Privacy Policy
The essentials
- Kinkslap is the app of the local kink scene. What you put on it can reveal your sex life: we treat it as sensitive data, with as little data as possible.
- We do not ask for your name or a password. Your phone number is only asked for if you choose to hide from your contacts. Your email is used to sign you in and is never shown to other members.
- Orientation, relationship status and practices are optional. You fill them in if you want, you choose who sees them, you delete them whenever you want.
- Optional: you can hide from your contacts. You pick, in your address book, the people you do not want to meet on Kinkslap (a colleague, your family): if they are members, you no longer see each other, and nobody is told. Only the contacts you pick leave your phone, as encrypted fingerprints, never your whole address book.
- Your exact position never leaves your phone: only an area of about 5 km is sent, and distances are rounded.
- Your data is hosted in the European Union. Only the photos and texts meant to be seen by other members are analysed by moderation services, which may process them outside the European Union, without your name or your identifier.
- We do not sell your data, there is no advertising and no advertising tracker, and the app reads nothing on your phone to follow you. To know whether Kinkslap keeps its members, our server counts a few actions (opening the app, registering for an event, sending a spank...) under a pseudonymous identifier, without saying with whom or where.
- You can export all your data and delete your account from the app, at any time.
This summary does not replace the full text below.
1. Who is responsible for your data
The controller is Alexandre Blause, self-employed sole trader, trading as Skelapps (company number (CBE) being assigned), established at rue de l'Hospice Communal 92, 1170 Watermael-Boitsfort, Belgium ("Kinkslap", "we", "us").
For any question about your data or to exercise your rights: privacy@kinkslap.app.
This policy applies to the Kinkslap mobile app (iOS and Android) and to the kinkslap.app website. It supplements the terms of use.
2. The data we process
What you give us
- Your account: your email address, and your year of birth. If you sign in with Apple, Apple only passes us your email, or a relay address if you choose to hide yours; never your name.
- Your profile: your username, your city, your photos, your bio, your roles, what you are looking for, and if you want, your gender, your height, your social networks, your orientation, your relationship status.
- Your practices and limits: for each practice, yes, maybe or no. Optional.
- Your links with other profiles (partner, D/s relationship...), which are only shown once the other person has accepted them.
- What you post: posts, comments, likes, events, venue descriptions.
- Your messages: texts and photos sent in conversations, spanks and the words that come with them.
- Your events: registrations, acceptance of an event's rules, tickets, attendance, anonymous feedback after an event.
- Your reports and appeals, with the details you add to them.
- Your settings: visibility, discretion, notifications, filters on what you receive.
- Your phone number and your hidden contacts, only if you use "Block contacts" (see below).
What is produced when you use the app
- Your approximate area, only if you allow location: your phone calculates a cell of about 5 km and only sends that, never your coordinates.
- Your sessions: the IP address and device model recorded at sign-in, for the security of your account.
- The notification token of your device, if you accept notifications.
- Your trust score: an internal indicator from 0 to 100, calculated from simple signals: verified email, verified age, attendance at events, account age, share of your spanks and words that were ignored, confirmed reports against you. It sets the number of spanks and pending words you can send. It is never shown to other members.
- The moderation decisions that concern you.
- Crash reports from the app and the server, reduced to what locates the error (see section 5).
- Usage measurements: when you open the app, create your account, pass a signup step or finish signing up, register for an event or enter it, send a spank, follow someone or publish a post, our server records the name of that action and its day, under a pseudonymous identifier (see section 5), and only sends it once the day is over. For the signup steps only, it adds the app language and your phone's system (iOS or Android). Nothing else: not the time, not with whom, not which event, not what content, and nothing is recorded for the person who receives your spank or whom you follow.
If you use "Block contacts"
This feature is optional. It exists so that people around you do not see you, and you do not see them. It is never used to suggest members to you, to invite or to contact anyone.
- Your phone number, if you add one: you verify it with a one-time code. Your number is sent to Prelude (Prelude SAS, France) only to deliver that code. After that, Kinkslap keeps only a keyed fingerprint (HMAC) and the last two digits, never the number in clear. It is never shown to anyone.
