Draft until the company is registered.
Anything marked To confirm is still being settled. We'd rather show you the gap than guess.
On this page
- 1. Who we are
- 2. Who this policy covers
- 3. What we collect
- 4. Location
- 5. Photos
- 6. Face check (face recognition)
- 7. Why we use your data, and on what legal basis
- 8. Who we share your data with
- 9. Where your data is stored
- 10. International transfers
- 11. How long we keep your data
- 12. Deleting your account
- 13. Your rights under the PDPA
- 14. Security
- 15. Children
- 16. Changes to this policy
- 17. Signing in with email, Apple or Google
- 18. Contact
You're trusting us with a lot, so this page tells you exactly what we collect, why, who else touches it, how long we keep it, and how to make us delete it.
The short version:
- We collect what a dating app needs to work: your phone number, your profile, your photos, your location, and what you do in the app (likes, matches, messages, reports, blocks).
- We don't run ads. We don't sell your data. We don't use advertising trackers, analytics SDKs or cookies in the app.
- The face check is optional. If you choose it, it involves face recognition, which is sensitive data under Thai law and many others. We ask for your explicit consent first, and we explain below what that involves, including the parts we don't control.
- You can delete your account from inside the app, any time. Your photos go with it.
1. Who we are #
Dolliy is operated by To confirm: Company legal name, a company registered in To confirm: Company country under registration number To confirm: Company reg no, with its registered address at To confirm: Registered address ("Dolliy", "we", "us").
For the purposes of Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), we are the data controller of the personal data described here.
Contact for anything in this policy:
- Email: support@dolliy.com
- Data Protection Officer / privacy contact: To confirm: DPO contact
2. Who this policy covers #
Dolliy is a dating app for adults in Thailand (Bangkok, Phuket and Chiang Mai), available in English. You need to be 18 or over to use Dolliy. This policy covers the Dolliy app and dolliy.com.
For the lawyer: Age of majority: the age of majority in Thailand is 20. Members aged 18-19 are minors under Thai law. Confirm whether PDPA section 20 requires guardian consent for anything that relies on consent (in particular verification, section 6), and whether the minimum age should be 20.
3. What we collect #
3.1 What you give us #
| What | Details | Who can see it |
|---|---|---|
| Phone number | Used to sign you in with a one-time SMS code. Stored in international format (for example +66...). | Only us. Never shown on your profile. |
| Email, Apple or Google sign-in details | Only if you sign in with them. Email: your email address. Apple or Google: your account ID with them and your email address (for Apple, this may be Apple's private relay address). Apple also gives us a token we use to cancel your Sign in with Apple. Section 17 has the detail. | Only us. Never shown on your profile or to other members. |
| Birth date | Set when you create your profile and locked afterwards. You can't change it in the app. We use it to confirm you're 18 or over and to show your age. | We show your age, never your birthday. |
| Profile | First name, gender, who you want to see ("show me"), what you're looking for, bio, interests, prompt answers, height, job title, company, school, and optional details such as languages or star sign. | Other members see your name, age, gender, what you're looking for, and everything you choose to fill in. Your "show me" setting is private. |
| Photos | Up to six. See section 5. | Other members, as your profile photos. |
| Location | Your phone's position, only while the app is open and only if you allow it. See section 4. | Nobody sees where you are. People see a rough distance, never a place: under 2 km, 2–5 km, 5–10 km, then whole kilometres. |
| Messages | What you write to your matches. | You and the person you're talking to. |
| Likes, passes and Winks | Your decisions in the deck. A Wink is a like you spend credits on to say you meant it. | A like can be shown to the person you liked. A Wink is shown to them as "Winked at you", including on the likes they can't open yet, which never say who it's from. Passes are private. |
| Reports and blocks | Who you report or block, the reason you pick, and any note you add. | Our moderation team. The person you reported or blocked is never told. |
| Face check (optional) | Only if you choose to verify: a few seconds of live video, checked by AWS. See section 6. | Dolliy never receives the video. We keep one still from it for 14 days, seen only by our team (section 6.2, C1). |
| Support emails | Whatever you send to support@dolliy.com. | Our support team. |
3.2 What we collect automatically #
- Sign-in data. Each device you sign in on gets a session. We store a scrambled (hashed) version of the session token, not the token itself, plus when it was created and last used, and the device's user-agent string so you can recognise your devices.
