Privacy Policy & Data Security

Contents

1. Who we are & the scope of this policy

SocialMate ("SocialMate", "we", "us", or "our") provides the SocialMate mobile application for Android and iOS, the web app, and the website at socialmate.online (together, the "Services"). We are the data controller responsible for the personal information described in this policy.

This Privacy Policy applies to all of the Services and explains how we handle personal information when you create an account, use features, communicate with us, or simply visit our website. It should be read together with our Terms of Service.

By using the Services, you acknowledge that you have read and understood this policy. If you do not agree with it, please do not use the Services. Where we rely on your consent (for example, for precise location, personalized ads, or certain notifications), you are free to decline or withdraw that consent as described below.

Contact for privacy matters: [email protected].

2. Key terms

• Personal information / personal data — information that identifies, relates to, or could reasonably be linked to you or your device.
• Processing — any operation performed on personal data (collecting, storing, using, sharing, deleting).
• Controller — the party that decides why and how personal data is processed (that's us).
• Processor / service provider — a company that processes data on our behalf and under our instructions (for example, our payment processor).
• Content — anything you create or upload: posts, stories, comments, direct messages, voice notes, anonymous notes, portfolios, marketplace listings, group and event content, and profile details.
• Mate / mating — SocialMate's word for following / connections between users.
• Coins — the in‑app virtual currency used for gifts, tips, marketplace purchases, and other features.

3. Information we collect

3.1 Information you give us

3.2 Information we collect automatically

3.3 Sensitive information

We do not intentionally collect special‑category / sensitive personal data (such as health, religion, ethnicity, or precise sexual orientation). Please do not put sensitive information into your public profile or posts unless you intend it to be seen. Precise location and, in some frameworks, exact age are treated with heightened care and are used only for the purposes described here.

4. Where the data comes from

• Directly from you — when you register, complete your profile, create content, transact, or contact support.
• Automatically — from your device and your interactions with the Services, as described above.
• From other users — for example, when someone sends you a message, gifts you, mentions you, or reports content.
• From third parties you connect — if you choose Google Sign‑In, Google shares your basic profile (name, email, and profile picture) so we can create or match your account. We do not receive your Google password.
• From service providers — our payment processor confirms whether a payment succeeded or failed and returns limited transaction metadata (never full card numbers).

5. How & why we use your data

• Provide the Services — create your account, show and deliver your content, run chats and calls, power the map, marketplace, gifts, portfolios, jobs, groups and events.
• Personalize your experience — rank your feed, suggest people/places, and surface content aligned with what you engage with (see section 9).
• Communicate with you — send push notifications, service messages, and respond to support requests.
• Payments & the economy — process top‑ups and cash‑outs, honor gifts and purchases, and maintain your coin balance.
• Advertising — show ads to free accounts and measure their performance (see section 7). Premium removes ads.
• Safety & integrity — detect and prevent fraud, spam, abuse, and violations of our Terms; moderate content (including automated review of media); enforce age limits; and keep accounts secure.
• Improve the Services — understand which features are used, diagnose crashes, and build better products.
• Legal — comply with law, respond to lawful requests, and establish, exercise or defend legal claims.

6. Legal bases for processing (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR:

Where we rely on consent, you can withdraw it at any time without affecting processing that already took place. Withdrawing consent for a feature (for example, location) simply turns that feature off.

7. Advertising & Google AdMob

SocialMate is free to use. To support the Services, we show advertising to free accounts using Google AdMob, a Google advertising service. Premium members do not see any ads.

7.1 What ads we show

• Banner ads on some browse screens.
• App‑open ads occasionally when you open or return to the app (rate‑limited).
• Interstitial ads sparingly between certain actions (rate‑limited).
• Rewarded ads that you choose to watch to unlock an action (for example, sending an anonymous voice note as a free user).
• Native ads that match the surrounding layout, clearly labelled as sponsored.

7.2 Data used for ads

To serve, cap, measure, and secure ads, Google AdMob and its ad partners may process: a resettable advertising identifier (Android Advertising ID / Apple IDFA), coarse/approximate location, IP address, device and app information, and ad interaction data (impressions, clicks, and reward events). Depending on your settings and consent, ads may be personalized (based on inferred interests) or non‑personalized (contextual only).

7.3 Your choices about ads

• Go Premium — Premium removes all ads across the app.
• iOS App Tracking Transparency — on iOS, we ask permission before any cross‑app tracking; if you decline, you'll only see non‑personalized ads and no IDFA‑based tracking.
• EEA/UK consent — where required, we present a consent choice for personalized ads via a Google‑certified consent mechanism; you can choose non‑personalized ads.
• Reset or limit your advertising ID — Android: Settings → Google → Ads. iOS: Settings → Privacy & Security → Tracking / Apple Advertising.