- The contacts you pick in your phone's address book: only the contacts you pick leave your phone, never the whole address book. Our server turns their phone numbers and emails into keyed fingerprints. We also keep their name as written in your address book, encrypted, visible to you alone.
- The fingerprint of your account email: it lets people who have your address in their contacts hide from you. We keep only the fingerprint for that; the address itself is used as described above.
- What it changes: you and any member who matches a contact you picked no longer see each other, as after a block. Nobody is told, and Kinkslap never reveals which of your contacts are members.
What we do not collect
No real name, no password, no GPS coordinates, no advertising identifier. No phone number and no contacts from your phone, unless you turn on "Block contacts" (see above), and even then never your whole address book nor a number in clear. Photos are re-encoded on your phone before they are sent, which removes their metadata (including the position where they were taken).
On the kinkslap.app website, we do not keep your IP address: it is only used, in a form encrypted with a secret key, to limit the number of requests per minute. The website sets no tracking cookie.
3. Your sensitive data
On Kinkslap, many things can reveal your sex life or your orientation: your orientation, your status, your practices and limits, your links, your attendance at a kink event, and even the fact of being a member. The GDPR gives them special protection (Article 9).
- You decide whether to give them. Orientation, relationship status, practices and limits are optional. You fill them in on your profile, under a note that explains what they reveal and who sees them. Filling them in is your explicit consent to their processing for the features described here.
- You decide who sees them. "Limits visible to" chooses who sees your yes and maybe answers; your "no" answers are never shown to anyone, only counted as differences in compatibility. What you choose to show on your profile is visible to signed-in members according to your settings.
- You withdraw them whenever you want, by clearing the field ("Not specified") or by tapping a limit's level again. Withdrawal does not affect what was done before.
- A link between two profiles is only shown after the other person has agreed to the exact type of link. Either of you can remove it alone.
- They are used for nothing else. Orientation, status, practices and limits are never sent to an automated analysis service, nor used for advertising.
- They are encrypted: orientation, status, limit levels and link types are encrypted in our database, on top of the host's encryption.
4. Why we use them, and on what basis
| What we do | Legal basis |
|---|---|
| Create and secure your account, sign you in by magic link, passkey or Apple | Performance of a contract (the terms of use) |
| Check that you are an adult, from your year of birth | Legitimate interest: protecting minors and complying with app store rules |
| Display your profile, your posts, your events; run the feed, the calendar, messaging, tickets | Performance of a contract |
| Compare your practices with another member's, display your orientation and your status | Your explicit consent (section 3) |
| Calculate rounded distances and show you nearby members | Your consent, given through your phone's location permission and withdrawable at any time |
| Send you push notifications | Your consent, given through your phone's permission |
| Send you the necessary emails (sign-in link, deletion code, deletion confirmation) | Performance of a contract |
| Moderate content, fight scams and harassment, handle reports and appeals, calculate the trust score | Legitimate interest (the safety of members) and our legal obligations as a host (Digital Services Act) |
| Understand and fix crashes | Legitimate interest (running the service) |
| Verify your number, keep fingerprints of your number, of your account email and of the contacts you picked, to hide you from them and them from you | Legitimate interest: the member's interest in not being seen by the people around them, and these people's interest in not seeing the member (GDPR art. 6(1)(f)) |
| Measure whether the app keeps its members (how many come back after a day, a week, a month) which features bring them back and at which step signup loses people | Legitimate interest (knowing whether the service is useful and improving it); you can object (section 9) |
| Respond to your requests for access, export, deletion; keep proof of your acceptance of the terms | Legal obligation |
| Block for 12 months the re-registration of a sanctioned member who deletes their account | Legitimate interest (the safety of members) and the defence of our rights |
We do not use your data for advertising or for commercial profiling, and we do not sell it.
5. Who they are shared with
Other members
They see what you choose to show, according to your settings: your public profile, your yes and maybe answers if "Limits visible to" allows it, your links if you both accept them, a distance rounded in steps (less than 2, 5, 10, 25 km, then 25 km and more) if you show it, your attendance at an event if you agree to appear on the list, your private album if you give them access to it. Your email is never visible.
The organisers of an event see the registrations for their event (username, main photo, status) and scan the tickets. Participants' feedback after the event reaches them anonymously, and only from 3 responses.