- Sign-in codes. When you ask for an SMS code, we store a scrambled version of the code for 5 minutes. To stop abuse, we count requests per phone number and per IP address in one-hour windows. Those counters delete themselves after the hour.
- Push notification token. If you allow notifications, your phone gives us a token so we can tell you about new matches and messages. It's tied to the session on that device.
- Match timing. When a match started, when the last message was sent, and when it ends.
- Verification status. Whether your profile carries the verified tick.
- Server logs. To confirm: Server logs
3.3 What we don't collect #
- No contacts, no photo library access beyond the photos you pick, no background location.
- No advertising identifiers, no ad networks, no analytics or crash-reporting SDKs, no cookies in the app. To confirm: Website cookies
- No sign-in with Facebook. Signing in with email, Apple or Google is covered in section 17. To confirm: Social login
4. Location #
We ask for your location so we can show you people nearby. Here's how it works:
- We only read it while the app is open. There's no background tracking and no geofencing.
- We ask your phone for a "balanced" reading, usually accurate to about 100 metres.
- We store your latest point on our server, rounded to about 1 km (two decimal places of a degree), and overwrite it when it changes. The precise reading is never stored. We don't keep a history of where you've been.
- Nobody sees where you are. People see a rough distance, never a place: under 2 km, 2–5 km, 5–10 km, then whole kilometres. The exact distance never leaves our server. We don't sell your location, share it or put you on a map.
- If you use Travel mode, people see how far you are from the place you picked and that you're using Travel mode. They never see which city it is or where you actually are. We keep the cities you picked for 30 days, to count today's moves and show your recent ones. City names come from GeoNames (geonames.org), CC BY 4.0.
- Dolliy needs location to show you anyone. You can turn it off in your phone's settings, but the deck will be empty until you turn it back on.
5. Photos #
- When you upload a photo, we decode it and re-encode it fresh. The file we store is a new one, so the hidden data your camera attaches (including GPS location, date and device details, known as EXIF data) is removed. The original upload isn't stored.
- We store three sizes of each photo, plus a tiny blurred placeholder.
- Before a photo goes on your profile, an automated service (AWS Rekognition, in To confirm: Moderation region) checks it for nudity, violence, hate symbols and similar content. If it flags a photo, or can't check it, the photo is held until a person on our team looks at it. The machine never turns a photo down on its own: a person decides. The AWS service-improvement caveat in section 6.3 applies to photos checked this way too.
- Other members get temporary, expiring links to your photos, not permanent public addresses.
- If you remove a photo or delete your account, it's deleted from storage.
- If you take the face check, your profile photos are sent to AWS to compare with it, and while you're verified, each photo you add is compared with your face template. See section 6.
6. Face check (face recognition) #
Verification is optional. If you choose it, you record a few seconds of live video in the app. The video goes straight from your phone to AWS Rekognition in AWS's Asia Pacific (Thailand) region, which checks that it's a live person and not a photo, a screen or a mask, then compares your face with your profile photos and checks it against other Dolliy accounts. At least two of your photos need to show your face clearly and match. The answer is automatic: you get the tick, or the reason it didn't work. Our team can see each result and correct one that's wrong. A score never bans anyone on its own. Dolliy never receives the video. We receive one still image from it, which we use for the comparison and keep, encrypted and seen only by our team, for 14 days. AWS keeps an encrypted face template for Dolliy until you remove your verification or delete your account, used to spot repeat accounts and to check photos you add later. AWS may keep and use the video, the still and your profile photos to improve its service, including outside Thailand, for a period we can't give you. Dolliy keeps your consent, check results and scores. To withdraw, tap Remove my verification in Settings, under Face check, or delete your account.
