Privacy Policy

Effective date: 1 October 2026

This Privacy Policy explains how [COMPANY LEGAL NAME] ("CRAVE", "we", "us" or "our") collects, uses, shares and protects personal information when you use the CRAVE Social mobile apps, the website at cravesocial.co.za and related services (the "Service"). It also explains the choices and rights you have.

CRAVE Social is a service for adults (18+) that helps singles and couples connect. Because of the nature of the Service, some of the information you share with us – such as your sexual orientation and the types of people you're looking for – is particularly sensitive. We only use it to provide the Service you ask for, we never sell it, and we never share it with advertisers.

1. Who we are and how to contact us

[COMPANY LEGAL NAME] (company number [COMPANY REGISTRATION NUMBER]), [REGISTERED ADDRESS], is the controller of your personal information (the "responsible party" under POPIA and the "business" under California law).

Privacy questions and requests: privacy@cravesocial.co.za
Data Protection Officer / Information Officer: [DPO NAME OR ROLE], privacy@cravesocial.co.za
EU representative (Article 27 GDPR): [EU REPRESENTATIVE NAME AND ADDRESS]
UK representative (Article 27 UK GDPR): [UK REPRESENTATIVE NAME AND ADDRESS]

2. Information we collect

Information you give us

Account information: your email address and password (stored only as a secure one-way hash). If you use Sign in with Apple or Google, we receive a unique account identifier and your email address (or an Apple private relay address) from that provider.
Age confirmation: your confirmation that you are 18 or over and your date of birth (for couples, each person's date of birth). We display your age, not your date of birth.
Profile information: your username, profile type (female, male or couple), gender, sexuality (for example straight, bicurious, bisexual, lesbian or gay), and optional details such as height, build, ethnicity, drinking and smoking habits, interests and your bio.
Cravings (discovery preferences): the profile types, sexualities, age range and distance you're interested in.
Photos: the public and private photos you upload, and your profile picture. When we process a photo we resize it and remove embedded metadata, including EXIF data and GPS location. We also create a small blurred preview of each photo.
Activity and communications: your swipes (likes, passes and Super Craves), matches, messages you send and receive, Quickies you post, vouches you write or receive, and members you block or unmatch.
Reports and support: reports you submit about other members or content, feedback, contact-form messages and any information you send to our support team.
Invitations: if you use "Invite a Friend", the name and email address of the friend you invite and your optional message. We use these only to send that one invitation.

Information collected automatically

Approximate location: with your permission, we collect your device's location to show you members and Quickies nearby and to show other members how far away you are. Other members only ever see an approximate distance (for example "12 km"), never your exact location. You can turn off location permission in your device settings at any time, but discovery will not work properly without a location.
Device and app information: device model, operating system and version, app version, language, time zone and crash data.
Push notification tokens: a token issued by Apple or Google that lets us send you notifications, if you allow them.
Usage information: how you use the app (for example features used, last-active time, login streaks, XP and badges), used to run features, measure performance and improve the Service.
Log and security data: IP address, session information, timestamps and request data, used to keep accounts secure and prevent abuse.
Advertising identifiers: if you are a free member, our ad partner Google AdMob may collect your device's advertising identifier (IDFA on iOS, only if you allow tracking; Google Advertising ID on Android), IP address and information about ad interactions. See section 6.

Information from others

App stores and our purchase partner: confirmation of your CRAVE+ purchase (transaction ID, product, price, currency, date and country) from Apple or Google, which may be processed through our in-app purchase provider [RevenueCat, Inc.]. We never receive your card details.
Other members: for example when someone reports you, vouches for you, messages you or invites you to CRAVE.
Sign-in providers: Apple or Google, as described above.

3. Sensitive information (special category data)

Information about your sexual orientation and sex life (for example your sexuality, profile type, Cravings and the content of your profile and conversations) and, if you choose to provide it, your ethnicity is "special category" personal data under the EU and UK GDPR, "sensitive personal information" under California law, and "special personal information" under POPIA.

