This Privacy Policy applies to all users worldwide. By using GoFitDaddy, you acknowledge that you
have read and understood this policy. This app is intended for adults aged 18 and over only.
1. Introduction and Data Controller
Martrick GmbH (“we”, “us”, “our”) operates the GoFitDaddy app
(“GFD”, the “App”) and is the controller of your personal data. We are
committed to protecting your personal data and complying with applicable data protection laws
worldwide, including the EU GDPR, the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA),
Brazil's LGPD, and other applicable privacy laws.
2. Data We Collect
2.1 Data You Provide
- Account information — username, email address, date of birth, phone number
- Profile information — photos, bio, gender identity, sexual orientation, preferences
- Communications — messages, reports, support tickets
- Verification data — identity documents (for age verification only, not stored long-term)
- Payment information — processed by third-party payment providers; we do not store full card details
2.2 Data Collected Automatically
- Device information — device type, operating system, unique device identifiers
- Usage data — features used, time spent, interactions
- Location data — approximate location (if permitted)
- Log data — IP address, browser type, pages visited, timestamps
- Cookies and similar technologies — see our Cookie Policy
2.3 Sensitive Data
We collect certain special categories of personal data, including sexual orientation and gender
identity, which you voluntarily provide. We process this data based on your explicit consent. You
may withdraw consent at any time.
3. How We Use Your Data
| Providing & improving the App · Contract performance | Retention: duration of account |
|---|
| Account registration · Contract performance | Retention: duration of account + 3 years |
|---|
| Content moderation & safety · Legitimate interest / Legal obligation | Retention: up to 7 years |
|---|
| Age verification · Legal obligation / Consent | Retention: until verified, then deleted |
|---|
| Customer support · Contract performance | Retention: 3 years after resolution |
|---|
| Sending service notifications · Contract performance | Retention: duration of account |
|---|
| Marketing (with consent) · Consent | Retention: until withdrawn |
|---|
| Legal compliance & reporting · Legal obligation | Retention: as required by law |
|---|
| Fraud prevention & security · Legitimate interest | Retention: up to 5 years |
|---|
4. Data Sharing and Third Parties
We do not sell your personal data. We may share data with:
- Service providers — cloud hosting, content moderation, age assurance (where used), and the sub-processors listed in section 4.1
- Law enforcement — when legally required, including mandatory CSAM reporting to NCMEC (USA), BKA (Germany), and equivalent national authorities
- Payment processors — Stripe or equivalent — subject to their own privacy policies
All third-party processors are bound by Data Processing Agreements (DPAs) in accordance with GDPR Article 28.
4.1 Current Sub-processors
We currently use the following sub-processors to operate the App. This list may change; we will update it here:
- Supabase / Amazon Web Services — database, authentication, file storage and backend hosting (United States)
- OpenAI — automated content moderation and AI conversation suggestions
- Mistral AI (France) — automated image content moderation
- Sightengine (France) — automated image and video content moderation
- Microsoft PhotoDNA — detection of child sexual abuse material (CSAM)
- Yoti — privacy-preserving age estimation (no identity document required)
- DeepL / Google Cloud (Translation API) — optional in-chat and interface translation
- Google / Mapbox (Geocoding) — turning a typed address into map coordinates
- Stripe — payment and event-ticket processing
- RevenueCat — subscription and in-app-purchase management
- Expo — push-notification delivery
- Strato (Germany) — delivery of account and support email — support tickets themselves are handled in-house, not by an external help desk
Several of these providers are located in, or transfer data to, the United States — see section 5 on international transfers.
4.2 Data sources & attribution
Some reference information in the App is based on the following public sources. GoFitDaddy is not affiliated with or endorsed by them:
- Equaldex & publicly available legal information — country LGBTQ+ legal status and rights data
- World Bank — country income classification (used only for pricing guidance)
- OpenStreetMap contributors — map and place data (© OpenStreetMap, ODbL)
5. International Data Transfers
Your data may be transferred to and processed in countries outside your country of residence. For transfers from the EU/EEA, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
- UK International Data Transfer Agreements (IDTAs) for UK data
For users in Brazil, South Korea, China, and India, additional local law requirements may apply. We comply with applicable data localisation requirements.