You can browse, like and chat without a blue tick. A blue tick means a live video check matched the profile photos. It doesn't prove who someone is or how they'll behave. If your face already has a tick on another Dolliy account, this one can't have one too. You get five tries a day.
This is sensitive personal data. Face recognition processes biometric data, which the PDPA (section 26) treats as sensitive. We only do it with your explicit consent, which we ask for in the app with a separate consent checkbox, ticked by you, before your photos are checked or the camera opens. While AWS's service-improvement use is on (section 6.3), the checkbox says so in its own words: "I agree, including AWS using my video and photos to improve its service." We record which version of the consent you agreed to, and if those words change, we ask you to read them and tick again before your next check.
For the lawyer: Gdpr art9: whether the same consent meets GDPR Article 9(2)(a) for members in the EU (sign-in is already live for Romanian numbers).
6.1 What happens when you verify #
- You read what happens and tick the consent box. Nothing is recorded before that.
- Before the camera opens, AWS Rekognition looks at your profile photos to see whether at least two of them show a face clearly. If not, the app asks you to update your photos first. This doesn't use a try.
- You look into your front camera, fit your face in an oval and move closer when the app asks. The screen doesn't flash colours. This takes a few seconds.
- The video streams from your phone straight to AWS Rekognition Face Liveness in AWS's Asia Pacific (Thailand) region. AWS checks it's a live person in front of the camera, not a photo, a screen replay or a mask, and gives us a score and one still image from the video.
- We send that still and the profile photos it's compared with to AWS Rekognition, which compares your face with the faces in each photo. At least two photos need to clearly match you. Group photos are fine, and a photo with no clear face, like a view or a pet, doesn't count either way. A photo whose clear faces are all someone else's, or show you only in sunglasses, needs swapping before you can get the tick.
- If they match, Rekognition also checks the still against the face templates of other Dolliy members. If your face already has a tick on another live account, this one doesn't get one.
- The answer is automatic and takes seconds. If everything checks out, your profile gets the tick; if not, the app tells you why and what to fix.
- Our team can see each check's result, scores and your current profile photos, and the still for its 14 days, and can give or remove a tick when a result is wrong. You're told either way. A score never bans anyone on its own.
- While you're verified, each photo you add is compared with your face template. Your tick pauses if a new photo's clear faces are all someone else's or show you only in sunglasses, if we can't check a new photo within a day, or if fewer than two of your photos clearly show you (removing a photo counts too). It comes back once every photo is fine and two clearly show you again, or when you take the check again.
6.2 What is kept, and for how long #
Dolliy never receives your face check video. We keep the one still from it for 14 days, encrypted and seen only by our team. AWS may keep copies to improve its service (see 6.3).
| Data | Kept by | How long |
|---|---|---|
| Face check video | AWS | Dolliy never receives it. How long AWS keeps it is covered in 6.3. |
| One still from the video | Dolliy | Stored encrypted, seen only by our team, deleted after 14 days. |
| Face template (a mathematical description of your face, not a photo). Also used to check photos you add while you're verified. | AWS, encrypted, in a collection used only by Dolliy | Until you remove your verification or delete your account. We keep only the template from your most recent successful check. Templates from failed or superseded checks are removed automatically. |
| Consent record, check results and scores (liveness and match) | Dolliy | Until you delete your account. |
| Video, still and photos AWS keeps for service improvement | AWS | We can't tell you. See 6.3. |
| Record that you withdrew (when, which consent version, and how many tries you'd used in the last 24 hours) | Dolliy | Until you delete your account. It's kept so withdrawing and agreeing again doesn't reset the five-a-day limit. |
Deleting your account removes these and queues the face template for deletion. Removal is retried automatically until it succeeds. A random cleanup reference, with no link to your identity, is kept for about 24 hours so the deletion can finish. We don't keep a permanent "face blacklist" of deleted accounts.