We do not use ads that target children, and we do not knowingly enable ad personalization for anyone under the age required by local law.

8. Push notifications

With your permission, we send push notifications — for example, likes, comments, new mates, messages, calls, gifts, and safety notices. Delivery uses Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS), routed through the Expo push infrastructure. To deliver them we store a device push token tied to your account.

Some notifications support quick actions — such as replying to a message, mating someone back, or reclaiming a gift — handled directly from the notification. You can turn notifications off entirely in your device settings or in the app's Settings, and you can toggle the in‑app notification sound separately.

9. Feed personalization & profiling

To make the app useful, we rank and recommend content. The "For You"/discovery feeds may take into account: topics you picked, categories and creators you engage with (likes, comments, watch), general recency and popularity, and an aggregate engagement signal. We also keep a record of posts you've already seen so we can show you fresh content instead of repeats.

This ranking is not automated decision‑making that produces legal or similarly significant effects about you. It only orders content. You can influence it by changing what you follow and engage with, and you can edit your chosen interests at any time.

10. Payments & the coin economy

Top‑ups, Premium, gifts, tips, marketplace purchases, and cash‑outs run on an in‑app coin system. Card and mobile‑money payments are processed by Paystack, a PCI‑DSS‑certified payment provider. Full card numbers and mobile‑money credentials never touch our servers — Paystack handles them directly and returns only a success/failure result and limited transaction metadata.

We retain records of transactions (amounts, dates, coin movements, and cash‑out references) as needed to operate the economy, prevent fraud, provide receipts and support, and meet legal, accounting and tax obligations.

11. Location data

Precise location is optional and off until you grant permission. When enabled, we use your location to power the live map, show nearby people, places and events, plot event routes, and provide local weather alerts (weather lookups send only coordinates to Open‑Meteo, with no identity attached).

• We show other users only the position you chose to share — not a continuous precise trail.
• You can turn location off anytime in Settings or in your device permissions; the map simply stops showing you.
• Private accounts are hidden from the map.
• We collect location only while you are using the app (foreground), not in the background.

12. Device permissions we request

You can grant or revoke each permission at any time in your device settings. Declining a permission only disables the features that rely on it.

13. Cookies, local storage & SDK identifiers

On the website and web app, we use strictly necessary cookies and local storage to keep you signed in, remember preferences, and secure sessions. We may use limited analytics to understand usage. Where required by law, we request consent for non‑essential cookies; you can also control cookies through your browser.

In the mobile app, we and our providers use SDKs and mobile identifiers (such as the advertising ID and push token) to deliver notifications, serve ads to free accounts, and maintain security. These are described throughout this policy and can be limited via your device privacy settings.

14. How we share data

We do not sell your personal information and we do not share it with data brokers. We disclose data only in these situations:

• With other users — your profile and the content you choose to share are visible according to your settings (public, mates‑only, or private). Anonymous notes never reveal your identity unless you request a reveal and the recipient accepts.
• With service providers (processors) — companies that perform functions on our behalf under contract and only on our instructions (see section 15).
• For advertising — with Google AdMob, limited to what is needed to serve and measure ads for free accounts.
• For legal reasons — to comply with applicable law, a lawful request, or legal process; to enforce our Terms; or to protect the rights, safety and property of our users, the public, or SocialMate.
• Business transfers — if SocialMate is involved in a merger, acquisition, financing, or sale of assets, data may transfer as part of that transaction; we will notify you and any successor will be bound by this policy or an equivalent.
• With your consent — for any other sharing you specifically authorize.

15. Third‑party processors & their policies

We keep this list current. If we add or change a material processor, we will update this page.

16. How long we keep data

We keep personal data only as long as necessary for the purposes in this policy, then delete or anonymize it. Typical periods:

Some data may persist briefly in backups after deletion from live systems; it is overwritten on the normal backup cycle.

17. How we protect your data

• Encryption in transit — all traffic between the apps and our servers uses HTTPS/TLS.
• Passwords are hashed with bcrypt — we cannot read them, ever.
• Payments are handled by Paystack (PCI‑DSS). Card and mobile‑money credentials never reach our servers.
• Access control — production data lives on a hardened, firewalled server with key‑based SSH and least‑privilege database access; admin actions require a separate token.
• Sessions use short‑lived signed tokens with rotating refresh tokens; logging out revokes them.
• Content moderation — media may be automatically reviewed before it becomes publicly visible, to keep the community safe.
• Backups run nightly so your account and balances survive failures.

