Privacy policy

Reference text: version 2026-09-19 of the policy presented in the app [effective date to be set; the version will go up once section 9 and the flagged additions are merged into the reference text]. ProxiBlu, a dating app built on real, physical encounters detected over Bluetooth.

1. Who is responsible for your data

The data controller is Philippe Leblond — Technologies DareCrush inc., [registered office address].

The person responsible for the protection of personal information answers any question about your data and receives your requests and complaints: philippe@leblond.info [confirm the “privacy” contact address to publish, and the name or title of the responsible person].

Each country, or large region, has its own servers. For Canada, your account and encounter data is hosted in Montreal, and falls under Quebec's Act respecting the protection of personal information in the private sector (Law 25) and under PIPEDA. Some processing goes through providers located outside Quebec: they are listed in section 10.

2. The data we collect

2.1 Your account

Your email address and your phone number, both verified by a code, and a password; your two-factor authentication settings. The email and phone are encrypted in our database — for lookups we keep only a one-way fingerprint. The password is stored only hashed, never readable. We also keep the versions of this policy and of the terms you accepted, and the date of each consent.

2.2 Your profile

Age, gender, height, weight, glasses, hair colour and, optionally and with your separate consent, skin colour; a description; a short tagline, shown to the people you cross paths with; the contact details you choose to share with a match; up to two photos; your search preferences (genders and ages sought); your language, your country and, for a large country, your province or state — these designate the region where your data is hosted.

We ask for neither your name nor your date of birth. The description, the tagline and your contact details are encrypted in our database. We keep the history of the declarations and changes to your physical attributes (value before, value after, date), which serves profile consistency; it is never shown to other members.

[addition to be merged into the reference text] Your nickname, optional: 30 characters at most, chosen at sign-up or in your profile. Your matches, your friends and the members of your group conversations see it; someone you have only crossed paths with, or someone a friend introduces you to, does not. It is encrypted in our database, our moderation team can clear it, it is included in the copy of your data and it is erased with your account.

2.3 Your age and the team's checks

ProxiBlu is for adults only. At sign-up, when the platform provides it, your phone reads the age signal from Google Play or Apple: the age range stays on the device, and only a status (“adult”, “minor”, “undetermined”…) is sent to us. A “minor” status prevents sign-up; our team can also block an account suspected of belonging to a minor.

Our team may ask you for a selfie taken with the camera, with a written reason that you read in the app. That selfie is looked at by a member of the team, who compares it by eye with your photos — no automated facial recognition. It is stored encrypted and is never shown to other members. If it is certified, it is kept for as long as your account exists, to be compared the same way with a later selfie; only the most recent one is kept. If it is refused, it is destroyed 30 days after the decision.

