Privacy
Policy.

1. Who processes your data

The controller of personal data within the meaning of Regulation (EU) 2016/679 (GDPR) is:

Mgr. Ing. Simona Cibulková
IČO (Company ID): 08419531
Registered office: Kurzova 2222/16, 155 00 Praha 5 - Stodůlky, Czech Republic
Data box (datová schránka): tttkfnk
E-mail: ahoj@cosmatch.cz

Operator of the website cosmatch.cz and the web application of the same name.

2. What data we collect and why

2.1 Identification data

• E-mail — for sign-in and communication. We obtain it from your Google or Facebook account (OAuth) or directly from you.
• Name — how you want to be addressed.
• Date of birth — for calculating birth-date compatibility (the app's key feature).

2.2 Profile data

• Photos (one required, six at most), bio, occupation, education, interests, gender, preferred gender, partner age range, relationship intent.
• Optionally: time and place of birth, life philosophy, family plans, lifestyle (smoking, alcohol, diet).

2.3 Location

• City and country for filtering profiles near you.
• If you enable GPS, we store an approximate location (accuracy approx. 1 km) to calculate distance.

2.4 Interactions

• Likes, matches, messages between matches, time of last sign-in.

2.5 Special legal basis for the date of birth (Art. 9 GDPR)

Cosmatch uses your date of birth not only to verify that you are of legal age (18+), but also as an input to the birth-date compatibility algorithm. This calculation is based on the numerological tradition and may be interpreted as processing of data that can indirectly reveal a user's philosophical beliefs within the meaning of Art. 9(1) GDPR (special categories of personal data).

Out of caution, Cosmatch therefore processes the date of birth for compatibility purposes on the basis of the user's explicit consent under Art. 9(2)(a) GDPR. The user gives this consent actively during registration by ticking a separate checkbox. The same explicit consent also covers sensitive profile answers that the user later voluntarily chooses to fill in (for example religious or spiritual orientation, intimate preferences) — filling them in is always optional, they are used exclusively for the compatibility calculation, and they can be deleted in the profile at any time.

Consent can be withdrawn at any time — either by e-mail to ahoj@cosmatch.cz, or by deleting your account in your profile. Withdrawal of consent has no retroactive effect on processing carried out before the withdrawal. Upon withdrawal of consent, the compatibility feature ends and the profile reverts to basic mode (or is deleted, at the user's choice).

Scientific status: Numerology and astrology are not scientifically validated as reliable predictors of relationship outcomes. Cosmatch presents them as an interpretive framework, not as a prediction. For details see How Cosmatch works (in Czech).

2.6 Payment data (Cosmatch+)

• The Cosmatch+ subscription is available exclusively in the mobile app for iOS and Android. Payments are processed by Apple Distribution International Ltd. (Ireland) for iOS users and by Google Commerce Limited (Ireland) for Android users, respectively. Both entities are independent controllers of personal data.
• Cosmatch receives from Apple / Google only the subscription identifier and its status (active / inactive) — never payment card numbers or the biometric data used to authorise the payment.
• For details of processing by Apple, see the Apple Privacy Policy. For Google, see the Google Privacy Policy.

2.7 Voice recording (optional)

• What: a voluntary voice message of up to 60 seconds that you record for your profile.
• Purpose: introducing your personality to other users. We do not analyse, transcribe, or use the recording for identification in any way — we only store it and play it back.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — you activate the feature yourself and can cancel it at any time.
• Who hears it: only signed-in users to whom your profile is shown. Blocked users have no access to it.
• Where it is stored: in secure Cloudflare R2 storage in an EU jurisdiction under a non-public random address.
• For how long: until you delete it yourself (we remove the file immediately), and no later than 30 days after account deletion.

3. Legal basis for processing

• Performance of a contract (Art. 6(1)(b) GDPR) — creating and managing your profile, matching, messages, payments.
• Consent (Art. 6(1)(a) GDPR) — geolocation, marketing e-mails.
• Legitimate interest (Art. 6(1)(f) GDPR) — security logs (anti-bot, anti-scam), fraud prevention.
• Legal obligation (Art. 6(1)(c) GDPR) — retention of invoicing records (Act No. 235/2004 Coll., on VAT — 10 years).

