Privacy Policy

1. Data we collect

• Account: email address, password (stored only as a hash we cannot read), the time you accepted the terms.
• Profile you enter: display name, date of birth (to confirm 18+ and show your age), country, height, weight, body type, position, relationship status, what you are looking for, a short bio. Because HIMO is for the LGBT community, using the app may reveal your sexual orientation or gender identity — this is sensitive data that we process only with your consent, given when you create an account, and we never infer or label it.
• Photos: profile photo, post photos, photos sent in messages.
• Private album: the photos you upload to it and the list of people you have opened it to. Album photos are not part of your profile and do not appear anywhere else in the app.
• Location: when you allow it, your device sends its current coordinates to the server once each time you open the grid (at most once every 60 seconds). The server immediately rounds them to a cell of about 550 m and stores only that cell; the original coordinates are not stored. Other users only see a distance computed between two rounded cells (off by up to about 500 m); under 500 m it only shows "< 500 m". You can hide your distance or turn the location permission off; the rest of the app keeps working.
• Location you send in a message: when you tap "Send location", your device takes a fresh, exact reading (not rounded) and attaches it to that one message. This is the only exception to the ~550 m rounding above, and it only happens when you choose it — you are asked every time. Only people in that conversation can read it (authorized HIMO staff can too, under the conditions in section 3), it does not update the location on your profile, and unsending the message deletes it from the server.
• Interactions: messages, comments, likes, people you follow, close friends, people you block, reports you send, profile views, last active time.
• Usage counting: when you run into one of the app's limits — for example reaching the end of the nearby grid, or opening the list of people who viewed your profile — we add ONE to a shared counter. The statistics table itself has no column pointing to any account and holds no location, no content and nothing you typed. So that each person · each item · each hour counts only once, a separate technical record links your account to that item and hour for 48 hours and then deletes itself; the figures delete themselves after 90 days. We also keep the list of days on which your account was active (one entry per day, with no time or location), used only to count active users; it is deleted together with your account. We use these figures to decide what to build next — never to track individuals, never for advertising, and they are not shared with anyone.
• Technical: infrastructure logs of our hosting provider (IP address, request time) kept briefly for security and abuse prevention. HIMO uses no advertising SDK, does not track you across other apps and does not need the advertising identifier.
• Message translations: only when you tap "Translate" on a specific message is the text of that message sent to an external translation service (DeepL or Google), and the result is stored so it need not be sent again. We never translate ahead of time, never translate a whole conversation, and never send photos.
• Message receipts: when the recipient's device received a message and when they opened it, so the "delivered" and "seen" marks can be shown.
• Notifications: if you allow notifications, a device token issued by Apple or Google through Expo's push service is stored with your profile, together with your app language and whether notifications may show a message preview. It is used only to deliver notifications to your device and is removed when you turn notifications off in HIMO or delete your account.

2. What it is used for

• Running the app: sign-in, showing profiles and the distance grid, the feed, messaging, views.
• Safety: confirming 18+, automated photo review, handling reports, enforcing blocks, detecting abuse.
• Service messages: account confirmation, password reset, important notices about your account. No marketing emails without your consent.
• Paid plans (when available): recording your subscription status from the App Store/Google Play to unlock features.

