Privacy Policy

Information We Collect

We collect the following categories of personal data when you use Slyker:

• Account data — email address, date of birth, display name, password (stored as a one-way hash)
• Profile data — photos, bio, pronouns, gender, sexuality, height, body type, interests, and what you are looking for
• Location data — approximate GPS coordinates when you use the app, used to show nearby users
• Messages — direct messages sent between users on the platform
• Transaction data — subscription history and payment amounts (payment card details are processed by Stripe and never stored by us)
• Usage data — screens visited, features used, timestamps of activity, and push notification tokens
• Device data — device type, operating system version, and app version

How We Use Your Information

Your data is used solely to operate and improve Slyker. Specifically:

• To create and authenticate your account
• To show you nearby users based on your location
• To enable messaging between users
• To process subscription payments
• To send transactional notifications (new messages, subscription reminders)
• To enforce our Community Standards and Terms of Service
• To improve app performance and resolve technical issues

Sensitive Personal Data

Slyker is an LGBTQ+ platform. Information you provide about your gender identity, sexuality, and relationship preferences is considered sensitive personal data under Singapore's Personal Data Protection Act (PDPA).

This data is used only to operate the service — matching you with nearby users and populating your profile. It is never shared with third parties, governments, or law enforcement except where we are legally compelled to do so under applicable law.

Data Sharing

We share your data only with the following service providers, and only to the extent necessary to operate Slyker:

• Amazon Web Services (AWS) — cloud infrastructure and backend hosting (Singapore region)
• Supabase — database and file storage (Singapore region)
• Stripe — payment processing. Stripe's Privacy Policy applies to card data
• Brevo (Sendinblue) — transactional email delivery (password resets, notifications)
• Expo / Apple / Google — push notification delivery

All providers are contractually bound to use your data only for the services they provide to us.

Location Data

Slyker requests access to your device location when the app is open ("when in use" permission only). Your coordinates are used to calculate distances between users and to sort the Nearby screen. Your exact coordinates are never displayed to other users — only an approximate distance (e.g. "1 km away").

You can deny location permission at any time in your device Settings. If you do, you will not appear in other users' Nearby screens and distances will not be shown on your profile.

Private Albums

Slyker offers a Private Album feature. Access to a user's Private Album requires explicit approval from that user. Content in Private Albums is stored in a restricted-access storage bucket and is only accessible via time-limited signed URLs (valid for 15 minutes). Screenshots within the Private Album viewer are blocked by default on supported devices.

All content in Private Albums must involve consenting adults aged 18 or over. Content violating this policy must be reported immediately using the in-app report function.

Data Retention

• Active accounts — data retained for the lifetime of your account
• Deleted accounts — profile data deleted within 30 days. Messages may be retained for up to 90 days for abuse investigation purposes, then permanently deleted
• Transaction records — retained for 7 years as required by Singapore financial regulations
• Reports and bans — retained indefinitely to prevent re-registration by banned users

Your Rights

Under Singapore's PDPA, you have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate personal data
• Withdraw consent and request deletion of your account and associated data
• Object to processing of your data for certain purposes
• Port your data in a machine-readable format

To exercise any of these rights, contact us at admin@mosshi.co. We will respond within 30 days.

Security

We implement the following measures to protect your data:

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted using AES-256
• Authentication tokens are signed and expire after 30 days
• Row-Level Security is enabled on all database tables
• Payment card data is never stored by Slyker — Stripe handles all card processing
• Private album content uses time-limited signed URLs and screenshot protection

Children's Privacy

Slyker is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. Age is verified at account creation. If we discover that a user is under 18, we will immediately terminate their account and delete all associated data.

If you believe a minor has created an account on Slyker, please contact us immediately at admin@mosshi.co.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes we will notify you via push notification or email at least 14 days before the changes take effect. Continued use of Slyker after the effective date constitutes acceptance of the revised policy.

The current version of this policy is always available at slyker.app/privacy.