Privacy Policy

Introduction

Gereh Technologies Inc. ("Gereh," "we," "our," or "us") is a Canadian company incorporated in Ontario. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("the App").

By using Gereh, you consent to the practices described in this policy. If you do not agree, please do not use the App.

Information We Collect

Information You Provide

When you create an account and use Gereh, you may provide:

• Account information: name, email address, phone number, date of birth
• Profile information: photos, bio, gender, sexual orientation, gender preferences
• Location: city, country, and geographic coordinates for proximity-based matching
• Messages: text messages, voice messages, and audio recordings sent within the App
• Personality assessment data: your responses to our Vibe Profile questionnaire, resulting personality scores across six dimensions (OCEAN+A), personality portrait, and longitudinal retake data (see "Sensitive Information" below)
• In-app activity: lesson progress, game performance, responses, accuracy ratings
• Payment information: purchase history for in-app coins (payment processing is handled by Apple App Store or Google Play Store — we do not store your credit card details)
• Referral data: referral codes used or shared
• Verification data: selfie photos submitted for profile verification

Information Collected Automatically

• Device information (type, operating system, app version)
• App usage data (features used, screens visited) — only if you opt in to analytics
• Push notification tokens
• Crash reports and performance data (always collected for app stability)

How We Use Your Information

We use the information we collect to:

• Provide the core App experience: matching, messaging, and lessons
• Show you relevant profiles based on your preferences, location, and personality compatibility
• Process in-app purchases and maintain your coin balance
• Send push notifications about matches, messages, and app updates
• Verify your identity through selfie verification
• Facilitate the referral program
• Track your lesson progress and award completion rewards
• Improve the App, fix bugs, and develop new features
• Enforce our Terms of Service and Community Guidelines
• Ensure safety and prevent fraud, abuse, and unauthorized access

Sensitive Information

Gereh collects certain categories of data that are classified as sensitive personal information under Canadian and international privacy law:

Sexual orientation and gender identity — collected solely to enable the App's core matching functionality.

Psychological assessment data — your Vibe Profile responses, personality scores (Openness, Conscientiousness, Extraversion, Agreeableness, Neuroticism, and Autonomy), personality portrait assignment, and longitudinal retake data constitute psychological profiling data. Under the EU General Data Protection Regulation (GDPR), this data may be classified as "special category" data under Article 9. We collect this data only with your explicit, separate consent. You can use Gereh without completing the personality assessment.

We apply heightened protections to sensitive data:

• Explicit consent: Personality data is collected only after you provide separate, informed, affirmative consent — distinct from your general account consent
• Purpose limitation: Personality data is used solely for matching and, with your separate consent, for anonymized academic research
• Access restriction: Your personality scores are never shown to other users
• No sale: We never sell any personal information, including sensitive data
• Deletion: You can delete your personality data at any time from Settings without deleting your account

Automated Decision-Making

Gereh uses automated processing to suggest matches. This process considers:

• Your stated preferences (age range, distance, gender)
• Geographic proximity
• Personality compatibility scores (if you've completed the Vibe Profile)

No human reviews individual match suggestions. You have the right to:

• Request information about how a specific suggestion was made
• Object to automated profiling
• Contact our Privacy Officer at privacy@gereh.ca with questions about automated decisions

Information Sharing

We do not sell your personal information — ever. We may share your information in these situations:

• With other users: Your profile information (name, photos, bio, age, and prompts) is visible to other users during discovery and matching. Messages are shared with your conversation partners. Your personality scores are never shared with other users.
• Service providers: We use third-party services to operate the App:
  • Supabase, Inc. (USA) — database hosting, authentication, and file storage
  • Google LLC / Firebase (USA) — crash reporting and, with your consent, usage analytics
  • OpenAI, LP (USA) — voice note transcription and message safety analysis. Audio submitted for transcription is retained by OpenAI for up to 30 days for abuse monitoring and is not used to train AI models.
  • Anthropic, PBC (USA) — AI-generated personality portraits and in-app content generation
  • Expo / Expo Application Services (USA) — push notification delivery
  • Resend, Inc. (USA) — transactional email (e.g., account deletion confirmation)
  • Apple App Store / Google Play Store — in-app purchase processing
• Legal requirements: We may disclose information if required by law, legal process, or government request, or to protect the rights, safety, or property of Gereh, our users, or the public.
• Safety: We may share information with law enforcement if we believe there is a risk of harm to any person.

