Privacy Policy
Updated 31 August 2026
This describes what Vyraj collects, why, where it is kept and for how long. It documents what the code actually does, not what is customary to write.
This English version is the authoritative one. Where a translation differs from it, this text governs.
Who is responsible
The controller is Eugene Klishevich. For anything about your data: privacy@vyraj.app.
What is collected
When you create an account
- Email address — to sign in and to recover access.
- Password — stored only as an argon2id hash. It cannot be turned back into your password, which is why we can reset it but never tell it to you.
When you fill in a profile
- Name, date of birth, city, optionally home town, gender, a short description.
- Photographs.
- Sexual orientation — only if you state it. Kept separately from the rest of the profile: it is a special category of data under GDPR and is treated more strictly.
When you open the “nearby” screen
- Your location, rounded to a grid of roughly 200 metres. The rounding happens before anything is written to the database — we do not hold precise coordinates at all, rather than holding them and choosing not to show them.
- Other people see only a distance band — “under 1 km”, “1–5 km” — never a number. Exact distances let someone work out your address from a few readings, so we do not hand them out.
Technical records
- Sessions: sign-in time and the browser or app identifier, so you can end a session you do not recognise.
- Connection address in server logs.
Why, and on what basis
| Account, sign-in, recovery | performance of our contract with you |
| Profile and photographs | performance of contract: without them the service does not work |
| Location | your consent — withdrawable in your phone settings |
| Sexual orientation | explicit consent; the field is optional |
| Reports and blocks | legitimate interest: the safety of people using the service |
How long it is kept
| Unfinished uploads | 24 hours |
| Revoked and expired sessions | 90 days |
| Deleted account | 30 days to change your mind, then erased completely, photographs included |
| Reports and what was reported | about a year — otherwise there is no way to act on a complaint about something older |
| Backups | one month |
Who else is involved
We do not sell data and do not pass it to advertisers. These providers help run the service:
- DigitalOcean — server and database.
- Cloudflare — traffic delivery and photo storage (R2, EU jurisdiction).
- Backblaze — backups, EU region, encrypted before they leave us.
- Resend — password reset and address confirmation emails.
Your rights
You can obtain a copy of your data, correct it, delete your account outright from inside the app, withdraw consent for location and orientation, and complain to the supervisory authority in your country.
Deletion lives in the app settings — no emails, no asking. After deleting you have 30 days to change your mind: sign in again and the account comes back.
Security
- Passwords use argon2id and are never stored in a readable form.
- Traffic is encrypted the whole way, including the leg from Cloudflare to our server.
- Backups are encrypted before they are sent: the storage provider holds no key.
Changes
If this policy changes materially, we will say so in the app before the change takes effect.