Privacy Policy
Version 1.1 · 2 October 2026 · Dor Dor Ltd, London, United Kingdom (the controller). Contact: privacy@dordorapp.com.
What we collect and why
This table lists the personal data Dor Dor holds. Our code keeps a registry of every field that holds personal data and a test fails when a new one is added without being registered; we check this page against that registry each time we change it.
| Data | Why | Protection |
|---|---|---|
| Email or phone number | Sign-in codes, account recovery | Encrypted at rest; a keyed hash is used for lookups; never shown to other users |
| Website waitlist: email address and the city you type | Sending you a confirmation now and one email on launch day | Encrypted at rest; a keyed hash is used for lookups; kept until about 12 months after launch day, or until you ask us to remove it, and removed when you sign up in the app or delete your account |
| Apple / Google account identifier | Sign in with Apple or Google | Only the provider's opaque id; Apple private relay addresses are supported |
| First name, date of birth, gender, who you want to see | Your card and the deck; 18+ check | Other users see your age, never your birthday. "Who you want to see" is stored because matching needs it; together with your gender it can reveal your sexual orientation, so we treat it as sensitive (see "Legal bases"). |
| City | Showing you people from your own city and nearby cities first, and showing your card to people everywhere | Your device's position is used once to find your city and then discarded. No exact coordinates are stored anywhere. |
| Photos and optional profile sections | Your profile | Metadata (including GPS) is stripped when a photo is uploaded; photos are served through short-lived signed links only. Every photo is sent to our moderation providers (see "Who receives data from us") before it is shown. Profile text is sent to Hive for the same check. |
| Verification selfie, only where selfie verification is offered | The verified badge | Compared with your photos and deleted within the hour |
| Messages | Chat between matches | Encrypted at rest; deleted 30 days after a match ends or when an account is deleted |
| Swipes, matches, blocks, reports | Running the service and keeping it safe | Reports are kept two years with the reporter pseudonymised |
| Sign-in history: your device's model and operating system (the "user agent"), an install id and a keyed hash of your IP address | Showing you where you are signed in, signing you out everywhere, investigating abuse | We do not store your IP address itself, only a keyed hash that cannot be turned back into it. Erased with your account. Our hosting providers' ordinary request logs may hold your IP address for a short time. |
| Device identifier, push token, hashed device fingerprint | Notifications; sign-out-everywhere; keeping banned users out | Push tokens are pruned when a device disappears |
| Notes you send with a flash (Premium), appeals, feedback you send us | Delivering your note, reviewing an appeal, improving Dor Dor | Encrypted at rest. Notes and feedback are erased with your account. |
| Purchase history (store transaction ids) | Premium and consumables | Payments are processed by Apple or Google; we never see card details |
| Product analytics | Improving Dor Dor (our legitimate interests) | Explicit events tied to your account id; no session recording; no advertising and no tracking across apps or sites. You can object by writing to privacy@dordorapp.com. |
Legal bases (UK GDPR)
Contract, for running the service you signed up for. Consent, for the website waitlist: you give us your email address so that we can tell you when the app launches, and you can withdraw that by writing to privacy@dordorapp.com. Legitimate interests, for safety, fraud prevention and product analytics. Explicit consent for special-category information: who you want to see ("Show me"), together with your gender, can say something about your sexual orientation, and "Religious practice" reveals your religion, so we treat both as special-category data. We ask for "Show me" once, at sign-up, with a short note beside the choice that says it is sensitive and used only to match you; "Religious practice" is an optional section you add yourself, with a similar note. You give your consent by making the choice, you can change or remove either at any time from your profile, and deleting your account erases them. We use them only to decide who sees you and who you see.
Who receives data from us
These are the companies the service sends personal data to, and what each one receives. Providers acting on our instructions are our processors; Apple, Google and the authorities named below decide for themselves how to use what they hold.
- Render hosts the app servers and the database (Frankfurt region). Cloudflare stores photos (Cloudflare R2).