Website visitors see the public pages of venues and events, never the participants or the members' profiles.
The moderation team
It sees reported content, including a private message when it is reported, and content waiting to be checked. It does not read your conversations otherwise.
Our service providers
They act on our instructions, under contract, and only for the following.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Cloudflare | Hosts the app, the website, the database, the photos and the conversations; sends the emails | All the service's data | European Union (database, photos and conversations stored in Cloudflare's EU jurisdiction) |
| OpenAI | Checks that a photo meant for other members follows our rules (profile photos, private album, post and event photos) | The photo alone, without metadata, without your name or your identifier. Never your private messages | United States |
| Cloudflare (Workers AI) | Checks that a text meant for other members follows our rules (bio, posts, comments, events, venues) | The text alone, without your name or your identifier. Never your private messages | The nearest Cloudflare data centre, which may be outside the European Union |
| PostHog | Measures how many members come back, for us | The name of an action, its day and a pseudonymous identifier computed by our server with a secret key, which PostHog cannot link to your account; for signup, the app language and iOS or Android. No email, no pseudonym, no IP address, no device model, no screen viewed, no content, not the person or the event concerned | European Union (Germany) |
| Sentry | Receives crash reports | The type of error, its redacted technical trace (links, emails and identifiers removed), the device model and the system version. No identifier, no screen viewed, no content | European Union (Germany) |
| Expo, then Apple or Google | Deliver push notifications to your phone | Your device's token and the text of the notification: "New activity" by default; if you turn off neutral notifications, a member's username or the name of an event or venue, never the content of a message | United States |
| Prelude (Prelude SAS) | Sends the one-time code that verifies your number, if you use "Block contacts" | Your phone number and the code, only for this delivery. Neither your username nor your email | France |
| Apple | Sign in with Apple, if you choose it | What you exchange directly with Apple | As determined by Apple |
City search goes through GeoNames, from our server: GeoNames only receives the name typed and the language, never your identity, your IP address or your position.
The classifiers that detect nudity and faces in your photos run on your phone and send nothing.
Authorities
We only disclose data to an authority if the law requires us to, on a lawful request.
6. Transfers outside the European Union
OpenAI and Expo are established in the United States, as are Apple and Google for delivering notifications. These transfers are covered by the European Commission's standard contractual clauses for OpenAI, and by Expo's certification under the EU-US Data Privacy Framework. The check of texts by Cloudflare Workers AI may take place outside the European Union: it is covered by Cloudflare's data processing agreement, which includes the same standard contractual clauses. You can get a copy of these safeguards by writing to us.
We limit what leaves: content meant to be seen by other members, without an identifier, for OpenAI and Cloudflare Workers AI; a neutral text by default for notifications.
7. How long we keep them
| Data | Duration |
|---|---|
| Account, profile, photos, practices and limits, settings | As long as your account exists, or until you clear the field |
| Sign-in link | 15 minutes |
| Sessions (IP address, device) | Until you sign out, or 90 days without opening the app |
| Location area | 30 days after its last update, and deleted immediately if you withdraw the permission |
| Conversation messages and photos | 24 months after the conversation's last message, or sooner if the conversation or your account is deleted |
| Answers to your spanks and words, accepted or ignored (for the trust score) | 12 months after the answer |
| Event sign-ups and attendance | 12 months after the event; an attendance you show on your profile stays as long as your account exists |
| Ephemeral photos | Deleted as soon as all recipients have opened them, at the latest 14 days after sending |
| In-app notifications | 90 days |
| Automatically refused photo | 6 months after the refusal, for a possible review, visible to moderators only |
| Request to review an automatic refusal (refused text and your note) | 2 years after the decision |
| Copy of reported content, kept as evidence | 6 months after the decision, longer if an appeal is in progress |
| Reports and moderation decisions | 2 years after the decision, longer while an appeal is in progress or a suspension lasts |
| Proof of your acceptance of the terms | As long as your account exists, deleted with it |
| Block on re-registration of a sanctioned member | 12 months, in the form of an encrypted fingerprint of their email, never the address |
| Hidden contacts (fingerprints of numbers and emails, encrypted name) | Until you remove the contact, or delete your account |
| Verified number (fingerprint and last two digits) | Until you remove it, another account verifies it in turn, or you delete your account |
| Fingerprint of your account email | As long as your account exists |
| Crash reports | 90 days at most |
| Usage measurements | 12 months at most |
8. When you delete your account
You delete your account from Settings > Delete my account, with a code sent to your email. Everything goes, permanently: profile, practices and limits, photos, posts, comments, likes, messages and photos sent, registrations, tickets, spanks.
