Version 2026-10-19
When this policy changes. Every version carries a date, and the date is shown at the top of the document inside the app, so a member told they accepted a particular version can go and read that version.
A change that matters brings up one screen the next time the app opens. It says the documents have changed, links to both, and asks for a tap to carry on. Until that tap the app cannot be used. Nobody is signed out for it, nothing about an account or its matches changes, and the same screen carries a Delete Account button so declining is a real option rather than a dead end.
A change that does not matter brings up nothing. Fixing a typo or rewording a sentence for clarity does not move the date and does not interrupt anybody. The test is whether the change takes something away or adds an obligation. If it does, the date moves and everybody sees the screen.
What is recorded is which version a member accepted and the moment they accepted it. That is kept for as long as the account exists, because it is the answer to "what did I agree to".
Nobody under 18. SMOLDR is for adults, and a person under 18 may not create an account or use the app under any circumstances. This is the one rule with no exception and no appeal.
SMOLDR does not knowingly collect anything from anybody under 18. A birthdate is taken at signup and an account that does not reach 18 is refused, but a date typed into a box is only as honest as the person typing it. If SMOLDR learns that an account belongs to somebody under 18, a person reads the report and the account is hidden or removed, and what was held about it is deleted.
Anybody can raise it, and no account is needed to do so. From inside the app it goes through Write to Us. From outside, privacy@joinsmoldr.com reaches a person. A parent or guardian who believes their child has an account should use either route and does not need to prove anything first: SMOLDR would rather look into it and find nothing.
SMOLDR LLC, a Florida limited liability company, is the company that collects and holds everything described below. It is registered with the State of Florida under a registered-agent address, and the filing is public at search.sunbiz.org.
Naming the company is the one thing a privacy policy cannot leave out. Everything else here describes what is collected; this says who is answerable for it.
The written route to SMOLDR about your own data. The published postal address is the registered agent's, which is public by design, so printing it costs nothing and keeps a home address off a document anybody can read:
SMOLDR LLC
c/o Northwest Registered Agent LLC
7901 4th St N Ste 300
St. Petersburg, FL 33702
Support inside the app stays the fastest route and the one most members will use. The postal address exists because a privacy policy has to offer a way in that does not depend on still having an account, which matters most for somebody who deleted theirs or was removed.
privacy@joinsmoldr.com.
Phone number. It is how somebody signs in: SMOLDR texts a six-digit code to it, and there is no password on a SMOLDR account at all, so there is no password held, leaked or stolen. The code is kept by the authentication provider only until it is used or expires a few minutes later.
Display name and bio: shown to other members
Birthdate: collected once at signup, never editable after. Only the calculated age is ever shown to others, never the raw date
Looking For preference: used for matching, never shown on a profile
Profile photos (up to 6)
Chat messages and any images sent in chat. Inside the app these are visible only to the two people in that match. They are stored in readable form, which means whoever administers SMOLDR's database can read them. That is set out in full under Admin access below, because a member should not have to work it out.
Swipes (like/pass): never shown to the other person directly; drives matching and the Likes tab
Matches and blocks
Support requests and reports: category, free-text message, optional screenshot, optional reported-member id
Support messages sent by SMOLDR to a member, and any reply, are kept with the request they belong to, so a conversation is stored and shown as one thing.
A member can remove their own sent messages from the Support screen, and SMOLDR keeps its copy. This is stated plainly because it is the kind of thing a member could reasonably assume works the other way. Hiding a message takes it off their phone; it does not withdraw a report or stop us acting on one. A report matters most after the person who filed it has stopped looking at it.
Which of SMOLDR's own messages a member may delete outright is set out in Product & Policy Notes. In short: anything that is a live constraint on the account stays, and anything that exists for the member's convenience can go.
Bookkeeping timestamps that are not about anybody else: when setup was finished, and which of two people completed a match. Both exist so the app can behave correctly - one keeps a half-finished member out of the pool, the other stops telling somebody about a match they are already looking at - and neither is shown to another member.