We process this information only with your explicit consent, which you give when you choose to add it to your profile and confirm our consent prompt during sign-up. Ethnicity is always optional.
We use it only to provide the Service – to build your profile, show it to members who may be interested, and match you with members based on your Cravings. We do not use it for advertising, we do not share it with ad networks and we do not sell it.
Your sexuality and profile type are shown on your profile to other members – that is how CRAVE works. Use Incognito mode if you want to limit who can see your profile.
You can withdraw consent at any time by editing your profile to remove optional information or by deleting your account. Because sexuality and profile type are needed for matching, removing them entirely means deleting your account. Withdrawing consent does not affect processing that took place before.

4. How we use your information and our legal bases

Where the EU GDPR, UK GDPR or similar laws apply, we rely on the following legal bases:

To create and run your account and provide the Service (profiles, discovery, swiping, matching, chat, Quickies, vouches, Gallery, Incognito, gamification, notifications) – performance of our contract with you, and explicit consent for special category data.
To show you nearby members and Quickies using your approximate location – consent (device permission) and performance of contract.
To moderate photos and content, review reports, prevent fraud, spam and abuse, verify ages, and keep members safe – our legitimate interests in running a safe service and protecting members, and legal obligations; where special category data is involved, substantial public interest (preventing unlawful acts and safeguarding) where permitted by law.
To detect, remove and report child sexual abuse and exploitation – legal obligation and vital/public interests.
To process CRAVE+ purchases and restore them – performance of contract and legal obligations (tax and accounting).
To show adverts to free members – consent for personalised ads where required (EEA, UK, Switzerland and on iOS via App Tracking Transparency); otherwise our legitimate interest in funding a free service through non-personalised ads.
To send service emails (verification codes, password resets, security alerts, account deletion confirmation) and respond to support requests – performance of contract and legitimate interests.
To analyse and improve the Service (aggregated usage statistics, crash diagnostics, performance) – legitimate interests.
To comply with the law, enforce our Terms and defend legal claims – legal obligations and legitimate interests.

We do not use your information for automated decision-making that produces legal or similarly significant effects on you. We use automated tools (for example to flag potentially inappropriate photos or spam) to support human moderators, and significant moderation decisions such as permanent bans are reviewed by a person.

We do not sell your personal information. We share it only as follows:

Other members: your public profile (username, profile type, age, sexuality, approximate distance, bio, interests, public photos, badges, level, vouches and last-active status, unless hidden) is visible to other members. Private photos are blurred unless the viewer has CRAVE+. Messages are visible to the member you're chatting with. Quickies are visible to members nearby until they expire.
Service providers who process data for us under contract and only on our instructions, including: hosting and infrastructure ([HOSTING PROVIDER], [DATA CENTRE LOCATION]); email delivery ([EMAIL PROVIDER]); push notifications (Expo, Apple Push Notification service and Firebase Cloud Messaging); in-app purchase management ([RevenueCat, Inc.]); crash reporting and diagnostics ([CRASH REPORTING PROVIDER]); and customer support tools ([SUPPORT TOOL]).
Advertising partners: Google AdMob, for free members only, as described in section 6. We do not give ad partners your profile, sexuality, messages or photos.
Apple and Google when you sign in with them or buy CRAVE+ through their stores.
Law enforcement, regulators and safety organisations: where we believe in good faith that disclosure is required by law, or necessary to prevent harm, investigate fraud or abuse, or protect anyone's safety. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and other competent authorities.
Business transfers: if we are involved in a merger, acquisition, financing or sale of assets, your information may be transferred to the new owner, who will be bound by this Privacy Policy.
With your consent or at your direction.

