Privacy policy

Pilke is an app for agreeing a date and then meeting face to face. This policy says what personal data we process when you use Pilke, who receives it, and what rights you have.

It also concerns somebody who does not use Pilke at all: the person whose phone number a user has saved as their trusted contact.

1. Who processes your data

The controller is [TO FILL IN: registered company name], business ID [TO FILL IN: business ID], address [TO FILL IN: address].

For anything to do with privacy, write to [TO FILL IN: email address]. Requests concerning your rights go to the same address (section 11).

2. What data we process

Account and profile

Data	What it is used for
Phone number	You identify yourself with it. The account has no password, and the login code is sent to this number.
Email address	We contact you about your account.
Nickname, gender and photograph	Shown to the people you may go on a date with.
Date of birth	We check that you are 18. Others are shown your age in years only.
Language	Decides which language your notifications and text messages are in.
Date preferences	Who you are interested in, what kind of date you are looking for, the ages you want to be offered, and the languages you want to speak.
Date area	The areas, drawn in advance by Pilke, that you have chosen on the map: where you could go on a date. Also a point and a radius derived from them.
Trusted contact’s phone number	Optional. The safety button sends a message to this number.

Dates

We process the times you mark as free in the calendar, the candidates offered to you and which of them you chose, invitations sent and received, agreed times and venues, cancellations and their reasons, and the feedback given after a date. We use your feedback answers when we pick your future candidates. They say what you are looking for, and they are not a rating of the person you met.

Whether you want to meet again

After a date we ask whether you would like to meet the person again. There are three answers: yes and my phone number may be shared with them, yes but only through Pilke, and no. We store your answer with that date.

If you both choose to share the number, each of you is given the other’s nickname and phone number: in a push notification and on that date in the app’s date history. If you both answer yes but either of you chose through Pilke, the two of you can be offered to each other again, and nothing is disclosed. If either of you answers no, nothing happens and nothing is disclosed.

We do not tell the other person what you answered. A refusal produces no notification of any kind to either of you, so that saying no looks to the other person exactly like not having given feedback at all.

The answer is final: it cannot be changed or taken back once you have submitted your feedback. If you file a safety report about the other person in the same feedback, no numbers are exchanged, even if you both asked for it. A report can only be filed in that same feedback, not afterwards.

Device and notifications

Sending push notifications requires a token from your device. We store the token and the device platform. We also store which notifications we have sent and whether they arrived.

Each device you have signed in on leaves its own record, so that you can sign out of one device at a time.

Question sets

You answer the personality quiz when you create your profile, and its answers affect the order your candidates come in. You can also answer optional question sets, whose answers we use for the same purpose. You answer every question set by picking an option; there is no free text in them.

Safety records

We process a safety report, the options chosen in it and its free text, a conduct report, a report that the other person did not turn up, a record that you pressed the safety button and who the message went to, and the record that, after a safety report, the two of you are never suggested to each other again.

A conduct report is filed only if you choose to: in the feedback after a date you can tell Pilke staff how the person you met behaved. We store who filed it and about whom, which date it concerns, the options you chose, any free text you wrote, and how far its handling has got. Only Pilke staff can see it.

If you say in the feedback after a date that the other person did not turn up, we store it as a no-show report. Only Pilke staff can see it, and the other person never sees it. It brings no restriction: a restriction follows only from a report made during the date, at the venue (section 10).

Safety and conduct reports are the only places in the service where free text can be written about another person. Write down only what happened.

What we do not collect

We use no analytics and no advertising identifiers, we set no cookies on this site, and we do not ask for your home address. The service has no chat, so there are no messages between users. We read your device location only as described in section 3.

3. How we handle location

Location means two different things in Pilke.

Your date area

You choose, on a map, which of the areas drawn in advance by Pilke you could go on a date in. You choose them yourself, and the choice does not come from your device’s positioning. We use it to decide which venues are within reach and who we can offer you: a venue is picked from an area you have both chosen. We store the areas you chose, and a point and a radius derived from them that cover them, which older versions of the app use to draw the map. Other users cannot see your area, and you can change it in settings at any time.

Your location at the venue

When a date is about to start, you can share your location with the person you are meeting so that the two of you can find each other. The location is exact, and we ask for permission separately.

Sharing is limited in five ways:

1. The date has been agreed and has a venue.
2. The window is 40 minutes: from 20 minutes before the agreed start to 20 minutes after it.
3. You are within 300 metres of the venue. Your device checks the distance before it sends anything, and the server checks it again.
4. Only the person you are meeting can see it. No other user can, and it does not appear in our admin views.
5. The location is deleted when the window closes. If you stop sharing yourself, it is deleted immediately and no record of it is kept.