Deletion feedback: deliberately anonymous, collected with no member id attached at all, by design
Membership level, expiry, and Notes balance
Relationship status and relationship style, if a member fills them in. Both are optional, both can be cleared back to empty at any time, and both are shown on that member's card to anybody who can see the profile. They are listed separately here because relationship style in particular can reveal something a person may consider sensitive, and because it is written by the member for other members to read rather than collected quietly by the app.
Gender and sexuality, if a member fills them in. Both are optional, both take a write-in rather than a fixed list, and both are shown on that member's card to anybody who can see the profile. They are also what the Gender and Sexuality filters read, so leaving either blank changes who a member appears to.
When the app was last opened. One timestamp, overwritten each time, so there is no history of when somebody has used SMOLDR and nothing that could show a pattern, only the most recent time. Members on a paid plan see it on other people's cards, as a day rather than a time: Active today, Active yesterday, or a number of days. A clock time is never shown to anybody, and a free member is not sent the value at all. It also drives one filter, Recently Active, which lets a paying member leave out profiles nobody has opened in the last week.
Where the member is, read from their phone's GPS. This is the most sensitive thing SMOLDR collects and it is handled differently from everything else on this list, so it is worth being exact about what happens to it.
The position is rounded to about a third of a mile before it is written down, so what is stored is a neighbourhood rather than an address. Only the latest one is kept: there is no location history, no record of anywhere a member has been, and nothing that could reconstruct a journey.
No other member is ever given a position. What they are shown is a distance in whole miles, worked out on the server and sent as a single number. This is deliberate and it is the reason the whole feature is built the way it is: an app that knows other people's coordinates can find somebody's home by measuring from three places and seeing where the circles cross, which is how other dating apps have exposed their members in the past.
Location is read while the app is open and never in the background. It is used for one thing, which is deciding who appears in Discover and how far away they are. It is not used for advertising, it is not sold, and it does not leave SMOLDR.
A member who declines the location permission keeps their account, their matches and their messages. Only Discover stops working, because a deck of people nearby cannot be built without knowing where anybody is.
One number is recorded about attempts to fake a location: how many times the phone reported a position that the operating system had flagged as coming from a fake-GPS app. The faked position itself is discarded rather than stored.
Visibility preferences (Hidden, match-preference toggles)
Push notification device token, one per device. It identifies the phone, not the person, and it is re-pointed to whoever signs in on that device. Signing out deletes it.
A device code SMOLDR creates for your phone. The app makes up a short random code the first time you sign in and keeps it on that phone. It is not your phone's serial number, it is not tied to your name, and it is never shared with anyone. It exists so SMOLDR knows which phone is currently signed in, can sign out any other, and can tell the phone being signed out why it happened.
Notification preferences, one on/off switch for each of the six notification categories.
None of the following should ever be described as collected until they actually exist:
Crash reports and analytics: whichever vendor is chosen becomes a named third party
Payment data: handled by the app store or payment processor, not stored by SMOLDR directly, but must still be described
Travel Mode, when it ships, will store the real location alongside the displayed one. It has to: location is locked to the phone's GPS precisely so nobody can fake where they are, and a sanctioned exception can only be told apart from an actual spoof if both are known.
Any signed-in member can see an approved, non-hidden profile: name, age, Looking For (behind the scenes only), bio, and photos.
Profile photos are private files. They are not public links and cannot be opened by someone who is not signed in. Each one is served as a signed link that expires after an hour, and every request is checked against the same rule that decides whether that member may see the profile at all, so hiding, blocking, suspension and an unapproved profile each cut off the photos as well as the profile. A member always keeps access to their own. Worth stating plainly in the final policy, since the limit is real: this cannot reach a picture somebody already saved to their own device, and it cannot stop someone re-posting one elsewhere. What it prevents is a photo remaining fetchable by anyone holding a link, indefinitely, whether or not they use SMOLDR.
Incognito Mode, an Amplify feature, hides a member from everyone except people they have liked, people they have sent an Introduction to, and people they already matched with. It hides the whole profile including the photos, not just the card in Discover, because the same permission rule governs both. Nothing extra is recorded while it is on: no log of who looked, no history of when it was switched, only the setting itself. It stops applying by itself if the membership lapses.
SMOLDR does not detect screenshots and does not attempt to block them. Nothing is recorded when someone takes one, and no notification is sent to anyone. Sharing another member's private photos is prohibited by the Terms instead.