6.3 AWS service improvement: the part we don't control #
We have not opted out of AWS's service-improvement programme. That means:
- AWS may store and use your face check video, the still from it, and the profile photos it's compared with to develop and improve Rekognition and related AWS technology.
- AWS may use them for service improvement outside AWS's Asia Pacific (Thailand) region.
- AWS's own terms limit how it uses the stored face templates. Those limits don't apply to the video and images in the same way.
- Deleting your Dolliy account doesn't guarantee AWS erases the video and images it kept for service improvement. We can't promise a retention period for that data. We'll pass deletion requests on to AWS where we can, but you may also need to contact AWS directly.
If you're not comfortable with this, don't verify. Nothing else in the app depends on it.
For the lawyer: Biometric consent: whether this disclosure and the separate consent checkbox meet PDPA section 26 explicit consent and section 19 (separate from other terms, freely withdrawable). For the lawyer: AWS controller: whether AWS's service-improvement use makes AWS a separate controller for that data, and what that means for section 10. For the lawyer: AWS opt out: whether Dolliy must opt out of AWS service improvement before launch (business decision on 2026-09-16 was to keep it enabled).
6.4 Withdrawing your verification consent #
You can withdraw at any time, in the app: Settings → Face check → Remove my verification. Your tick comes off straight away, your face template is queued for deletion at AWS, and your check results and scores and the still from your check are deleted. We keep a record that you withdrew (section 6.2). You can also delete your account, or email support@dolliy.com. Withdrawing doesn't erase the video and images AWS kept for service improvement (6.3).
7. Why we use your data, and on what legal basis #
The PDPA requires a legal basis for everything we do with personal data. Here are ours. For the lawyer: Section refs
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account, signing you in | Phone number, sessions, sign-in codes | Performing our contract with you (PDPA s.24(3)) |
| Showing your profile to others and others to you, likes, matches, chat, the 72-hour match window | Profile, photos, location, likes, matches, messages | Contract (s.24(3)) |
| Checking you're 18 or over | Birth date | Contract (s.24(3)); legitimate interest in keeping minors off the service (s.24(5)) |
| Face check, repeat-account checks and checking new photos | Face check video (processed by AWS), the still from it, profile photos, face template, scores | Explicit consent (s.26) |
| Our team seeing check results and correcting a wrong one | Check results, scores, profile photos and the still | Explicit consent (s.26) of the person verifying. For the lawyer: Review basis |
| Checking photos before they go live | Your photos | Legitimate interest in keeping members safe from explicit and abusive images (s.24(5)) |
| Safety and moderation: reports, blocks, bans, keeping evidence | Reports, blocks, messages, profile, ban records | Legitimate interest in keeping members safe (s.24(5)); legal obligation where it applies (s.24(6)); protecting someone's life, body or health (s.24(2)) |
| Preventing sign-in abuse (rate limits) | Phone number, IP address | Legitimate interest (s.24(5)) |
| Stopping a closed account signing up again | A one-way keyed fingerprint of the phone number | Legitimate interest in keeping members safe (s.24(5)) |
| Making sure one purchase is credited once | A one-way hash of the store's transaction id | Legitimate interest in preventing fraud (s.24(5)) |
| Keeping an unpaid refund debt when an account is deleted, including a refund that comes after it | A one-way keyed fingerprint of the phone number, a one-way hash of each store purchase that gave you credits, and the amount a refund of it would take | Legitimate interest in preventing fraud (s.24(5)) |
| Push notifications | Push token, sender's first name | Contract (s.24(3)); you can switch notifications off on your phone |
| Answering support requests | What you send us | Contract / legitimate interest |
| Complying with the law and lawful requests from authorities | Whatever the request lawfully covers | Legal obligation (s.24(6)) |
Gender and who you want to see. Your gender (which can include trans and non-binary identities) is shown on your profile, and your "show me" preference shapes who you see. Some of this may reveal information about your sex life or sexual orientation. For the lawyer: Gender sensitive
We don't make automated decisions about you that have legal or similarly significant effects. The face check's answer is automatic: a score can withhold the tick. It never bans anyone on its own, our team can correct a wrong result, and you can ask a person to look at yours by writing to support@dolliy.com.
