Privacy Policy

1. Who we are and scope

Abracadabra+ Inc. is the controller of personal information processed for Abracadabra+, including our app and website. Contact privacy@abracadabra.plus about privacy or any representative-related enquiry.

This policy explains what we process, why, who receives it and your choices. We do not sell your personal information.

2. Information we process

• Account and profile information you provide, including email, self-declared birthdate, gender, interests, profile content and photos.
• Messages, voice notes, shared photos and locations; activities, events, services, bookings, payment and subscription records; live video and chat; Alejandro conversations and memory; connected-app permissions and actions.
• With permission, precise device location. Places check-ins include Google Place IDs. Security records include IP address, approximate city/country, network, user agent, device/operating system and hashed device ID.
• Information from providers for sign-in, payments, subscriptions and approximate country lookup; website advertising signals, browser campaign names, consent choices and error reports.

3. Purposes and legal bases

For EU/UK GDPR purposes, the table identifies our Article 6 bases. “Contract” means processing needed to provide a feature you request; “legitimate interests” means the specific interests named below, subject to your rights. A device permission does not authorise unrelated processing. Special-category conditions are addressed separately in section 4.

4. Sensitive and special-category data

Profile content can reveal sexual orientation, gender, health and other sensitive information. We do not treat accepting our terms as explicit consent to special-category processing, and this notice does not claim that any such consent has been collected. You control what you add to your profile and can edit or remove it, hide your profile with incognito or private settings, or delete your account at any time.

Being identified as a user of an LGBTQ+ app can itself be sensitive. Proximity, interests and repeated location observations may reveal routines or sensitive associations even without your name. Consider your audience, incognito/private settings and what you share.

5. Location and Places

With your device location permission, we store precise coordinates on your profile for Nearby discovery and distance. In Nearby discovery, other members see your distance rounded in 200 m steps, not your coordinates. Locations you choose to share in a chat, venues you check in to and addresses you add to your own listings are visible to the people they are shared with, as described in this policy. You can revoke device location permission in device settings.

Places check-ins are verified against a Google Place ID: within 150 m of the venue and with location accuracy of 100 m or better. We store Place IDs, cache Google venue coordinates for no more than 30 days and purge check-in history after 30 days. Incognito ends presence. Check-in visibility respects incognito, blocks, bans and gender-segregated discovery.

6. Public website and historical interest map

Our homepage map shows historical “I want…” categories, such as coffee, gym or yoga, including expired or fulfilled wants that are still retained. Symbols use your current saved profile location reduced to the centre of a fixed approximately 600 m grid cell; that centre is within approximately 500 m of the saved location. It is not the location at the time you posted the want.

The map shows no names, photos, IDs, counts or timestamps. It is visible at every zoom level to anyone, including signed-out visitors. It excludes incognito, private, suspended, locked, banned, business and deleted accounts and intimate categories. There is no dedicated map opt-out: incognito or private account settings exclude you. There is no minimum number of people per cell. In sparse areas, a symbol may reflect a single person, so we cannot guarantee that the map is anonymous. You can object to your data being used on the map, or ask for it to be erased, as explained in section 14.

Other public showcases include text-only previews of upcoming public events and services, with an approximately 1 km pin and coarse city/country. Private, remote, cancelled, suspended, unapproved and past listings, and listings by deleted, suspended, banned or locked hosts, are excluded. Featured organizations are a manually reviewed list of non-clickable business logos. The signup counter shows the total existing registered accounts, refreshed about every 60 seconds, without personal details.

7. Messaging and sharing with members

Members see profile information and content according to visibility settings, blocks and discovery rules, including men/women discovery spaces. Groups: when another member invites you to a group or subgroup, you are added only after you accept. Separately, members may be placed automatically in a community group for their country and their men/women space; blocks are respected, and if you leave such a group you are not added back automatically. Confirming attendance (“going”) for an activity can add you to that activity’s chat. People who receive your content can screenshot, copy or forward it.

Message text is encrypted at rest with AES-256-GCM and per-conversation keys held on our servers. Transport uses HTTPS/TLS. Our servers can decrypt messages for delivery, previews, notifications, connected apps you authorise and safety/moderation when reported or legally required. Messages are not end-to-end encrypted.