4. Who we share data with

Cosmatch never sells your data to third parties. We share it exclusively with processors who need it to perform a specific function:

• Supabase (USA, EU servers) — database and authentication. Servers in Frankfurt (EU). Supabase Privacy Policy
• Cloudflare (USA, global) — website hosting, DDoS protection, CDN. Cloudflare Privacy Policy
• Apple Distribution International Ltd. (Ireland) — payment processing for iOS users via the Apple App Store. Apple Privacy Policy
• Google Commerce Limited (Ireland) — payment processing for Android users via Google Play. Google Privacy Policy
• Google (Ireland) — Google OAuth for sign-in.
• Meta (Ireland) — Facebook OAuth for sign-in.
• Resend (USA) — sending transactional e-mails (registration confirmation, voucher).
• Anthropic (USA) — only if you use the optional AI text-profile enhancement feature; only the texts you yourself enter into the feature are processed (never photos, the voice recording, or messages). Via a commercial API without use of the data for model training. Anthropic Privacy Policy

If any processor is located outside the EU/EEA, the data transfer is safeguarded by Standard Contractual Clauses approved by the European Commission.

5. How long we keep data

• Profile data — for as long as your account exists. After account deletion, the data is irreversibly erased within 30 days.
• Messages — kept for the duration of the match. After a match is deleted, the messages of both parties are erased.
• Voice recording and photos — we delete the voice recording file immediately when you remove it or replace it with a new one. After account deletion, all files (photos, voice recording, verification selfie) are irreversibly erased from storage within 30 days.
• Security logs — 90 days (necessary for fraud detection).
• Invoicing data — 10 years (statutory obligation).
• E-mail after account deletion — we keep a hash of the e-mail (not plain text) in an internal blacklist database to prevent re-registration by persons who violated the terms. You can request erasure from this database as well.

6. Your rights under the GDPR

You can exercise the following rights at any time by writing to ahoj@cosmatch.cz:

• Right of access — you can request a copy of all your data (within 30 days).
• Right to rectification — if there is an error in your profile, correct it (except the date of birth, which is locked after registration for technical reasons).
• Right to erasure ("right to be forgotten") — you can delete your account and all data in your profile with one click. Carried out within 30 days.
• Right to restriction of processing — you can request that processing be suspended (e.g. while a dispute is being resolved).
• Right to data portability — we will send you your data in a machine-readable format (JSON).
• Right to object — to processing based on legitimate interest.
• Right to withdraw consent — at any time, for geolocation and marketing.
• Right to lodge a complaint — with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) (Pplk. Sochora 27, 170 00 Praha 7).

7. Cookies and tracking technologies

Cosmatch uses minimal cookies — only those technically necessary for the app to function:

• Supabase auth cookie — for your signed-in session (required).
• Cloudflare cf-clearance — anti-bot protection (required).
• localStorage "cosmatch_user" — a cache of your profile for faster loading.
• localStorage "cosmatch_daily_swipes" — daily like counter (for the Free tier).

Cosmatch does not use Google Analytics, Facebook Pixel, Hotjar, or any other third-party tracking tools. No advertising cookies. No cross-site tracking.

8. Children

Cosmatch is intended exclusively for persons over 18 years of age. We actively prevent registration by minors (date-of-birth check during registration). If you discover that a minor has registered on Cosmatch, please let us know immediately at ahoj@cosmatch.cz — we will block their account immediately.

9. Data security

• Servers run in the EU (Frankfurt) in ISO/IEC 27001 certified data centres.
• All communication is encrypted via HTTPS (TLS 1.3).
• Passwords do not exist with us — we use only Google/Facebook SSO, so we cannot lose your password.
• Row Level Security at the database level — no one can see other people's messages, likes, or profiles outside the dating feed.
• In the event of a data breach, we will inform you within 72 hours in accordance with Art. 33 GDPR.

10. Changes to this policy

If we change this policy, we will notify all active users by e-mail at least 30 days in advance. If you do not agree with the changes, you can stop using the app and request deletion of your account.

11. Contact

For questions about personal data protection, write to ahoj@cosmatch.cz. We respond within 30 days, usually within 48 hours.