Privacy policy
Last updated: 6 October 2026
The short version
Cupalz is an app for meeting people in person. Your account, profile, photos and messages are stored on a Supabase server in the EU (Frankfurt). There is no advertising, there are no trackers, and there is no analytics without your consent. Who else receives data, and why, is set out below.
The rules for using Cupalz itself are in the terms of service.
Who is responsible
The controller of personal data for cupalz.app and the Cupalz app is Kostiantyn Postol. For anything about privacy, write to [email protected].
What the app keeps
To build your profile the app asks for an email address, your name, date of birth, city, gender, who you want to meet and why, photos, drinks, humour, tags, topics and a short bio. It also keeps the requests, chats, meetings and reviews you make, and your settings such as theme and language. Your password is kept by the sign-in service only in hashed form; we cannot read it.
Your account, profile, photos and messages are stored on a Supabase server in the EU (Frankfurt), so that the people you meet can see your profile and your chats. The app also keeps a copy in your browser's local storage on your device. In the demo mode the people are demonstration profiles and replies come from a simulated partner running on your phone; nothing from the demo is sent anywhere.
Your date of birth is used only to check that you are 18 or older. Photos are cropped on your device before they are uploaded.
Website and hosting
cupalz.app and app.cupalz.app are served by Cloudflare, Inc. To deliver the pages and protect them from abuse, Cloudflare processes technical data such as your IP address, browser type and the time of the request. This is done on our behalf, on the basis of our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
These pages set no cookies and run no analytics. The app saves its own files in your browser's cache so that it keeps working offline.
When you email us
If you write to one of our addresses, we receive your email address and your message and use them only to answer you. Mail is handled by Google Workspace (Google Ireland Limited) on our behalf. We keep correspondence only as long as the conversation needs it, and no longer than 24 months after it ends. The legal basis is our legitimate interest in replying (Article 6(1)(f) GDPR).
Checking photos
Every photo you upload is checked automatically before other people can see it. The photo is sent to Google Cloud Vision (Google Ireland Limited, on our behalf), which only answers whether it looks like adult, racy or violent content; the photo is not used for anything else. If the check is unsure or unavailable, the photo stays visible only to you until we look at it ourselves.
Places to meet
The cafés, bars and other public places suggested for meetings come from Google Places (Google Maps Platform). We fetch the list of places ourselves, about once a month; choosing or viewing a place in the app does not send anything about you to Google. Place data is marked «Google Maps» where it is shown.
Analytics, only with your consent
If — and only if — you switch on «Help improve Cupalz» (during sign-up or later in Settings), the app counts a few steps: an account created, a request sent, a request accepted, a meeting proposed, confirmed and reviewed. With each step go only the kind of drink, the kind of place, how the meeting went and your plan — never your messages, photos, name, address or who you talk to. The steps are linked to your account id and processed by PostHog in its EU region, on our behalf, on the basis of your consent.
Nothing is recorded automatically — no page views, no clicks, no session recordings — and nothing is stored on your device outside the app's own data. You can switch it off at any time in Profile → Settings; sending stops at once.
Push notifications
If you turn on push notifications, notifications about requests, matches, messages and meetings are delivered through the push service of your device: Firebase Cloud Messaging (Google) on Android, Firebase Cloud Messaging together with Apple Push Notification service (APNs) on iOS, and your browser's own push service on the web. These services only deliver the notification. It carries a short title and text and the place in the app to open — never the text of a message or the address of a venue.
Backups
So that an accident or a fault does not wipe out everyone's accounts, a copy of the database is made once a week. Before it leaves the job that makes it, the copy is encrypted with age, using a key that only the controller holds. The encrypted copy is stored on GitHub (GitHub, Inc., a Microsoft company) for 90 days and then deleted automatically; GitHub cannot read it.
When you delete your account, it is removed from the live server at once. Older weekly copies that still contain it expire within 90 days, and they are used only to restore the service after a failure. The legal basis is our legitimate interest in not losing the service and your data (Article 6(1)(f) GDPR).
Transfers outside the EEA
Your account, profile, photos and messages are stored and processed by Supabase on our behalf, on a server in the EU (Frankfurt).
Cloudflare and Google may process data outside the European Economic Area. Where they do, they rely on the EU–US Data Privacy Framework and on the European Commission's standard contractual clauses.
GitHub (Microsoft) may store the weekly backups outside the European Economic Area, on the same legal basis. It receives them only in encrypted form and has no key to open them.
Deleting your data
In the app, open Profile → Settings → Delete account. Your account is deleted from the server together with your profile, photos, requests, chats and meetings, and the app's copy is removed from your device.
Clearing the site data for app.cupalz.app in your browser settings, or uninstalling the app, removes only the copy on your device; your account stays until you delete it. To have your emails with us deleted, write to [email protected].
Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to data portability. Write to [email protected] and we will answer within one month.
You may also complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
Age
Cupalz is only for people aged 18 and over. The app checks the date of birth during sign-up and does not let anyone younger continue.
Changes
When what Cupalz does with your data changes, this policy is updated before that happens, and the date at the top changes.