If you authorise a connected AI app to read your chats, messages other people sent you may be included. Other members may likewise authorise an app to read messages you sent in chats they can see. Section 10 explains the limits and controls.

8. Live video, safety and moderation

Live video is relayed through real-time media servers built on LiveKit technology. Viewers can watch and chat; hosts can moderate or ban viewers. Periodic video frames are sent to OpenAI for automated safety checks, which can end a stream. Live push alerts target members in the same country, are limited to three per day and observe quiet hours.

OpenAI performs a first photo-moderation review for explicit or illegal content. The owner can appeal for a second AI review. Account bans require explicit administrator action. Use the in-app report dialog for concerns; child-safety reports may put an account on hold pending administrator review. We may disclose relevant information when legally required or to protect people and investigate abuse.

9. Alejandro, our built-in AI assistant

Alejandro is optional. OpenAI’s API processes your messages and the context needed to reply, such as recent Alejandro conversation, shared preferences and relevant public listings. We configure requests not to be stored where the provider supports that setting; provider-side processing and logs follow the provider’s terms and policies. An internal quality-evaluation tool may use Google Gemini. Connected outside apps are covered in section 10.

Alejandro keeps operational memory of preferences and facts learned from your chats to personalise answers. Review and delete memory items in Profile → Settings → Data & Privacy → Alejandro AI. Deleting an item removes it from operational memory. Conversations and memory are kept while your account exists unless you delete them. Technical provider-call records are kept for up to 90 days; provider logs follow provider policies.

Model training on your data is currently off. We do not currently use your Alejandro conversations, memory, demographics or voice notes to train AI models, and no training opt-in is currently offered. Any future training would require a separate opt-in for each category, default off. We keep usage counts and technical identifiers to enforce usage limits and prevent duplicate charging on retries, rather than conversation text in those usage records.

10. Connected AI apps

An outside AI app, such as a ChatGPT connector, connects only when you sign in and approve permissions on our authorisation screen. It receives only the scopes you enable. Its provider (for example OpenAI for ChatGPT) handles received data under its own terms, privacy policy and your settings there. Review those before connecting.

• Profile basics: your own basic profile information and connection status.
• Chats: chat lists and visible message text decrypted on our servers, including other people’s messages. Photos, voice notes, videos, shared locations, disappearing and deleted messages are not shared through chat access. Blocks and membership rules apply.
• Sending messages: only exact text previews you approve, in a chat you belong to or to a person found in the AI app. We reuse an existing one-to-one chat or open an ordinary new one. Blocks, age and gender-space rules and normal moderation apply.
• Nearby people: display name, age, rough distance band (never coordinates or addresses), shared interests and coarse last-active status only if visible. Opening a profile can return the bio and interests permitted by privacy settings. Public photos may be sent as small thumbnails visible to the AI app. Blocks, age, gender-space and privacy rules and a daily limit apply.
• Events, services and plans: public title, time and rough area, and plans you host or joined; changes require confirmation. Interests and preferences you choose to share and Alejandro advice you request may also be included.
• Your paid-checkout receipts, followers/visitors summary, and mute/block/report actions you confirm.
• Optional activity sharing is off by default. If enabled in the AI app for 15–240 minutes, use there refreshes the same last-active time and may trigger existing came-online notifications to nearby members. Hidden activity status and incognito are respected. The same permission lets the app check your own Pro subscription through RevenueCat/app stores and Stripe using your account ID solely to enable incognito there. It does not purchase, cancel or change subscriptions. Web Stripe subscriptions cannot currently be checked this way unless checkout linked your account ID, so you may need to turn incognito on in the app. Changing incognito changes your profile privacy.

Connected apps never receive precise coordinates. Other members are not asked separately when you connect. Their messages in chats you can see, public profile details and public photos may reach the app, limited by visibility and privacy settings, blocks and AI opt-outs.

Disconnect at any time in Settings → Connected apps. This stops access from the next request, but does not erase data already received. Use the provider’s tools to delete those copies. Connection retention is described in section 13.

