PRIVACY, THE HONEST VERSION

LAST UPDATED 27 JULY 2026 · MESSAGES, RETENTION + YOUR OWN CONTROLS — REWRITTEN IN THE SAME DEPLOY AS THE CODE

WHY THERE'S NO COOKIE POPUP

Cookie banners are legally required for tracking cookies — ads, analytics, fingerprinting. We don't do any of that, so there's nothing to ask permission for. There are exactly three cookies, all functional, and here is all of them:

ff_seed — your seed number, set only once you plant one. Your action, your cookie.
ff_c — if you arrived through a campaign link (a QR on a sticker, a link in a bio), this remembers the one word on that link — like "sticker" or "intro" — for 30 days, so we learn which sticker worked. It is a word about our marketing, never about you: no browsing history, no location, no profile. If you sign up it is kept with your seed; delete your seed and it goes with it.
ff_ref — if you arrived through someone's link, this remembers whose, for 30 days, so their count is right. It holds a number, nothing about you.
ff_admin — logs us in to our own back room. You will never have one.

Functional cookies need no consent. The popup other sites show you exists because of what they do, not because of what cookies are.

WHAT WE STORE

Five things, and you can see all five:

Your email address. To invite you when the garden opens.
The moment you planted it. That's your seed number.
In bloom or resting. One digit. You set it, you change it whenever you like.
Optionally, two words — whether you're a man, a woman or other, and whether you're looking for men, women or everyone. More on those below.
Who brought you, if you came through someone's link — their seed number, so their count is honest.

That is the entire database. One file, on our own server in Amsterdam, not in anybody's analytics cloud.

WHY WE ASK THOSE TWO OPTIONAL WORDS

Because a dating app that opens lopsided is worse than one that stays shut. If we let everyone in the moment a counter hits a round number, whichever side is smaller gets flooded in the first hour and leaves — and then everyone else leaves too. So we open when both sides of the room are actually there. We cannot know that without asking.

Those two words are used for one calculation: how many people are on the smaller side. They are never shown publicly, never shown to another member, and never leave the server. We publish whether Amsterdam is ready — never the ratio, never a number about you. Skip them and you keep your place in the queue; you just make our arithmetic worse.

THE SENSITIVE BIT, SAID PLAINLY

"Looking for men" or "looking for women" can say something about your sexual orientation, and European law treats that as a special category — the strongest protection the GDPR has. We're not going to bury that in a footnote:

It's optional — the app works if you never touch it.
The legal basis is your explicit consent, given by tapping, after reading why.
It's stored as one short word beside your email. No inference, no profiling, no scoring.
Taking it back is one tap — "clear these" under the buttons wipes both words immediately. Withdrawing has to be as easy as giving, so it is.

WHAT WE DON'T

No name. No location. No device fingerprint. No analytics. No ad pixels. No third-party requests at all — open your browser's network tab: it's silence. Even the fonts are yours (system fonts, no Google). IP addresses pass through memory only to slow down bots and are never written to disk.

YOUR PROFILE, AND YOUR PHOTOS

If you build a profile, we also store your first name, your age, the part of Amsterdam you picked from a list, two prompt answers you wrote, and up to four photos. Nothing else. No surname, no phone number, no job, no height.

The neighbourhood is a dropdown, not a location. We never ask your browser or your phone where you are. There is no geolocation call anywhere in this app — you can check, the source is one file and there are no third-party scripts to hide it in.

Photos have their metadata destroyed twice. Your phone resizes each one and re-encodes it before it's ever sent, which drops the EXIF block entirely — camera model, timestamp, and the GPS coordinates of wherever you took it. Then our server strips every metadata segment again on arrival, because a promise that depends on the browser behaving isn't a promise. What lands on disk is pixels.

A human looks at every photo before anyone else can. That human is me. Until then it's visible to you and nobody else. Photos live on our own disk in Amsterdam — no image CDN, no cloud bucket, no third party ever sees your face.

Delete means delete. Removing a photo unlinks the row and erases the file from disk in the same action. There's no thirty-day tombstone and no "hidden" state.

BLOCK AND REPORT

Both exist from the first day there is anyone to use them on — not added later after something goes wrong. Blocking is silent and permanent from your side. Reporting also blocks, automatically, because nobody should have to keep seeing someone to report them. Reports come to me with the two seed numbers and what you wrote, and nothing else.

MESSAGES

When two people reach for each other, they can write to each other. Those messages are readable by exactly two people: the two of you. They are not scanned to sell you anything, they are not used to train anything, and they are not read by us — not because we're forbidden to, but because nothing in the code does it.

Two deliberate absences: no read receipts and no "online now". Both exist to make you anxious and to let one person monitor another. When either of you deletes their account, the conversation goes with it. Not archived — deleted.

The one exception, stated plainly: if you report something, the messages you point at are kept as evidence so a human can look at them, and if we suspect a threat to someone's life or safety we will preserve them and go to the police. We won't ask permission first.

HOW LONG WE KEEP THINGS

A retention schedule you can hold us to, and it runs on a timer rather than on our intentions:

Account, profile and photos — while your account exists.
Rejected photos — erased within 30 days.
Messages — until either person deletes their account.
Late Blooms — 30 days, then gone.
Safety plans ("tell a friend") — 14 days.
Reports and moderation records — 12 months, then stripped back to counts.
Backups — 14 daily, 8 weekly, then overwritten.
Deleted accounts — erased. We keep one line: the seed number and the date, so that number is never given to somebody else.

DOING IT YOURSELF

On your profile page, right now, without asking us: Download everything gives you a JSON file with every field we hold about you. Delete my account erases it — the database rows and the photo files off the disk, in the same action. No thirty-day grace period, no "hidden" state, no support ticket.

The only thing withheld from your download is the content of reports made about you, because handing those over would identify the person who made them.

WHEN THE APP LAUNCHES

This section is how you check whether we kept our word, and it now has two entries.

The two optional words — man/woman, and who you're looking for — arrived on 26 July 2026, and this page was rewritten the same day, in the same deploy. Profiles and photos arrived 26 July 2026 as well, and the paragraphs above them were written before the upload button worked. Not after launch, not "coming soon" — in the same commit as the code.

What's still ahead: matching, messages, and events. Each one will be described here before it exists, in the same way. If you ever find something we store that isn't on this page, that's a bug and a broken promise, and mailing us about it is doing us a favour.

YOUR RIGHTS

See it, get a copy, correct it, delete it, or withdraw a consent — mail info@goatpixels.com and a human answers, usually the same day. No form, no ticket number, no "please allow 30 days". Deleting means the row is gone, not flagged as hidden. Controller: GOAT Pixels, Amsterdam, KvK 82724822.