Our database and servers are in the EU (Render, Frankfurt), our selfie check runs in London, and analytics go to PostHog's EU host. Several of the providers above are in the United States or may process data there, and we do not control where they do: Microsoft, Hive, Twilio, Expo, RevenueCat, Apple, Google, Cloudflare and, depending on how its account is set up, Sentry. When personal data goes to a provider outside the UK and the EEA we rely on a safeguard that UK GDPR recognises: an adequacy decision such as the UK-US data bridge for a certified US company, or standard contractual clauses (the UK International Data Transfer Agreement or the UK Addendum to the EU clauses). Write to privacy@dordorapp.com and we will tell you which safeguard applies to a provider and send you a copy of the terms.
Retention
Website waitlist: about 12 months after launch day. Passes: 90 days. Messages: 30 days after a match closes. Verification selfies: under an hour. Push tokens: on rotation. Reports: 2 years, pseudonymised. Account data: deleted 14 days after you ask (the grace period); backups roll off within 35 days. Likes: until you delete your account. The one-way hashes that keep a banned account from registering again: for as long as the ban stands. Child-safety material and its connected data, where our checks or a report find it: at least one year, as that law requires.
What deleting your account removes, and what stays
Removed 14 days after you ask: your profile and photos (and the copies we hold), verification selfies, messages, swipes, matches, blocks, devices and sessions, feedback you sent, a website waitlist entry under the same email, and the Sign in with Apple grant.
Kept: reports about you or made by you, for two years, with the link to your account removed and the reporter pseudonymised; a one-way hash of your email, phone number or device, so that a banned account cannot register again; store purchase records, with the link to you removed; and any preserved child-safety material (at least one year). The one-way hashes cannot be turned back into your details.
Held by others: we do not yet delete your records at RevenueCat (purchase history), PostHog (analytics events) or Sentry (error reports) when your account is erased, and Apple and Google keep their own records of purchases and sign-in. Email privacy@dordorapp.com and we will ask the providers we use to delete what they hold about you.
Automated decisions
Three things happen without a person looking first: a photo that our moderation providers flag (nudity, violence, weapons, an apparent minor) is rejected; a profile is hidden for review when three different people report it within a week; and a photo that our checks flag as apparent child sexual abuse material suspends the account while a person reviews it. Apart from that, a person decides every ban. If you think one of these was wrong, appeal from the app or write to privacy@dordorapp.com and a person will look at it.
Visiting this website
This website sets no cookies, runs no analytics and loads nothing from other companies: the fonts are served from our own domain. Our hosting providers see your IP address and browser details in their ordinary request logs, as any website's host does. If you join the waitlist, what we do with your address is described above.
We do not sell your data
We do not sell personal data and we do not share it for advertising. The companies listed above receive it only to provide the service to us, or, for the authorities and for Apple and Google, because the law or your own choice of their service requires it.
Your rights
Access, rectification, erasure, restriction, portability and objection, and you can withdraw a consent at any time without affecting what happened before (for the waitlist, write to us; for "Show me" or "Religious practice", change or remove it in the app). In the app: Settings → Account → Download my data / Delete account. On the web: dordorapp.com/account/delete, which works with an email address or a phone number. Or email privacy@dordorapp.com. You can complain to the Information Commissioner's Office (ico.org.uk) and, if you live in the EU, to your own data-protection authority.
Children
Dor Dor is for adults. Age is checked at sign-up, photo moderation flags apparent minors, and anyone can report an under-18 from the app or at safety@dordorapp.com. Read our child safety standards.
If privacy is a safety matter for you
Dor Dor is built for Persians living outside Iran; we do not distribute the app in Iran and take no payments from anyone resident there. We still designed for the people whose private life carries a risk: first name only, city-level location, no phone or email ever shown, and an optional biometric lock. We only ever know the city a person picks. Please also read our safety page.