No method of transmission or storage is 100% secure, but we work hard to protect your information and continually improve our safeguards. If a breach affects you, we will notify you and the relevant authorities as required by law.

18. International data transfers

SocialMate operates globally, and our providers (such as Google, Apple, Expo and Paystack) may process data in countries other than yours, including the United States. Where we transfer personal data out of the EEA, UK, or other regions with transfer restrictions, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's approved certification — to ensure your data remains protected.

19. Your privacy rights & controls

Depending on where you live, you may have some or all of these rights:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data (much of it you can edit in‑app).
• Erasure — delete your data or your whole account.
• Restriction / objection — limit or object to certain processing, including profiling and direct‑marketing‑style notifications.
• Portability — receive your data in a portable format.
• Withdraw consent — for anything based on consent (location, personalized ads, notifications).
• Opt out of personalized ads — via Premium, device settings, or the in‑app/consent controls.
• Non‑discrimination — we won't treat you worse for exercising your rights.

How to exercise: use the in‑app controls, or email [email protected]. We may need to verify your identity before acting. We respond within the time your law requires (generally 30–45 days) and free of charge, except for excessive or repetitive requests.

20. Notice for the EEA & UK

If you are in the EEA or UK, we process your data on the legal bases in section 6, and you have the rights in section 19. You also have the right to lodge a complaint with your local supervisory authority (for the UK, the Information Commissioner's Office at ico.org.uk). We'd appreciate the chance to address your concern first, so please consider contacting us before you do.

21. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, to request access and deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information.

We do not sell your personal information for money. Certain ad‑related disclosures (for example, sharing an advertising identifier with Google AdMob for cross‑context behavioral advertising) may be considered "sharing" under the CPRA. You can opt out by going Premium, using your device's ad‑tracking controls, or contacting us. We honor Global Privacy Control (GPC) browser signals where applicable.

We do not knowingly sell or share the personal information of anyone under 16. We will not discriminate against you for exercising your rights. To make a request, email [email protected]. You may use an authorized agent, and we may verify the request.

Categories collected (CCPA): identifiers; customer records (name, contact); commercial information (transactions); internet/network activity; approximate and (opt‑in) precise geolocation; audio/visual content you upload; and inferences drawn for personalization. See section 3 for details and section 5 for purposes.

22. Other US state privacy rights

Residents of states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others) have rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising and certain profiling. You can exercise these rights as described in section 19. Where a law provides an appeals process for a declined request, we will honor it.

23. Ghana & other regions

Where the Data Protection Act, 2012 (Act 843) of Ghana applies, we process personal data in line with its principles — accountability, lawfulness, specification of purpose, data minimization, accuracy, storage limitation, and security — and you may exercise the access, correction and deletion rights described above by contacting us. Users in other countries have the rights granted by their local law; contact us and we'll help you exercise them.

24. Children & families

SocialMate is not intended for children under 13 (or under the minimum age required in your country — for example, 16 in parts of the EEA). We ask for your date of birth at sign‑up to enforce this age limit and do not knowingly collect personal data from anyone under the applicable age.

We do not serve ads designed for children and do not knowingly enable ad personalization for minors. If you believe a child has provided us personal data, contact [email protected] and we will delete the account and associated data. Parents and guardians may contact us with any concern.

25. Deleting your account & data

You are always in control:

• In the app — go to Settings → Delete account. This removes your profile and content from the Services.
• By email — request deletion at [email protected] from your account email, and we'll process it.
• Partial deletion — you can delete individual posts, stories, and messages you sent without deleting your account.

What is deleted: your profile, posts, stories, comments, messages you sent, portfolios, listings, and other content tied to your account. What may be retained: records we are legally required to keep (such as transaction/tax records), de‑identified/aggregate data, and anything needed to prevent fraud or resolve disputes — kept only as long as the law or a legitimate need requires, then deleted. Residual copies may remain briefly in backups before cycling out.

26. Google Play "Data Safety" summary

To help align with Google Play's Data Safety section, here is a plain summary of our practices:

• Data collected & shared: Personal info (name, email, username, phone [optional], DOB); Photos & videos; Voice/audio you record; Messages you send; App activity and interactions; Approximate and (opt‑in) precise location; Device and other IDs (including advertising ID for free accounts); Purchase/transaction info.
• Shared with third parties: With Google AdMob for advertising (free accounts); with Paystack for payments; with push and infrastructure providers to deliver the service. We do not sell data or share it with data brokers.
• Security practices: Data is encrypted in transit; passwords are hashed; you can request deletion.
• Data deletion: Users can delete their account and data in‑app or by email (see section 25).
• Ads: This app contains ads (removed for Premium members).