An unapproved or hidden profile is visible only to its owner, plus anyone with an existing match.
The two members in a match can see their own conversation and any images sent in it. Nobody else can, including by guessing a direct link.
Blocking is asymmetric on purpose: the person who blocked someone can see only that person's name, enough for a usable block list. The blocked person cannot see the blocker's profile at all. This exists specifically to prevent "block an ex, then keep monitoring them."
Reports are one-directional: a reported member is never told who reported them.
A new Like reveals only a timestamp, never a name, below the paid level that unlocks identities.
Messages are not end-to-end encrypted. They travel encrypted, they sit on encrypted disks, and the app shows a conversation only to the two people in it. SMOLDR's own database holds them in readable form, and whoever administers that database can read any message in the app. Today that is one person.
What is promised instead is restraint. Conversations are not read as a matter of course, they are not read out of curiosity, and there is no routine, automated or bulk reading of anybody's messages. A reported conversation may be read when the report cannot be answered from what was submitted with it: only that conversation, only when it is needed, and only as a person's decision rather than automatically.
Moderation has no way to browse conversations. Reviewing a report shows what was submitted with it, not a door into two people's chat history.
SMOLDR tells one member some things about another member's activity, and what you can see depends on what you pay. Today that is Read Receipts, where an Amplify member sees when their message was read.
Account deletion is member-initiated and frictionless by design (type "delete," no retention offers). It deletes the account and everything tied to it: profile, photos, messages, chat images.
Messages are kept for 90 days after a conversation ends, whether it ended because an account was deleted, or because somebody unmatched or blocked. When an account is deleted the profile, the photos and the account itself go immediately. Either way the messages disappear from the app in the same instant, for everybody including the other person in the conversation, and are erased for good 90 days later. After that there is nothing left to give anybody.
They are kept for one reason: so a complaint or a request from law enforcement that arrives just after somebody leaves can still be answered. Until now it could not. Deleting an account erased every message that person had ever sent, including from the other side of the conversation, so somebody could harass a member, delete, and take the evidence with them. The person harassed also lost their own record of what happened to them.
It is not a recycle bin. The account cannot be recovered and neither can the conversation. Deletion stays immediate and final, and somebody who wants to come back builds a new account.
Who can still see them, said exactly. Nobody using the app can, and that includes the other person in the conversation: no screen anywhere shows them. SMOLDR can, through the database, because a complaint that cannot be read cannot be answered and that is the only reason these are kept at all. They are not browsed, they are opened when a specific complaint or a lawful request names a specific conversation, and 90 days later the question stops arising because there is nothing there.
What a member can ask for, and how. Both stores expect this spelled out, and it was the one section missing.
Delete the account: Account, then Delete Account, inside the app. No retention offers and nothing to argue with. Apple requires deletion to be reachable in-app for any app that lets you create an account, and it is.
Delete the account without the app: joinsmoldr.com carries a deletion request form that does not need a sign-in or an install. Google Play requires a route that works for somebody who has already uninstalled, and the in-app button alone does not satisfy it.
A copy of the data: privacy@joinsmoldr.com. What is sent back is the profile, the photos, the messages sent, and the reports filed. Answered within 30 days.
A correction: most of it is editable on the profile itself. Anything that is not, including a date of birth entered wrongly at signup, goes to the same address.
A question about any of this goes to the same address, and it reaches a person rather than a queue.
US state privacy rights. Several states give residents specific rights over their data, and the wording differs by state even where the right is the same. SMOLDR gives every member all of them regardless of where they live, because running one set of rules is simpler than running twelve and nobody should get less for being in the wrong place.
The right to know what is held about you, and to get a copy.
The right to have it corrected.
The right to have it deleted.
The right not to be discriminated against for asking. Nothing about an account changes because somebody exercised one of these.
SMOLDR does not sell personal information, and will not. It is not shared for advertising of any kind, in the wording California uses, not for cross-context behavioural advertising either. There is no advertising in SMOLDR, no advertising identifiers, and no data broker relationship. There is nothing to opt out of because there is nothing being done. This is a commitment rather than a description of how things happen to be arranged today.
