Privacy policy

Version 1.2 of 30 October 2026 (new: section 2 “Promoters” — team notifications to leaders; version 1.1 of 21 October 2026: section 11 “MEEYO Heart Project”; previously version 1.0 of 16 September 2026). Framework: the Swiss Federal Act on Data Protection (FADP) and, for people in the EU, the GDPR. Where language versions differ, the German version prevails.

Data about meeting people is among the most sensitive data there is. So at MEEYO: every special processing only with your explicit consent, nothing pre-ticked, every consent revocable at any time, everything documented.

1. Who is responsible

FoxxCode GmbH, Blegistrasse 7, 6340 Baar, Switzerland, support@meeyo.ch. Representative in the EU under Article 27 GDPR: Thomas Schrader, Bremgartener Str. 22, 79258 Hartheim am Rhein, Deutschland, eu-vertreter@meeyo.at.

2. What data we process

• Account: e-mail, password (Argon2 hash only), first name, date of birth (internal; only your age is shown), gender, language, country, promoter code, channel (which link you came from, e.g. "ig" — a short tag only, no third-party IDs).
• Sign-in with Google or Apple (optional): from the provider we receive only an identifier, your e-mail and first name. Google or Apple learn only that you sign in to MEEYO — nothing from your profile.
• Profile: what you enter yourself — photos, goal, region, field of work, education, children, lifestyle, languages, interests, wishes, personality scales, partner preferences, bio.
• Protected area (optional, separate consent — special categories under Art. 5 FADP / Art. 9 GDPR): sexual orientation, meaning of sexuality, closeness, needs, preferences, boundaries, relationship model — encrypted field by field in a separate table, never sent to AI providers, never used for advertising. For each field you decide: in the profile, suggestions only, not at all.
• Location (optional, separate consent): stored rounded to about 1 km; others see only a region or a rounded distance. Can be switched off at any time.
• Selfie verification (optional, biometric consent): a live selfie with a gesture is compared once with your profile photo. The selfie is discarded immediately afterwards; only these remain: verified yes/no, time, comparison score.
• Messages: your chats with your connections. Translation only on your request. An automatic safety check detects patterns (money, threats, bulk text); only on a hit does an AI assessment and then a human look.
• AI processing (AI consent): conversation with MEE, bio suggestions, photo feedback, explanation of fit, translation, coach. The provider receives only purpose-bound excerpts of your own entries — never the protected area, never your location, never your e-mail. Logged are purpose, provider, duration, tokens — not the content.
• Payment: via Stripe (card, Twint). We store no card data, only package, period, amount, country and the Stripe customer number. For EU residents additionally your consent to immediate start (right of withdrawal).
• Waitlist (before launch): e-mail, language, optionally "I am", promoter code, channel; confirmation by link. Unsubscribe with one click in every mail.
• Promoters: name, address, IBAN (encrypted, shown masked), statement e-mail, channels, statements. Promoters never see their customers' names, e-mails or profiles — only a running number, month of registration and amounts. Exception (since 30 October 2026): people in a leadership role at MEEYO (co-owners, head of sales/marketing) whom MEEYO expressly authorises for this receive, when you sign up, your first and last name, your role (free chat, customer, promoter), the way you signed up and the promoter line through which you came — no contact details. Purpose: supporting and building the sales organisation (legitimate interest); these notifications are deleted after 90 days at the latest.
• Country from IP address: at sign-up we derive only the country from the IP address (local database DB-IP Country Lite, CC BY 4.0, nothing is sent externally) to assign currency and tax; only the country code is stored, not the address.
• Technical: sessions, rate limits, audit log (who did what and when). IP addresses are pseudonymised after 7 days.

3. Purposes and legal bases

Contract (account, profile, suggestions, chat, payment, promoter statements) · Consent (protected area, location, biometrics, AI, marketing e-mails — each separately, each revocable with immediate effect, without the rest of the service suffering) · Legitimate interest (security, fraud prevention, moderation, abuse protection) · Legal obligation (accounting, tax).

4. Who receives data

Only processors under contract: Infomaniak (hosting and e-mail, Switzerland) · Stripe (payments; Stripe Payments Europe, Ireland, and Stripe Inc., USA) · AI providers for purpose-bound excerpts: Groq (USA), as fallback OpenAI and Anthropic (USA) — no training on your data · Google / Apple only if you sign in with them. · Google (Gemini, USA) only if you create an avatar for the friends map: with your consent your approved profile photo is sent to Google for this — revocable, revoking deletes the avatars. Transfers to the USA rely on the Data Privacy Framework where the provider is certified, otherwise on Standard Contractual Clauses. We sell no data and pass nothing to advertising networks.

5. How long

Verification codes 10 minutes · sessions 30 days · technical logs 90 days, IP pseudonymised after 7 days · moderation cases 12 months · waitlist until you unsubscribe, at the latest 12 months after launch · deleted accounts 30 days, then physically erased · statement and payment data 10 years (accounting duty, CO 958f).

6. Your rights

Access and export (Account → My data → ZIP, within seconds) · rectification (edit profile) · erasure (Account → Delete account; 30-day period, then profile, photos and messages are physically erased; chat partners see "Deleted user") · restriction and objection (support@meeyo.ch) · withdrawal of any consent (Account → Consents) · portability (the export is machine-readable) · complaint to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your national supervisory authority.

7. Browser storage, ad measurement only with consent, third parties

In your browser we store what the service needs: sign-in token, language, light/dark theme, promoter code and the channel tag from the link you came from. That is technically necessary and needs no consent.

Ad measurement (Meta pixel) — only with your yes. On our advertising pages we ask whether we may measure which ad brought you to us. Only after «Agree» does your browser load the pixel of Meta Platforms Ireland Ltd. Meta then receives your IP address, browser details, the page visited and — after registration — the event «registration» with the promoter code; never your name, e-mail, date of birth or search details. Meta may transfer data to the USA (EU-US Data Privacy Framework or standard contractual clauses). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG, Art. 6 and 31 Swiss FADP). Without your yes nothing is sent to Meta. You can withdraw at any time: «Privacy settings» at the bottom of every page — this also deletes the Meta cookies (_fbp, _fbc). No Google tag, no other analytics or advertising tools.

Maps. All map images — vibe map, friends map and event maps, on the web and in the app — are fetched and cached by our server (raster map © OpenStreetMap contributors; vector map in the app © OpenFreeMap, © OpenMapTiles, data from OpenStreetMap). Your device never loads a map from a third party: your IP address, your location and the map area you look at are not passed to OpenStreetMap, OpenFreeMap or any other map service. Only the tile number goes out, with no link to you. Sign in with Google or Apple: the provider's page only loads when you tap the button; its privacy policy then applies as well. Shop: the merchandise shop is operated by Spreadshirt (sprd.net AG, Leipzig); it only loads when you open it in the promoter area.

8. Children

MEEYO is for adults 18 and over. We ask for the date of birth and reject younger people. If we learn of an account belonging to a minor, we delete it.

9. Security

TLS, Argon2 passwords, two-factor for admin, revocable sessions, rate limits, audit log, encrypted backups, keys server-side only, field-level encryption for the protected area and IBAN. In case of an incident we inform those affected and the authorities within the statutory deadlines (GDPR: 72 hours).

10. Changes

If this policy changes materially, we inform you by e-mail or in the app before the change takes effect. The current version, with date, is at meeyo.ch/datenschutz.

Rooms (since 21.09.2026): rooms such as "Adventure", "Kinks" or "Educated" are part of the protected area. You tick them voluntarily (separate consent "sensitive profile fields"), the data is encrypted on servers in Switzerland, never goes to an AI provider and appears only to members of the same room — and there only as the overlap of what you both ticked. You can leave any room at any time; the data is deleted immediately. For statistics we only count how many accounts use a room, never who.

11. MEEYO Heart Project

If you give voluntary support, we process the amount, currency, date, payment reference and status, fees, refunds, your canton or country of residence (for our tax obligations) and the link to your account. Purpose: processing, accounting, compliance with legal obligations and an anonymous overall display (total and number). We never show publicly who has given support — unless you expressly wish so. Payment is handled by Stripe (Stripe Payments Europe, Ireland; Stripe Inc., USA); we do not see any card data. We keep accounting records for ten years under Art. 958f CO; if you delete your account, we separate the records from your profile.