Privacy Policy

Ultimates.app ("Ultimates", "we") runs the Ultimates dating service and is responsible for the personal data described in this policy (the "data controller"). For any question or request about your data, write to privacy@ultimates.app.

• Matching: once your profile is complete, we compute its compatibility with the other complete profiles and email you as soon as we find someone highly compatible for you (unless you turned off notification emails).
• Who sees your profile: the people you are matched with, and our authorised administrators (see section 7). Your profile is never shown in a public list.
• Any time: you can edit your profile, turn off emails or delete your account.

• Account: your email address and name; your password (stored only in hashed form) if you sign up with email, or the name and email address shared by Google if you sign in with Google.
• Profile: photos, gender, date of birth, height, city (we store the city you choose and its public coordinates, never your precise location), spoken languages, and your "About you" answers (body type, smoking, drinking, children, relationship goal, education, occupation and, only if you choose to, your religion and how important it is to you).
• Partner preferences: who you want to meet (gender), age range, minimum height, maximum distance and your deal-breakers (children, smoking, religion).
• Compatibility questionnaire: your answers as you gave them (including free-text answers) and the personality and values profile we derive from them.
• Messages and reports: the messages you exchange with your matches. When you report someone, we receive your report together with the recent messages of that conversation so that we can review it.
• Referrals: your referral code, who invited you and how many people joined with your code.
• Technical data: IP address and request logs (security and abuse prevention), the session cookie that keeps you signed in, and usage data collected by our audience-measurement tools (see section 8).
• Email preferences: whether you want to receive notification emails.

Some of this information is sensitive data under the GDPR (article 9):

• your sexual orientation, which follows from the gender(s) you want to meet;
• your religion, only if you choose to share it.

We process this data only with your explicit consent, which you give with a dedicated checkbox before sharing it, and only to find compatible matches for you. It is never used for advertising and never sold.

Withdrawing consent: you can withdraw it at any time in Settings. We then delete the religion information you shared, and your profile is no longer included in matchmaking, since we cannot match you without knowing who you would like to meet. Withdrawal does not affect processing that took place before it. You can give your consent again later.

When you upload a photo, it is sent to Google's Gemini API, which returns an automated score of facial appearance (from 1 to 10). We store this score with your profile and use it as one of our matching criteria: we avoid suggesting two people whose scores are far apart. The score is never shown to other members.

• Running the service: your account, your profile, matchmaking, messaging and the emails that go with them: necessary to provide the service you signed up for (GDPR art. 6(1)(b)).
• Using sensitive data for matching: your explicit consent (art. 9(2)(a)), see section 4.
• Security, abuse prevention and handling reports: our legitimate interest in keeping members safe and the service secure (art. 6(1)(f)).
• Audience measurement: our legitimate interest in understanding how the website is used and improving it (art. 6(1)(f)).
• Legal obligations: for example answering a lawful request from an authority (art. 6(1)(c)).

You can turn off notification emails in Settings → Notifications or with the unsubscribe link included in every notification email.

Other members: the people you are matched with can see your profile (for example your name, photos, age, city and the information you add to it) and why we think you are compatible. They never see your email address.

Our team: a small number of authorised administrators can access profiles to run the service, answer support requests, handle reports and check the quality of the matching.

Service providers that process data on our behalf, only for the purposes below:

• Google (Gemini API): interprets your free-text questionnaire answers (answers given with a button are not sent) and produces the photo score described in section 5.
• Resend: sends our emails (your email address and the content of the email).
• Amazon Web Services (S3): stores your photos.
• Pusher: delivers messages and typing indicators in real time.
• MongoDB database hosting: stores your account, profile, answers and messages.
• Vercel: hosts the website and runs the application.
• Google Analytics and Hotjar: audience measurement and usage analytics on our website.

If you sign in with Google, Google also acts as an independent provider under its own privacy policy. We may disclose data when the law requires it. We do not sell your data and we do not use it for advertising.

We use a session cookie to keep you signed in (for up to 90 days) and cookies set by Google Analytics and Hotjar for audience measurement. See our Cookie Policy.

Some of these providers are based in, or process data in, countries outside the European Economic Area, including the United States. In that case we rely on the safeguards the provider offers, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

• Account and profile: as long as your account exists.
• When you delete your account (Settings → Delete account), we delete your account and profile data, including your photos and questionnaire answers. We may keep limited information for a short time where the law requires it or to handle an ongoing report.
• Inactive accounts: we will set a maximum period of inactivity after which accounts are deleted, notify you by email beforehand, and state that period on this page.
• Reports: as long as needed to handle them and protect members.

You have the right to access, correct and delete your data, to restrict or object to its processing, to receive a copy of it in a portable format, and to withdraw your consent at any time.

• Edit most of your data directly in your Profile and Settings.
• Turn off notification emails in Settings → Notifications.
• Withdraw your sensitive-data consent in Settings.
• Delete your account in Settings → Delete account.
• For anything else, such as a copy of your data, email privacy@ultimates.app. We answer within one month.

You can also lodge a complaint with your data protection authority (in France, the CNIL: cnil.fr).

We protect your data with access controls, encrypted connections (HTTPS) and hashed passwords. No system is perfectly secure; if a data breach puts your rights at risk, we will inform you and the authorities as the law requires.

Ultimates is only for people aged 18 or over. We do not knowingly collect data from anyone younger; if you believe a minor has signed up, contact us and we will delete the account.

We will publish any change on this page and update the "Last updated" date. If a change significantly affects how we use your data, we will also tell you by email.

Questions or requests: privacy@ultimates.app.