Voapo Privacy Policy
Version 2026-11-01
Voapo is an app for gay, bi, trans and queer men to meet people nearby. We know that using it can say a lot about you. This policy explains what data we process, why, for how long, and your rights.
The essentials
- We do not sell your data. We do not share it with advertisers. There are no third-party ads in Voapo.
- Nobody sees where you are: we store an approximate, shifted location, and other people only see a distance range, which you can hide.
- You can delete your account from the app at any time, and it is really deleted.
1. Who is responsible
[TITULAR], tax ID [NIF], registered office [DOMICILIO] ("Voapo", "we"). Privacy contact: [EMAIL_PRIVACIDAD]. Data Protection Officer: [DPD].
2. What data we process
| category | examples | source |
|---|---|---|
| Account | email, user ID, sign-up date, Sign in with Apple or Google | you |
| Date of birth | only to check you are an adult; never shown | you |
| Profile | name or nickname, photos, text, height, weight, position, relationship status, what you're looking for, tags | you (all optional) |
| Approximate location | a cell of about 500 m randomly shifted, and your country | your phone, with your permission |
| Messages and photos | what you send in chats and albums | you |
| Interactions | hellos, favorites, profile views, blocks | your use of the app |
| Reports | what you report or what others report about you | you and other users |
| Purchases | plan, store, dates; we never see your card | Apple, Google, RevenueCat |
| Technical | push token, device type, error logs without content | your phone |
| Consents | what you accepted, which version and when | you |
Special category data. Using Voapo may reveal your sexual orientation, and what you write may reveal health or sex-life data. We process this only with your explicit consent (GDPR art. 9(2)(a)), given separately at sign-up and withdrawable at any time. If you withdraw it, we cannot keep providing the service and will offer to delete your account.
3. Purposes and legal bases
| purpose | legal basis |
|---|---|
| Create and run your account, show your profile, the grid and chats | contract (art. 6(1)(b)) + explicit consent for sensitive data (art. 9(2)(a)) |
| Check you are an adult | legal obligation and protection of minors (6(1)(c)), legitimate interest (6(1)(f)) |
| Approximate location to show people nearby | consent (system permission) and contract |
| Moderate photos, handle reports, prevent fraud and abuse | legitimate interest in a safe service and legal obligations (Digital Services Act) |
| Detect and report child sexual abuse material | legal obligation and vital interests of children |
| Country-based safety measures (hide distance, alerts) | vital and legitimate interests in your safety |
| Manage subscriptions | contract and accounting obligations |
| Usage statistics | consent (optional, off by default) |
| News emails | consent (optional) |
| Respond to authorities | legal obligation, always after the review in section 4 |
We do not make solely automated decisions with legal effects on you. Automated photo moderation only holds content for review or rejects clear cases; you can ask for human review.
4. Who else sees your data
- Other users: your profile (no date of birth, no location), a distance range unless hidden, whether you're online, and what you send them.
- Service providers acting for us (processors under art. 28 contracts): hosting and database (Supabase, EU servers), subscriptions (RevenueCat), notifications (Expo, Apple, Google), automated image review and child-abuse detection, email delivery and error logging. Current list: voapo.com/en/processors.
- Apple and Google when you buy a subscription: they are responsible for that payment.
- Authorities: only where the law requires it and after checking that the request is valid and proportionate. We review with particular care any request that could be used to persecute someone for their sexual orientation or gender identity, and challenge it where the law allows.
- Child-protection bodies: if we detect child sexual abuse material, we report it as the law requires.
Never: advertisers, data brokers or ad networks.
5. International transfers
Some providers are in the United States or other countries. We rely on GDPR safeguards: adequacy decisions (such as the EU-US Data Privacy Framework where the provider is certified) or standard contractual clauses, with extra measures where needed. You can ask us for a copy.
6. How long we keep data
| data | period |
|---|---|
| Account, profile, photos, messages | while you have the account; deleted immediately when you delete it (backups overwritten within 30 days) |
| Inactive accounts | deleted after 24 months without signing in; we email you 30 days before |
| Temporary photos | deleted after being viewed; withdrawn messages within 24 hours |
| Profile views | 30 days |
| Location | overwritten on each update; deleted with the account |
| Reports and moderation decisions | up to 12 months after resolution unless the law requires longer |
| Content reported as illegal | as needed for the investigation and as long as the law requires |
| Purchase records | as required by tax and accounting law |
| Consents | while you have the account and up to 3 years after, to prove you gave them |
7. Security
Encryption in transit, row-level access control in the database, location never exact nor sent to other users, private photos only through short-lived links, removal of photo metadata (including GPS), notifications without content, optional PIN and biometrics, and screenshot blocking inside the app. No system is perfect: if a breach affects you, we will tell you and notify the regulator within 72 hours as the GDPR requires.
8. Your rights
You can access, correct, delete, object to or restrict the use of your data, take it with you (portability) and withdraw consent at any time. Write to [EMAIL_PRIVACIDAD] from your account email. We reply within one month. Much of this you can do yourself in the app.
You can complain to the Spanish Data Protection Agency (aepd.es) or your local authority. UK: UK GDPR applies; you can complain to the ICO. Brazil: LGPD applies; contact our DPO ([DPD]) or the ANPD. California and other US states with privacy laws: you can know, delete, correct and limit the use of sensitive data; we do not sell or "share" personal data as defined by those laws.
9. Minimum age
Voapo is for adults 18+ only. Accounts belonging to minors are closed and their data deleted. If you think a minor is using Voapo, report it in the app.
10. Website
voapo.com uses only strictly necessary cookies. If we ever add analytics or non-essential cookies, we will ask first.
11. Changes
If we change something important, we will tell you in the app and, where the law requires, ask for your consent again.