The authoritative, itemized declarations appear in the app's Google Play "Data safety" form; this section is a readable companion to it.

27. Apple App Privacy summary

For Apple's App Privacy ("nutrition label"), our typical declarations are:

• Data used to track you (only with your App Tracking Transparency consent): advertising identifier and coarse usage/interaction data, used by Google AdMob for personalized ads on free accounts. Decline the ATT prompt and you will not be tracked across apps.
• Data linked to you: contact info, user content, identifiers, usage data, purchases, and (opt‑in) location.
• Data not linked to you: diagnostics and some aggregate usage.

The definitive declarations are set in App Store Connect; this section explains them in everyday language.

28. Calls & real‑time media

SocialMate offers one‑to‑one audio and video calls between mutual mates. Calls use WebRTC, a peer‑to‑peer technology. To set up a call, our servers exchange connection information ("signaling") between the two participants; where a direct connection can't be established, media may be relayed through a server to keep the call working.

• We do not record the audio or video content of your calls.
• To establish connections, participants' network addresses (IP) are shared between the calling parties, which is inherent to how internet calling works.
• We log basic call metadata — such as who called whom, the time, duration, and whether it connected or was missed — to show your call history and provide the feature. This can appear as a call entry in your chat.
• Microphone and, for video calls, camera access are required only for the duration of a call and only with your permission.

29. Anonymous features

Some features let you reach others anonymously — for example, anonymous voice notes to a specific person or to a random stranger. Privacy is central to how these work:

• The recipient hears your note but is not shown your identity.
• Your identity is revealed to another user only if you request a reveal and that person accepts it.
• For "random" delivery, matching may consider a broad area (for example, city or country) that you choose; the recipient never learns who you are unless you both agree to a reveal.
• Behind the scenes, we still associate anonymous content with your account so we can enforce our Terms, prevent abuse, and respond to reports and legal requests. "Anonymous" means anonymous to other users, not that the content is untraceable to us.

30. Marketplace, commerce & orders

SocialMate includes a marketplace where users list and buy items, and features like tips, gifts and event tickets. When you transact:

• Buyers and sellers see the information needed to complete an order — such as the counterpart's profile, the item, and order status updates.
• We process purchases, order status (e.g. just bought, in transit, delivered), reviews and ratings you leave, and gift send/redeem events.
• Payment credentials are handled by Paystack, not us (see section 10).
• We keep transaction records to honor purchases, resolve disputes, prevent fraud, and meet legal and tax obligations.
• Ratings and reviews you post about a seller or item are visible to other users.

You are responsible for the accuracy and lawfulness of what you list and what you disclose to counterparts. Do not share others' personal data through the marketplace beyond what a transaction requires.

31. Community safety: blocking & reporting

To keep SocialMate safe, we provide tools and process the data they generate:

• Blocking — when you block someone, you stop seeing each other across the app and can't message or call each other. We store the block relationship to enforce it.
• Reporting — when you report a user, post, or message, we receive the report (including the reason and the reported content) so our team can review and act. Reports are confidential; we don't tell the reported person who filed a report.
• Enforcement — we may restrict, suspend, or remove accounts or content that violate our Terms, and we keep records of enforcement actions to run the service fairly and handle appeals.
• Account status — we may notify you about actions affecting your account (for example, content removed after review).

32. Content moderation & automated/AI processing

To protect the community, media you upload may be automatically reviewed before it becomes publicly visible. This automated review helps detect content that violates our rules. Automated systems may also assist with ranking, spam detection, and abuse prevention.

• Automated review affects the visibility of content, not your legal rights, and you can still see your own content (with an "under review" indicator where applicable).
• Where a decision significantly affects you (for example, account suspension), a person can review it — contact us to appeal.
• We may use aggregated, de‑identified data to improve safety and ranking systems.

Any AI‑assisted features are used to operate and improve the Services and to keep you safe, consistent with this policy. We do not use the private content of your messages to build advertising profiles.

33. Aggregated & de‑identified data

We may create aggregated or de‑identified data (for example, total active users, popular categories, or general usage trends) that does not identify you. We may use and share such data for analytics, research, reporting, and improving the Services. Where we hold de‑identified data, we maintain it as de‑identified and do not attempt to re‑identify it except to test our de‑identification.

