Privacy Policy

HelloLGBTQ is operated by Garlic Apps ("we," "us," "our"). We built this app to be a safer space for LGBTQ+ people, and that starts with how we handle your data. This policy explains what we collect, why, who we share it with, and the rights you have over it — in plain language, not legalese dressed up as transparency.

Our guiding principle is minimal collection: we only collect what the product needs to function, we never sell your personal information, and sensitive information about who you are — your sexual orientation, gender identity, and pronouns — is treated as the sensitive category of data it legally is, with the strictest protections we can reasonably provide.

What we collect

Account information

When you sign up, we collect your email address and a password (stored as a salted hash — we never see or store it in plain text). We do not collect your date of birth, phone number, or government ID.

Profile information

Username, display name, bio, pronouns, identities (how you describe your LGBTQ+ identity, entirely optional and self-selected), what you're looking for (community, dating, mentorship, housing), and an optional avatar image.

Content you create

Posts, comments, articles, direct messages, channel messages, event listings, RSVPs, likes, bookmarks, follows, and anything else you post or send through the app.

Location — Radar

If you use Radar to find nearby people, your device sends your exact coordinates to our server for a single calculation. We immediately apply a random offset of 300–800 meters before storing anything — your exact location is never written to our database and never shared with any other user. Other users only ever see a coarse distance band ("under 1km," "within 5km,", etc.), never a distance in meters or a point on a map. Radar sessions expire automatically after 45 minutes and are purged hourly.

Safety reports

Reports and blocks you file, so we can act on them and keep you from seeing someone again.

Information we do not collect

We do not collect your date of birth, government-issued ID, phone number, or precise/raw GPS coordinates.

How we use your information

• To operate the core features of the app — profiles, messaging, matching, Radar, events, and community spaces.
• To keep the platform safe — processing reports, enforcing blocks, and moderating content.
• To communicate with you about your account (e.g. sign-in links, safety notices).
• To understand how the product is used in aggregate, so we can improve it (see Analytics below).
• To comply with legal obligations where we are required to.

Who we share data with

We do not sell your personal information. We use a small number of service providers ("processors") to operate the app:

• Supabase — our database and authentication provider. Your account and content data is hosted on Supabase infrastructure in the AWS ap-south-1 (Mumbai, India) region.
• Google Sign-In — if you choose to sign in with Google, we receive your email address and basic profile info (name, profile picture) from Google to create and authenticate your account. We don't receive or request access to your Gmail, Drive, or other Google services.
• Twilio — if you choose to sign in with your phone number, Twilio delivers the one-time verification code via SMS. Twilio receives your phone number only for that purpose.
• Cloudflare R2 — stores images you upload (avatars, post images, event covers).
• Cloudflare Turnstile — a bot-detection check run at sign-up and sign-in. It receives a verification token and your IP address, not your account details.
• Upstash Redis — used only to enforce rate limits (e.g. preventing spam sign-ups). It stores request counters keyed to your user ID or IP, never message content or profile data.
• PostHog — our analytics provider (see below).
• OneSignal — if push notifications are enabled, sends you notification text tied to an internal app identifier, not your email.

We may also disclose information if required by law, to protect the safety of our users, or to enforce our Terms of Service.

Analytics and session replay

We use PostHog to understand how people use the app — page views and general usage patterns. PostHog also provides session replay, a recording of how you navigate the interface, so we can spot and fix confusing or broken flows. All text content and form inputs are masked before a replay is ever recorded or stored — we don't see what you type, including in messages or search fields, but page structure and navigation are captured. Exception/error details are also sent to PostHog to help us fix bugs.

Cookies

• Session cookie (Supabase) — strictly necessary, httpOnly, keeps you signed in. Can't be disabled without signing out.
• Analytics cookie/storage (PostHog) — used to distinguish anonymous sessions for the analytics described above.
• Turnstile cookie — set by Cloudflare as part of the bot-detection check at sign-up/sign-in.

We don't currently run a cookie-consent banner. If you're visiting from a jurisdiction that requires opt-in consent for analytics cookies, you can block them at the browser level; we're evaluating a consent mechanism for a future update.

Data retention and deletion

You can delete your account at any time from Settings → Your data. Deleting your account permanently removes your profile and essentially all content tied to it — posts, comments, messages, likes, bookmarks, follows, matches, event listings, and RSVPs — with no recovery period. This happens immediately, not after a waiting period.

The one exception: if a moderator took an action involving your account, or your activity appears in a security/audit log, that record may be retained for safety and legal-compliance purposes — but it is disassociated from your identity once your account is deleted, not kept as personally identifiable data about you.

Your privacy rights

You can access and download a copy of your data at any time from Settings → Your data → Export. For anything not available as self-service, contact us at hello@hellolgbtq.com and we'll respond within 30 days.

If you're in the European Economic Area or UK (GDPR)

You have the right to access, correct, delete, restrict, or port your data, and to object to certain processing. You also have the right to lodge a complaint with your local data protection authority.

If you're in California (CCPA/CPRA)

You have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.

If you're in Sri Lanka (PDPA)

Under the Personal Data Protection Act, No. 9 of 2022, you have the right to access, rectify, and request erasure of your personal data, and to object to or restrict certain processing, consistent with the rights described above.

Special category data

Information revealing sexual orientation or gender identity is treated as a sensitive ("special category") data under data protection law. We minimize collection of this information wherever possible: identity fields are optional and self-selected, your profile visibility is under your control, profiles are never indexed by search engines, and Radar deliberately never stores or shares your precise location. Security measures protecting this data include database-level access controls (row-level security) so that even our own backend code cannot casually read across user boundaries, httpOnly session cookies, and rate limiting on sensitive actions.

International data transfers

Our database is hosted in India (AWS ap-south-1) via Supabase. If you access HelloLGBTQ from the EEA, UK, or elsewhere, your information will be transferred to and processed in India and other countries where our service providers operate. We take steps to ensure appropriate safeguards are in place for these transfers consistent with applicable law.

Children's privacy

HelloLGBTQ is intended for people 18 and older. We do not knowingly collect information from anyone under 18. If we learn that we have, we'll delete it.

Security

We use row-level security at the database layer so access to your data is enforced independently of application code, httpOnly cookies for session storage, bot-detection on authentication, and rate limiting on sensitive actions. No method of transmission or storage is 100% secure, but we design with the assumption that a data breach would be especially harmful for this community, and build accordingly.

Changes to this policy

We may update this policy as the product changes. We'll update the date at the top of this page, and for material changes, we'll make a reasonable effort to notify you directly.

Contact us

Garlic Apps — hello@hellolgbtq.com