2.4 Your location

• Encounters: only if you gave your geolocation consent, revocable at any time, the position of an encounter is rounded on your phone to a cell of about 100 metres before anything is sent, and again as it reaches our servers. The app never displays the place or the time of an encounter.
• Location sharing with someone you trust: during a share you start yourself (1 to 12 hours, stoppable at any time), your precise position is sent to your trusted person through a secret link. We keep their phone number and, if you give it, their name — encrypted.
• Crossing paths with a match again: if you and your match have both agreed to be told when you cross paths again, the recognition happens on the phones; a safety protection, which you turn on separately, can record the precise position of such a re-encounter.
• Team messages targeted at an area, and pre-registration campaigns: it is your phone that decides whether it is in the area, using your GPS position if you consented to it, otherwise the approximate location of your IP address, which it requests itself from a public service (section 10). We learn only the result — “in the area” for a campaign, in order to pre-register you and tell you about the launch — never your position.
• The “What's happening” map: it is computed from aggregated cells about a hundred metres across, published only when at least three different people passed through, without ever exposing one person's spot.
• [addition to be merged into the reference text] “Around my places”: an optional feature, which is not GPS tracking; nothing is set up in advance. You add, by hand, up to three places you frequent, each with a radius. Each centre is rounded by our servers, on a 500-metre grid by default, before it is stored: the exact address is never kept. For each place, we keep that rounded centre, in the clear (it is our server that compares places), its radius, its name — private, and encrypted on our servers — and the dates it was set and confirmed; added to that are the list of profiles shown to you each day, and the likes and “skips” you give. People with a place that matches one of yours can see your public profile, and you, theirs; nobody sees your places or how far away they are; each person only knows which of their own places matches. On your account's record, our team sees only how many places you have and their dates, never where they are. Turning the feature off erases all your places from our servers, as does deleting your account; they are included in the copy of your data (section 11), and their retention periods are in section 7. [Places a person frequents, even rounded: sensitive nature to be validated.]
• [addition to be merged into the reference text] The dynamic place in “Around my places”: optional, set by you, with one tap, at most once a day. “Update my dynamic place” sends us your phone's precise position, measured by GPS, with its margin of error — refused beyond 20 metres, or if the phone reports it as simulated; “Choose on the map or by address” sends us the point you pick. The centre is rounded to 10 metres, then stored in the clear, with a 50-metre radius, the measured margin and the times it was set and ends, because it is our server that compares it with other people's dynamic places: it only matches those, within 50 metres. Nobody sees it, nor knows that a profile came from it; on your account's record, our team sees only whether it is active and until when. It stops counting after 24 hours, and its coordinates are erased within the following hour, or as soon as you remove it; only the date of its last update remains, which limits updates to one a day. It is included in the copy of your data while its coordinates are kept (section 11). [A person's precise position, even for 24 hours: sensitive nature and PIA to be validated.]
• [addition to be merged into the reference text] “Going to meet”: when you declare a meeting with a match — place, date and time, comment — and only with your geolocation consent, your phone sends us its precise position right away, then 1 hour, 30, 10 and 5 minutes before, at the time of the meeting, and every 15 minutes for 6 hours; “Stop sharing” ends this at any time. Without that consent, the meeting is declared with no position. These positions are in the clear on our servers: they are not end-to-end encrypted. Our team can look at them on your account's record, as a safety trace. The friends you choose to notify receive a message with the place and time, then see the meeting and your positions on your friend profile, until 24 hours after tracking ends. The person you are meeting is not told. “Remove” erases the meeting; it is included in the copy of your data (section 11), and its retention period is in section 7.

[addition to be merged into the reference text, which said: “Our servers never infer your position from your IP address.”] Centring a map: when you open a map to choose a place and your phone's position isn't available, the map starts from the first of your places (“Around my places”); failing that, our servers estimate your IP address's city in a database installed on our side — no third party receives it — and, failing that, your region. It is the only use they make of your IP address to locate you: the result serves that map, and nothing is kept. Database: “IP Geolocation by DB-IP” (db-ip.com), under the Creative Commons Attribution 4.0 licence.

[addition to be merged into the reference text] Searching for an address: above the maps where you set a place, the text you type goes to our servers, which relay it to an address search service (section 10) with, at most, a neighbourhood rounded to about 1 km — never your account or your IP address. That text is written to no log; our servers keep the answer for 24 hours, under a hashed key, so as not to ask the same question again.

2.5 Your encounters and your activity

Your phone broadcasts and listens for ephemeral Bluetooth beacons (see section 3); when two phones cross paths, each sends us the other's beacon, with the signal strength and how long it was present. From that we derive the encounters — who crossed whom, and when.

We also record your likes and Super Likes, your matches, your messages without a match, your favourites, your blocks, the profiles you ignore or remove, your reports, the dates you declare, and the metadata of your messages (who, when, which match) — never their text, see section 8.

To diagnose detection between phones, our team may temporarily place an account under observation (30 days at most): the sightings it exchanges are then traced in detail and kept 14 days. [To be reserved for test accounts, or announced to the person concerned.]

2.6 Payments

A subscription bought in the App Store or on Google Play is billed by Apple or Google: we receive the proof of purchase (product, dates, transaction identifier), which we verify. If card payment on our site is offered to you, the card is entered with the payment gateway, never with us: we keep only the brand, the last four digits and, for some gateways, a token that allows renewal. We also keep your credits, and the referral, promotion or ambassador codes used.

2.7 Technical data

A device identifier and the token that lets us send you notifications; the app version and the device model. On Android, pseudonymous crash and diagnostic reports (with no account identifier) go to our own error server; you can switch them off and erase them in the app, and they are never used in an investigation.

The app also tells us, per day and for your account, how long Bluetooth was on and how long the app was able to measure — two durations, nothing else: neither what it detected, nor where you were. Without that measure, an app that no longer detects anything looks exactly like a day with nobody around, and we could not warn you that detection isn't running on your phone. It is kept six months, then destroyed.

