Privacy Notice

Version 2026-09-27

How TondiMatch collects, uses, shares, protects, and deletes personal information.

The data controller is NoelTech Solutions LLC, doing business as TondiMatch, United States. For privacy questions or requests, email privacy@tondimatch.com.

Dating information is highly personal. This notice describes what the service does today. If a practice below changes, we will update this notice and obtain any consent required before the change applies.

What we collect, and what we do with it

What	How it is stored	Why
Your email address	As a keyed hash for account lookup. The address itself is not shown to other members.	It is how we recognise your account when you sign in with an emailed code or with Google or Apple, and how we enforce one account per address.
Your date of birth	Encrypted. We derive your age from it and show only the age.	We are 18+ only and must be able to prove we checked.
Your name, gender, who you are looking for, intentions, languages, optional job title, education, faith, values, interests, and what you write about yourself	Plainly, as you entered it	It is your profile. Other members see it. Faith is shown as you entered it, is never inferred from anything else, and is not used to rank or filter anyone today.
Your city, and optionally where you are from	As a choice from a fixed list of places	Distance is shown to others as a band — "same city", "nearby", "same region", "elsewhere in the country", or "abroad". Never a precise position.
Your photos	In private storage. Location and camera metadata are stripped before we store them.	Your profile. A photo a moderator has removed stops being visible.
A verification selfie, if you choose to verify	Until a moderator decides, then deleted	So a person can confirm the photos are of you. It is never shown to members and never becomes a profile photo. We do not store a face template or face geometry from it.
Your messages, optional Home Story answers, likes, passes, matches, blocks, reports and appeals	Plainly	Home Story answers stay hidden from your match until you both reply. Reports keep a copy of relevant messages and revealed answers so a moderator can act even if they are later deleted.
Discovery ranking logs	Plainly, tied to your account id while the account exists	To improve who we show whom. They are erased when your account is erased.
Sign-in sessions, a device identifier, a push notification token, and the IP address your device uses to reach us	As hashes, opaque tokens, or short-lived connection metadata	To keep you signed in, end a session, deliver notifications you allow, and limit abuse.
Purchase records, if you buy anything	Which store charged, whether a subscription is running and when it renews or ends, when a Spotlight placement started and ended, and how many placements you bought on a given day	To unlock what you paid for, apply the daily and outstanding Spotlight limits, and keep an audit trail of what was charged. We never receive your card, Mobile Money number, PIN or wallet details.

Phone-number sign-in is built but switched off until an SMS provider is contracted. We do not ask for your phone number in the app today.

We do not currently offer video profile media, voice notes on profiles, or in-app voice or video calls. Any previously stored profile voice intro is deleted.

What we do not collect

Your precise location. The app never asks your device for a position, and the server would reject one. Distance comes from the city you picked.
Your contacts. We never read your address book.
Advertising or tracking identifiers. There is no advertising in this app and no third-party analytics, cookies, pixels, or advertising SDKs.
Payment cards, Mobile Money numbers, PINs or wallet details. If you subscribe, Apple or Google take the payment. We receive a confirmation, not the instrument. The same is true of a one-time Spotlight placement.

Sensitive information

A dating profile can reveal sexual orientation, religion, ethnicity, sex-life information, and other sensitive details — especially gender, who you are looking for, intentions, and optional faith. Those fields are optional except where needed to run the matching feature you chose. Accepting this notice when you create an account is the consent we record for those fields. There is not a second, separate sensitive-data checkbox in the app today. You can leave optional fields blank or clear them later. We do not sell sensitive information, use it for third-party advertising, disclose it to data brokers, or infer sensitive characteristics from photos or behaviour for advertising.

We do not use private messages, verification selfies, or sensitive profile traits to train a general-purpose AI model.