Free members see adverts, including between profiles while swiping. Adverts are served by Google AdMob. Google's use of data is described at policies.google.com/technologies/partner-sites.
EEA, UK and Switzerland: before personalised ads are shown we ask for your consent using a consent message that follows the IAB Transparency & Consent Framework (Google User Messaging Platform). If you do not consent, you will see non-personalised ads, which use only limited data such as approximate location derived from IP address and the current app context. You can change your choice at any time in the app under Settings → Privacy.
iOS: we only access your device's advertising identifier (IDFA) if you allow tracking in Apple's App Tracking Transparency prompt. You can change this in iOS Settings → Privacy & Security → Tracking.
Android: you can reset or delete your Advertising ID in your device's Google settings.
United States: personalised advertising may be considered "sharing" for cross-context behavioural advertising or "targeted advertising" under some US state laws. You can opt out in the app under Settings → Privacy or by emailing privacy@cravesocial.co.za. We honour Global Privacy Control signals on our website.
Ads are never targeted using your sexuality, profile type, Cravings, photos or messages.
CRAVE+ members do not see ads and no ad requests are made for them.

7. How long we keep information

Account and profile information: for as long as your account is active. After you delete your account, your profile, photos, Cravings, location and sign-in identifiers are removed from our live systems immediately or within 30 days, and from backups within a further [35] days as backups rotate.
Messages: conversations are part of both members' accounts. When you delete your account, messages you have already sent remain in the other member's conversation, shown as coming from "Deleted User" without your name or photos, until that member deletes their account or the conversation is deleted under our retention rules. Messages are deleted [24 months] after a conversation's last activity where both members are inactive.
Quickies: visible for a maximum of 48 hours, then removed from public view and deleted from our systems within 30 days.
Rejected photos: deleted promptly after moderation, unless kept as evidence of a serious breach.
Safety and moderation records (reports, moderation decisions, and limited identifiers of banned accounts such as email hash and device data): up to [5 years] after the action, to prevent banned members re-registering, protect members and defend legal claims. Material relating to child sexual exploitation is preserved and reported as required by law.
Purchase records: up to [7 years] to meet tax and accounting obligations.
Server logs and security data: up to [90 days], unless needed to investigate a specific incident.
Support and contact-form messages: up to [2 years] after the request is closed.
Inactive accounts: we may delete accounts that have been inactive for [24 months] after giving you notice by email.

8. Security

We use administrative, technical and physical safeguards designed to protect your information, including encryption in transit (TLS), hashing of passwords using a modern algorithm (Argon2), access controls limited to staff who need access, private storage for private photos, metadata stripping on photos, rate limiting and monitoring for suspicious activity. No system is completely secure; please use a strong, unique password and tell us immediately about any suspected unauthorised access. If a data breach is likely to put your rights at risk, we will notify you and the relevant authorities as required by law.

9. International transfers

We are based in [COUNTRY OF INCORPORATION] and our servers are located in [DATA CENTRE LOCATION]. Some of our service providers process data in other countries, including the United States. When we transfer personal information out of the EEA, UK, Switzerland, South Africa or Australia, we use appropriate safeguards such as adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU-U.S. Data Privacy Framework (where the recipient is certified), or other mechanisms permitted by law. You can request a copy of the relevant safeguards by emailing privacy@cravesocial.co.za.

10. Your rights and choices

Choices in the app

Edit or remove profile information and photos at any time.
Use Incognito mode to limit who can see you.
Turn off location or notifications in your device settings, and manage notification types in the app.
Change your advertising choices under Settings → Privacy (free members).
Delete your account in the app or at cravesocial.co.za/delete-account.

Your legal rights

Depending on where you live, you may have the right to: access the personal information we hold about you and receive a copy in a portable format; correct inaccurate information; delete your information; restrict or object to certain processing (including processing based on legitimate interests and direct marketing); withdraw consent at any time; and not be subject to decisions based solely on automated processing that significantly affect you.

To make a request, email privacy@cravesocial.co.za from the email address on your account. We will verify your identity before responding (for example by asking you to confirm a code sent to your account email) and respond within the time required by law (usually one month under GDPR, 45 days under US state laws). You can use an authorised agent where the law allows; we may ask for proof of their authority. We will not discriminate against you for exercising your rights.

