Privacy Policy

This Privacy Policy explains how the Malvi app (“Malvi”, “we”, “us”) handles information when you use it. Malvi is developed and operated by Nazarii Kalinchuk, an individual developer based in Ukraine, who is the controller responsible for your personal data. We built Malvi to be private by design: you don't need an account to use it, and if you don't use partner connection, your names, relationship date and goals stay on your device. Some usage and technical data does reach our analytics, crash reporting, subscription and advertising providers, as described below.

Partner connection is optional. If you use it, the app creates an anonymous account (no email, phone number or password) and stores the data described in Section 2 on our servers so that you and your partner can use Malvi together: share Premium, send each other drawings, play quizzes each on your own phone and keep a shared Flame. If you never use partner connection, Section 2 does not apply to you.

1. Information you provide

During onboarding you may optionally enter details such as first names or nicknames, your relationship start date, relationship status, and relationship goals. This information is stored locally on your device to personalize your experience (for example, to show your names in the app and on your widgets, or to count your days together). Your names, relationship date and goals are never included in the data we send for analytics or advertising, and we do not require an account or login. Photos you add to widgets are also stored only on your device. Your Flame (daily streak) and the answers you give in quizzes played on one phone stay on your device too; Amplitude receives only events about them, such as a day being counted or whether your answers matched (Section 3).

There are two exceptions. The relationship status tags you select are sent to our analytics provider Amplitude (Section 3). If you use partner connection, the name you entered for yourself, your relationship start date, statuses and goals are sent to our servers to set up your pair, and your Flame and quizzes played on two phones are synced with your partner (Section 2).

2. Partner connection (optional)

Partner connection links your Malvi app with your partner's, so that you can share Premium (called Pro in the app), send each other drawings, play quizzes each on your own phone and keep a shared Flame. Nothing in this section happens unless you choose to invite a partner, enter a partner's code or open a partner's invite link. Under the buttons that create an invite or join with a code, the app shows a line saying that by continuing you accept the connection rules and our Terms of Use, with links to both. When you create an invite or join with a code, our server records when you first accepted them. The anonymous account, account record and device record described below are created as soon as you tap to invite a partner, enter a code or open an invite link in the app (the app then checks the code with our server), even if you stop before connecting; you can have them deleted as described in Section 8.

Anonymous account. The first time you choose to invite a partner, enter a code or open an invite link (even if you stop before connecting), the app signs you in to Google Firebase Authentication with an anonymous account: a random ID with no email, phone number or password. The ID is kept in your iPhone's Keychain, so it remains if you delete and reinstall the app on the same phone. On our servers we keep an account record with this ID, when it was created, when you accepted the connection rules, when you last opened the app, your app version, platform and app language, your current pair and invite code, whether you want notifications from your partner, when and how your last pair ended (including your former partner's anonymous ID), the anonymous IDs of anyone you blocked, and counters that limit abuse (for example, failed code attempts).

Device record and notifications. At the same moment, the app registers your phone for push notifications and stores a device record, named with the random ID of your app installation (Section 3): a push token from Google Firebase Cloud Messaging, your time zone, app language and version, whether notifications are allowed on the phone and whether iOS can deliver them quietly, and, on iOS 26 and later, a push token that Apple provides for Malvi's widgets. The record is stored even if notifications are not allowed, and it is updated while you use the app. We use it to send you notifications about your partner's actions (for example, that your partner joined, sent you a drawing, is waiting for your quiz answers, finished a quiz so its result is ready, shared Premium with you, changed phone or ended the connection) in your language, to update your widgets (see Drawings below), and to let your partner's app show whether these notifications reach you. These notifications are delivered by Google Firebase Cloud Messaging and Apple Push Notification service and show your partner's name. After you connect, the app asks iOS for quiet (provisional) notifications, which appear only in Notification Center, without sounds or banners, until you choose to keep or turn them off. You can turn notifications off in iOS Settings.

Invite codes. When you create an invite, our server stores a one-time code together with the name you entered for yourself, your relationship start date, statuses and goals, so that your partner's app can be filled in when they join. When you join with a code, your app sends the same details to set up the pair. None of these details is required: the app sends only what you have entered, and where your name is missing, a general word such as “partner” is used instead. Anyone you give your code or invite link to can see your first name (the first word of the name you entered) before joining, until the code is used or expires. The invite link opens a simple page on go.malvi.app that shows the code; the page does not use analytics or cookies.

Your pair. When your partner joins, our server creates a pair record with each partner's anonymous ID (including an earlier anonymous ID if one of you moved to a new phone), the name each of you entered, app language, platform and which features each app version supports; your shared relationship start date, statuses and goals; which partner's subscription provides Premium and until when; a random widget key that lets your widgets load drawings (see Drawings below); and technical data such as when the pair was created, activity counters and notification limits.

