The short version
We collect the minimum we need to run Jarta. We never sell your data. We never use it to manipulate you. You can export or delete everything, anytime.
What we collect
Account and profile information
Your email address, first name, date of birth, gender identity, location (city-level), relationship intent, and profile photos. You control what you fill in; nothing beyond your email is strictly required to create an account.
Waitlist
If you join the waitlist: your email address, city and language, so we can tell you when your city opens. Optionally your gender (woman, man or non-binary), which we only use as a rounded mix per city, shown to our team once at least 20 people there have answered, so we can open cities with a good balance. We never ask who you're looking for on the waitlist. You can ask us to remove your waitlist entry at any time.
Values and preferences
The stances and preferences you set (religion, politics, children, etc.) are stored separately as values (public, shown to potential matches) and wants (private, never shown to other users). Your wants — including importance weights and dealbreakers — are yours alone.
Messages
Conversations are stored on our servers so they're available across devices. We do not read your messages unless you report a conversation for safety reasons, and we never use message content for profiling or advertising.
Who you want to meet
Which genders you want to meet, set under "Who you see". Together with your own gender this says something about your sexual orientation, so we only store it with the same explicit consent as your orientation, faith and politics answers. Without that consent the choice stays on your phone: it still filters who you see, but people of any gender may see you.
Usage data
Aggregated, anonymised signals to improve matching quality (e.g., which filters are used most). The app also tells our servers which app version and platform (iOS or Android) it is, so we know which versions are in use; we keep the latest one with your account and otherwise only daily totals. We do not build individual behavioural profiles.
Identity verification (optional)
If you verify your profile with BankID, BankID confirms who you are through our verification provider, and we receive your date of birth and a BankID identifier. We save that you're verified, when, and your date of birth, which replaces the one you typed in. We don't save your name or national ID number. From the BankID identifier we make a one-way, keyed code (a hash) and save only that code. It lets us make sure each person has only one account and that people we've suspended can't verify a new one. The code can't be turned back into the identifier. If BankID shows you're under 18, we don't verify the account: it's locked until your 18th birthday, and the code is kept until then so a new account can't be verified either. We'll email you a week before your 18th birthday and on the day itself to let you know the account is open. You can still delete the account and your data at any time.
Safety reports
If you report another user, we store the report including a hashed identifier for the reporter (never your raw user ID), the context, and outcome. This lets us track trust scores without exposing your identity to the person you reported.
How we use your information
- Matching: to surface compatible people based on your values, preferences, and location.
- Safety: to investigate reports, enforce community guidelines, and remove bad actors.
- Service delivery: to run the app, send account emails, and provide customer support.
- Improvement: to understand how features are used and make Jarta better.
We do not use your data for advertising, do not sell it to third parties, and do not use it to create addictive behaviour patterns.
Our legal basis
Under the GDPR, every use of personal data needs a legal basis. These are ours:
- Running your account and matching (your profile, photos, location, preferences, messages and dates, and the reach numbers we show you): this is the service you signed up for, so the basis is our contract with you.
- Your answers on orientation, faith and politics, and which genders you want to meet: these reveal special categories of data, so we only save them with your explicit consent. You can withdraw it in Settings at any time, and they are then deleted.
- Marketing emails: only with your consent, which you can withdraw at any time.
- The waitlist: your consent when you sign up. Ask us and we'll remove you.
- Identity verification: our contract with you when you choose to verify. Keeping the identity code of a suspended person for as long as the suspension lasts is based on our legitimate interest in keeping members safe.
- Safety reports and moderation: our legitimate interest in keeping members safe. We limit what we store, for example by keeping reporters' identities as a code.
- Crash reports, app versions and aggregated statistics: our legitimate interest in keeping the app working and fair. They aren't linked to your account.
- Partner offers: our contract with you when you use an offer, and our legitimate interest in billing partners correctly.
Where we rely on legitimate interest, you can object, see Your rights.