8. Who we share your data with #
We don't sell your personal data, and we don't share it with advertisers.
Other members see your public profile (section 3.1), a rough distance (under 2 km, 2–5 km, 5–10 km, then whole kilometres), your verified tick, and your messages to the people you've matched with.
Service providers process data for us under contracts that limit them to our instructions (except AWS service-improvement use, section 6.3):
| Provider | What they do | Data involved | Where |
|---|---|---|---|
| Amazon Web Services (Rekognition, including Face Liveness) | The face check, repeat-account checks and checking new photos | Face check video, the still from it, profile photos, face template | AWS's Asia Pacific (Thailand) region; service improvement may be elsewhere |
| Amazon Web Services (Rekognition) | Checking photos before they go live | Every photo you upload | To confirm: Moderation region; service improvement may be elsewhere (section 6.3) |
| Hostinger | Running our servers, database and cache, and keeping its own automatic backup copies of those servers | Everything in section 3 | Malaysia (servers); backup copies stored by Hostinger To confirm: Hostinger backup region |
| Cloudflare (R2) | Storing photos and our own off-site backups of our database | Your photos; the backups hold everything in our database | Cloudflare's network; no country pinned To confirm: R2 location |
| Cloudflare | Sitting in front of our servers: delivering the app's content quickly and blocking attacks (CDN, DDoS protection, firewall) | Everything sent between the app and our servers passes through it | Cloudflare's global network, usually the data centre nearest you |
| RevenueCat | Handling in-app purchases and subscriptions | A random purchase id (never your profile id), what you bought and when, your store receipts | United States |
| GIPHY | GIF search in chat | The words you search for (sent by our server, without your name or account). When a GIF loads, your phone fetches it from GIPHY, so GIPHY sees your IP address | United States |
| Sentry | Crash reports, only when crash reporting is switched on | Scrubbed crash details and a random account id. No messages, photos, location or contact details | To confirm: Sentry region |
| To confirm: SMS provider | Sending your sign-in code | Phone number, the code | To confirm: SMS region |
| Resend | Emailing your sign-in code, and important notices about your account like your face check result, to the email we have for you | Email address, the code or the notice | To confirm: Email region |
| Expo (650 Industries) | Relaying push notifications to Apple and Google | Push token, notification text | United States |
| Apple (APNs) / Google (FCM) | Delivering push notifications | Push token, notification text | United States, and wherever Apple or Google route delivery |
| To confirm: Support tool | Support inbox | Your emails to us | To confirm: Support tool region |
Push notifications never contain your messages. A new-message notification shows only the sender's first name.
Apple and Google sign-in. If you sign in with Apple or Google, they send us your sign-in details, and section 17 lists the few we keep. They aren't service providers working for us: each runs its own sign-in under its own privacy policy. We send them nothing beyond what the sign-in itself needs and, for Apple, the request to cancel your Sign in with Apple when you remove it or delete your account.
Authorities. If the law requires it, or if we believe in good faith it's needed to protect someone's life or safety, we may share data with police, courts or regulators, limited to what the request lawfully covers.
If the business changes hands. If Dolliy is merged, acquired or sells its assets, your data may move to the new owner, who must keep honouring this policy. We'll tell you first.
9. Where your data is stored #
Our servers run with Hostinger in Malaysia, and Hostinger keeps its own backup copies of them. Photos and our own database backups are stored with Cloudflare R2. Everything you send passes through Cloudflare's global network on its way to us, which keeps the app fast and fends off attacks. The face check runs in AWS's Asia Pacific (Thailand) region.
- Our servers, database and cache: Hostinger, Malaysia.
- Hostinger's own backup copies of those servers: stored by Hostinger. To confirm: Hostinger backup region
- Photos and our own database backups: Cloudflare R2. To confirm: R2 location
- Every connection to Dolliy: through Cloudflare's global network.
