Privacy Policy
The essentials
- Nawori is the app of the local kink scene. What you put on it can reveal your sex life: we treat it as sensitive data, with as little data as possible.
- We do not ask for your name, your phone number or a password. Your email is used to sign you in and is never shown to other members.
- Orientation, relationship status and practices are optional. You fill them in if you want, you choose who sees them, you delete them whenever you want.
- Your exact position never leaves your phone: only an area of about 5 km is sent, and distances are rounded.
- Your data is hosted in the European Union. Only the photos and texts meant to be seen by other members are analysed by moderation services, which may process them outside the European Union, without your name or your identifier.
- We do not sell your data, there is no advertising and no advertising tracker, and the app reads nothing on your phone to follow you. To know whether Nawori keeps its members, our server counts a few actions (opening the app, registering for an event, sending a spank...) under a pseudonymous identifier, without saying with whom or where.
- You can export all your data and delete your account from the app, at any time.
This summary does not replace the full text below.
1. Who is responsible for your data
The controller is Alexandre Blause, self-employed sole trader, trading as Skelapps (company number (CBE) being assigned), established at rue de l'Hospice Communal 92, 1170 Watermael-Boitsfort, Belgium ("Nawori", "we", "us").
For any question about your data or to exercise your rights: privacy@nawori.app.
This policy applies to the Nawori mobile app (iOS and Android) and to the nawori.app website. It supplements the terms of use.
2. The data we process
What you give us
- Your account: your email address, and your year of birth. If you sign in with Apple, Apple only passes us your email, or a relay address if you choose to hide yours; never your name.
- Your profile: your username, your city, your photos, your bio, your roles, what you are looking for, and if you want, your gender, your height, your social networks, your orientation, your relationship status.
- Your practices and limits: for each practice, yes, maybe or no. Optional.
- Your links with other profiles (partner, D/s relationship...), which are only shown once the other person has accepted them.
- What you post: posts, comments, likes, events, venue descriptions.
- Your messages: texts and photos sent in conversations, spanks and the words that come with them.
- Your events: registrations, acceptance of an event's rules, tickets, attendance, anonymous feedback after an event.
- Your reports and appeals, with the details you add to them.
- Your settings: visibility, discretion, notifications, filters on what you receive.
What is produced when you use the app
- Your approximate area, only if you allow location: your phone calculates a cell of about 5 km and only sends that, never your coordinates.
- Your sessions: the IP address and device model recorded at sign-in, for the security of your account.
- The notification token of your device, if you accept notifications.
- Your trust score: an internal indicator from 0 to 100, calculated from simple signals: verified email, verified age, attendance at events, account age, share of your spanks and words that were ignored, confirmed reports against you. It sets the number of spanks and pending words you can send. It is never shown to other members.
- The moderation decisions that concern you.
- Crash reports from the app and the server, reduced to what locates the error (see section 5).
- Usage measurements: when you open the app, finish signing up, register for an event or enter it, send a spank, follow someone or publish a post, our server records the name of that action and its day, under a pseudonymous identifier (see section 5), and only sends it once the day is over. Nothing else: not the time, not with whom, not which event, not what content, and nothing is recorded for the person who receives your spank or whom you follow.
What we do not collect
No real name, no phone number, no password, no GPS coordinates, no contacts from your phone, no advertising identifier. Photos are re-encoded on your phone before they are sent, which removes their metadata (including the position where they were taken).
On the nawori.app website, we do not keep your IP address: it is only used, in a form encrypted with a secret key, to limit the number of requests per minute. The website sets no tracking cookie.
3. Your sensitive data
On Nawori, many things can reveal your sex life or your orientation: your orientation, your status, your practices and limits, your links, your attendance at a kink event, and even the fact of being a member. The GDPR gives them special protection (Article 9).
- You decide whether to give them. Orientation, relationship status, practices and limits are optional. You fill them in on your profile, under a note that explains what they reveal and who sees them. Filling them in is your explicit consent to their processing for the features described here.
- You decide who sees them. "Limits visible to" chooses who sees your yes and maybe answers; your "no" answers are never shown to anyone, only counted as differences in compatibility. What you choose to show on your profile is visible to signed-in members according to your settings.
- You withdraw them whenever you want, by clearing the field ("Not specified") or by tapping a limit's level again. Withdrawal does not affect what was done before.
- A link between two profiles is only shown after the other person has agreed to the exact type of link. Either of you can remove it alone.
- They are used for nothing else. Orientation, status, practices and limits are never sent to an automated analysis service, nor used for advertising.
