BondMe
CZDownload

Legal

Privacy policy

What personal data the BondMe app processes, why, who can access it, how long it is kept and what rights you have.

Effective from
31 October 2026
Version
2026-10-31

1. Who processes your data

The controller of personal data processed in the BondMe mobile app and on this website is Jan Vávra, company ID IČ: 23425440, registered at Doksy, Jiřího z Poděbrad 1043, 47201 (“the operator”, “we”).

For questions about personal data or to exercise your rights, contact info@darkrose.cz. For general support, contact info@darkrose.cz.

This policy explains how we process personal data under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Czech law.

2. What data we process

Account and profile

  • e-mail address, display name and your account identifier at the sign-in provider (Google or, where applicable, Apple);
  • an optional profile photo — a small JPEG image stored in the database;
  • your role in a partnership, app language and your six-character invite code;
  • a consent record: confirmation that you are at least 18, the version of the terms you accepted and when;
  • an optional date of birth — you only enter it if you want a birthday discount on Premium, and you can remove it at any time.

Technical data

  • push notification token(s) of your device;
  • only if you allow anonymous statistics in the app: a random app-instance identifier and usage data (for example which screens were opened, views of the Premium offer, started and completed purchases, device type and app version). Statistics never contain a pair’s content, names or an advertising identifier.

Offers and referrals

  • when your one-off, time-limited Premium offer started;
  • for the referral programme: your referral code, who invited whom (account identifiers), redemption of a code and rewards credited;
  • for Premium shared within a couple: the identifier of the partner whose subscription or Premium bonus you share, and until when it applies.

Partnership content

Content that you and your partner create within a pair: tasks, rewards, consequences, points history, rituals, limits, activity feed, safe words, emergency contacts and health notes. Both members of the pair can see this content.

Emergency contacts may include names and phone numbers of other people. Only enter them if you are entitled to do so, and let those people know.

Subscriptions

Payments are processed by Google Play (and by the App Store once the iPhone version launches). We do not receive your card details. To verify a purchase, the store sends us purchase information, and our verification server keeps a Premium entitlement record linked to your account ID.

3. Sensitive data

Health notes and content relating to your sex life (for example limits or tasks) may be special-category data under Article 9 GDPR. We process such data only on the basis of your explicit consent (Article 9(2)(a) GDPR).

Entering it is voluntary. Remember that your partner in that pair can see it too. You can withdraw your consent at any time by deleting this data in the app, leaving the partnership or deleting your account; withdrawal does not affect the lawfulness of processing before it.

4. Why we process data and on what legal basis

  • Providing the app — account, sign-in, pairing with your partner, shared content, notifications and Premium features: performance of a contract (Article 6(1)(b) GDPR).
  • Sensitive data — health notes and content relating to your sex life: your explicit consent (Article 9(2)(a) GDPR).
  • Couple Premium, offers, free trials and the referral programme — sharing Premium with your partner, discount offers (including a birthday offer if you entered your date of birth) and crediting rewards: performance of a contract (Article 6(1)(b) GDPR).
  • Anonymous usage statistics (Firebase Analytics) — improving the app and measuring whether offers and purchases work: your consent (Article 6(1)(a) GDPR). Nothing is sent without consent; you can withdraw it any time in the app’s Settings.
  • Accounting and tax records of payments: compliance with a legal obligation (Article 6(1)(c) GDPR).
  • Security and abuse prevention — protecting accounts and the service, handling fraud and disputed payments (chargebacks) and defending legal claims, including the record of your 18+ confirmation and acceptance of the terms: legitimate interest (Article 6(1)(f) GDPR).

5. Who can access the data

Your partner. The other member of a pair sees the pair’s content and your display name, profile photo and role. Nobody else can find you in the app — a partner can only be found with the exact invite code. If you have Premium, your partner sees in the app that they have it thanks to you.

We also use these processors and infrastructure providers:

  • Google Firebase (Authentication, Cloud Firestore, Cloud Messaging) — Google Ireland Limited and Google LLC; sign-in, database and notification delivery. Data storage region: Firebase/Firestore.
  • Google Sign-In (Google) and Sign in with Apple (Apple), if you use that sign-in method.
  • Google Play Billing and, where applicable, the App Store — buying and managing subscriptions.
  • Google Analytics for Firebase (Google Ireland Limited and Google LLC) — only if you allow anonymous statistics; without an advertising identifier and without ad personalisation.
  • Our verification server bondme.darkrose.cz (hosting: ) — verifies purchases and keeps Premium entitlement records linked to your account ID.
  • Public authorities, where the law requires it.

We do not use ads or any advertising SDKs, and we do not sell your data. The analytics SDK sends data only with your consent.

6. Transfers outside the EU

Google (and, where applicable, Apple) may process data outside the European Economic Area, including in the USA. Such transfers are protected by appropriate safeguards, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework where applicable.

7. Security

  • Access to data requires signing in.
  • Server-side database rules allow only the two members of a pair to read that pair’s data.
  • Communication between the app and the servers is encrypted in transit (TLS).
  • There are no public profiles and no user directory.

Content is not end-to-end encrypted and the app is not anonymous — your account is linked to your e-mail address. No technical measure is absolute, so protect your phone with a screen lock and do not share your sign-in details. Hidden mode only changes how the app icon looks and is not a security measure.

8. Push notifications

Notifications are generic and do not show the content of tasks or other items on the lock screen. We store a device token to deliver them. You can switch notifications off in the app or in your phone settings.

9. How long we keep data

  • We keep account data and content until you delete your account.
  • When you remove a partner or leave a partnership, all shared data of that pair is deleted for both partners.
  • When you delete your account, we immediately remove from our active systems your account, profile, invite code, pending invitations and every pair you belong to, including all shared content.
  • We keep payment and Premium entitlement records for the period required by accounting and tax law.
  • Your referral code, records of its redemption and shared or bonus Premium are deleted together with your account.
  • Google Analytics keeps anonymous statistics for at most 14 months; withdrawing consent erases the app-instance identifier on your device.

10. Your rights

Under the GDPR you have the right to:

  • access your personal data;
  • have inaccurate data rectified;
  • erasure (“the right to be forgotten”);
  • restriction of processing;
  • data portability;
  • object to processing based on legitimate interest;
  • withdraw your consent at any time;
  • lodge a complaint with the supervisory authority — the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), www.uoou.cz.

You can edit or delete most data directly in the app; the Account and data deletion page explains how to delete your account. Send any other request from the e-mail address linked to your account to info@darkrose.cz. We will reply without undue delay and within one month at the latest.

11. Adults only

BondMe is intended solely for people aged 18 and over. You confirm your age when you sign up. If we learn that an account is used by a minor, we will delete it.

12. This website

This website uses no advertising or analytics tools and sets no tracking cookies. The hosting provider may technically process data such as your IP address to the extent needed to deliver the page.

13. Changes to this policy

We may update this policy. The current version and effective date are shown at the top. We will tell you about material changes in the app and, where needed, ask you to confirm again.

14. Contact

Jan Vávra, company ID IČ: 23425440, Doksy, Jiřího z Poděbrad 1043, 47201. Privacy e-mail: info@darkrose.cz.

Back to top