Privacy Policy

Last updated: April 25, 2026

GoldWingman ("we," "us," or "our") is operated by Jason Goldberg, a sole proprietor registered in the Czech Republic (IČO: 08386226, Pardubice, Czech Republic). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use the GoldWingman mobile application ("App").

By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

2.1 Account Data

When you sign in via Google OAuth or Apple Sign-In, we receive:

• Email address
• Display name (as provided by the authentication provider)
• Authentication token (stored locally on your device via encrypted storage)

We do not receive or store your password. Authentication is handled entirely by Google or Apple.

2.2 Conversation Data

When you use the App as a signed-in user, we store:

• Conversation metadata (name, creation date)
• Text messages you submit for coaching
• AI-generated response suggestions

Anonymous (not signed-in) users' conversations are stored only on the local device and are not transmitted to our servers, except for the content submitted for AI processing (see Section 2.4).

2.3 Usage & Rate-Limiting Data

To prevent abuse and enforce usage limits, we collect:

• Device identifier — a randomly generated UUID stored locally on your device. This is not linked to hardware identifiers and cannot identify you personally.
• IP address — used solely for per-minute rate limiting. IP addresses stored in our abuse log are automatically overwritten with each new request and are not retained long-term.
• Request count — the number of AI generation requests made within a rolling time window.

2.4 Screenshot & Image Data

You may upload screenshots of dating app conversations for AI analysis. Here is exactly what happens:

• The image is compressed and optimized locally on your device before transmission to reduce data size.
• The compressed image is sent to our server and immediately forwarded to OpenAI's API for processing.
• We do not store screenshots on our servers. Images exist only in transit during the AI processing request.
• Only the resulting text suggestions are stored (for signed-in users).

Important: By uploading screenshots that contain information about other people (e.g., dating profiles, messages from matches), you represent and warrant that you have the right to share this content and that you will not use the App to harass, stalk, or harm any individual.

2.5 Payment Data

Subscription payments are processed by RevenueCat, Inc. and the respective app store (Google Play or Apple App Store). We do not collect, process, or store your credit card number, billing address, or other financial information. We only receive:

• Subscription status (active/expired)
• Plan type (monthly/weekly)
• Entitlement information

2.6 Device Identifier

To prevent abuse of our free tier and ensure fair access, we collect a device-level identifier (Android ID on Android devices). This identifier is used solely for fraud prevention and rate-limiting purposes under our legitimate interest. It is stored in our rate-limiting log alongside a randomly generated device UUID and is not used for advertising or tracking.

2.7 Feedback Data

If you submit feedback through the App, we store the feedback text along with your user ID (if signed in) and subscription status. When you delete your account, your user ID is removed from all feedback records — the feedback text is retained in anonymized form and cannot be linked back to you.

2.8 Data We Do NOT Collect

• Precise geolocation
• Contacts or address book
• Biometric data (facial recognition, fingerprints)
• Health or financial data
• Advertising identifiers (we do not serve ads)
• Browsing history

3. How We Use Your Data

• Provide the Service — process your text and screenshots through AI to generate conversation suggestions.
• Manage your account — authenticate you, store your conversations, sync across sessions.
• Enforce usage limits — track free-tier generation counts, prevent abuse via rate limiting.
• Process payments — verify subscription status through RevenueCat.
• Improve the Service — analyze aggregated, anonymized usage patterns (never individual conversations).
• Respond to feedback — address issues you report to us.

4. Third-Party Service Providers

We share data with the following third parties solely to operate the App:

OpenAI Data Processing: Data sent via OpenAI's API is processed in accordance with OpenAI's API Data Usage Policy. OpenAI does not use data submitted through its API to train its models. Screenshots and text are processed in real-time and are not retained by OpenAI beyond the duration of the API request.

We do not sell, rent, or trade your personal data to any third party.

5. International Data Transfers

Our third-party service providers (OpenAI, Supabase, RevenueCat) are based in the United States. When your data is transferred from the European Economic Area (EEA) to the US, these transfers are protected by:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The EU-U.S. Data Privacy Framework, where applicable

6. Data Retention

• Account & conversation data: Retained as long as your account is active. Deleted within 30 days of account deletion request.
• Abuse log data (device UUID, IP, request count): Automatically overwritten with each new request. Entries older than 30 days are not actively used for limit enforcement.
• Screenshots: Never stored. Exist only in transit during AI processing.
• Feedback: Retained indefinitely in anonymized form. Upon account deletion, your user ID is removed from all feedback records so the content can no longer be linked to you.
• Payment data: Managed by RevenueCat and the respective app store per their retention policies.

7. Your Rights Under GDPR (EEA Residents)

If you are located in the European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access — request a copy of the personal data we hold about you.
• Right to Rectification — request correction of inaccurate data.
• Right to Erasure ("Right to Be Forgotten") — request deletion of your data. You can delete your account and all associated data directly in the App via the "Delete Account & Data" button in your profile menu.
• Right to Restriction of Processing — request that we limit how we use your data.
• Right to Data Portability — request your data in a structured, machine-readable format.
• Right to Object — object to processing based on legitimate interests.
• Right to Withdraw Consent — withdraw consent at any time by deleting your account or contacting us.

To exercise any of these rights, contact us at privacy@goldwingman.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, uoou.cz) or your local supervisory authority.

Legal Basis for Processing (Article 6 GDPR)

• Contract performance (Art. 6(1)(b)) — processing necessary to provide the Service (AI suggestions, account management).
• Legitimate interest (Art. 6(1)(f)) — abuse prevention, rate limiting, service improvement.
• Consent (Art. 6(1)(a)) — uploading screenshots containing third-party data.

8. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) grants you the following rights:

• Right to Know — request what personal information we collect, use, and disclose.
• Right to Delete — request deletion of your personal information.
• Right to Opt-Out of Sale — we do not sell your personal information. No opt-out is necessary.
• Right to Non-Discrimination — we will not discriminate against you for exercising your rights.

To exercise these rights, contact us at privacy@goldwingman.com.

9. Children's Privacy

GoldWingman is intended for users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If you are under 18, do not use the App and do not provide any personal information.

If we become aware that we have collected data from a person under 18, we will promptly delete that information. If you believe a child under 18 has provided us with personal data, please contact us at privacy@goldwingman.com.

10. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Authentication tokens are stored in encrypted device storage.
• All data in transit is encrypted via HTTPS/TLS.
• Database access is restricted by row-level security policies.
• Server-side functions run in isolated environments.

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.
• We will notify affected users without undue delay if the breach is likely to result in a high risk to their rights.
• California residents will be notified in accordance with California Civil Code § 1798.82.

12. Third-Party Links

The App may contain links to third-party websites or services (e.g., dating platforms). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you via an in-app notice for significant changes.

Your continued use of the App after changes are posted constitutes acceptance of the updated policy. We encourage you to review this page periodically.

14. Contact Us

If you have questions about this Privacy Policy, your data, or wish to exercise your rights: