ParDate
Back to home

Privacy Policy

Last updated: October 2026

The legally binding version of this privacy policy is the German version. This English version is a non-binding convenience translation provided to aid understanding.

1. Principle: data minimisation, no cookies for tracking

ParDate was developed according to the principle of data minimisation. We use no tracking, analytics or marketing cookies whatsoever, do not operate visitor tracking and do not pass on any data to advertising networks or analytics services.

Under Art. 45c of the Swiss Telecommunications Act (FMG) and Art. 5(3) of the EU ePrivacy Directive, only those cookies that are strictly necessary for operation are exempt from the consent requirement. The platform uses exclusively such functional cookies:

  • Session cookie (authjs.session-token): keeps you signed in during use.
  • CSRF protection value (authjs.csrf-token): protects sign-in forms against forgery attacks.

In addition, the browser uses local storage only for technically functional purposes: the chosen colour-scheme setting (light/dark, localStorage, not personal) and a protection mechanism against loading errors after app updates (sessionStorage). Neither is evaluated nor transmitted.

2. Controller and contact

The controller for the data processing is:

Martin Kempter, Degersheimerstrasse 21, 9100 Herisau, Schweiz.

If you have questions about your data, you can reach us by email at info@pardate.com.

For members resident in Switzerland, the revised Federal Act on Data Protection (revDSG) and its associated ordinance (DSV) apply. For members resident in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) applies, since the platform deliberately also offers its services there (marketplace principle, Art. 3(2) GDPR).

3. What data we process and why

Account and profile data

For registration we collect your email address and a password, which is stored exclusively using secure one-way encryption (bcrypt) and is not readable by anyone. In addition you can provide a name and a place of residence. Name, email and place of residence are freely chosen or freely stated; coordinates are derived from the place of residence to calculate the displayed distance and are used only in that context. This information is necessary to provide you with the core functions (profile, matching, contacts, messages) (legal basis: performance of a contract, Art. 6(1)(b) GDPR / Art. 31(2)(a) revDSG).

Email verification and proof of consent

After registration we send a verification link to your email address; the link and the associated token are valid for 24 hours. The same applies accordingly to the confirmation link when you change your email address. It is technically impossible to create an account or a profile without having a valid and verified email address. Verification emails and other system messages are sent via the email service Google Workspace (see section 4).

On registration, the accepted version of the Terms and the acknowledgement of the privacy policy are stored with a timestamp. This allows us to prove the express consent and the conclusion of the contract at any time (legal basis: statutory or contractual obligation to provide proof).

Deletion of unconfirmed accounts: Accounts whose email address is not confirmed within 30 days of registration are automatically deleted in full (daily automated job). This affects only accounts whose address has never been confirmed. Accounts that change their already confirmed email address and need to confirm the new address are not affected; the email change does not reset the verification.

Profile content

During onboarding you answer questions about yourself and your expectations. These answers and your profile picture (stored in the database) serve exclusively to calculate matches and to display your profile. An optional area on intimacy and preferences is only actively processed if you switch it on yourself. Answers to questions in this area are used exclusively for calculating matches and are not disclosed to other users; the corresponding answers of the other person likewise remain hidden from you in the profile view — only whether the criteria match is shown.

Particularly sensitive data (Art. 9 GDPR / Art. 6 revDSG)

Questions in the optional area on intimacy and preferences, as well as information about your sexual orientation or gender identity, may be particularly sensitive data. We process these only if you provide them yourself, exclusively for calculating matches and displaying the profile. By saving such information you consent to this processing (Art. 9(2)(a) GDPR / Art. 6(1) revDSG). The information is voluntary; you can change or remove it at any time and withdraw your consent with effect for the future, e.g. by deactivating the area in your profile settings.

Messages and interactions

Contact requests, favourites, ignores, matches and conversations are processed in order to provide the platform’s functions. Personal (direct) messages are stored in the database exclusively in encrypted form (AES-256-GCM; plaintext content is not retrievable from the database). Archived messages are automatically irreversibly deleted 30 days after archiving. System messages (without personal content) are subject to the same deletion rule.

Online status

When you are signed in and a page is open, a technical timestamp is stored in order to show whether you are currently online and when you were last online. This timestamp serves exclusively to display the status to your matches and contacts (contractual function, legitimate interest of users).