- Verification: AWS's Asia Pacific (Thailand) region, with the service-improvement caveat in section 6.3.
- Checking photos before they go live: AWS, To confirm: Moderation region.
- Sign-in codes: To confirm: SMS provider, To confirm: SMS region.
- Emailed sign-in codes and account notices: Resend, To confirm: Email region.
- Your emails to us: To confirm: Support tool, To confirm: Support tool region.
- Purchases (RevenueCat), GIF search (GIPHY), push notifications (Expo, Apple, Google) and, when it's on, crash reporting (Sentry): see the table in section 8.
10. International transfers #
These and our other providers are in different countries, so your data may be sent outside your country, including outside Thailand. It's encrypted on its way between your phone, us and each provider. Only the people who need it to run Dolliy can get to it, and each provider works under a contract with us that limits what it can do with your data, with one exception: AWS may keep video and images from the face check to improve its own service. Section 8 lists every provider; the countries your data goes to are below.
- Malaysia: our servers, database and cache (Hostinger).
- Thailand: the face check (AWS).
- The United States: purchases (RevenueCat), GIF search (GIPHY), push notifications (Expo, Apple, Google), and images AWS keeps for service improvement (section 6.3, which may also be elsewhere).
- Cloudflare's network: photos, our own database backups, and every connection passing through. Cloudflare runs data centres in many countries. To confirm: R2 location
- Where Hostinger stores its backup copies: To confirm: Hostinger backup region
- Crash reports, only when crash reporting is on: To confirm: Sentry region
- Checking photos before they go live (AWS): To confirm: Moderation region, and service-improvement use may be elsewhere (section 6.3).
- Sign-in codes (To confirm: SMS provider): To confirm: SMS region
- Emailed sign-in codes and account notices (Resend): To confirm: Email region
- Your emails to us (To confirm: Support tool): To confirm: Support tool region
We transfer personal data abroad only in line with PDPA sections 28 and 29: where the destination has adequate data protection standards, where the provider has agreed to appropriate safeguards in its contract with us, or where the transfer is needed to provide the service you signed up for. For the lawyer: Transfer mechanism
Want to know where something of yours is, or how it's protected? Write to support@dolliy.com and a person answers. You can also ask for a copy of the safeguards that cover a transfer.
11. How long we keep your data #
| Data | How long |
|---|---|
| Account, profile, likes, passes, blocks | Until you delete your account. |
| Location | Your latest point only, rounded to about 1 km, overwritten on each update, until you delete your account. |
| Cities picked in Travel mode | 30 days, or until you delete your account. |
| Photos | Until you remove them or delete your account. |
| Messages in an active match | Until the match ends or either person deletes their account. |
| Messages after a match ends (expired, unmatched, blocked, closed) | The conversation disappears for both of you. We keep it for 30 days in case it's reported, then delete it. If a report about that conversation or that person is still open, we keep it until a person has read the report. |
| Reports you've made | Kept if you delete your account, without your identity, so the evidence doesn't disappear. Deleted 2 years after the report is resolved. |
| Reports about you | Kept after they're resolved, and kept without your identity if you delete your account, so we can deal with repeat abuse. Deleted 2 years after the report is resolved. |
| Records of a closed account | To confirm: Ban retention |
| Phone number of a closed account that was then deleted | We keep a one-way keyed fingerprint of the number, never the number itself, for as long as the closure stands, so the same number can't be used to sign up again. If you appeal to support@dolliy.com and we agree we got it wrong, we delete the fingerprint and the number can sign up again. If you'd linked an email address, we keep the same kind of fingerprint of it, never the address itself, and delete it with the number's. |
| Which purchases have already been credited | For each purchase that gave you credits, a one-way hash of the store's transaction id, with nothing that links it to you or your account. Kept indefinitely, because the store can resend a purchase at any time, so a purchase restored onto a new account isn't credited twice. |