We do not keep your IP address in your profile, at sign-up, or with each encounter. It is recorded in bounded cases, for safety only: the address of each sign-in is attached to the session it opens — that is what feeds your list of “active sessions” and the “new sign-in” alert — and disappears with the session; it is also noted with a date you declare, with a re-encounter recorded by the safety protection, and with the request to delete your account (section 7).

2.8 Support

If you write to our support team, from the app or from the site: the subject chosen from a list, the identifiers of the account concerned and the email or number where to answer you — encrypted in our database — and, from the app, the app version and the device model. The form has no free-text field.

2.9 What we do not collect

Not your name, nor your date of birth, nor your postal address, nor your phone's address book, nor your browsing history, nor your full card number, nor any biometric print of your face.

3. What Bluetooth carries

Encounter detection relies on Bluetooth alone, never on GPS. Your device broadcasts an encrypted sixteen-byte beacon, renewed every fifteen minutes, that only our server can resolve.

No profile data, no photo, no account identifier and no geographic coordinate travels over the radio. A third-party device capturing these beacons could neither identify you nor establish that two successive beacons come from the same phone.

The raw observations your phone reports are destroyed as soon as they are processed; only the encounter remains.

4. Why, and on what basis

We process this data to:

• provide the service — show you the people you genuinely crossed paths with, manage likes, matches and messages, apply your search preferences and your plan;
• keep our members safe — moderation, reports, age, location sharing, cooperation with authorities on a valid legal request;
• bill your purchases;
• improve the app — diagnostics you can switch off.

The legal basis is [contract, consent, and legitimate interest for safety — breakdown to be specified by a lawyer according to the jurisdiction]. Sensitive data (section 5) rests on your consent alone.

We do not sell your data and do not use it for advertising. ProxiBlu shows no advertising.

5. Sensitive data and biometrics

Skin colour, which is optional, may reveal an origin: it is recorded only with your explicit, separate consent, dated; you can withdraw it at any time in the app, and the data is then erased from your profile and from its history.

Your search preferences (genders sought) are optional — left empty, they mean “everyone” — are used only to choose who appears in your encounters, are never shown to anyone, and can be changed or erased at any time.

No biometric data is processed. When photo checking is active, each profile photo is analyzed as it is uploaded to verify that it does show a face: this is detection (is there a face?), with no face print and no comparison. The selfie required by the team (section 2.3) is compared by eye by a person. If automated identity verification (face comparison) were ever offered, it would be optional, subject to express consent, to the formalities required by law, and to an update of this policy before its launch.

6. Automated decisions

Some moderation decisions rely on automated processing, always under a person's control:

• a profile photo judged shocking (nudity, violence) by the automatic analysis is refused on upload;
• your description and tagline are reviewed by a text classifier: it can approve a tagline or refer it to a person, and flag a description to the team — it never removes anything on its own;
• when an account is the subject of many reports, it stops appearing in other people's encounters pending review by a member of the team;
• [addition to be merged into the reference text] an image attached to a message, and a text written in the Social tab, are analyzed automatically as they are sent and can be refused without human involvement (section 9).

You can ask for the reasons behind a decision that concerns you and present your observations to a member of the team, through support or at the address in section 1. [Law 25, s. 12.1: informing the person at the time of the decision — to be built.]

7. How long we keep it

The periods specific to friends, the Social tab and backup appear in section 9.

When you delete your account, in the app or on the web portal, your profile — description, tagline, contact details, attributes, preferences, photos, selfies, location shares, profile history, sessions and devices — is genuinely erased, your matches are closed, and your sign-in identifiers are released. A subscription bought in the App Store or on Google Play, however, is cancelled in the store: deleting the account does not cancel it.

A bare minimum for investigations — your phone and your email (encrypted), the last known position of an encounter, and the IP address of the deletion request — is placed in a separate, restricted-access store, kept six months then destroyed. It serves only to answer a valid legal request from authorities following an incident.

8. Messages: end-to-end encryption

The text of your private conversations — with a match, with a friend, or in a group — is end-to-end encrypted: we cannot read it. The key that decrypts it stays on your phone; your phone warns you if the other person's key changes.