SMOLDR does not use personal data for profiling that produces legal or similarly significant effects, and there is no automated decision-making of that kind anywhere in the app. Moderation decisions are made by a person.
How to exercise any of them: privacy@joinsmoldr.com, or the deletion route already described. Answered within 45 days, which is the tightest deadline any of these states set. Identity is confirmed through the account itself, and nobody is asked to send documents.
An authorised agent may make a request on somebody's behalf where a state allows it. SMOLDR will ask for written proof that the member appointed them.
Dormant accounts are deleted after 24 months. If nobody signs in for two years the account and everything tied to it is removed, the same as a deletion the member asked for.
Two years rather than one, and the reason is the case that would be worst to get wrong: somebody meets a person on SMOLDR, is with them for fourteen months, it ends, and they come back to find everything gone. People disappear from a dating app for a year on purpose, and deletion is the one thing that cannot be undone. Two years is also what the larger apps use.
No warning is sent first. A dormant member does not open the app, so the only ways to reach them are a push, an email or a text, and SMOLDR does not send notifications designed to pull somebody back. "Come back or we delete you" is that message wearing a warning's clothes. The notice is here, in the document agreed to at signup, which is the honest place for it rather than a text two years later. An account with an active paid membership is never deleted for inactivity.
No fraud fingerprint is kept for one of these. When a member deletes their own account SMOLDR keeps a scrambled fingerprint, which is what stops somebody deleting and rejoining to collect a fresh set of free Notes. That is not applied here, because SMOLDR removed this account rather than the member choosing to, and somebody who comes back after we deleted them should arrive as a new member and not as a suspected one.
Ending a match, by unmatching or blocking, closes that conversation for both people at once and keeps the same 90 days. It disappears from both Matches lists immediately, neither person can open it, read it, or add anything to it ever again, and the messages and the photos in them are erased on day 91. The reason is the one that keeps a deleted account's messages: somebody who blocks a person to get away from them should not have destroyed the evidence a report would need, and a report carries a category, a few lines of text and one optional screenshot, never the conversation.
Deletion feedback survives deletion but is anonymous and cannot be linked back to anyone.
Signing out deletes that device's push notification token, so a member who signs out stops being reachable on that phone. Signing in on a shared or resold phone moves the token to the person now signed in, rather than leaving it pointed at the previous account.
ONE THING IS INTENDED TO SURVIVE ACCOUNT DELETION, AND IT MUST BE STATED PLAINLY: an irreversible, one-way scrambled version of the phone number. This is pseudonymised data, not anonymous data. A scrambled version of an identifier is still personal data under most privacy law, because the same phone number always produces the same result. The policy cannot claim "we delete everything," because that would be false in the one section people read most carefully.
Two permitted uses, and they are different in kind. One: knowing whether a signup is somebody returning or somebody new. That is not a statistic for publication, it is operational, and it is what decides the free Notes a new account starts with, since a returning account does not get another set. Two: stopping somebody who was removed from signing straight back up, and flagging a minor's number on deletion for the same reason. It is never used to profile behaviour, target advertising, or reconstruct a deleted account.
The stored value is an HMAC-SHA256 digest keyed with a secret that is held outside the database, so it cannot be turned back into a number by anybody, including SMOLDR.
Hashing alone would not have been enough, and it is worth saying why rather than just claiming the word. There are only about ten billion possible phone numbers, so a plain hash of one is undone by trying all of them, which is a few seconds of work. The secret key is what makes that impossible, and keeping it outside the database is what stops it being read by whoever can read the data.
Law enforcement, and where the line falls. If an agency names a number, SMOLDR can run it through the same process and say whether it matches: that number held an account, deleted on this date, this many times. If an agency asks for the numbers behind our records, there is nothing to hand over. That is not a refusal, it is an inability, and it is deliberate. A request about a CURRENT member is a different thing and is answered in full, because that number is live in the account rather than reduced to a fingerprint.
In plain language, and this is the wording itself rather than a note about it: "When you delete your account we delete your profile, photos, messages, and everything you sent. We keep one thing: a scrambled fingerprint of your phone number. It cannot be turned back into your number, not by us either. We keep it so we can tell whether someone signing up has been here before, and to stop someone who was banned from simply signing up again."
