Privacy policy

Pilke is an app for agreeing a date and then meeting face to face. This policy says what personal data we process when you use Pilke, who receives it, and what rights you have.

It also concerns somebody who does not use Pilke at all: the person whose phone number a user has saved as their trusted contact.

1. Who processes your data

The controller is [TO FILL IN: registered company name], business ID [TO FILL IN: business ID], address [TO FILL IN: address].

For anything to do with privacy, write to [TO FILL IN: email address]. Requests concerning your rights go to the same address (section 11).

2. What data we process

Account and profile

Data	What it is used for
Phone number	You identify yourself with it. The account has no password, and the login code is sent to this number.
Email address	We contact you about your account.
Nickname, gender and photograph	Shown to the people you may go on a date with.
Date of birth	We check that you are 18. Others are shown your age in years only.
Language	Decides which language your notifications and text messages are in.
Date preferences	Who you are interested in, what kind of date you are looking for, the ages you want to be offered, and the languages you want to speak.
Date area	A point on the map and a radius in kilometres: how far you could travel for a date.
Trusted contact’s phone number	Optional. The safety button sends a message to this number.

Dates

We process the times you mark as free in the calendar, the candidates offered to you and which of them you chose, invitations sent and received, agreed times and venues, cancellations and their reasons, and the feedback given after a date.

Device and notifications

Sending push notifications requires a token from your device. We store the token and the device platform. We also store which notifications we have sent and whether they arrived.

Each device you have signed in on leaves its own record, so that you can sign out of one device at a time.

Question sets

You answer question sets by picking an option; there is no free text in them. Answering is voluntary, and the answers currently have no effect on who you are offered.

Safety records

We process a safety report and the free text in it, a report that the other person did not turn up, a record that you pressed the safety button and who the message went to, and the block created when somebody cancels a date because they did not feel safe.

A safety report is the only place in the service where free text can be written about another person. Write down only what happened.

What we do not collect

We use no analytics and no advertising identifiers, we set no cookies on this site, and we do not ask for your home address. The service has no chat, so there are no messages between users. We read your device location only as described in section 3.

3. How we handle location

Location means two different things in Pilke.

Your date area

You pick a point and a radius on the map: how far you could travel for a date. You set it yourself, and it does not come from your device’s positioning. We use it to decide which venues are within reach and who we can offer you. Other users cannot see it, and you can change it in settings at any time.

Your position at the venue

When a date is about to start, you can show your position to the person you are meeting so that the two of you can find each other. The position is exact, and we ask for permission separately.

Sharing is limited in five ways:

1. The date has been agreed and has a venue.
2. The window is twenty minutes: ten minutes either side of the agreed start.
3. You are within 300 metres of the venue. Your device checks the distance before it sends anything, and the server checks it again.
4. Only the person you are meeting can see it. No other user can, and it does not appear in our admin views.
5. The position is deleted when the window closes. If you stop sharing yourself, it is deleted immediately and no record of it is kept.

Sharing continues if you leave the app or put the phone in your pocket. We say so in the app as well, when we ask for permission. The position is not used for anything other than helping the two of you find each other.

4. What other users see about you

Another user sees your nickname, age, gender and photograph. They also see the agreed time and venue, the times you have offered them, and your position at the venue if you share it.

Another user does not see your phone number, your email address, your date of birth, your trusted contact’s number, your date area, your preferences, any restriction placed on you, or the feedback you give or that is given about you.

5. Why we process your data, and on what basis

Purpose	Lawful basis
Creating your account and signing you in	Contract
Finding candidates from your preferences, area and calendar	Contract
Invitations, agreeing a time and venue, and cancellations	Contract
Notifications about invitations, arrivals and feedback requests	Contract
Showing your position at the venue	Consent, which you can withdraw by stopping sharing
Answers to question sets	Consent, given by answering
Safety: blocks, reports, the safety button and restrictions	Legitimate interest — the safety of our users
Your trusted contact’s phone number	Legitimate interest — the user’s safety
Support and investigating misuse	Legitimate interest — proper use of the service

Your date preferences can reveal whether you are interested in the same or a different gender and whether you are looking for sex. That is special category data, and we process it only with your explicit consent, which you give when you set those preferences. You can change your preferences or delete your account at any time.

The free text of a safety report may describe acts that are criminal offences. We process such data only to protect users and, where necessary, to bring or answer a legal claim.

Where the basis is legitimate interest, we have weighed our interest against your rights. You can ask us for an account of that assessment at the address in section 1.