If you turn on backup, your key is first encrypted on your phone with a password only you know, before it is entrusted to us: we cannot open it.

[addition to be merged into the reference text] An image attached to a message is an exception on one point: it is analyzed automatically once, in the clear, before being encrypted, to screen out nudity and violence. It is not written to our servers on that occasion; only the verdict and a fingerprint of the image are kept 30 days. The image is then end-to-end encrypted like the text.

[addition to be merged into the reference text] Editing a message, deleting it for everyone: for a short time after sending (15 minutes by default), the author of a message can edit it or delete it for everyone, with a match, with a friend or in a group conversation. The new version is end-to-end encrypted like a message and travels like one: we cannot read it. We only know that a message was edited or deleted, and when. As long as the message is still waiting on our servers, it is replaced there by its new version, or emptied — image included — if it is deleted; a deletion also empties its edited versions. On the phones that received it, the text is replaced, or erased along with its image, and the person sees “edited”, or that the message was deleted; they may have read it, or copied it, before. The name a member gives a group conversation is end-to-end encrypted in the same way.

Faced with a request from authorities, we can provide only metadata — who wrote to whom, and when — never the content.

9. Friends, the Social tab and backup

Friends and invitations

We record who is friends with whom, how the friendship came about (number, email, match, shared space) and its dates. A request left unanswered is erased after 90 days; a removed friend can be restored for 24 hours.

When you add or invite someone by their number or email, that value is sent to us to check whether it matches an account. If the person is not signed up, we keep only a fingerprint of it: 60 days to pass on your request when they sign up, then two years in a register, with no link to you, that avoids offering them a second invitation. “Invite from my contacts” goes through the system's contact picker, which hands us only the person you tap: the app does not read your phone's address book.

The app's “Contacts” notebook is filled in by you and stays on your phone. To link a contact to one of your friends, their number and email are compared by the server, which keeps none of it. [You enter information about third parties there: processing to be validated.]

The location you show a friend, once or live for a period you set, is encrypted for them alone: we cannot read it. When you show a match to your friends, we record your request and that match's approval, or refusal, for each friend. When you introduce to your friends someone you crossed paths with — only if they allowed it: that setting is off by default — or another of your friends, we likewise record the request, and the introduced person's approval or refusal for each friend; the friend they are introduced to sees their card and description. You see a friend's answer, never that of someone you crossed paths with. [Retention period for introductions to be set: no purge for now.]

The invitations you send through your phone's share sheet (WhatsApp, Messenger…) carry your invitation link and your referral code, never your profile; we don't know who you send them to.

Private events, gangs and groups

We record who is a member, who invited whom, the answers to invitations and the dates. Each text you write there — name, description, message, poll question — is analyzed automatically once, in the clear, as it is sent, by a text classifier, then stored encrypted with a key our servers do not have: we can no longer read it. A private event is erased one week after it starts, with its messages: to do so, your phone tells our servers the day of that erasure — so they know the approximate day of the event, never its content. [Retention period for gangs and groups to be set.]

A person without an account whom you invite through a personal link sees the event's details and answers on a web page; the key that makes them readable travels in the link itself and does not reach our servers.

“Find the gang” searches among your encounters, including those your filters keep out of your list: those are kept a few days, with no location, for that purpose alone. The search never reveals the time of an encounter.

Public events and groups

These spaces are not end-to-end encrypted: their name, description, place, date and messages are readable by members in the region and by our moderation team, and are stored encrypted at rest only. A public event is erased 7 days after it starts; a draft never published, after 48 hours. The place around which you search is sent rounded to about a hundred metres and is not kept.

Find one or more people

A search brings together a title, a description, a point on the map with a radius of 50 metres at most, a date with a time range of 3 hours at most, and a description of the person sought: a gender, an age range, one or two skin and hair colours, glasses or not, a height range. It lasts 30 days and can be extended by 30 days on request. [Retention of a finished search, its group and its discussion, and the encryption regime of their text: to be confirmed.] [A search describes, skin colour included, a person who has not consented to it, and that description is compared with profiles: processing to be validated.]

You can note the places where you were, with the day and time: nobody else sees them, and each one is erased after 30 days. If a search matches one of those places and your profile, it is shown to you in “Someone may be looking for you” — the person searching does not know you appear there. You can answer with a short request; if the person searching accepts it, you join the search's group, where they can send you a friend request.