Why we use information, and on what basis

We use the information above to:

create and maintain your account, show profiles, rank discovery, and deliver messages, matches, likes and the features you request;
process an optional store subscription and prevent payment fraud;
detect minors, scams, spam, impersonation, account compromise and other prohibited conduct, investigate reports, and enforce the Community Rules;
complete selfie verification when you choose it;
send security, service, match, message, purchase and support notices;
debug, secure and improve the Service;
comply with law, preserve evidence, and establish, exercise or defend claims.

Depending on your location and the purpose, privacy laws use grounds such as performance of our contract, your consent, compliance with legal obligations, protection of vital interests, and legitimate interests such as safety, fraud prevention and securing the Service. Naming those grounds does not mean a Cameroon data-protection authorization has been granted, and it is not a claim that every processing activity has already been approved by a regulator.

Who else can see it

Other members see your profile, your photos, and your city as a distance band. They never see your email address, your date of birth, or your exact location.
Our moderators see profile content, photos and reported messages, in order to review them. They cannot see your email address or your date of birth — the system does not expose either to them. Privileged staff access uses multi-factor authentication.
Google, if you choose to sign in with a Google account. Google tells us your email address and that it verified it; we never receive your Google password.
Apple, if you choose to sign in with Apple. Apple tells us an email address (which may be a private relay address) and that it verified it; we never receive your Apple password.
Apple or Google, if you choose an optional in-app subscription. They take the payment. We receive a confirmation that you paid, not your card or Mobile Money details.
Our service providers, listed below, because the service runs on their computers.
Authorities or others when reasonably necessary to comply with valid legal process, protect life or safety, report child exploitation, investigate crime or fraud, or meet a legal obligation.
A buyer or successor if the business is sold or reorganised, subject to confidentiality and any notice the law requires.

We do not sell your data. There is nobody to sell it to and no mechanism to. We do not use third-party behavioral advertising. We do not currently have affiliates that receive member data.

Where your data is held

Provider	What they hold	Where
Supabase	The database and your photos	Canada
Render	The application server	United States
Expo	Build, distribution and push delivery	United States
Resend	Sign-in codes and other transactional email	United States
Apple / Google	App distribution, optional sign-in, and optional in-app subscription payments	Varies
RevenueCat	Purchase events and your account identifier, so we can unlock what you paid for	United States
Amazon Web Services Rekognition, if photo-safety scanning is switched on	A copy of an uploaded photo long enough to return safety labels. Not used to identify you or to store a face template.	The AWS region configured for that scan

This means your data leaves Cameroon. Contact privacy@tondimatch.com if you have questions about that transfer. We may replace or add a processor after security, privacy, contract and transfer review; material changes will appear in this notice.

Recommendations and automated systems

Discovery ranking uses the city you chose and the distance band it produces, the preferences and filters you set, activity such as likes and passes, how recently you were last active, intentions and languages you share with the other person, whether you both have roots in the same area, and whether you have completed selfie verification.

Paying changes placement, and we will not pretend otherwise. A purchased Spotlight lifts you higher in other members' Discover for the length of that placement. It does not change who you see, and it cannot put you in front of someone who blocked you, someone whose filters exclude you, or anyone at all if your profile is incomplete — those checks run before ranking and a payment does not affect them. Outside a Spotlight window, nobody's placement is affected by money.

We do not infer race, health, religion, wealth or sexuality from photos or behaviour. Automated filters may flag scams, spam or possible rule violations; a person reads reports and makes high-impact account decisions. Automated results can be wrong. You can change key preferences, and you can appeal a qualifying account decision by writing to support@tondimatch.com.

Face and identity verification

Verification means a moderator compared a live selfie to your profile photos. It tells other members that the photos are probably of you. It does not mean a person is honest, kind or safe. The selfie is deleted after that decision unless a documented fraud investigation, appeal or legal obligation requires a short exception. Government-ID verification is not part of ordinary use today.

