This is a translation. In case of discrepancies, the German version prevails.

Privacy Policy

1. Controller

Thomas Gnahm

Mainzer Str. 44

12053 Berlin

The appointment of a data protection officer is not required because fewer than 20 people are regularly engaged in the automated processing of personal data (§ 38 BDSG). For data protection inquiries, please contact contact@before.social.

2. Data Collected

We collect and process the following personal data:

Profile data: Name, date of birth, gender, orientation, relationship style, profile photos, bio text
Account data: Email address, encrypted password
Event data: Event attendance, check-in times
Matching data: Likes, matches, bookmarks
Messages: Chat messages between matched users
Usage data: Device information, app usage behavior (with consent)

Notice regarding special categories of personal data: Information about sexual orientation and gender preference constitutes special categories of personal data within the meaning of Art. 9 (1) GDPR. This data is processed exclusively on the basis of your explicit consent pursuant to Art. 9 (2) (a) GDPR, which you give when creating your profile. You may withdraw this consent at any time with effect for the future.

3. Legal Basis

Processing is based on:

Art. 6 (1) (a) GDPR - Consent (e.g. analytics, cookies)
Art. 6 (1) (b) GDPR - Performance of a contract (providing app features)
Art. 6 (1) (f) GDPR - Legitimate interests (security, prevention of abuse)
Art. 9 (2) (a) GDPR - Explicit consent for special categories of personal data (sexual orientation, gender identity)

4. Cookies & Tracking

We use the following services, which are activated only after explicit consent:

PostHog - Product analytics to improve the app (EU servers)
Sentry - Error detection and performance monitoring

You may withdraw your consent at any time in the app settings under "Privacy".

Technically necessary storage (e.g. authentication tokens, theme setting) is based on § 25 (2) TDDDG (German Telecommunications and Digital Services Data Protection Act) and does not require consent, as it is strictly necessary for providing the service.

5. Disclosure of Data to Third Parties

Your data is transmitted to the following processors:

Supabase Inc. (AWS eu-central-1, Frankfurt) - Database, authentication, file storage. Processing on behalf of the controller based on EU Standard Contractual Clauses (SCC).
Vercel Inc. (Edge Network, processing in the EU/USA possible) - Hosting of the web application. Data transfers based on the EU-US Data Privacy Framework.
PostHog Inc. (EU instance) - Product analytics, only with consent.
Functional Software Inc. / Sentry (USA with EU data processing) - Error tracking, only with consent. Data transfers based on the EU-US Data Privacy Framework.
Resend Inc. (USA) - Transactional emails. Data transfers based on the EU-US Data Privacy Framework.

Transfers to third countries outside the EU/EEA take place only on the basis of appropriate safeguards, in particular EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or an adequacy decision by the European Commission (Art. 45 GDPR), such as the EU-US Data Privacy Framework.

6. Retention Periods

Account data: Until your account is deleted
Messages: Until the account or chat history is deleted
Analytics data: A maximum of 12 months, then anonymized
Error reports: 90 days

7. Your Rights (Art. 15-21 GDPR)

You have the right at any time to:

Access (Art. 15 GDPR) - What data we store about you
Rectification (Art. 16 GDPR) - Correction of inaccurate data
Erasure (Art. 17 GDPR) - Deletion of your data / your account
Restriction (Art. 18 GDPR) - Restriction of processing
Data portability (Art. 20 GDPR) - Export of your data
Objection (Art. 21 GDPR) - Objection to certain processing activities
Withdrawal of consent (Art. 7 (3) GDPR) - You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, contact: contact@before.social

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR (Art. 77 GDPR).

The supervisory authority responsible for us is:

Berlin Commissioner for Data Protection and Freedom of Information

Friedrichstr. 219

10969 Berlin

Email: mailbox@datenschutz-berlin.de

Website: www.datenschutz-berlin.de

9. Profiling

The app uses algorithmic matching based on your preferences (age range, gender preferences). This constitutes profiling within the meaning of Art. 4 (4) GDPR. Matching is based exclusively on preferences you set and does not involve automated decision-making with legal effects or similarly significant effects within the meaning of Art. 22 GDPR. You can adjust your preferences at any time in the settings.

10. Contact Form

When you write to us using the contact form, we process your details in order to answer your request:

Data processed: Name, email address, message; for technical reasons the hosting provider processes your IP address when the form is accessed
Purpose: Answering your request
Legal basis: Art. 6 (1) (b) GDPR if your request concerns a contract or pre-contractual measures, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering inquiries)
Recipients: Vercel Inc. (hosting of the website and the form) and Resend Inc. (delivery of the message to us by email), see section 5
Abuse protection: To keep the form from being misused automatically, we check, among other things, the time since the page was loaded and briefly limit the number of requests per IP address in memory. If Cloudflare Turnstile is enabled, the form loads a verification widget from Cloudflare, Inc. (USA), which processes technical characteristics of your browser and your IP address to detect bots; the legal basis is Art. 6(1)(f) GDPR (protection against spam), and the transfer to the USA relies on the EU-US Data Privacy Framework, in which Cloudflare participates.
Retention period: The message is not stored in a database. It remains as an email in our mailbox until your request has been dealt with.

11. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changed legal requirements or changes to our service. The current version can be identified by the date below. We will inform you separately of material changes.

Last updated: February 2026