A removal is permanent, so the phone number tied to it is kept indefinitely. This is longer than anything else SMOLDR retains and it is deliberate: a ban that quietly expires because the record aged out is not a ban. It is a narrow keep, the number and the fact of the removal, not the profile, which is deleted like any other. A self-deleted account is different and keeps its number for 90 days, because that record only exists to stop the signup bonus being farmed.
A fingerprint is kept indefinitely.
Answered above: a report outlives the member who filed it, with their identity replaced by an irreversible reference so that distinct reporters can still be told apart. The retention clock is the report's own, not the reporter's.
Chat images do not expire on their own. Today a photo lives as long as the match, and there is no timer of any kind. A blanket timer would quietly hollow out a conversation two people valued, ordinary photos and all, so it will not be added.
The timer starts when the recipient opens the photo, not when it is sent. SMOLDR's photos arrive covered and are not downloaded until she taps, so a send-time timer would expire pictures she never saw.
What expiry actually does is stated plainly where the sender chooses it: it removes the photo from the conversation and from SMOLDR. It cannot stop somebody photographing their own screen. That protects against her phone being picked up by someone else months later, or the two of them falling out and her scrolling back; it does not protect against her in the moment. Saying so is the same rule that ruled out screenshot blocking and nudity detection, which is that SMOLDR does not imply a safety it cannot deliver.
Deleted data survives in backups for a while, and the policy says so. Deleting an account removes it from SMOLDR immediately, but the hosting provider takes its own automated backups and a deleted row sits inside those until the backup itself ages out. Nobody at SMOLDR reads a backup to find deleted data, and a backup is only ever restored to recover from a failure, never to look somebody up.
This is stated rather than glossed because gone in the app and gone everywhere are different claims, and only one of them is true on the day. Saying deletion is immediate and complete, while a copy exists somewhere for weeks, is the kind of small dishonesty that costs everything when somebody finds out. The exact window is the provider's retention period and belongs in the published policy as a real number once it is confirmed with them.
One consequence worth carrying: a member who deletes an account and immediately creates a new one is a new account to SMOLDR, not a restored one. Nothing is pulled back out of a backup, which is also why the signup bonus cannot be farmed that way.
Database, authentication, and file storage provider: the primary data processor.
Build and update pipeline for the app itself.
The provider that delivers the sign-in code by text. It is given the phone number and the code, because sending the message is its whole job. It is given nothing else: no name, no profile, and no indication of whether the number belongs to an account.
Planned: an email/notification provider for support replies, a payment processor, and a crash/analytics vendor once chosen.
Nobody can find out whether a particular phone number has a SMOLDR account. Entering a number sends a code to that number, and the screen says the same thing either way, because the only place the answer appears is on the phone that owns the number. Somebody testing an ex's number, or a colleague's, learns nothing and reads nothing. This is a real, deliberate protection against a common stalking and outing tactic, worth describing in the policy rather than leaving invisible.
A different risk arrives with it, and it is worth naming here rather than discovering later. Nobody can learn anything by entering someone else's number, but they can make that person's phone buzz, and every message costs real money to send. There is a cap on how many codes SMOLDR will send in an hour across the whole app. The protections are that ceiling and the Terms, which treat repeatedly triggering codes to somebody else's phone as harassment in its own right.
The screen says so before the button, not after. Anyone entering a number is told that a code is going to that number, in those words rather than "your phone", while they can still change their mind. One sentence, and deliberately no gloss explaining that the owner will therefore see it: that would only be explaining the situation to the one reader who already understands it. Said afterwards this would only be a receipt. Said beforehand it tells a person probing somebody else's number that the owner is about to find out, and it reads to everyone else as an ordinary check that they typed their own number correctly.
The text message is deliberately plain: it names SMOLDR and carries the code, nothing else. Receiving one without asking for it creates nothing, because an account exists only once a code has been entered back into the app.
No push notification names anyone. Every notification reads that someone did something, never who. A lock screen is read by whoever is holding the phone, which is not always the member, so nothing about another member is disclosed there. The only exception is a message from SMOLDR itself, which shows its own subject because it is not about another member.