| Credits owed after a refund, when an account is deleted | If you delete your account while it owes credits (a refund left your balance below zero), we keep a one-way keyed fingerprint of your phone number, never the number itself, and the amount owed. We also keep, for each store purchase that gave you credits, a one-way hash of the purchase and what a refund of it would take (the credits you used, not the ones you gave up by deleting), so a refund that comes after you delete is still owed. If you sign up again with that number, your new account starts with what is owed and we delete the record. If you don't, we delete it after 365 days. |
| Our moderation log (what we decided about a report, a photo or an account, which of our team decided it, when, and why) | 2 years after each decision, then deleted. If you delete your account, the entries stay without your identity until then. |
| A note you add to a report | With the report (see "Reports you've made" above). |
| Sign-in codes | 5 minutes for a text, 10 minutes for an email. |
| Rate-limit counters (phone number, email address, IP address) | 1 hour. |
| Sessions | Ended after 90 days without use, and after 180 days regardless. Deleted when you log out. |
| Push tokens | Deleted when you log out, when your session ends, when your account is closed, or when you delete your account. |
| Face check still, face template, verification records | See section 6.2. |
| Backups | To confirm: Backups |
| Server logs | To confirm: Server logs |
12. Deleting your account #
Go to Settings → Delete account. It's permanent and immediate:
- We first delete all your photos from storage. If that fails, nothing else is deleted and the app asks you to try again, so you're never left half-deleted with orphaned photos.
- Then we delete your account, profile, sessions, push tokens, likes, blocks, matches, verification attempts and the still from your face check. Deleting a match deletes the whole conversation, including the other person's messages in it.
- Your face template is queued for deletion at AWS (section 6.2).
What stays after deletion: reports other members made about you, and reports you made, without your identity (section 11); our moderation log entries, without your identity, for 2 years after each decision; a one-way hash of each store purchase that gave you credits, with nothing linking it to you, so it can't be credited twice; if your account owed credits after a refund, a one-way keyed fingerprint of your phone number and the amount owed, and for each purchase that gave you credits a one-way hash of it and what a refund would take, until that number signs up again or for 365 days (section 11); AWS service-improvement data we can't control (section 6.3); and backups and logs for their retention period.
If we've closed your account, you can still delete it: the closed-account screen has a Delete my account button, and it works the same way. The one difference: we keep a one-way keyed fingerprint of your phone number (never the number itself) for as long as the closure stands, so that number can't be used to sign up again (section 11). If you think we got the closure wrong, write to support@dolliy.com, before or after deleting; if we agree, we lift it.
13. Your rights under the PDPA #
You have the right to:
- Access your personal data and get a copy of it, and ask how we got data you didn't give us.
- Portability: get your data in a commonly used, machine-readable format, and ask us to send it to another service where that's technically possible. To confirm: Data export
- Correction: fix anything inaccurate. Most of your profile can be edited in the app. Your birth date is locked; if it's wrong, email us.
- Deletion: ask us to delete or anonymise your data. You can delete your account in the app at any time (section 12).
- Restriction: ask us to pause using your data while a question about it is sorted out.
- Objection: object to processing we do on the basis of legitimate interest.
- Withdraw consent at any time, for anything based on consent (today that's verification, section 6.4). Withdrawal doesn't affect processing before it.
- Complain to the Office of the Personal Data Protection Committee (PDPC), To confirm: PDPC contact. We'd like the chance to fix it first, but you don't have to come to us before going to the PDPC.
How to use these rights: email support@dolliy.com from, or mentioning, the phone number on your account. We may need to confirm it's really you (for example with an SMS code). We'll respond within To confirm: DSR response time. We don't charge for reasonable requests.
Some rights have legal limits. For example, we may keep data we need for legal claims, or reports needed to protect other members. If we can't do what you ask, we'll tell you why.
