Privacy Policy / מדיניות פרטיות

English

1. Information We Collect

• Profile data: full name, age, date of birth, gender, city, height, education, religion, smoking status, family status, languages, bio.
• Photos and videos: profile photos, video clips, stories you upload.
• Authentication: email address, hashed password, Google/Apple OAuth tokens, government ID (KinShield only — verified, then deleted).
• Family data: ancestor surnames up to 7 generations (KinShield 7G) — stored as one-way hashes, never plain-text.
• Usage data: likes, profile views, conversations, swipes, matches.
• Location: coarse location (city-level, not GPS) for nearby matches — opt-in only.
• Device data: device type, OS, app version, FCM push token.
• Communications: chat messages (encrypted in transit), video calls (not recorded).

2. How We Use Information

• Match you with other users based on your preferences.
• Verify your identity and prevent fake profiles.
• Run the KinShield 7G algorithm to detect family kinship.
• Improve the app via aggregated, anonymous analytics.
• Send notifications (new matches, messages) — you can opt out anytime.
• Prevent fraud, spam, and abuse.
• Comply with legal obligations.

3. Sharing With Third Parties

We do not sell your data. We share with:

• Supabase (database infrastructure) — hosts your data on EU servers.
• Firebase Cloud Messaging (Google) — for push notifications.
• RevenueCat — manages premium subscriptions (no chat content access).
• Agora.io — peer-to-peer video calls (not recorded).
• Apple App Store / Google Play — payment processing only.
• Law enforcement — only when legally required by court order.

4. KinShield 7G — Family Data

The ancestor names you provide for your family tree are:

• Hashed via a one-way algorithm before storage — never stored in plain text.
• Never displayed to other users — only the match outcome (kin / not kin) is shown.
• Never shared with third parties.
• Permanently deleted when you delete your account.

5. Security & Storage

• All communication encrypted via TLS 1.2+.
• Passwords stored hashed (bcrypt).
• Database protected by Row-Level Security (RLS) policies.
• Daily backups; backup retention 30 days.
• Data hosted on Supabase EU servers (GDPR-compliant region).

6. Your Rights (GDPR + CCPA)

• Access: request a copy of your data via joshiwap8@gmail.com.
• Rectification: edit your profile in-app at any time.
• Erasure: delete your account from Settings — full deletion within 30 days.
• Portability: request structured JSON export of your data.
• Object: opt out of analytics/marketing in Settings.

7. Account & Data Deletion

To delete your account in 3 simple steps:

1. Open the app → Profile → Settings → Account.
2. Scroll to bottom and tap "Delete My Account".
3. Confirm with your password.

You can also request manual deletion by emailing joshiwap8@gmail.com — we delete within 30 days and confirm in writing.

8. Children

TABAH is for users 18 and older only. We do not knowingly collect data from anyone under 18. If we learn of a minor account, we delete it immediately.

9. Policy Changes

We will update the "Last Updated" date for any change. Material changes will be emailed to you at least 14 days before taking effect.

10. Contact Us

Questions, privacy requests, or complaints:

• Email: joshiwap8@gmail.com
• Web: https://tabahapp.com