European Economic Area and United Kingdom (GDPR / UK GDPR)

You have the rights listed above. You also have the right to lodge a complaint with your local data protection supervisory authority – in the UK, the Information Commissioner's Office (ico.org.uk) – although we'd appreciate the chance to deal with your concerns first.

California and other US states (CCPA/CPRA and similar laws)

In the past 12 months we have collected the following categories of personal information: identifiers (email, account IDs, IP address, device and advertising identifiers); customer records (purchase records); characteristics of protected classifications (age, sex/gender, sexual orientation, and ethnicity if provided); commercial information (CRAVE+ purchases); internet or electronic network activity (app usage, interactions with ads); geolocation data (approximate location); audio-visual information (photos); inferences (matching preferences); and sensitive personal information (account login credentials, sexual orientation, ethnicity if provided, and the contents of messages). We collect these from the sources and for the purposes described in sections 2 and 4, and disclose them to the categories of recipients described in section 5.

No sale. We do not sell personal information and have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16 (the Service is 18+ only).
Sharing for targeted advertising. Allowing AdMob to serve personalised ads to free members may be "sharing" or "targeted advertising". You can opt out as described in section 6.
Sensitive personal information. We only use and disclose sensitive personal information to provide the Service you request and for other purposes permitted by the CPRA regulations, so we do not offer a separate "limit the use" right.
You have the right to know, access, correct and delete your personal information and to opt out of sharing/targeted advertising. Residents of states such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon have similar rights, including to appeal a decision about your request by replying to our response or emailing privacy@cravesocial.co.za with the subject "Privacy appeal". If your appeal is denied, you may contact your state Attorney General.

South Africa (POPIA)

You have the right to access, correct or delete your personal information, to object to processing, and to withdraw consent for the processing of special personal information. You may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za. Our Information Officer can be contacted at privacy@cravesocial.co.za.

Australia (Privacy Act 1988 and the Australian Privacy Principles)

You may request access to and correction of your personal information. Sensitive information (such as sexual orientation) is collected only with your consent and used for the primary purpose for which it was collected. Some of your information may be disclosed to recipients overseas, including in [DATA CENTRE LOCATION] and the United States, as described in section 9. If you have a complaint, contact us first; we will respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Other countries

If you live elsewhere (for example Canada, Brazil, New Zealand or Switzerland), you may have similar rights under local law. Contact us and we will respond in line with the law that applies to you.

11. Deleting your account

You can delete your account at any time:

In the app: Settings → Delete Account.
On the web: at cravesocial.co.za/delete-account (for accounts with an email and password). If you signed up with Apple or Google, please delete your account in the app, or email privacy@cravesocial.co.za from your account email address.

When you delete your account we remove your profile, photos, Quickies, swipes and likes, vouches you wrote, notifications, push tokens and location, sign you out of all devices and replace your email address with an anonymous placeholder. In other members' chats you appear as "Deleted User" and they cannot reply. Limited records are kept as described in section 7. Uninstalling the app does not delete your account.

12. Children

CRAVE Social is only for adults aged 18 or over. We do not knowingly collect information from anyone under 18. If we learn that a person under 18 has created an account, we will delete it and, where appropriate, report it. If you believe a minor is using CRAVE, please report the profile in the app or email safety@cravesocial.co.za. See our Child Safety Standards.

13. Our website and cookies

Our website does not use analytics, advertising or tracking cookies. See our Cookie Policy for details. When you use the contact or account-deletion forms on the website, we process the information you enter only to handle your request.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes we will notify you in the app or by email before they take effect and, where required, ask for your consent again. The effective date at the top shows when it was last updated.

15. Contact and complaints

If you have any questions or concerns about your privacy, contact us at privacy@cravesocial.co.za or write to: Privacy, [COMPANY LEGAL NAME], [REGISTERED ADDRESS].