out of GDPR scope). The histogram counts after deletion are anonymous in the strict Recital 26 sense, there is no reasonably-likely means by which we, or anyone else, could single you out from a count.

11.3 Why no consent popup

Because the data we keep about you for peer comparison is either (a) the personal memo, which is deleted on demand like everything else, or (b) anonymous bucket counts that GDPR doesn't cover, the lawful basis for this processing is our legitimate interest in offering peer comparison as a core feature of the product (Article 6(1)(f) GDPR). We don't ask for separate consent because none of the data outlives your account in identifiable form. If you object to your numbers being part of the aggregate, clearing your data removes your personal memo immediately; the surviving anonymous counts cannot be linked back to you.

You can also email us and we will scrub your contribution memo manually while keeping your account active, same effect, no UI toggle yet.

11.4 Synthetic baseline

When we launched, the cohort was thin. To give the first hundred users a reference range to compare against, we seeded the histogram with 120 simulated profiles generated by code (no real data, no stolen profiles, no scraping). The simulated rows are tagged synthetic and are progressively replaced by real scans, once a demographic cell has enough real users, the simulated rows stop influencing what's shown to people in that cell.