Support enquiries

Via the support button in the app you can send us bug reports, feature requests, support enquiries and feedback. In doing so, your email address and the message you enter (subject and content) are transmitted to the support address info@pardate.com. We use this data exclusively to process your enquiry and — insofar as necessary — to contact you (legal basis: legitimate interest in handling user concerns, Art. 6(1)(f) GDPR / Art. 31(1) revDSG). You receive a confirmation of your enquiry by email; enquiries are usually answered within about one day.

Protection of the platform (security)

To defend against attacks, failed sign-in attempts (normalised email address, number of attempts, lockout time) are stored temporarily and deleted after a successful sign-in or on expiry. In addition, a captcha procedure is used that operates without storing personal data (legal basis: legitimate interest, Art. 6(1)(f) GDPR / Art. 31(1) revDSG).

4. Recipients and processors

Insofar as data processing is carried out by service providers on our behalf, we conclude with them the legally required data processing agreements (DPA under Art. 28 GDPR or Art. 9 revDSG). With service providers established in third countries (in particular Google, established in the USA), corresponding contracts based on the EU Standard Contractual Clauses (SCC) exist or will be concluded, so that an adequate level of data protection is ensured. We currently use the following service providers:

  • Hosting: The platform, the database and uploaded image files are operated on the servers of a hosting provider (server location Switzerland or EU). The hosting provider thereby receives the data technically necessary for operation (in particular IP addresses of accesses to the application).
  • Email delivery (Google Workspace): Verification emails, system messages, support confirmations and replies are sent via the email service Google Workspace (SMTP relay, smtp-relay.gmail.com). In doing so, the recipient address and message content are transmitted to Google (end-to-end TLS encryption). Server location of further processing: Europe/USA (Google Ireland Ltd. or Google LLC; SCC).

Personal data is not passed on to any other third parties for their own purposes (in particular for advertising purposes). The platform is currently operated entirely free of charge; no payment processing takes place and no payment data is collected or transmitted to a payment service provider.

5. Location search (external service providers)

When you enter your place of residence, a search for localities is carried out via the free geocoding service Photon (OpenStreetMap data, photon.komoot.io). In doing so, only your search term (place name) is transmitted to this service; no account data, device location data or personal data is passed on. The service stores the requests without any personal reference.

Optionally, the location search can be operated via Google Places (only if the operator configures this); in that case Google’s privacy notices apply, and the transmission is likewise limited to the search term.

6. Retention period and deletion

  • Account: stored until you delete your account (see section 7). On deletion, all associated data is removed.
  • Archived messages: permanently deleted 30 days after archiving by an automated job.
  • Sign-in protection data: removed after a successful sign-in or on expiry of the lockout.
  • Verification and email-change tokens: the associated link expires after 24 hours; the token is removed on successful use or on deletion of the account.
  • Unconfirmed accounts (email address never confirmed, no pending email change): automatic full deletion 30 days after registration by a daily job.
  • Terms and consent records (accepted version of the Terms, timestamp): stored until deletion of the account and beyond within the scope of statutory retention obligations.

7. Your rights

Regardless of whether you are resident in Switzerland or the EU, you have the following rights:

  • Access to the data stored about you (Art. 25 revDSG / Art. 15 GDPR) – an overview of your stored data (contacts, direct and system messages, profile rank) can also be found in the app under “Profile → More → Metrics”,
  • Rectification of inaccurate data (Art. 32(2) revDSG / Art. 16 GDPR),
  • Erasure of your account including all data — in the app under “Profile → Delete account” or on request by email (Art. 32(2) revDSG / Art. 17 GDPR),
  • Restriction of processing as well as objection (Art. 21 GDPR),
  • Data portability (Art. 20 GDPR) and
  • Complaint to the competent supervisory authority: in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC), in the EU to your local data protection authority (Art. 77 GDPR).

You can withdraw a consent at any time with effect for the future, insofar as a processing is based on consent.

8. Transfer security

All communication with the platform takes place over TLS-encrypted HTTPS. Passwords are stored exclusively with bcrypt (work factor 12), and direct messages are stored encrypted in the database with AES-256-GCM. Therefore, even in the event of unauthorised database access, there is no readable access to message content or passwords.

9. Changes to this policy

We update this privacy policy when the processing changes. The current version is always available on this page.