How long we keep it

While your account exists, we keep what is listed above.
A verification selfie is erased the moment a moderator decides on it, in the same operation that records the decision.
When you delete your account, we wait 7 days and then erase your profile, photos, messages, Home Story answers, matches, likes, passes and discovery ranking logs. The delay exists so a request made in anger, or by someone who has taken your phone, can be undone. You can cancel at any point in those 7 days. The profile is removed from active discovery during that period.
Report evidence is kept after your account is erased. A report you filed, or one filed about you, keeps a copy of relevant messages and revealed Home Story answers so a moderator can still act. Those copies are not shown to other members.
Blocks made against you are kept after your account is erased. They protect the person who set them if the same human returns with a new account. They contain no information about you beyond the fact of the block.
Purchase records are kept after your account is erased. We keep which store charged, whether a subscription was running and when it renewed or ended, when each Spotlight placement started and ended, and how many placements were bought on a given day — not your profile, and not shown to other members. They are the audit trail of what was paid for, and the store and tax rules that govern a payment are why they outlive the account.
Consent and contract-acceptance records are kept for as long as needed to show what you agreed to and to handle claims.
Backups cycle out on the backup schedule unless a lawful preservation hold applies.

How long the kept items last. We do not keep them forever. Report evidence, blocks made against you, and purchase records are held only for as long as the purpose that justifies them lasts: report evidence and blocks until the safety risk they document is spent, and purchase records for as long as store, tax, accounting and dispute rules require. When that purpose ends we erase them on the next scheduled deletion run. If you want to know whether we still hold something about you, ask privacy@tondimatch.com and we will tell you.

Security

Traffic uses HTTPS. Date of birth is encrypted. Your email address is stored as a keyed hash. Photos sit in private storage. No service can guarantee absolute security. Report a suspected account compromise to privacy@tondimatch.com or support@tondimatch.com.

If a breach of your personal data happens and it is likely to put you at risk, we will tell you and the relevant authority without undue delay once we understand what happened, and we will describe what was affected and what you can do about it.

What you can do

Inside the app, under Profile → Your data and account:

Export your account and profile, your photo records, your likes and passes, your matches, your messages, your Home Story answers, the blocks you set, the reports you filed, and your purchase records, as a single file. It includes your date of birth — that is the one place it is ever shown, and only to you.
Pause your account. You disappear from discovery; nothing is deleted.
Delete your account, as described above.

You can also correct profile fields in the app, withdraw optional profile details by clearing them, and change notification permissions on your device. Where applicable law gives you further rights — including Cameroon personal-data law, GDPR / UK GDPR, Canadian or Australian privacy law, or a U.S. state privacy law — you may ask us to access, correct, delete or port covered information, withdraw consent, object to or restrict certain processing, or request human review of a qualifying automated decision. We will verify requests proportionately and will not discriminate because you asked. Email privacy@tondimatch.com.

We aim to answer a rights request within 30 days of confirming who you are. If a request is complex or you have sent several, we may need longer, and we will tell you why before that first 30 days is up. If we refuse a request we will say so and explain the reason. You may also complain to the relevant privacy or consumer authority.

Children

This service is for adults. You must be 18 or over. We ask for your date of birth at sign-up and refuse accounts under 18. If we learn that a minor has an account, we will restrict it, preserve or report legally required evidence, and delete information not needed for safety or law. If you believe a child is using this service, report the profile — reports naming a minor are our highest priority.

Language

These documents are published in English. The app is also offered in French. Until a counsel-reviewed French legal text is published, this English notice is the text we operate to, except where the mandatory law of your country requires otherwise.

Changes

We may update this notice and will post the new version date. The version you accepted is recorded when you create an account. We do not currently block existing accounts until they re-accept a later version. For a material change we will notify you in the app or by email where we have an address, and we will ask for a new acceptance when the law requires it or when we choose to do so.

Contact

NoelTech Solutions LLC, 209 Nassau Street, St. Peter, MN 56082, United States. privacy@tondimatch.com