3. Who can see your data

• Other users: display name, age, country, approved photos, the profile details you fill in, your approximate distance (unless hidden), online status, and posts according to the audience you choose (public / close friends / private). People you block, or who block you, cannot see you. In incognito mode you do not appear in the grid, the feed or view lists, and your private album is temporarily closed. Among users, a private album is visible only to the people you open it to, and you can take that back at any time. With "quiet view" on, opening someone's profile is not recorded.
• Authorized HIMO staff: a small number of authorized HIMO administrators and moderators can access any content stored on HIMO — including private album photos, direct and group messages, images and locations sent in chats, reports, and account details — when this is reasonably necessary to operate the service, provide support, keep users safe, investigate reports, abuse, fraud or security incidents, enforce our Terms, or meet legal obligations. Content that is waiting for review or has been reported to us is seen by staff as part of normal moderation. Beyond that, opening someone's private conversations, private album or chat images requires a recorded reason. Access to private content requires a staff account protected by two-factor authentication, and these accesses, report reviews and moderation actions are recorded in an audit log that moderators cannot edit or delete. Staff do not read private conversations without such a reason. Messages you unsend and content you delete are removed from the live database and are no longer available to staff, except report evidence kept as described in section 6. Removing a conversation from your inbox only hides it for you; the other participants keep their copy.
• Transition notice (12 October 2026): the two-factor requirement and the reason-recorded access log described above are being put into operation. Until that is complete, administrator accounts are protected by a password only; staff can open private conversations, private albums or chat images only in connection with a report about that content or its owner, or while that content is awaiting moderation review; and moderation actions are recorded in an audit log. This notice is removed once the upgrade is complete.
• Processors acting on our behalf (only to provide the service, under contract, and not for their own purposes): Supabase (database, authentication, photo storage; servers in Singapore) and, for account emails such as confirmation and password reset, Supabase's email service or a transactional email provider (Resend); the host of our website (GitHub Pages for the current address, Cloudflare for himosocial.com), which receives your IP address and the address of the page you open, including the pages opened from account emails; Sightengine (an artificial-intelligence service that checks profile and post photos for sexual or violent content — photos are sent for analysis and are not kept by Sightengine for training); DeepL or Google (message translation — ONLY the text of the message you chose to translate, with no name, email or any other information about you); Expo, Apple and Google (delivery of notifications — your device token and the notification itself; with message previews on, a notification carries the sender's display name or the group name and the text of the message, otherwise only a neutral sentence); RevenueCat (management of paid plans — your HIMO account id, an identifier your phone's operating system assigns to HIMO, the app and system version and your purchase status; no name, email or card details; the app contacts it when you use HIMO on a phone, even if you never buy anything); Apple and Google (subscription payments, if any); Google Workspace (the mailbox that receives the emails you send to us).
• Authorities: when required by law or to protect users' safety.
• We do not sell or rent personal data and do not share it for advertising.

4. Legal basis and consent

We process data to perform our service agreement with you, to meet legal obligations, and on the basis of your consent for sensitive data (sexual orientation, gender identity, location). You give consent when you create an account after reading this policy, and when you grant the location permission on your device. You can withdraw consent at any time by turning location off, hiding your distance, going incognito, or deleting your account.

5. Storage and transfers

Data is stored on Supabase infrastructure in Singapore and transmitted over encrypted connections (TLS). Photos can only be loaded through signed, expiring links, and access is enforced at the database level so that one user account cannot read another account's private data (authorized staff access is described in section 3).

6. How long we keep it

• While your account is active: kept so the app works.
• When you delete your account: profile, photos, posts, comments, messages, views, follow and block lists are removed from the live database immediately; the photo files themselves are deleted by an automated cleanup (if the cleanup is interrupted, it retries until they are gone); technical backups are overwritten within 30 days.
• Transition notice (12 October 2026): the automatic deletion of photo files — of deleted accounts, unsent messages and removed posts or album photos — is being put into operation. Until it is live, those files are no longer shown in the app but remain in storage; they will be deleted once the cleanup is in operation.
• A location sent in a message is kept with that message and goes away when you unsend it or delete your account (removing the conversation from your inbox only hides it for you).
• Message translations are kept alongside the message; unsending a message deletes its translation too.
• Abuse reports and related evidence may be kept for up to 12 months after deletion to prevent abuse and meet legal requests.
• Records of staff access and moderation actions (who, when, what and why — without a copy of the content itself): up to 2 years.
• Infrastructure logs: for the provider's short retention period.
• Photos of messages you unsend, posts you delete and album photos you remove are deleted from storage by the same automated cleanup.

7. Your rights

• See and correct: every profile field can be edited in the app (Me → Edit profile).
• Delete: Settings → Delete account, or the web page himosocial.com/delete-account if you have uninstalled the app.
• Withdraw consent, limit visibility: turn location off, hide distance, go incognito, block users.
• Request a copy of your data, complain, or ask anything: email support@himosocial.com from your account's email address. We reply within 7 days.

8. Children

HIMO is for adults 18 and over only. We do not knowingly collect data from anyone under 18; accounts that lied about their age are deleted when found. If you know of someone under 18 using HIMO, report them in the app or email us.

9. Changes and contact

When this policy changes materially we notify you in the app before the new version applies to you; the new version takes effect for you when you continue using HIMO after that notice. The latest version is always in the app (Settings → About HIMO) and at himosocial.com/privacy.

HIMO's operator and any question about your data: support@himosocial.com.