11. Providers and recipients

• Supabase/Lovable Cloud, our cloud hosting and database provider, supports hosting, database, authentication and storage.
• OpenAI processes Alejandro requests and photo/live moderation; an internal quality-evaluation tool may use Google Gemini via the Lovable AI gateway.
• Google provides Sign-in, Maps/Places, the Google Ads tag and Firebase Cloud Messaging for push notifications.
• Our real-time video infrastructure, built on LiveKit technology, relays live video.
• Stripe handles web subscriptions and supported on-platform payments; Apple App Store and Google Play handle native subscriptions via RevenueCat. Many activities/services are free or paid directly to hosts off-platform.
• Sentry provides error monitoring with default personal-information sending disabled (sendDefaultPii false). Resend delivers transactional and marketing email.
• ipapi.co and ipwho.is provide approximate IP-based country lookup for language/country defaults; ip-api.com supports server-side session security location lookup when geographical headers are missing.
• TikTok receives website pixel signals. Authorised connected-app providers receive the information described in section 10. Other members and public visitors receive content as described in sections 5–8.

12. International processing and security

Data is processed in the United States and other countries where we and the providers listed in section 11 operate. Contact privacy@abracadabra.plus for information about these international transfers.

We use reasonable technical and organisational measures, including transport encryption and encryption of message text at rest as described in section 7. No system is perfectly secure.

13. Retention and account deletion

Use Delete Account in Settings → Data & Privacy. When you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, tax or regulatory purposes. Login is removed immediately and cleanup of associated profile, media, sent messages, social graph and live-stream data starts right afterwards. Payment records are kept as long as tax and accounting law requires, and session security logs are kept for about 90 days. Data held by Apple, Google or Stripe as independent providers follows their own policies.

Deletion attempts to cancel active Stripe web subscriptions on a best-effort basis. Cancel store subscriptions separately in Apple/Google settings.

14. Your rights and choices

Signed-in users can use Download My Data (JSON) and Delete Account in Settings → Data & Privacy. See Data & Privacy. You can edit your profile, use incognito/private settings, block members, change device location/push permissions, review Alejandro memory and disconnect connected apps. Contact privacy@abracadabra.plus for requests or to stop marketing email.

EU/UK: subject to applicable conditions, you may request access, rectification, erasure, restriction and portability; object to processing based on legitimate interests and to the use of your data on the public historical interest map; and withdraw consent without affecting earlier lawful processing. You may complain to a supervisory authority, such as your local authority or the UK ICO. We respond within one month, extendable by two further months where permitted.

Mexico: you may exercise ARCO rights (acceso, rectificación, cancelación, oposición) and revoke consent by emailing privacy@abracadabra.plus. Under the LFPDPPP, we respond within 20 business days and implement an accepted request within 15 business days after that response. You may complain to the competent data-protection authority in Mexico.

United States and elsewhere: rights are available as provided by local law. Contact us to exercise applicable rights.

15. Adults only and child safety

Abracadabra+ is for people aged 18 or older. Age is based on self-declared birthdate; the database rejects known under-18 ages. We do not perform documentary age verification. Report suspected minors through the app. See Child Safety Standards.

16. Cookies and website measurement

We use necessary browser storage and website advertising technologies. Google Ads Consent Mode can send limited cookieless signals while advertising/analytics storage is denied. The TikTok Pixel currently loads on website pages independently of the Cookie settings choice. Native apps do not include these Google Ads/TikTok web tags. Campaign names may be kept in the browser up to 30 days only with consent or where not required; no click IDs are stored. See our Cookie Policy for controls and details.

17. Changes and contact

We may revise this policy by publishing an updated version and revision date here. Please review it for changes. For questions or privacy requests, contact Abracadabra+ Inc. at privacy@abracadabra.plus. Postal and business correspondence address: Abracadabra+ Inc., 8735 Dunwoody Place #5729, Atlanta, GA 30350, United States. Barcelona office: Norrsken House Barcelona, Passeig del Mare Nostrum 15, 08039 Barcelona, Spain. These addresses are for correspondence only; they are not walk-in support locations, and no one at them is appointed as a data protection representative.