- They are encrypted: orientation, status, limit levels and link types are encrypted in our database, on top of the host's encryption.
4. Why we use them, and on what basis
| What we do | Legal basis |
|---|---|
| Create and secure your account, sign you in by magic link, passkey or Apple | Performance of a contract (the terms of use) |
| Check that you are an adult, from your year of birth | Legitimate interest: protecting minors and complying with app store rules |
| Display your profile, your posts, your events; run the feed, the calendar, messaging, tickets | Performance of a contract |
| Compare your practices with another member's, display your orientation and your status | Your explicit consent (section 3) |
| Calculate rounded distances and show you nearby members | Your consent, given through your phone's location permission and withdrawable at any time |
| Send you push notifications | Your consent, given through your phone's permission |
| Send you the necessary emails (sign-in link, deletion code, deletion confirmation) | Performance of a contract |
| Moderate content, fight scams and harassment, handle reports and appeals, calculate the trust score | Legitimate interest (the safety of members) and our legal obligations as a host (Digital Services Act) |
| Understand and fix crashes | Legitimate interest (running the service) |
| Measure whether the app keeps its members (how many come back after a day, a week, a month) and which features bring them back | Legitimate interest (knowing whether the service is useful and improving it); you can object (section 9) |
| Respond to your requests for access, export, deletion; keep proof of your acceptance of the terms | Legal obligation |
| Block for 12 months the re-registration of a sanctioned member who deletes their account | Legitimate interest (the safety of members) and the defence of our rights |
We do not use your data for advertising or for commercial profiling, and we do not sell it.
5. Who they are shared with
Other members
They see what you choose to show, according to your settings: your public profile, your yes and maybe answers if "Limits visible to" allows it, your links if you both accept them, a distance rounded in steps (less than 2, 5, 10, 25 km, then 25 km and more) if you show it, your attendance at an event if you agree to appear on the list, your private album if you give them access to it. Your email is never visible.
The organisers of an event see the registrations for their event (username, main photo, status) and scan the tickets. Participants' feedback after the event reaches them anonymously, and only from 3 responses.
Website visitors see the public pages of venues and events, never the participants or the members' profiles.
The moderation team
It sees reported content, including a private message when it is reported, and content waiting to be checked. It does not read your conversations otherwise.
Our service providers
They act on our instructions, under contract, and only for the following.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Cloudflare | Hosts the app, the website, the database, the photos and the conversations; sends the emails | All the service's data | European Union (database, photos and conversations stored in Cloudflare's EU jurisdiction) |
| OpenAI | Checks that a photo meant for other members follows our rules (profile photos, private album, post and event photos) | The photo alone, without metadata, without your name or your identifier. Never your private messages | United States |
| Cloudflare (Workers AI) | Checks that a text meant for other members follows our rules (bio, posts, comments, events, venues) | The text alone, without your name or your identifier. Never your private messages | The nearest Cloudflare data centre, which may be outside the European Union |
| PostHog | Measures how many members come back, for us | The name of an action, its day and a pseudonymous identifier computed by our server with a secret key, which PostHog cannot link to your account. No email, no pseudonym, no IP address, no device, no screen viewed, no content, not the person or the event concerned | European Union (Germany) |
| Sentry | Receives crash reports | The type of error, its redacted technical trace (links, emails and identifiers removed), the device model and the system version. No identifier, no screen viewed, no content | European Union (Germany) |
| Expo, then Apple or Google | Deliver push notifications to your phone | Your device's token and the text of the notification: "New activity" by default; if you turn off neutral notifications, a member's username or the name of an event or venue, never the content of a message | United States |
| Apple | Sign in with Apple, if you choose it | What you exchange directly with Apple | As determined by Apple |
City search goes through GeoNames, from our server: GeoNames only receives the name typed and the language, never your identity, your IP address or your position.
The classifiers that detect nudity and faces in your photos run on your phone and send nothing.
Authorities
We only disclose data to an authority if the law requires us to, on a lawful request.
6. Transfers outside the European Union
OpenAI and Expo are established in the United States, as are Apple and Google for delivering notifications. These transfers are covered by the European Commission's standard contractual clauses for OpenAI, and by Expo's certification under the EU-US Data Privacy Framework. The check of texts by Cloudflare Workers AI may take place outside the European Union: it is covered by Cloudflare's data processing agreement, which includes the same standard contractual clauses. You can get a copy of these safeguards by writing to us.
We limit what leaves: content meant to be seen by other members, without an identifier, for OpenAI and Cloudflare Workers AI; a neutral text by default for notifications.
