Privacy policy

bareminimum (thebareminimum.uk) is the data controller. [To confirm: legal entity name, address, privacy contact email, ICO registration number]

• Account: email address, password (stored hashed by our authentication provider), first name, username.
• Your tracker: the people you add (name, optional photo, where you met, notes, tags, status), weekly ratings, eras, notes.
• Priorities: your questionnaire answers and the resulting priority ranking.
• Insights: Pattern Insights and Your Dating Patterns, generated from your ratings. We treat these as sensitive.
• Friends: friend connections, requests, invites (including any email address you enter), shared updates, comments and reactions.
• Settings: your sharing preference and technical data needed to keep you signed in.

• Running your account and tracker, and showing friends what you chose to share — contract.
• Automatically sharing your pattern overview — your consent, off by default and withdrawable in Settings at any time.
• Sending invite emails you ask us to send — legitimate interests of you and us in connecting friends. The recipient can decline.
• Security, abuse prevention and error logs — legitimate interests.

[To confirm: legal review of these bases, especially for data about the people you date, who are not users]

Your tracker, notes, ratings, priorities and insights are private to you. Friends see only updates you explicitly send to them, and your pattern overview if you turn on sharing. The overview contains general sentences only — never names, photos, scores or notes.

Stopping sharing, removing or blocking a friend ends their access straight away. Stopping sharing removes access; deleting removes the content itself.

When you request Pattern Insights, your weekly scores and dates are sent to an AI model through the Lovable AI Gateway (currently a Google Gemini model). Names, photos, notes and tags are not sent; each person is replaced by a label like "Person 1". Results are shown to you and not stored or shared.

[To confirm: provider retention and training terms, and whether processing happens outside the UK]

Hosting, database, authentication, file storage and email sending are provided through Lovable Cloud and its sub-processors. [To confirm: list sub-processors, their locations and transfer safeguards (e.g. UK IDTA / adequacy)]

We use browser storage only to keep you signed in and remember small preferences (such as drafts and your last share recipients). We do not use advertising cookies. [To confirm: confirm no analytics or session-replay tools are added]

We keep your data while your account is active. Deleting your account (Settings → Delete my account) removes your records, photos, shared updates, friend connections and reactions from the live database at once. [To confirm: backup retention period and log retention period]

You can access and download your data (Settings → Download my data), correct it in the app, delete your account, and withdraw consent to sharing. You can also ask us to restrict or object to processing, or complain to the ICO (ico.org.uk). [To confirm: how to send requests and the response process]

[To confirm: breach response procedure, including notifying the ICO within 72 hours where required]