6. Your Rights
6.1 Rights Under GDPR (EU/EEA/UK Users)
- Right of access — request a copy of your personal data
- Right to rectification — correct inaccurate or incomplete data
- Right to erasure — request deletion of your data (“right to be forgotten”)
- Right to restriction — limit how we process your data
- Right to data portability — receive your data in a structured format
- Right to object — object to processing based on legitimate interest
- Rights related to automated decision-making and profiling
- Right to withdraw consent at any time without affecting prior processing
6.2 Rights Under CCPA/CPRA (California Users)
- Right to know what personal information is collected, used, shared, or sold
- Right to delete personal information
- Right to opt-out of the sale or sharing of personal information
- Right to non-discrimination for exercising your rights
- Right to correct inaccurate personal information
- Right to limit use of sensitive personal information
6.3 Rights Under LGPD (Brazilian Users)
- Confirmation of the existence of processing
- Access to data, correction, anonymisation, blocking or deletion
- Data portability and information about sharing
- Right to revoke consent
6.4 Rights Under Other Jurisdictions
Users in Australia, Canada, Japan, South Korea, Singapore, and India also have rights under their respective local laws. Please contact us to exercise any applicable rights.
6.5 How to Exercise Your Rights
To exercise any of your rights, contact us at: support@gofitdaddy.com. We will respond within 30 days (or sooner as required by applicable law). We may need to verify your identity before processing your request.
7. Data Security (Technical & Organisational Measures)
Because we process special categories of personal data (such as sexual orientation and approximate location), we apply a heightened, risk-based level of protection under Art. 32 GDPR. Our technical and organisational measures are designed to meet or exceed the security level that is customary for comparable dating and community applications.
7.1 Encryption
- All data is encrypted in transit using TLS 1.2/1.3; HTTPS is enforced.
- All data is encrypted at rest (AES-256) in both the database and media storage.
7.2 Access control & data isolation
- Row-level security: every request is authenticated and each user can access only their own data. Privileged service credentials are never shipped inside the app.
- Least-privilege access for staff and administrators; administrative access to production data is logged in an audit trail.
- Sensitive processing is isolated to dedicated providers — identity documents for age verification are handled by a specialist provider and are not stored long-term by us.
7.3 Content safety & abuse prevention
- Detection of child sexual abuse material using Microsoft PhotoDNA.
- AI-assisted photo moderation keeps explicit content out of public areas of the app.
- Rate limiting and automated risk assessment on sensitive operations and at sign-up.
7.4 Safety features you control
Especially for users in higher-risk regions, we provide additional protective tools: stealth mode, an emergency data wipe, a trusted-contacts allowlist, automatic stealth in high-risk locations, screenshot alerts in chat, expiring messages, and use of approximate rather than exact location.
7.5 Availability & recoverability
- Managed, geo-redundant infrastructure with automated backups and point-in-time recovery.
7.6 Organisational measures
- Data minimisation and defined retention periods; complete (hard) deletion of your data when you close your account.
- Data-processing agreements (DPAs) are in place with all sub-processors.
- Regular security and code reviews; our controls are oriented to recognised standards such as ISO 27001. Confidentiality and data-protection obligations apply to anyone with access.
7.7 Incident response
- We maintain an incident-response procedure and will notify the competent supervisory authority within 72 hours — and affected users where required — of becoming aware of a personal data breach, in line with Art. 33/34 GDPR.
No method of transmission over the internet or electronic storage is ever 100% secure, but we continuously work to protect your data and to improve our safeguards.
8. Children's Privacy
Our App is strictly for users aged 18 and over. We do not knowingly collect data from anyone under 18. If we discover that a user is under 18, we will immediately delete their account and associated data. If you believe a minor has registered, please contact us immediately.
9. Cookies
We use cookies and similar tracking technologies. Please refer to our separate Cookie Policy for full details. You can manage your cookie preferences at any time through your device or browser settings, or through our in-app privacy settings.
10. Supervisory Authorities
You have the right to lodge a complaint with a supervisory authority. Key authorities:
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via the App or by email. The date at the top of this policy indicates when it was last updated. Continued use of the App after changes constitutes acceptance of the updated policy.
12. Contact Us