We have entered into Data Processing Agreements (DPAs) with our key service providers to ensure your data is handled in accordance with applicable privacy laws.

Data Storage and Cross-Border Transfers

Gereh is a Canadian company. To operate the App, your data is transferred to and processed by service providers located in the United States:

By using the App, you consent to the transfer of your data to the United States. We ensure appropriate safeguards are in place, including Data Processing Agreements incorporating standard contractual clauses, to protect your data in accordance with PIPEDA, Quebec Law 25, and the GDPR.

Data Retention

• Active accounts: We retain your data for as long as your account is active.
• Paused accounts: Your profile is hidden but all data is preserved.
• Deleted accounts: When you delete your account, we permanently remove your profile, photos, matches, and (unless you consented to research) personality data within 30 days. Messages are flagged as deleted and become inaccessible; residual copies in encrypted backups are purged within 30 days.
• Personality data: You can delete personality data independently via Settings without deleting your account. If you consented to research, an irreversibly anonymized snapshot (age range, gender, scores — no name, no user ID) is preserved before deletion.
• Research snapshots: Anonymized data is retained indefinitely. Because anonymization is irreversible, this data cannot be linked back to you.
• Reports: Records of reports and safety incidents may be retained after account deletion to protect community safety.
• Analytics: If you opted in, aggregated usage data is retained. It does not contain personal identifiers.

Your Rights

Depending on your location, you may have the following rights under applicable law (including PIPEDA, Quebec Law 25, GDPR, and CCPA):

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Delete your account and all associated data through the App settings, or delete specific data (e.g., personality data) independently. You can also request deletion online if you no longer have the app installed.
• Data portability: Download a copy of your data in a structured format (available in Settings)
• Withdraw consent: Withdraw consent for analytics, personality assessment, or research at any time through Settings. Withdrawal does not affect the lawfulness of prior processing
• Object to automated decisions: Request human review or explanation of automated matching decisions
• Restrict processing: In certain circumstances, request that we limit how we use your data
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your local data protection authority

To exercise any of these rights, contact us at privacy@gereh.ca. We will respond within 30 days (or as required by applicable law).

Anonymized Research

With your separate, explicit consent, we may use anonymized versions of your personality assessment data for academic research on personality and compatibility. This consent is:

• Separate from your general App consent — you can use Gereh without participating
• Revocable at any time through Settings, without affecting your App access
• Specific: Anonymized data may be accessed by Gereh researchers and approved academic partners for the purpose of academic publication
• Irreversible: Anonymization destroys the link between your identity and the data. Researchers cannot identify you. Withdrawing consent excludes your data from future research but does not affect data already included in published aggregate results

Account Deletion

You can delete your account at any time through the App's Settings screen. If you have already uninstalled the app, you can request account deletion here.

Upon deletion, we permanently remove your profile, photos, matches, and personal data. Messages are flagged as deleted and become inaccessible; encrypted backup copies are purged within 30 days. If you previously consented to research, an irreversibly anonymized snapshot of your personality scores may be retained. We process web deletion requests within 30 days.

Children's Privacy

Gereh is strictly for users aged 18 and older. We verify age through date of birth entry during account creation. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from a user under 18, we will delete their account and data promptly. If you believe a minor is using the App, please contact us immediately.

Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS) and at rest
• Row-level database security policies
• Secure authentication with phone OTP or OAuth
• Access controls limiting employee access to personal data
• Heightened protections for sensitive data (personality assessment, sexual orientation)

No system is completely secure, and we cannot guarantee absolute security. In the event of a data breach, we maintain records of all security incidents for a minimum of 24 months. Where a breach creates a real risk of significant harm to any individual, we will notify affected users and report to the Office of the Privacy Commissioner of Canada as soon as feasible, as required by PIPEDA.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App and updating the version number. Your continued use of the App after changes constitutes acceptance of the updated policy.