Sharing continues if you leave the app or put the phone in your pocket. We say so in the app as well, when we ask for permission. The location is not used for anything other than helping the two of you find each other.

4. What other users see about you

Another user sees your nickname, age, gender and photograph. They also see the agreed time and venue, the times you have offered them, and your location at the venue if you share it.

Another user does not see your email address, your date of birth, your trusted contact’s number, your date area, your preferences, any restriction placed on you, or the feedback you give or that is given about you.

They do not see your phone number either, with one exception: if the two of you have both chosen, after the date, that the number may be shared, you are each given the other’s nickname and number. If only one of you chooses that, or neither does, your number is told to nobody. Section 2 says how that question works.

5. Why we process your data, and on what basis

Purpose	Lawful basis
Creating your account and signing you in	Contract
Finding candidates from your preferences, feedback, area and calendar	Contract
Invitations, agreeing a time and venue, and cancellations	Contract
Notifications about invitations, arrivals and feedback requests	Contract
Sharing your location at the venue	Consent, which you can withdraw by stopping sharing
Answers to question sets	Consent, given by answering
Exchanging phone numbers after a date	Consent, given by choosing that answer
Safety: reports, the record that two people are not suggested to each other after a safety report, the safety button and restrictions	Legitimate interest — the safety of our users
Your trusted contact’s phone number	Legitimate interest — the user’s safety
Support and investigating misuse	Legitimate interest — proper use of the service

Exchanging phone numbers is the only place where we disclose your personal data to another user on the basis of your consent. The consent concerns one date, and it has an effect only if the other person gives it too.

The answer cannot be changed or taken back once you have submitted your feedback. If you withdraw your consent, the withdrawal affects what we do from then on, and it does not undo a disclosure already made: a number that has been sent cannot be taken off the other person’s phone.

So an exchange cannot be stopped afterwards. Before it happens, a safety report stops it — once one of you has filed a safety report about the other, no numbers are exchanged, even if both of you chose to — but a report can only be filed in the feedback for that date, not later. Once the numbers have been exchanged you can delete your account: your number disappears from the other person’s app, but that does not reach a notification that has already arrived either (section 9).

Your date preferences can reveal whether you are interested in the same or a different gender and whether you are looking for sex. That is special category data, and we process it only with your explicit consent, which you give when you set those preferences. You can change your preferences or delete your account at any time.

The free text of a safety or conduct report may describe acts that are criminal offences. We process such data only to protect users and, where necessary, to bring or answer a legal claim.

Where the basis is legitimate interest, we have weighed our interest against your rights. You can ask us for an account of that assessment at the address in section 1.

6. Who receives your data

Recipient	What they get
Other users	What section 4 describes.
The person you dated, when you both choose it	Your nickname and your phone number, once, after the date. This is the only disclosure that rests on your consent, and the only one that cannot be taken back.
Your trusted contact	One text message containing your nickname, if you press the safety button. It contains no position, no venue and nothing about the person you are meeting.
Expo (650 Industries, Inc., United States)	Your device’s push token and the content of the notification. Expo passes the notification on to Google’s FCM service.
GatewayAPI (Denmark)	The recipient’s phone number and the content of the message, when we send a login code or a safety message.
OpenFreeMap (Hyperknot Software Kft., Hungary)	Your device’s IP address and which map tiles it requests. The request comes from your device, not from our server. Its own policy says it does not log IP addresses.
Our hosting provider, [TO FILL IN: provider], Finland	All data in the service sits on its servers.
Pilke staff	What the admin view shows, where that is needed for support or to deal with a safety or conduct report. Shared locations do not appear in the admin view.
Google Play	What the app store receives as the distributor of the app.

We do not sell your data and we do not release it for marketing.

7. When data leaves Europe

Push notifications travel through Expo to the United States and on to Google’s FCM service. The transfer is based on the standard contractual clauses approved by the European Commission.

Every other recipient is in the EU or the EEA, and the servers your data sits on are in Finland.