Your verified number, your hidden contacts (fingerprints and encrypted names) and the fingerprint of your account email also go, permanently.
What remains, no longer naming you:
- the events you organised, for the other participants' history;
- the reports you made;
- the messages others wrote to you, which belong to them;
- the anonymous feedback you gave after an event.
If your account was suspended or was the subject of a confirmed report or one under review, the reports against you are kept without your name for moderation, and your email address cannot create an account for 12 months.
Usage measurements already sent stay until their retention period ends, but nobody can link them to you any more: their pseudonymous identifier can only be computed from your account, which no longer exists.
Our host's backups and technical logs may still contain your data for their retention period, at most 30 days for the database backups and 7 days for the logs, before being deleted.
9. Your rights
At any time, you can:
- access your data and take it with you: Settings > My data > Export my data, which produces a file of your account's data;
- correct it: Edit profile;
- delete it: field by field, or by deleting your account;
- withdraw your consent: clear a sensitive field, withdraw the location or notification permission in your phone's settings;
- remove your number or a hidden contact: Settings > Discretion > Block contacts;
- object to processing based on our legitimate interest, or ask for it to be restricted, by writing to us;
- challenge a moderation decision, from the app, within 6 months, and ask for a person to review an automated decision.
For everything else, write to us at privacy@kinkslap.app. We reply within one month.
You can also lodge a complaint with the Data Protection Authority (Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be), or with the authority of the country where you live (in France, the CNIL; in the Netherlands, the Autoriteit Persoonsgegevens).
If you are not a member
A Kinkslap member may have entered your phone number or email address while choosing to hide from their contacts. You have no account and accepted nothing, so here is what we do with it:
- we keep only a keyed fingerprint of that number or email, which cannot be read back without Kinkslap's key: neither the number nor the address in clear;
- the name the member gives you in their address book is encrypted and visible to them alone;
- we use the fingerprint only to keep that member and you apart if you ever join Kinkslap: never to contact you, invite you, suggest you to anyone or tell you that you were hidden;
- we delete it when the member removes that contact or deletes their account.
You can exercise the rights of section 9 (access, erasure, objection) by writing to privacy@kinkslap.app with the number or email concerned: we compute its fingerprint to find what matches it. We do not say which member entered it, so as not to reveal who is a member.
10. Automated decisions
- Automated moderation: a photo or a text meant for other members is checked automatically, on your phone and then on our server, before it becomes visible. Refused content is not published; you can ask, from the app where the refusal shows and within 6 months, for a person on the team to review it; the answer comes with its reason. A refusal on your phone happens without anything leaving the device, so there is nothing to review. When the automated check is not possible, the content waits for a person's decision.
- Trust score: it sets your number of spanks per day (from 10 to 50) and of pending words (from 3 to 50). It never takes away your access to the app and decides no sanction: warnings, removals and suspensions are decided by a person, and you can challenge them from the app.
11. Security
Sensitive data encrypted in the database, photos with no public address and readable only through a temporary link, sign-in links stored as a fingerprint, no conversation kept on your phone, neutral notifications by default, app lock by fingerprint (on Android) and a discreet icon if you choose. If a data breach poses a high risk to you, we will tell you.
Conversation messages are encrypted by our host but are not end-to-end encrypted: do not send anything you would not want read if it is reported.
12. Minors
Kinkslap is for adults only. We only ask for your year of birth: so that no minor gets through, the year you give must be at least 19 years before the current year, and a refused year blocks sign-up until the following 1 January. If you think a minor is using Kinkslap, report their profile: these reports are handled as a priority.
13. Changes
If this policy changes significantly, we will tell you in the app at least 30 days before the new version takes effect, and we will ask for your agreement when a change affects a consent. The date of the current version is shown at the top of this page, and it is this version that the app records when you accept it.