What we don't do
- Sell your data to advertisers or data brokers.
- Share your profile with third parties without your consent.
- Read your private messages unless safety-reported.
- Use your wants/dealbreakers to inform anything visible to other users.
- Track you across other websites or apps.
- Retain data longer than needed.
Your rights
Regardless of where you are, you have the right to:
- Access — request a copy of everything we hold about you.
- Correction — update inaccurate data from within the app at any time.
- Deletion — delete your account. Your personal data is removed within 30 days; anonymised references in safety records may be retained.
- Portability — export your data in a structured format (Settings → Export my data).
- Objection — object to specific processing; email us and we'll respond within 30 days.
Users in the EEA and UK have additional statutory rights under GDPR; other jurisdictions may provide their own. Contact privacy@jarta.app to exercise any right.
Data security
Jarta doesn't use passwords — you sign in with a one-time link sent to your email, so there's no password to be stolen, guessed, or reused from another site. Data in transit uses TLS 1.2+. Data at rest is encrypted. We conduct regular security reviews. In the event of a breach affecting your data, we'll notify you within 72 hours.
Data retention
Active account data is retained while your account is open. On deletion, personal data is removed within 30 days. Safety records (anonymised reporter hashes and report outcomes) are retained for up to 24 months, so moderators can see repeated reports about the same person and weigh reports from accounts that misuse reporting. If a verified account is suspended, its identity code is kept for as long as the suspension lasts, even if the account is deleted, so the same person can't verify a new account; for a permanent suspension, that means for as long as it stays in place. One exception: deleting your account can't cancel an App Store or Google Play subscription, only you can. If yours is still active when your account is removed, we keep just your email address, language and the subscription's renewal date, to remind you to cancel it and to answer support about it, and we delete them as soon as the subscription stops renewing.
Third-party services
We pick EU-based processors wherever a good one exists, and we list every service that handles your data here, including the ones outside the EU:
- Hosting: Hetzner (Germany).
- Photo storage and delivery: BunnyCDN (Slovenia). The app resizes each photo on your phone and saves it as a new image before uploading it, so the hidden data cameras add (such as where and when it was taken, and which phone took it) never leaves your phone.
- Our own mailboxes: mailbox.org (Germany). Emails you send to our support, safety, privacy and billing addresses are stored there.
- Account emails such as sign-in links and account notices: Scaleway Transactional Email (France, EU). It receives your email address and the content of the email we send you.
- Identity verification: Idura (Denmark) connects us to BankID when you choose to verify. It passes us your date of birth and a BankID identifier for that login.
- Payments: handled entirely by Apple's App Store and Google Play. We never see or store your card details.
- Subscription status: RevenueCat (USA) receives your store purchase receipts and a pseudonymous app user ID, so the app knows whether your membership is active.
- App updates: Expo (USA) delivers app updates. When the app checks for an update, Expo receives that request, which includes your IP address, the app version and whether the device runs iOS or Android. We don't use Expo for usage metrics, and nothing is linked to your account.
- Push notifications: Apple Push Notification service and Google Firebase Cloud Messaging deliver notifications to your device. They receive a device token and the notification itself.
- City lookup: to turn your location into a city name, our servers send approximate coordinates to OpenStreetMap's Nominatim service (OpenStreetMap Foundation, UK).
- Crash reports: when the app runs into an error, it sends a technical report to Bugsink (Netherlands, hosted in the EU). A report contains the device model, operating system and app version, where in the code the error happened, and the app screens and actions just before it. To count how many devices an error affects, each report carries a random ID created when the app is installed. It isn't linked to your account and resets if you reinstall the app or clear its data. Reports don't include your name, email, IP address or messages.
We're formalising data processing agreements with each processor. We don't use advertising networks, and nothing in Jarta tracks you across other apps or websites.
Children
Jarta is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we'll remove it immediately.
Contact
Questions about privacy? Email privacy@jarta.app. For urgent safety concerns use trust@jarta.app.