1. What data we collect

Data	Exactly what	Why
Account details	Email address and an encrypted password (scrypt with a unique salt). When signing in with Google or Apple: the unique identifier, the verified email address and the name the account provides, with no password	Signing in and securing the account
Profile	First name, year of birth, gender, who you are looking for, relationship status, city, height, personal description, interests and dating intentions	Showing your profile to other users and matching
Photograph	One profile photograph, and a verification photograph if you completed verification	Display on the profile and confirming a real person. You can set the photograph to be revealed only after a mutual match
Location	GPS coordinates from the device	Calculating distance between users. See section 2: the exact position is never revealed
Content you create	Chat messages, opening lines, and answers to WinMe challenges in video, voice, photograph and text	Delivering messages and showing answers to the participants of that competition
Voice and video calls	Calls run directly between devices over WebRTC, are not recorded and are not stored by us	Holding the call, and nothing else
Live captions	When captions are on, short audio segments are sent to the server for immediate transcription	Showing captions and live translation. See section 3
Purchases	Credit packs bought, balance and credit transactions	Running the credit system and showing your history
Technical usage data	IP address, last activity time, and the device notification token	Rate limiting against intrusion and spam, and sending notifications such as an incoming call

We do not collect: contacts, calendar, your photo gallery beyond the images you chose, browsing history, advertising identifiers, or biometric data.

2. How we protect your location

This is the most dangerous weak point in any distance-based dating app, so we addressed it explicitly.

An app that publishes an exact distance and an exact bearing allows an attacker to stand in three different places, note three readings, and calculate a person’s exact address. The attack is called trilateration.

On TOKME your position snaps to a fixed grid of about 150 metres before any distance or bearing is computed from it, and bearings are rounded to 15 degree segments. The snap is deterministic, so repeated readings return exactly the same value and cannot be averaged. Your raw coordinates are never sent to another user; only a rounded distance and a coarse bearing.

You can also switch exposure off entirely with private mode in the settings. In that state you appear on nobody’s radar.

3. Live captions and translation

Live captions are a feature you switch on. While they are running, short audio segments from the call are sent to our server and passed to an AI provider for transcription, and the text is shown to the other side, translated into their language where needed.

The audio segments are used for transcription only, are not kept by us after processing, and are not used to train models. The automatic image screening uses the same provider. Switching captions off stops the audio being sent immediately.

We do not sell data and we do not share it with advertisers or data brokers. Sharing is limited to the following:

Other users of the app: your public profile, the rounded distance and the coarse bearing. In a WinMe competition your answers are shown to the participants of that competition, with profiles anonymous until the final.
Google Play and the Apple App Store: for processing payments. We do not see or store payment details.
Processing providers: caption transcription and automatic content screening, restricted to that purpose only.
Authorities: only where required by a binding court order, or under a reporting duty concerning child safety.

5. Security

Passwords are stored as a scrypt hash with a unique random salt per user. They cannot be recovered.
All traffic between the app and the server is encrypted with HTTPS and TLS.
Session tokens expire after 90 days.
Sign-in and sign-up attempts are rate limited to prevent password guessing.

No user can send you a message without your explicit approval. You can decline a request, or decline and block, after which that person cannot approach you again and will not appear in your search. Blocking works after a conversation has opened, and every video call, voice call and competition carries report and block controls.

Reporting a user blocks them from you immediately and automatically, before the team has reviewed the report.

7. Retention and deletion

Data is kept while the account is active. You can delete the account at any moment:

From inside the app: Profile, then permanent account deletion.
From the site: the account deletion page.

Deletion permanently removes the profile, photographs, all messages and chats, all requests, WinMe answers, and the credit balance and transaction history. It cannot be undone, and unused credits are not refunded. Billing records we are required to keep under tax law may be retained separately for the period the law requires.

8. Your rights

You may access your data, correct it, delete it, and receive a copy of it. Most of these are available directly from the profile screen. For anything else, write to us at the address below and we will reply within 30 days.

If you are in the European Economic Area or the United Kingdom, you also hold the rights granted by the GDPR, including the right to object to processing, the right to restrict it, and the right to lodge a complaint with your local supervisory authority.

9. Minors

The service may not be used under the age of 18. If an account is found to have been opened by a minor it is deleted immediately. See also our child safety standards.

10. Changes to this policy

We will update this page when something changes and change the date at the top of it. A material change will also be shown inside the app.

11. Contact us

Any question about this document can go to: nisim@tokme.me

Privacy policy