Quizzes on two phones. When you are connected, you can play a quiz each on your own phone. Each round is stored with your pair's data on our servers: which quiz and deck it comes from, the IDs of its questions (from 3 to 12), the quiz type and level, the language of the phone that started it, who started it and when. Your answers are stored as numbers linked to the question IDs (for example, which of two options you picked, or a rating from 1 to 10), together with the questions you skipped and when you answered. The text of the questions is part of the app and is not sent. Your partner's app receives your answers as soon as you send them and shows them in the quiz result. Some quizzes are about intimacy, so your answers to them can reveal something about your intimate life. If you choose “Partner is right here”, the quiz is played on one phone and your answers stay on that phone. The app lets you cancel a round your partner has not answered yet, which deletes the round with your answers. Each time you send your answers, we also store a short quiz record (the round, the quiz and whether it is the first or the second set of answers), without your answers; it is used for notifications.

Shared Flame. When you are connected, your Flame becomes shared. For each of you, the pair's data on our servers holds the dates of the days you counted (up to the 400 most recent), your current run, your best run and your total number of days, so that both apps can count the shared Flame.

What your partner can see. Your partner can access the name you entered, your app language and type of device; the shared date, statuses and goals, which either of you can change; your drawings and when you viewed theirs; your answers in quizzes you play on two phones; the days you counted for the shared Flame, with your best run and total; whether notifications from them can reach you; and which of you pays for Premium. Your partner cannot see your account or device record or your analytics data. We look at pair data only to review a report, answer your request or fix a technical problem.

Some data about you also comes from your partner: shared details they change, and their answers in quizzes that are about both of you, such as “who of us” quizzes. These answers are stored, shown and deleted in the same way as yours.

Drawings. When you send a drawing, our server stores the image (a small PNG picture), the strokes it is made of, when it was sent and when each of you viewed it. Your partner sees it in the app and, if they have added it, on the Malvi drawing widget. The app can redraw a drawing from its strokes for the history and the widget, so a drawing can stay visible for as long as its strokes are kept, up to 90 days (Section 8).

How drawings reach the phone and the widget. Your partner's app loads the image from our servers using its anonymous account. When a drawing notification arrives, the app's notification extension downloads the image with a long random key, which works only while the image is stored on our servers, and saves the latest drawing on the phone so it can appear on the widget before the notification is opened. The Malvi drawing widget also checks our server for your partner's latest drawing by itself: from time to time, as iOS allows, and right after an invisible widget push. On iOS 26 and later our server sends such a push through Apple Push Notification service when your partner sends a drawing; it shows nothing on screen and is sent even if notifications are not allowed, because it only asks the widget to refresh. The widget's request carries your pair ID, your anonymous ID, the pair's widget key and the IDs of drawings you hid on the phone, and, until our server has saved it, the widget push token with the random ID of your app installation. Our server returns the drawing with your partner's name and, like any server, sees the phone's IP address.

Hiding, reporting and blocking. Hiding a drawing your partner sent removes it only from your phone. Hiding a drawing you sent also hides it in your partner's app; it stays on our servers until it is deleted as described in Section 8. Reports apply to drawings. If you report a drawing, it is removed from the pair right away, and our server keeps a copy of it (the image, or its strokes if the image has already expired) in a report record together with the reason you chose, both partners' anonymous IDs and the pair ID. After a report, the app offers to block your partner. We are alerted automatically, review every report and may take action, such as disconnecting the pair. If you block your partner, you are disconnected and their anonymous ID is kept on your account so that neither of you can connect again; it is removed when you unblock them or delete your connection data.

Disconnecting. Either of you can disconnect at any time. You then stop receiving each other's drawings, quizzes and notifications, the Flame is no longer shared, and the partner who does not pay loses the shared Premium. The pair's widget key stops working, so the Malvi widget removes your partner's drawing the next time it reaches our server; a phone that stays offline can keep it until it goes online or the app is deleted. The disconnected pair record and its content, including drawings, quiz rounds and Flame days, are deleted 30 days later, or immediately if you disconnect within 10 minutes of connecting.

3. Analytics, crash reports and support

To understand how the app is used and to improve it, we use third-party analytics services (Amplitude and Google Firebase Analytics). These services receive usage events, for example which screens are opened, which decks and features are used, events about your Flame (such as a day being counted and how long your Flame is), when the paywall is shown, and when a purchase is started or completed (including the product, price and currency). The events come with technical data such as device model, operating system version, app version, app language and app settings (for example, theme and whether notifications are allowed).

Events are linked to random identifiers of your app installation or device: the Amplitude device ID, the Firebase app instance ID, Apple's identifier for vendors and, only if you allow tracking, your advertising identifier (Section 5). We also send Amplitude your support code (below) and, if you use partner connection, your anonymous connection ID. These services also receive your IP address, which they use to estimate your approximate location (for example, country, region or city). This data is pseudonymous: it does not include your name or contact details, but it is linked to your device, and through the support code it stays linked to you when you reset your data or reinstall the app on the same phone. When we handle your request, we can use the support code or your anonymous connection ID to match this data with your partner connection data.