7. How long we keep them
| Data | Duration |
|---|---|
| Account, profile, photos, practices and limits, settings | As long as your account exists, or until you clear the field |
| Sign-in link | 15 minutes |
| Sessions (IP address, device) | Until you sign out, or 90 days without opening the app |
| Location area | 30 days after its last update, and deleted immediately if you withdraw the permission |
| Conversation messages and photos | 24 months after the conversation's last message, or sooner if the conversation or your account is deleted |
| Answers to your spanks and words, accepted or ignored (for the trust score) | 12 months after the answer |
| Event sign-ups and attendance | 12 months after the event; an attendance you show on your profile stays as long as your account exists |
| Ephemeral photos | Deleted as soon as all recipients have opened them, at the latest 14 days after sending |
| In-app notifications | 90 days |
| Automatically refused photo | 6 months after the refusal, for a possible review, visible to moderators only |
| Request to review an automatic refusal (refused text and your note) | 2 years after the decision |
| Copy of reported content, kept as evidence | 6 months after the decision, longer if an appeal is in progress |
| Reports and moderation decisions | 2 years after the decision, longer while an appeal is in progress or a suspension lasts |
| Proof of your acceptance of the terms | As long as your account exists, deleted with it |
| Block on re-registration of a sanctioned member | 12 months, in the form of an encrypted fingerprint of their email, never the address |
| Crash reports | 90 days at most |
| Usage measurements | 12 months at most |
8. When you delete your account
You delete your account from Settings > Delete my account, with a code sent to your email. Everything goes, permanently: profile, practices and limits, photos, posts, comments, likes, messages and photos sent, registrations, tickets, spanks.
What remains, no longer naming you:
- the events you organised, for the other participants' history;
- the reports you made;
- the messages others wrote to you, which belong to them;
- the anonymous feedback you gave after an event.
If your account was suspended or was the subject of a confirmed report or one under review, the reports against you are kept without your name for moderation, and your email address cannot create an account for 12 months.
Usage measurements already sent stay until their retention period ends, but nobody can link them to you any more: their pseudonymous identifier can only be computed from your account, which no longer exists.
Our host's backups and technical logs may still contain your data for their retention period, at most 30 days for the database backups and 7 days for the logs, before being deleted.
9. Your rights
At any time, you can:
- access your data and take it with you: Settings > My data > Export my data, which produces a file of your account's data;
- correct it: Edit profile;
- delete it: field by field, or by deleting your account;
- withdraw your consent: clear a sensitive field, withdraw the location or notification permission in your phone's settings;
- object to processing based on our legitimate interest, or ask for it to be restricted, by writing to us;
- challenge a moderation decision, from the app, within 6 months, and ask for a person to review an automated decision.
For everything else, write to us at privacy@nawori.app. We reply within one month.
You can also lodge a complaint with the Data Protection Authority (Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be), or with the authority of the country where you live (in France, the CNIL; in the Netherlands, the Autoriteit Persoonsgegevens).
10. Automated decisions
- Automated moderation: a photo or a text meant for other members is checked automatically, on your phone and then on our server, before it becomes visible. Refused content is not published; you can ask, from the app where the refusal shows and within 6 months, for a person on the team to review it; the answer comes with its reason. A refusal on your phone happens without anything leaving the device, so there is nothing to review. When the automated check is not possible, the content waits for a person's decision.
- Trust score: it sets your number of spanks per day (from 10 to 50) and of pending words (from 3 to 50). It never takes away your access to the app and decides no sanction: warnings, removals and suspensions are decided by a person, and you can challenge them from the app.
11. Security
Sensitive data encrypted in the database, photos with no public address and readable only through a temporary link, sign-in links stored as a fingerprint, no conversation kept on your phone, neutral notifications by default, app lock by fingerprint (on Android) and a discreet icon if you choose. If a data breach poses a high risk to you, we will tell you.
Conversation messages are encrypted by our host but are not end-to-end encrypted: do not send anything you would not want read if it is reported.
12. Minors
Nawori is for adults only. We only ask for your year of birth: so that no minor gets through, the year you give must be at least 19 years before the current year, and a refused year blocks sign-up until the following 1 January. If you think a minor is using Nawori, report their profile: these reports are handled as a priority.
13. Changes
If this policy changes significantly, we will tell you in the app at least 30 days before the new version takes effect, and we will ask for your agreement when a change affects a consent. The date of the current version is shown at the top of this page, and it is this version that the app records when you accept it.