Reveal Privacy Policy

Who this policy is for

Reveal is a dating and communication service for people aged 18 and over. This policy covers the app and its web version. We do not sell conversations and do not promise absolute security. The personal data controller is Dzmitry Maiseyenka. Contact for requests: Botikigames@gmail.com.

Data we process

Registration data: email address, account and session identifiers, and email verification information. Passwords are handled by Supabase authentication; the app does not show them to other people.
Profile data: name, date of birth, gender, dating preferences, biography, interests, city and country, optional personal details and photos. Distances may be calculated from the location you select. Your precise coordinates must not be disclosed to other users as an address.
Conversations and games: questions, answers, choices, messages, photos, voice messages and transcripts, matches, blocks, reports, AI companion memory and interaction history. Messages and a limited context surrounding a report may be recorded for safety purposes.
Technical data: IP addresses and infrastructure logs, installation/session identifiers, and a push token if that feature is enabled. The service logic does not require phone contacts, an advertising identifier or continuous background location. Do not enter passport, banking, medical or other unnecessary sensitive information in open text fields.

Purposes and legal bases

Contract (Article 6(1)(b) GDPR): registration, profiles, communication, game actions and handling requests. Legitimate interests (Article 6(1)(f)): protection against spam and abuse, investigating reports and defending legal claims, subject to a proportionality assessment. Legal obligations apply where relevant (Article 6(1)(c)).
Consent (Article 6(1)(a)): permitted optional processing and sending selected data to an external AI provider. Gender, preferences and free text may reveal sexual orientation or other special categories of data. Processing and displaying such information requires separate explicit consent (Article 9(2)(a)); do not post it unless you wish to disclose it. Refusing or withdrawing consent does not prevent access to documents, account management or local games.

Who receives data

Other participants see published profile elements, game answers and messages in their respective context. We cannot fully control screenshots or subsequent actions by recipients.
Supabase is used for authentication, the database, files and server functions. Hosting for botikigames.com is provided through AVA Hosting. The OpenAI API is used for AI responses, text/photo moderation and, when the relevant features are enabled, speech recognition and speech generation. Apple receives the data necessary for permitted push notifications. Other recipients are allowed only for disclosed purposes or in response to a justified lawful request.
Only the context needed for a particular feature is sent to external AI: the question/message text, limited history and available profile context; for media features, the selected photo, audio recording, transcript or text to be spoken. A separate screen explains this before transmission. AI participants are labelled; their responses may be incorrect and are not professional advice.

International transfers and providers

Providers may process data outside the EEA. The app database is in the Supabase eu-central-1 region (Germany); this does not guarantee that all technical data is processed only in the EEA. Before release, the operator must confirm processing agreements and applicable safeguards, such as an adequacy decision or standard contractual clauses and a transfer assessment. Do not assume all data stays in Poland or the EU.
OpenAI states that API data is not used for training by default. This is not a promise of zero retention: abuse-prevention logs and lawful exceptions may apply. Our store:false request is not the same as Zero Data Retention. The operator's actual contractual settings remain subject to verification.

Controls and your rights

You can edit your profile/visibility, block and report others, withdraw AI consent and sensitive-profile consent, and delete your account. Device permissions for the camera, photos, microphone, location and notifications do not replace consent to sending data to external AI.
For access, rectification, portability, restriction, objection or erasure, contact the project. Under the GDPR we normally respond within one month; complex requests may take longer with an explanation. You can complain to UODO (uodo.gov.pl) or the authority where you live or work. Decisions with significant effects on a user must allow human review; AI must not independently impose final sanctions.
Retention periods, deletion and exceptions are described in the separate Data Retention and Deletion document. Material changes are communicated before they apply; a new purpose or recipient requires updated information and consent where necessary.