toMATEtwo

Privacy Policy

Last updated: 21 October 2026

Who we are and how to contact us #

toMATEtwo is a dating and friend-finding app. This policy explains what personal data the app and this website handle, why, who can see it, and how you can delete it.

toMATEtwo is run by an individual developer based in Egypt, trading as "toMATEtwo". There is no company. This person is the "controller" (data controller) of your data. There is no postal address on this website; we are reachable by email only.

Questions about your data: write to support@tomatetwo.com.

toMATEtwo has no advertising, no ad tracking and no analytics or crash-reporting tools inside the app.

Data we collect #

We collect what the app needs to work, and nothing for advertising. By section:

Account

Your email address, to send you a sign-in code, or the email address and name of your Google account if you choose "Continue with Google". We do not see your Google password. We also keep an internal account number and the time you signed up.

Website waitlist: if you join the waitlist on this website, we store your email address, the country you choose and the time you agreed. We use them only to email you once, when the app is ready to download, and the country only to decide where to launch first. There is no confirmation email and no newsletter. We delete them when we launch, after that one email is sent. You can ask us by email to erase them earlier, at any time.

Profile

Your display name, date of birth (others only ever see your age), gender, the people you want to see, and what you choose to add: a bio, job title, education, height, lifestyle answers, religion, prompt answers, favourite things to do and what you are looking for. These are set per section (Dating, BFF), so you can present differently in each.

Your name, gender and date of birth cannot be changed after sign-up.

Photos

Up to 6 photos you upload. Our server re-encodes each photo and strips its hidden metadata (including any GPS position) before storing it. Photos are kept in private storage and shown through short-lived links, only where your profile is shown. We also store a small and a blurred copy of each photo (the blurred copy is used for the "Liked you" preview).

Location

With your permission, your phone sends your position to our server. The server rounds it to about 1 km (0.01 degree) before storing it, and keeps the rounded value and a city label. We use it to show people near you and to apply your distance setting. We do not store your exact position, and we do not track you in the background.

Messages

The messages you send in a chat, with the time. Only the two people in the chat can read them (and see Reporting below for what happens when someone reports a chat).

Likes and matches

Whom you liked, passed on or super-liked, your matches, your BlindDate entries (see Sensitive information) and tickets (the ledger of tickets you were given, used or got back), the date plans you and a match build together (idea, place, time), and when each step happened. We also keep which chats you have read, as a marker, so we can show an unread dot.

Blocks you set. Your allowance of likes and super likes for the day or week, and whether you currently have Premium.

Safety reports

If you report someone, we store your report: who, the reason you chose, any note you add, and a copy of what that profile showed at that moment (name, bio, prompts, job title, photo references), so we can review it even if the person edits the profile afterwards. If someone reports you, the same applies to you. See "Sensitive information" and "How long we keep data".

If we suspend an account, we keep a record of that and of the reason category.

Notifications and device data

If you allow notifications, a push token from your phone, so we can send you a notice. Lock-screen notices are generic: they never contain a name or message text.

To stop people who were suspended from coming back unnoticed, we compute a one-way code (a keyed hash) of your email address and of your Android device ID, and keep only that code, not the email or the ID itself. A match with a suspended account only raises a flag for a person on our team to look at; it does not by itself block you from signing up. We never use your advertising ID.

Our servers keep short technical records (for example to limit how often a request can be sent). Our hosting providers (Google Cloud, Supabase, Cloudflare) may also record IP addresses in their own technical logs, under their own retention rules.

Sensitive information #

Some of what you can tell us is sensitive: your gender, who you want to see, your religion and your lifestyle answers (for example drinking or smoking). Religion and lifestyle are optional; leaving a field empty is how you keep it private. Gender and who you want to see are needed to show you suitable people.

We use this information only to run the app: to show it on your profile where you choose to fill it in, and to match the gender filter. We keep it out of notifications and out of our logs, and it is erased when you delete your account.

Photos can also reveal sensitive things. Photos you report or that are removed are looked at by us for safety only.

BlindDate and the ID check. BlindDate is a weekly blind-date game. To enter, you answer by picking three date ideas, and we keep your entry (the week, your three picks and its status) and your ticket ledger. BlindDate is only for members who passed an identity check, shown as a yellow tick. For that check you send, in one request, a fresh selfie in a pose we ask for and one photo of an identity document (passport, national ID card or driving licence). These images are face data and identity-document data, which are sensitive categories under the GDPR (Art. 9), the UK GDPR and the Egyptian Personal Data Protection Law. The app owner reviews them by hand, compares the selfie with the document, and decides once. There is no outside verification company. Both images are deleted when the decision is made. We keep only the dates, the outcome and a log entry (check type, pose, document type) with no image, no ID number and no date of birth. If the check is rejected, we also remove any verification tick you had. We use these images only for this check.

You give us this information yourself and you can remove optional answers any time in your profile. For the ID check you give your explicit consent when you send the images; the images are in any case deleted at the decision. For other sensitive data (gender, who you want to see, religion, lifestyle), filling in the field is your explicit consent, and clearing it withdraws it.

How we use your data #

We use your data to:

We do not sell your data, we do not "share" it for advertising (in the sense of California law), and we do not show ads. We make no automated decision about you that has legal effects.

Legal bases. If you are in the EU or UK, we need a legal basis (GDPR Art. 6) for each use:

What other people can see #

People you could meet see your photos, display name, age (never your birth date), bio and the answers you filled in for that section, a city label, and your distance in steps of 5 km. They never see your email, your exact position or your birth date. What you add to Dating is shown in Dating, and what you add to BFF in BFF.