Spontaneous activities

An activity brings together a precise place, a date and time, a duration, a description, the number of people expected, and the age range and genders sought. Others find it by keyword, within 10 km by default and up to 50 km around their position or another point, if they meet its criteria. The people who say they will be there are visible to everyone who can see the activity. The activity is erased 24 hours after it ends.

Your presence is proven by your position, checked in at the start and at the end, by crossing paths over Bluetooth on site, or by the confirmation of a participant whose presence is proven. Everyone has a participant reliability — the ratio of their attendance to their commitments, over one year — which never rests on the mere absence of a Bluetooth signal; a declaration concerning you can be contested. The organizer has their own reliability, which nobody sees as a percentage: it is used only to filter activities by “reliable organizer”. [Encryption regime of an activity's text and discussion, and retention periods for check-ins, attendance and reliability: to be confirmed.]

Polls

The question and options follow the rule of their space. Votes, however, are recorded in the clear by the server along with the account that voted, including in a public space where other members see only totals.

Account backup

Optional. It gathers what lives only on your phone — conversations and their images, encryption key, private nicknames, notes, contacts notebook — and encrypts it on your phone, with a password that is never sent to us, before storing it on our servers. We cannot open it; we know only its size, its date and the device model. There is only one per account: you can delete it whenever you like, and it disappears with your account.

10. Who it is shared with

We do not sell your data. We use providers that process it on our behalf, each bound by a written data-protection agreement [agreements to be signed before launch]:

The other ProxiBlu regions. If you cross paths with someone signed up in another region, your public profile — the one any encounter shows — is sent to that region's servers; your messages pass through there encrypted, unreadable; your contact details only if you share them with that person; and a report you file against them is handled there. Your phone number, your email, your position and your search preferences never leave your region.

Communications outside Quebec. Twilio, OpenAI, Google and Apple process data in the United States, Amazon Rekognition partly as well; Mistral AI in the European Union; Swift SMS Gateway in Canada, outside Quebec; the OpenStreetMap Foundation in the United Kingdom and the European Union; Laravel Cloud is an American company, which declares Cloudflare among its sub-processors [to be confirmed in writing: location of the data, and whether the app's traffic passes through Cloudflare]. These communications were the subject of a privacy impact assessment and are governed by contractual commitments [PIA to be validated by legal counsel]. [addition to be merged into the reference text] Address search goes through komoot, in Germany.

Authorities. We may disclose data to authorities on a valid legal request, and we are required to report any child sexual exploitation content — see our child safety standards.

11. Your rights

You can, at any time:

• Access your data and obtain a copy in a structured format — “Download my data”, in the app or on the “My account” web portal.
• Rectify your information by editing your profile.
• Withdraw a consent — geolocation, skin colour, re-encounter — one by one, without losing access to the service.
• Delete your account, in the app or on the web portal, even after uninstalling the app — the steps are on the “Delete my account” page.
• Switch off and erase diagnostic data.
• Stop receiving launch notices for a pre-registration campaign, through the link each notice carries. Messages needed for the service — codes, account security, billing — are not affected.

For any other request, or a complaint, write to the person responsible for protection (section 1). If our answer does not satisfy you, you can turn to Quebec's Commission d'accès à l'information or, elsewhere in Canada, to the Office of the Privacy Commissioner of Canada [authorities of other regions to be added as they open].

12. Security and incidents

Exchanges with our servers are encrypted in transit (HTTPS). Your messages are end-to-end encrypted; your sign-in identifiers, your description, your tagline, your contact details, your trusted person's phone number and required selfies are encrypted at rest; photos are served only through signed, time-limited links, to the only people entitled to see them; the sign-in token is stored encrypted on your device. Every time our team looks at an account, it is logged.

No system is infallible: we keep a register of confidentiality incidents and, in the event of an incident presenting a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned with diligence.

13. Age

The app is reserved for people aged 18 and over (see section 2.3). We do not knowingly collect data from minors; an account that reveals one is blocked. Our child safety standards describe what we do against any exploitation.

14. Changes

We may change this policy; the current version is shown at the top. With each new version, the app presents the text to you and asks you to accept it again before continuing.

See also our terms of use. For any question, write to us. This English text is a translation of the French version. [Counsel to confirm which language version governs.]