What Binder needs — and what it does not expose.
This policy describes Binder’s current beta architecture, including first-party ranking measurement and optional technical diagnostics.
Data we process
Account: authentication identifiers such as email and Supabase Auth metadata.
Private eligibility data: birth date and current location used to enforce 18+ access and discovery distance.
Profile and UGC: first name, bio, gender, interests, profile photos and messages you choose to create.
Optional profile attributes: height, smoking, drinking, drug use, exercise, diet, beliefs, whether you have children, whether you want children, and whether you have a car. Every one of these is optional, you choose each answer from a fixed list, you can clear any of them at any time, and a question you leave unanswered is simply not shown. Beliefs (religion or worldview) is a special category of personal data under Article 9 GDPR. Binder processes it only because you volunteer it by choosing an answer, and only to show it on your profile and to match against other people's filters — never for advertising, scoring or any other purpose. Your zodiac sign is shown on your profile but never stored: the server derives it from your birth date each time your profile is read.
Who you want to meet: the genders you select during onboarding, stored with your discovery preferences. Together with your own gender this can reveal sexual orientation, which is a special category of personal data under Article 9 GDPR. Binder processes it only because you provide it yourself when you set up your account (Article 9(2)(a) GDPR, explicit consent), and only for one purpose: to decide who may appear in whose deck. It is never used for advertising, scoring or any other purpose, and it is never shown to other users as a separate field.
Discovery filters: the attribute filters you set are stored with your discovery preferences. They work in both directions — somebody whose filters exclude you does not appear in your deck either, so a like cannot land in nothing.
Voice recordings: voice messages you record in a chat, and the optional voice intro on your profile. Recordings run up to sixty seconds, are stored in private buckets, and are never public files: a voice message can be heard only by the two people in that conversation, a voice intro only by people who may already view your profile. Moderators can listen to a recording only when it has been reported or is referenced by a message under review. Deleting a voice intro removes it; deleting your account removes your recordings.
Safety data: blocks, reports, report context snapshots, moderation state and abuse-control events. A report is evidence about somebody else, so it does not disappear when the account it is about is deleted: the link to the person is removed, the report and its snapshot are kept while a moderator is still working on the case and for 180 days after it is decided, then deleted. Article 17(3)(e) GDPR allows this — without it, the fastest way to end a harassment case would be to delete your own account. Blocks are not kept: the account id in a block can never return, so the row would protect nobody.
Device data: an Expo push token may be stored only if notifications are enabled in a configured build.
Beta ranking measurement: Binder can record the accounts involved in a discovery impression, rank position, shared-interest count, a coarse 10-km distance bucket and the later Bind/Pass result. Exact coordinates, profile text, message text and media paths are not copied into this ranking measurement.
Optional client diagnostics: if you explicitly enable Beta Diagnostics, Binder may record a fixed technical event or screen name, duration, a numeric counter, the success or error outcome, the operating system (Android today) and the app version. This channel does not accept free-form metadata, profile/message content, exact location, contact data, raw exception messages or stack traces.
Why we use it
- authenticate your account;
- enforce adult-only onboarding and discovery preferences;
- calculate candidate eligibility and rounded distance;
- store and deliver matched conversations, including voice messages;
- show the optional attributes you volunteered and match them against the filters other people set;
- prevent abuse, investigate reports and enforce blocks;
- measure whether discovery ordering and the core matching funnel work;
- diagnose beta load-time or render problems when optional diagnostics are enabled;
- operate account deletion and security controls.
Beta measurement choices
Core ranking and funnel measurement is generated by Binder’s own server from product actions and remains private from other users. Optional client diagnostics are separate and start disabled. You can enable or disable them in Profile → Beta Program. Disabling them deletes the existing optional client-diagnostic rows for your account.
Current retention targets are 30 days for optional client diagnostics and 90 days for discovery ranking observations. Private beta feedback and content-free server funnel records may be kept for up to 180 days while the beta is evaluated.
Infrastructure
Binder currently uses Supabase for authentication, Postgres data, private file storage, realtime delivery and first-party beta measurement. Expo infrastructure may be used for remote notifications when production push is enabled. Binder does not sell personal data to advertisers.
Account email: confirmation, sign-in and password mails are delivered by Brevo (Sendinblue SAS, France) on Binder's behalf, from no-reply@it-handwerk-stuttgart.de. Brevo therefore processes your email address and the delivery status of those mails. Brevo adds its own open and click measurement to transactional mail and does not offer a way to switch it off; Binder runs it in anonymised mode, so opens and clicks are not tied back to an individual recipient. This is delivery infrastructure, not advertising or profiling: nothing from it reaches the app, another user, or any third party.
Microphone
Binder requests microphone access only at the moment you start a recording, and only for that recording. There is no background listening, no automatic recording and no transcription. If you deny the permission, everything else in the app keeps working — voice is optional throughout.
Location
Binder requests foreground location for discovery. Exact coordinates are stored privately for server-side distance checks and are not returned to another user. Ranking measurement uses a coarse 10-km distance bucket instead of copying exact coordinates. Background location is not part of the current product.
Retention and deletion
When you request account deletion, Binder is designed to remove account-associated product data, authentication identity and account-linked beta measurement through database cascade. Certain safety or fraud-prevention records may need limited retention where legally justified; retained records should be minimized and separated from normal product use.
Use the account deletion page or the in-app account controls to initiate deletion.
How long conversations are kept
Messages are kept for as long as the match exists. They are not deleted on a timer, because a conversation with somebody you met a year ago is the point of the app and not a leftover. Deleting your account deletes them, and so does the other person deleting theirs. Beta measurements, safety reports and your last location are pruned on their own schedules, whether or not anybody asks.
Access and portability
Write to nullmesh@protonmail.com from the address your account uses and ask for a copy. You get what Binder holds about you — profile, preferences, matches, messages, photos and any safety records that concern you — as a machine-readable file, within one month, free of charge. The same address takes a request to correct something that is wrong. Asking for a copy is not the same as leaving: the account stays until you delete it, in the app or on the account deletion page.
Age
Binder is for adults only. The birth date given at sign-up is enforced on the server and cannot be changed afterwards. It is a declaration, not a document check: Binder does not ask for identification. An account found to belong to a minor is removed, and reports about one are handled at the highest priority.
Your choices
You can update profile information in the app, answer or clear any optional attribute, record, replace or delete your voice intro, deny microphone permission, deny location permission, disable push notifications, enable or disable optional Beta Diagnostics, submit private beta feedback, block or report another user, unmatch, and request account deletion.
Contact
Privacy questions: nullmesh@protonmail.com. The conduct rules behind the safety controls described here live in the Terms & Community Rules, and the child-protection commitments are published on the child safety standards page.