Draft — to be reviewed by a lawyer before launch
Privacy Policy
IceBreaker helps you meet people who are nearby and free at the same time as you. That only works with some personal data — including where you are. This policy explains, in plain language, what we collect, why, who we share it with, how long we keep it and what your rights are.
1. Who is responsible for your data
The data controller is [OPERATOR NAME], a sole proprietor (ditta individuale) based at [ADDRESS], Italy, VAT number (P.IVA) [VAT NUMBER] ("IceBreaker", "we", "us").
For anything to do with your personal data, email aakashnandrajog.work@gmail.com. We have not appointed a Data Protection Officer, as we are not required to; the operator handles privacy requests personally.
2. What data we collect
Account data
- Sign-in details: depending on how you sign in, your phone number, email address, or the identifier provided by Google or Apple (Apple may give us a private relay email instead of your real one). We don't receive your Google or Apple password.
- Date of birth: used to confirm you are 18 or over. It is kept private and can't be changed after sign-up; other users only see your age.
- Device push tokens so we can send you notifications.
Profile data (you choose what to add)
- Name, 2 to 6 photos, age, gender, who you'd like to see ("show me": women, men or everyone), bio, interests, activities you're up for, what you're looking for, and optionally a prompt ("ask me about"), job title, education, height, languages and an area label (for example your neighbourhood).
- An optional home area (latitude and longitude) if you let the app find your location during setup. This is stored privately and is not shown to other users.
Location data
- Approximate location while you're online. When you choose to go online (for 1 to 3 hours), your position is rounded on your phone to about 100 metres before it is sent to us, and is updated as you move while the app is open. You can also add a short note about where you are (a "venue"). We do not track your location in the background or when you're offline.
- Precise location you share in a chat. If you tap to share your location with someone you're chatting with, your precise position is sent to that one person as a message.
Activity and messages
- Hi's you send and receive, including the short note and any suggested activity, and whether they were accepted or passed.
- Chats: up to 10 text messages per conversation plus any location shares, with timestamps.
- People you've blocked, and reports you make (reason, optional details, and whether it was about a profile, a hi or a chat).
Technical data
- Crash reports from release versions of the app (Firebase Crashlytics): device model, operating system version, app version, the technical details of the crash and a random installation identifier.
- App integrity checks (Firebase App Check, using Google Play Integrity or Apple App Attest) to confirm requests come from the genuine app, which protects everyone against bots and abuse.
- Standard server logs kept by our hosting provider, such as IP addresses and request times, for security.
What we don't do: we don't show ads, we don't sell or rent your data, we don't use an analytics or advertising SDK, and we don't build marketing profiles of you.
3. Sensitive data
Your gender, and especially your "show me" preference (which genders you'd like to meet), can reveal information about your sexual orientation. Under the GDPR this may be a special category of personal data (Article 9). We only process it with your explicit consent, which you give when you choose these options in your profile, and only to show you to — and show you — the right people.
You can change these options in your profile, or withdraw your consent at any time by deleting your account. Withdrawing consent doesn't affect processing that happened before. Because IceBreaker can't match people without these settings, you can't use the app without them.
Your photos, bio and other free-text fields may also reveal sensitive information if you choose to include it. Please think about what you share — your profile is visible to other users.
4. Why we use your data, and our legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account; showing your profile; showing you who's nearby; delivering hi's and chats | Account, profile, location, activity and messages | Performance of our contract with you (Art. 6(1)(b)) |
| Matching by gender and "show me" preference | Gender, "show me" preference | Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
| Making sure every user is 18 or over | Date of birth | Contract (Art. 6(1)(b)) and our legitimate interest in protecting minors (Art. 6(1)(f)) |
| Sending notifications about new hi's, accepted hi's and messages | Push tokens, sender's first name, note or message text | Contract (Art. 6(1)(b)); you can turn notifications off in your phone's settings |
| Safety: blocking, handling reports, enforcing our Terms and Guidelines, preventing fraud and abuse | Blocks, reports, relevant profile and message content, technical data | Legitimate interest in keeping users safe (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)) |
| Keeping the app stable and secure (crash reports, integrity checks, logs) | Technical data | Legitimate interest in a working, secure service (Art. 6(1)(f)) |
| Answering your emails and requests | Your email address and what you tell us | Contract (Art. 6(1)(b)) or legal obligation (Art. 6(1)(c)) for rights requests |
| Complying with the law and defending legal claims | Whatever is relevant | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have balanced it against your rights, and you can object (see Your rights). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. What other users can see
- Your profile (name, photos, age, gender, "show me", bio and other profile fields) can be seen by other signed-in IceBreaker users. Your date of birth, sign-in details and home area are never shown.