How we order profiles. The order in which you see people depends on: whether someone super-liked you; whether the person likes almost everyone (in the last 7 days at least 30 swipes and more than 85% likes, which puts them lower); in BFF, activities you marked as wanting a buddy; favourite things you share; and how recently they were active (today or yesterday, within 7 days, or older: a day bucket, never an exact time). The rest is a stable shuffle. Age, distance and gender settings only filter. Premium has no effect on the order and we sell no boosts. These signals stay on our side and are never shown to other people.

Likes are private. The person who sent a like cannot tell whether it was declined, ignored or is still waiting. Free members see a preview of who liked them (first letter of the name, age, a blurred photo); Premium members see the full profile.

Only your match can read your chat. If you block someone, or they block you, you stop seeing each other and neither sees a name or photo of the other.

If you delete your account, people you chatted with keep the conversation and see you as "Deleted User" (see below).

Who we share data with #

We do not share your data for advertising or analytics. We use service providers who process data for us, under their own terms, only to run the app:

All of them are processors acting on our instructions. We have not sold personal data and have not shared it for cross-context advertising, in the last 12 months or ever.

We may also disclose data if the law or a valid legal request requires it, or if we need to protect someone from serious harm. We tell you when we may do so, unless the law forbids it.

How long we keep data #

While your account exists we keep your profile, photos, likes, matches and messages so the app works. When you delete your account, see the next section. Besides that, we delete these records automatically:

Your blocks are kept as long as both accounts exist, because they are what keeps two people apart.

We keep the one-way codes of a suspended account's email and device for as long as the suspension lasts.

Deleting your account and what stays #

You can delete your account any time in the app (Settings, Account, Delete account). It happens at once and cannot be undone. Details and what to do without the app are on the delete page.

Your profile is removed from Dating and BFF, along with your name, date of birth and bio. Likes and matches with no messages are removed too.

People you chatted with keep the conversation. They see you as "Deleted User" and can't message you.

Messages you sent stay in their chats, exactly as you wrote them.

You can sign up again later with the same email. It will be a new account with none of your old profile, matches or messages.

Also stays, for safety: reports you made or that were made about you, until their retention ends above; and copies of your deleted photos, which only we can see, for 90 days (12 months if they were reported or your account was suspended), then they are erased. If your account was suspended, the one-way codes mentioned above stay for the suspension.

Your rights and choices #

You can see and edit most of your data in the app: profile, photos, preferences, sections, blocks, and notification and location permissions (in your phone settings). You can leave a section or delete your account.

You can also ask us by email at support@tomatetwo.com for a copy of your data, to correct it, to delete it, or to object to how we use it. A copy includes the evidence photos described above. We may need to check that the request comes from you. We answer within 30 days. We do not charge for a request and never treat you worse for making one.

If you are in the EU or UK (GDPR, UK GDPR): you have the right of access, rectification, erasure, restriction of processing, portability (a copy in a common format), objection (including to processing based on legitimate interests), and to withdraw consent at any time. You can complain to your local supervisory authority (in the UK, the Information Commissioner's Office).

If you are in Egypt (Personal Data Protection Law 151/2020): you may know what we hold, access it, correct it, restrict or object to its use, withdraw consent, and ask us to erase it. The authority is the Personal Data Protection Center.

If you are in the US (for example California under CCPA/CPRA, and other state laws): you have the right to know what personal data we collect, use and disclose (this policy lists it), to have it deleted, to have wrong data corrected, to opt out of sale or sharing, and not to be discriminated against for using these rights. We do not sell personal data and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We do not knowingly collect data from anyone under 18. Sensitive data is used only to provide the app as described above. An authorised agent may write to us for you.

Everyone, wherever you live, can use the email above, and we handle every request the same way.

Children #

toMATEtwo is for people aged 18 and over. We check your date of birth at sign-up and do not let you in if you are under 18. If we learn that someone under 18 has an account, we remove it. Anyone can report an account that seems to belong to someone under 18.

If you think a child is using the app, write to support@tomatetwo.com.

Security #

Data travels over encrypted connections (HTTPS). Photos are stored in a private store and shown only through short-lived links. Database rules limit what each signed-in person can read, and the people who can use our admin tools need a second sign-in step. Your sign-in session is kept in the secure storage of your phone.

No system is perfectly safe. Keep your email account and phone secure, and tell us at once if you think someone has got into your account.

International transfers #

Our service providers run servers in several countries, so your data may be processed outside the country where you live. Our API runs on Google Cloud in europe-west1 (Belgium). Our database, sign-in and photo storage (Supabase) run in the EU, in Ireland (eu-west-1). Push notices pass through Expo and Firebase Cloud Messaging, and this website through Cloudflare, which run servers in several countries. When data goes from the EU, UK or Egypt to a country without an equivalent level of protection, we rely on the providers' standard contractual clauses or an equivalent safeguard, as published in their terms. We are an individual based in Egypt, so your data is also handled in Egypt.

We have not appointed a representative in the EU or UK yet; contact us by email.

Changes to this policy #

When we change this policy we change the date at the top. For changes that matter to you we will tell you in the app or by email before they apply.

Contact and complaints #

Write to us at support@tomatetwo.com for anything about your data. If we do not solve a problem, you may complain to the data-protection authority where you live: in Egypt the Personal Data Protection Center, in the EU your national supervisory authority, in the UK the Information Commissioner's Office, and in the US your state attorney general. We reply to requests within 30 days.