6. Who receives your data

Recipient	What they get
Other users	What section 4 describes.
Your trusted contact	One text message containing your nickname, if you press the safety button. It contains no position, no venue and nothing about the person you are meeting.
Expo (650 Industries, Inc., United States)	Your device’s push token and the content of the notification. Expo passes the notification on to Google’s FCM service.
GatewayAPI (Denmark)	The recipient’s phone number and the content of the message, when we send a login code or a safety message.
OpenFreeMap (Hyperknot Software Kft., Hungary)	Your device’s IP address and which map tiles it requests. The request comes from your device, not from our server. Its own policy says it does not log IP addresses.
Our hosting provider, [TO FILL IN: provider], Finland	All data in the service sits on its servers.
Pilke staff	What the admin view shows, where that is needed for support or to deal with a safety report. Shared positions do not appear in the admin view.
Google Play	What the app store receives as the distributor of the app.

We do not sell your data and we do not release it for marketing.

7. When data leaves Europe

Push notifications travel through Expo to the United States and on to Google’s FCM service. The transfer is based on the standard contractual clauses approved by the European Commission.

Every other recipient is in the EU or the EEA, and the servers your data sits on are in Finland.

8. How long we keep data

Data	Retention
Account and profile	As long as your account exists.
A position you have shared at a venue	Deleted when the window closes, or immediately when you stop sharing.
Signed-in devices	90 days from when the device was last used.
Calendar entries and answers to question sets	For the life of the account; deleted with it.
Dates, invitations and cancellations	12 months from the date.
Feedback	12 months from the date.
No-show reports and the restrictions that follow from them	12 months from the report.
Notifications sent, and delivery records for text messages	90 days.
Safety reports, their free text, and records of safety button presses	5 years from the report.
A block created for a safety reason	Indefinitely. It does not lapse with time, and it is not undone by either person deleting their account.
A record of which version of the terms you accepted	As long as we may have to show what the processing was based on.

At the end of a retention period we delete the data or make it non-identifiable. If a support matter, a safety report or a legal claim is open, we keep what relates to it for as long as handling it requires.

9. When you delete your account

You can delete your account in the app’s settings. It happens immediately and cannot be undone. There is more detail on How to delete your data.

We delete your phone number, email address, nickname, date of birth, gender, photograph, trusted contact’s number, date preferences, date area, calendar entries and answers to question sets. The photograph is deleted from storage as well, and every device is signed out at the same moment.

Two groups remain:

• Data that belongs as much to the other person. Past dates, the feedback given about them, and no-show reports. The other person sees Somebody where you used to be.
• Safety decisions that leaving must not undo. Safety reports, and a block created because somebody did not feel safe.

Both are kept for the period set out in section 8, and your name is no longer attached to them. A record that the account existed also remains, so that we do not create two accounts for the same number. You can register again with the same number; you get an empty account, and nothing links it to the old one.

10. How we make automated decisions

Finding candidates is automated, but it only produces a suggestion. You decide who to invite, and you can pass on every candidate.

Restrictions also arise automatically, from cancelling an agreed date or not turning up. A restriction means you are not shown among other people’s candidates, or you cannot draw new candidates, and it lasts no more than 30 days.

One restriction rests on another user’s report: if the person you were meeting reports that you did not turn up, the restriction follows automatically. You can file your own report within 24 hours, which lifts it. You can also ask for the decision to be looked at again by writing to the address in section 1, and a person will then review it.

A safety report never triggers a restriction automatically.

11. Your rights

You have the right to

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have data deleted, to the extent the law allows (section 9);
• restrict processing, and object to it where the basis is legitimate interest;
• receive the data you gave us in a portable form;
• withdraw consent, where the processing rests on it;
• not be subject to a decision based solely on automated processing (section 10).

Some of this you do yourself: you change your profile and preferences in settings, you stop sharing your position with one tap, and you delete your account in settings. Send other requests to the address in section 1. We will confirm that the request comes from you and answer within one month. If the request is extensive we may extend that by two months, and we will tell you if we do.

If another user has filed a safety report about you, you cannot see what it says. Otherwise the person who filed it would be identifiable and reporting would become impossible. You can still ask us to confirm whether we hold such data about you.

Complaining to the supervisory authority

If you believe we are processing your data unlawfully, you can complain to the Office of the Data Protection Ombudsman: PO Box 800, FI-00531 Helsinki, switchboard +358 29 566 6700, tietosuoja.fi. We would rather you came to us first.

12. How we protect your data

The account has no password: you identify yourself with your phone number and a one-time code, and each device signs in separately. We store only a hash of the session token, and on the phone the token is held in the operating system’s secure store.

Connections between the app and the server are encrypted. Admin access is limited to those who need it for their work, and shared positions do not appear in the admin view at all.

13. When we change this policy

Every version has a date, shown at the top of this page. The app shows the same version alongside the terms and records the version you accepted.

If a change affects what is done with your data, we will tell you in the app before it takes effect. Smaller changes, such as corrected contact details, we publish here directly.