- While you're online, people who have a profile can see your approximate position (about 100 m), your venue note and when your session ends.
- A hi is seen by the person you send it to. Chat messages and location shares are seen only by the two people in that chat.
- People you've blocked, and people who've blocked you, are hidden from each other. A person you block isn't told.
- Reports are confidential: the person you report isn't told who reported them.
6. Who we share data with
We use Google Firebase, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC, as our data processor, under Google's data processing terms. We use these Firebase services:
- Firebase Authentication (sign-in), Cloud Firestore (database), Cloud Storage (photos) and Cloud Functions (server logic such as notifications, blocking and account deletion) — hosted in the europe-west1 region (Belgium);
- Firebase Cloud Messaging (push notifications), Firebase Crashlytics (crash reports), Firebase App Check (integrity checks) and Firebase Hosting (this website).
Notifications pass through Apple Push Notification service (on iPhone) or Google's services (on Android) to reach your device. If you sign in with Google or Apple, that company processes your sign-in under its own privacy policy. If you sign in with your phone number, the verification code is sent by SMS via Firebase.
We may disclose data to authorities when the law requires it, or where necessary to protect someone's life or safety. We never sell your data.
7. International transfers
Our main database and photo storage are in the EU (Belgium). Some Firebase services (such as Authentication, Cloud Messaging and Crashlytics) and Google's support and security operations may process data outside the European Economic Area, including in the United States. Google LLC is certified under the EU-US Data Privacy Framework, and Google's data processing terms also include the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.
8. How long we keep your data
- Online location: your "online" entry ends when your session ends (at most a few hours) or when you go offline, and expired entries are deleted automatically.
- Hi's: a hi that isn't answered expires after 12 hours in the app. Hi's and their status are kept while both accounts exist, so the app knows whether you've already said hi, and are deleted when either account is deleted.
- Chats and their messages and location shares are kept while both accounts exist. When either person deletes their account, the whole chat is deleted for both people.
- Profile, photos, account data and blocks: kept until you delete your account. Photos you remove from your profile are deleted.
- Reports: kept for safety and to handle repeat abuse, including after the accounts involved are deleted, for up to [REPORT RETENTION PERIOD, e.g. 12 months], unless we need them longer for a legal claim or a request from authorities.
- Crash reports: kept by Crashlytics for up to 90 days.
- Backups: deleted data may remain in encrypted backups for up to 30 days before being overwritten.
- Emails with us: kept as long as needed to deal with your request, and up to [EMAIL RETENTION PERIOD, e.g. 24 months] afterwards.
When you delete your account, we delete your profile, photos, online entry, hi's, chats, blocks, private account data and sign-in account straight away. See Delete your account.
9. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy;
- Rectify inaccurate data — you can edit most of your profile in the app, and we can correct your date of birth on request;
- Erase your data — you can delete your account yourself in Settings at any time;
- Data portability — receive data you gave us in a structured, machine-readable format;
- Object to processing based on our legitimate interests;
- Restrict processing in certain situations;
- Withdraw consent at any time, without affecting earlier processing.
To exercise these rights, email aakashnandrajog.work@gmail.com from the email address linked to your account, or tell us the phone number you signed in with. We may need to verify that it's really you. We'll answer within one month (extendable by two months for complex requests, in which case we'll tell you why).
You also have the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it. You can also complain to the authority in the EU country where you live or work. We'd appreciate the chance to sort things out with you first.
10. Adults only
IceBreaker is only for people aged 18 or over. We check your date of birth when you sign up and our systems reject profiles under 18. If we learn that someone under 18 is using IceBreaker, we delete their account. If you believe a minor is using the app, please report their profile or email us.
11. Security
We protect your data with encryption in transit (HTTPS/TLS) and at rest, access rules enforced on our servers (for example, only the two people in a chat can read it, and your private account data is readable only by you), integrity checks against fake apps and bots, and rounding of your location on your phone before it is sent. No system is perfectly secure; if a breach affects your data and is likely to put you at high risk, we'll tell you and the Garante as the law requires.
12. Device permissions
- Location — to show you people nearby and let you go online. Only used while you're using the app.
- Photos / camera — to add pictures to your profile.
- Notifications — to tell you about new hi's and messages.
You can change these permissions at any time in your phone's settings.
13. Changes to this policy
We'll update this policy when the app or the law changes. The date at the top shows the latest version. If we make significant changes, we'll let you know in the app before they take effect.
14. Contact
[OPERATOR NAME], [ADDRESS], Italy · P.IVA [VAT NUMBER] · aakashnandrajog.work@gmail.com