8. How long we keep data

Data	Retention
Account and profile	As long as your account exists.
A location you have shared at a venue	Deleted when the window closes, at the latest 20 minutes after the agreed start, or immediately when you stop sharing.
Signed-in devices	90 days from when the device was last used.
Calendar entries and answers to question sets	For the life of the account; deleted with it.
Dates, invitations and cancellations	12 months from the date.
Feedback	12 months from the date.
Your answer about meeting again, and an exchanged phone number	12 months from the date, with the date itself. A copy of the number sits in the push notification that was sent, and that goes after 90 days.
No-show reports, including those made in the feedback, and the restrictions that follow from them	12 months from the report.
Notifications sent, and delivery records for text messages	90 days.
Safety and conduct reports, their free text, and records of safety button presses	5 years from the report.
The record that, after a safety report, the two of you are never suggested to each other again	Indefinitely. It does not lapse with time, and it is not undone by either person deleting their account.
A record of which version of the terms you accepted	As long as we may have to show what the processing was based on.

At the end of a retention period we delete the data or make it non-identifiable. If a support matter, a safety or conduct report or a legal claim is open, we keep what relates to it for as long as handling it requires.

9. When you delete your account

You can delete your account in the app’s settings. It happens immediately and cannot be undone. There is more detail on How to delete your data.

We delete your phone number, email address, nickname, date of birth, gender, photograph, trusted contact’s number, date preferences, date area, calendar entries and answers to question sets. The photograph is deleted from storage as well, and every device is signed out at the same moment.

There is one thing the deletion does not reach. If you have exchanged phone numbers with somebody you dated, your number disappears from their app at the same moment as your account, but a push notification that has already arrived cannot be taken back: the number is on their phone and it stays there. Our own copy of that notification goes after 90 days.

Two groups remain:

• Data that belongs as much to the other person. Past dates, the feedback given about them, and no-show reports. The other person sees Somebody where you used to be.
• Safety decisions that leaving must not undo. Safety and conduct reports, and the record that, after a safety report, the two of you are never suggested to each other again.

Both are kept for the period set out in section 8, and your name is no longer attached to them. A record that the account existed also remains, so that we do not create two accounts for the same number. You can register again with the same number; you get an empty account, and nothing links it to the old one.

10. How we make automated decisions

Finding candidates is automated, but it only produces a suggestion. You decide who to invite, and you can pass on every candidate.

Restrictions also arise automatically, from cancelling an agreed date or not turning up. A restriction means you are not shown among other people’s candidates, or you cannot draw new candidates, and it lasts no more than 30 days.

One restriction rests on another user’s report: if the person you were meeting reports that you did not turn up, the restriction follows automatically. You can file your own report within 24 hours, which lifts it. You can also ask for the decision to be looked at again by writing to the address in section 1, and a person will then review it.

A safety report never triggers a restriction automatically. A conduct report or a no-show reported in the feedback brings no restriction.

If two different users say in their feedback within 90 days that the same person did not turn up, or that their photos gave a different impression, Pilke staff are told. A person looks into it, and the alert by itself leads to nothing automatically.

11. Your rights

You have the right to

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have data deleted, to the extent the law allows (section 9);
• restrict processing, and object to it where the basis is legitimate interest;
• receive the data you gave us in a portable form;
• withdraw consent, where the processing rests on it;
• not be subject to a decision based solely on automated processing (section 10).

Some of this you do yourself: you change your profile and preferences in settings, you stop sharing your location with one tap, and you delete your account in settings. Send other requests to the address in section 1. We will confirm that the request comes from you and answer within one month. If the request is extensive we may extend that by two months, and we will tell you if we do.

Withdrawing consent affects processing from then on. You stop sharing your location with one tap, and you can change your date preferences at any time. The answer about meeting again cannot be withdrawn: once the numbers have been exchanged, withdrawing does not get them back. Section 5 says what withdrawing means in that situation.

If another user has filed a safety or conduct report about you, you cannot see what it says. Otherwise the person who filed it would be identifiable and reporting would become impossible. You can still ask us to confirm whether we hold such data about you.

Complaining to the supervisory authority

If you believe we are processing your data unlawfully, you can complain to the Office of the Data Protection Ombudsman: PO Box 800, FI-00531 Helsinki, switchboard +358 29 566 6700, tietosuoja.fi. We would rather you came to us first.

12. How we protect your data

The account has no password: you identify yourself with your phone number and a one-time code, and each device signs in separately. We store only a hash of the session token, and on the phone the token is held in the operating system’s secure store.

Connections between the app and the server are encrypted. Admin access is limited to those who need it for their work, and shared locations do not appear in the admin view at all.

13. When we change this policy

Every version has a date, shown at the top of this page. The app shows the same version alongside the terms and records the version you accepted.

If a change affects what is done with your data, we will tell you in the app before it takes effect. Smaller changes, such as corrected contact details, we publish here directly.