Privacy Notice

Version 1, effective on publication.

This notice explains, in plain language, what favorU stores about you, what it never stores, why the law allows it, and what you can do about it. The controller of your data is favorU, a sole trader established in the United Kingdom. You can reach us about anything on this page at privacy@favoru.app.

What we store

• Account data: your email address (that's how you sign in; there are no passwords) and your year of birth.
• Your profile: the name you show, your area, the abilities you offer, the languages you speak, and your bio.
• Requests and swaps: what you asked for, who you swapped with, statuses, and timestamps.
• Trust records: ratings, reports, and strikes. When someone files a report, we keep a snapshot of the relevant chat excerpts with their tamper-evident receipt chain, so the reviewer sees what was actually said.
• Your devices: an identifier and push-notification token per signed-in device.
• Your settings, including the language you use the app in.

The launch waitlist

If you leave your email on the closed-beta interest form, we store it — and your site-language choice — to send you one launch announcement and at most one reminder. We delete it when you sign up, or 12 months after the announcement at the latest.

What we never store

Chat history. Messages travel through a transient, encrypted buffer and are deleted from our servers once delivered. Your conversations live on your devices. Because we never keep them, we also cannot delete the copy on your swap partner's device, and we won't pretend otherwise.

One narrow exception: if law enforcement sends us a documented preservation request, we can pause the deletion of undelivered messages for the conversation named. Nothing else pauses, we never read the thread, and we tell affected users whenever the law allows.

One line about your first visit

On your first visit we derive your country from your IP address (via Cloudflare) to show the site in your language; we never store IP addresses.

Why we're allowed to store these (lawful bases)

• Contract: account, profile, request, and swap data. The service cannot run without them.
• Legitimate interest: moderation records (reports, strikes, captured report evidence) keep a community safe.
• Legal obligation: passing credible threats to the police and acting on preservation requests.

Children

favorU is 18+. Signup asks your year of birth and blocks anyone under 18; what a blocked underage visitor entered is not retained. Any account discovered to belong to a minor is terminated and its data deleted.

How long we keep things

• While your account is live: as long as your account is active.
• When you delete your account (Settings → Delete account, or privacy@favoru.app): we delete your email, profile, devices, drafts, and report prose. Swap, rating, strike, and report rows that also concern other users are kept but pseudonymised (detached from your identity) as legal-claims records, for a maximum of 5 years. After that they are anonymised outright: the last identifiers are scrambled and any remaining prose is purged.
• One honest hold: if you ask for deletion while a report naming you is still open, deletion waits for the review's verdict and its email to you, but never past your legal erasure deadline, and we'll always show an honest status line.
• Backups re-apply pending deletions when restored; server and authentication logs live briefly and are covered by the same deletion job.

Your rights

You can export your data at any time (Settings → Export my data, a JSON file of everything you provided) and delete your account. You also have the rights to correct, restrict, and object. We answer data requests within one month (we may extend by two for complex cases, and we'll tell you). You can complain to the ICO in the UK (ico.org.uk) or the NAIH in Hungary (naih.hu).

Where your data lives

favorU is hosted in the European Economic Area (Germany), so data about EU users stays in the EEA. The controller is in the UK; transfers between the UK and the EEA currently ride on the EU-UK adequacy decisions, which we re-check before public launch.

The bot check on the sign-in and interest forms is Cloudflare Turnstile — Cloudflare processes device and browser signals (never your messages) under its Turnstile Privacy Addendum.

Changes

Like the Terms, this notice is versioned and dated; material changes are announced by email or in-app before they take effect.