34. Third‑party links & content

The Services may contain links to third‑party websites, apps, or content (for example, links users share, social profiles, or sponsored ad destinations). We don't control those third parties and are not responsible for their privacy practices. When you leave the Services or interact with an ad, the third party's own privacy policy governs. Review those policies before providing personal information.

35. Do Not Track & Global Privacy Control

Some browsers offer "Do Not Track" (DNT) signals. Because there is no common industry standard for DNT, our website does not respond to DNT signals differently at this time. However, where required by law, we honor recognized opt‑out preference signals such as the Global Privacy Control (GPC) as a valid request to opt out of "sale"/"sharing" for that browser or device.

36. Your responsibilities

• Keep your login credentials secure and don't share your account.
• Only post content and personal information you have the right to share.
• Respect others' privacy — don't collect, expose, or misuse other people's personal data (including via screenshots, the marketplace, or anonymous features).
• Provide accurate information, especially your date of birth for age verification.
• Use reporting and blocking tools rather than escalating conflicts.

Misusing others' data or the Services may lead to account action and, where appropriate, referral to authorities.

37. More regional notices

Nigeria (NDPA)

Where the Nigeria Data Protection Act applies, we process personal data lawfully and fairly, and you may exercise access, correction, deletion and objection rights by contacting us.

Canada (PIPEDA)

We handle personal information in line with fair information principles, obtain consent where appropriate, and let you access and correct your information.

Brazil (LGPD)

If the LGPD applies, our legal bases mirror those in section 6, and you have rights of confirmation, access, correction, anonymization, portability, deletion, and information about sharing.

Australia (Privacy Act)

We handle personal information consistent with the Australian Privacy Principles, including access and correction rights and notification of eligible data breaches.

Wherever you live, contact us and we'll help you exercise the rights your local law provides.

38. Data‑use matrix

A consolidated view of what we process, why, and who it may be shared with:

39. Accessibility & languages

We aim to keep this policy clear and readable. If you need this policy in another format or have trouble accessing it, contact us and we'll help. If we provide translations, the English version governs in the event of any conflict, to the extent permitted by law.

40. Data breach notification

We maintain safeguards to prevent unauthorized access to personal data (see section 17). If we become aware of a security incident that compromises your personal data, we will:

• Investigate promptly and take steps to contain and remediate the incident.
• Notify affected users and the relevant supervisory authorities where and when the law requires (for example, within 72 hours of becoming aware, under the GDPR).
• Explain, as far as we can, what happened, what data was involved, and what you can do to protect yourself.

We encourage you to use a strong, unique password and to keep your device and app up to date to reduce your own risk.

41. Privacy FAQ

Do you sell my data?

No. We do not sell your personal information for money, and we don't share it with data brokers. Free accounts do see ads via Google AdMob, and some ad‑related sharing may count as "sharing" under certain US laws — you can opt out (see sections 7 and 21).

How do I stop seeing ads?

Upgrade to Premium — Premium members see no ads anywhere in the app.

Can other people see my exact location?

No. Location is optional and off until you allow it. Other users only see the position you chose to share, and private accounts are hidden from the map. You can turn location off anytime.

Are my direct messages used for advertising?

No. We do not use the private content of your messages or calls to build advertising profiles.

Is "anonymous" really anonymous?

Anonymous features hide your identity from other users. Your identity is revealed only if you request it and the other person accepts. For safety and legal compliance, the content remains associated with your account on our systems.

How do I delete my account?

Go to Settings → Delete account in the app, or email us. See section 25 for exactly what is deleted and what may be retained.

How do I get a copy of my data?

Email [email protected] from your account address and ask for an export; we'll verify and respond within the time your law requires.

What happens to my data if the app shuts down?

If the Services close or transfer to another company, we'll notify you and either delete your data or ensure it stays protected under this policy or an equivalent one.

Who can I complain to?

Contact us first at [email protected]. If you're in the EEA/UK and remain unsatisfied, you may complain to your local data protection authority.

42. Changes to this policy

We may update this policy as the Services evolve or the law changes. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Your continued use of the Services after an update means you accept the revised policy. We encourage you to review this page periodically. Prior versions are available on request.

43. How to contact us

For any privacy question, request, or concern:

• Email: [email protected]
• Website: socialmate.online
• Data requests (access, deletion, correction, portability): email us from your account address and tell us what you'd like.

We're committed to resolving privacy concerns fairly and promptly. If you're in the EEA/UK and remain unsatisfied, you may contact your local data protection authority.