14. Security #
- Your connection to Dolliy is encrypted, and so is every connection between our servers and our providers. To confirm: TLS
- Photos and our own database backups are encrypted where Cloudflare stores them. We can't yet say the same for Hostinger's backup copies of our servers. To confirm: Hostinger backup encryption
- Session tokens and sign-in codes are stored only in scrambled (hashed) form, so a leaked database doesn't hand out working logins.
- Photos are served through short-lived links. Verification data can't be served to anyone, by design.
- Face templates are held encrypted by AWS in a collection used only by Dolliy.
- Only authorised staff can use moderation tools. Each moderator has their own access key, and every decision is logged with who made it. To confirm: Staff access
No system is perfectly secure. If a breach puts your rights at risk, we'll notify the PDPC within 72 hours of becoming aware of it, and tell you without undue delay where the risk is high, as the PDPA requires.
15. Children #
You need to be 18 or over to use Dolliy. We don't knowingly collect data from anyone under 18. If you think someone under 18 is on Dolliy, report their profile ("This person is under 18" is one of the report reasons) or email support@dolliy.com. We'll close the account and delete its data. See also For the lawyer: Age of majority in section 2.
16. Changes to this policy #
If we change this policy, we'll update the date at the top. If a change is significant, for example a new use of your data or a new kind of provider, we'll tell you in the app before it takes effect, and ask for fresh consent where the law requires it. Verification consent is versioned: if what we do with face data changes, you'll be asked to agree again before your next check.
17. Signing in with email, Apple or Google #
Besides the one-time text code, you can sign in to Dolliy with your email address, or with your Apple or Google account. None of them replaces your phone number: every Dolliy account still starts with a phone number you've confirmed with a code, and email, Apple or Google becomes another way back in. Here's exactly what each involves.
17.1 Google #
- We ask Google only for your basic sign-in details.
- We keep two things: your Google account ID and your email address.
- We don't keep or use your Google name or profile photo.
- We don't read your contacts, calendar, Gmail, Drive or anything else in your Google account, and we use no other Google services with it.
- We use these details only to sign you in, to keep your account secure (for example, to tell you when a new way to sign in is added to your account) and to send you important notices about your account, like your face check result. Never marketing.
- They never appear on your profile and are never shown to other members.
- We don't sell them, share them, or use them for ads.
- They're deleted when you remove Google in Settings or delete your account.
Dolliy's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
17.2 Apple #
- We keep your Apple account ID and the email Apple shares with us. If you choose Apple's Hide My Email, that's Apple's private relay address, not your own.
- We also keep a token Apple gives us when you sign in. We use it for one thing: cancelling your Sign in with Apple when you delete your account or remove Apple in Settings.
- We use these details only to sign you in, to keep your account secure (for example, to tell you when a new way to sign in is added to your account) and to send you important notices about your account, like your face check result. Never marketing.
- They never appear on your profile and are never shown to other members.
- We don't sell them, share them, or use them for ads.
- They're deleted when you remove Apple in Settings or delete your account.
17.3 Email #
- We keep your email address with your account.
- We use it only to send you sign-in codes, to recognise you when you sign in with it, and to send you important notices about your account, like your face check result. We don't use it for marketing, and we don't sell it, share it, or use it for ads.
- It never appears on your profile and is never shown to other members.
- When you ask for a code, we send it through our email provider, Resend (section 8). We keep only a scrambled (hashed) version of the code, for 10 minutes.
- It's deleted when you delete your account. If we'd closed your account and you then delete it, we keep a one-way keyed fingerprint of the address, never the address itself, for as long as the closure stands, the same way we do for a phone number (section 11).
17.4 Seeing and removing them #
You can see and remove Apple or Google in Settings, any time. We also notify you whenever one is added or removed, so nothing gets attached to your account without you knowing. Your email can't be removed in Settings: it goes when you delete your account, or sooner if you write to support@dolliy.com (section 13).
18. Contact #
To confirm: Company legal name
To confirm: Registered address
Registration no. To confirm: Company reg no
Data Protection Officer / privacy contact: To confirm: DPO contact
Email: support@dolliy.com