To understand who uses Malvi, we also send Amplitude the relationship status tags you select (for example “dating”, “married” or “long distance”), whether you set a relationship date (yes or no), how many goals you chose and, if you use partner connection, events such as creating or entering a code, connecting or disconnecting, sending, receiving, viewing, hiding or reporting drawings, and playing quizzes on two phones, as well as whether you are connected, your role in the pair, whether notifications from your partner can reach you and whether your Premium comes from your own or your partner's subscription. For quizzes we send which quiz you play, the position of each question in the round, whether your and your partner's answers matched and the match percentage, but not the answers themselves. We do not send your names, relationship date, goals, drawings, invite codes, your partner's identifiers or your answers to these services.

Support code. The app creates a random ID of your app installation and keeps it in your iPhone's Keychain, so it remains when you reset your data, delete connection data or delete and reinstall the app on the same phone. From this ID the app makes a short support code (in the form MV-XXXX-XXXX), which you can see at the bottom of the Menu tab next to the app version; tapping it copies it. The same code is sent to Amplitude (as a user property), to Firebase Crashlytics (as the user ID) and to RevenueCat (as an attribute), and it appears in the subject of support emails, so that we can find the data that belongs to you when you contact us. The code is not a password and does not give access to anything. The app has no setting to reset it.

Crash reports and errors. Versions of Malvi from the App Store and TestFlight use Google Firebase Crashlytics, together with its Firebase Sessions component, to tell us about crashes and errors. When the app crashes, or when an unexpected error occurs, Crashlytics receives a report with technical details: where in the app it happened and an error code, for crashes the stack trace and error message, recent app log lines about errors, device model and state (for example, free memory), operating system version, app version and build, a Firebase installation ID, your support code and, if you use partner connection, your anonymous connection ID. Firebase Sessions records when the app is used, so that crashes can be measured against app sessions. We also send Amplitude an App_Error event with the place in the app and the error code, and the app keeps its last 30 errors (time, place, error code and app version) on your phone for support emails. These reports are designed to exclude your names, drawings, answers and other content, but the message of an unexpected crash is created automatically, so we cannot promise it will never include a fragment of text from the app. Crash reporting runs for everyone who uses these versions, whether or not you use partner connection; the app has no setting to turn it off.

Support emails. Contact Support in the Menu tab opens an email to us in your mail app. Below the space for your message, the email contains a technical block: your support code, app version and build, iOS version, device model, app language, the state of your partner connection without names (for example, connected or disconnected and why, the first 6 characters of your pair ID and your role in the pair), whether notifications are allowed and whether notifications about your partner's actions are on, whether you have added the Malvi drawing widget and in which size, whether you have Premium and from whom, your RevenueCat customer ID, your anonymous connection ID and your last 5 errors (time, place in the app and error code). It does not include names, invite codes, drawings or answers. Nothing is sent until you send the email yourself, and you can edit or delete the block before sending. When you write to us, we receive your email address and everything you write or attach. Our support mailbox is a Gmail account provided by Google.

4. Purchases and subscriptions

In-app purchases and subscriptions are processed by Apple through the App Store; we never receive or store your payment details. We use RevenueCat to manage subscription status (for example, whether Premium is active). RevenueCat receives a random customer ID, your purchase and subscription history, device identifiers (Apple's identifier for vendors, your IP address and, if you allow tracking, your advertising identifier), your app language, the Amplitude and Meta identifiers of your app installation, your support code (Section 3) and, if you use partner connection, your anonymous connection ID. It uses them to manage your subscription and to send subscription events (such as trial starts, renewals and cancellations) to Amplitude and, if you allowed tracking, to Meta. To measure the effectiveness of our advertising, we may use Apple's on-device attribution (the AdServices framework) and share limited device identifiers with RevenueCat and Apple for attribution purposes.

Premium shared with your partner. If you use partner connection, your RevenueCat customer ID becomes your anonymous connection ID (Section 2). Our server checks both partners' subscription status with RevenueCat. If one of you subscribes, the server gives Premium to the other for as long as the subscription is active and you stay connected, and both of you can see which of you pays. When you delete your connection data, we remove the shared Premium and ask RevenueCat to remove the app language and the Amplitude and Meta identifiers from your record; RevenueCat keeps your purchase history, the device identifiers it collected, your support code and your anonymous connection ID.

5. Advertising attribution

If you install Malvi after tapping an Apple Search Ads ad, Apple provides us with campaign-level attribution data so we can measure ad performance. This uses Apple's privacy-preserving frameworks and does not identify you personally.

We also advertise Malvi on Meta platforms (Facebook and Instagram). To measure the performance of these campaigns, the app uses the Meta SDK. Whether or not you allow tracking, the Meta SDK sends Meta basic app events (installs and app opens, completing onboarding, and viewing the paywall together with where in the app it was shown), with a Meta ID for your app installation and device information such as device model, operating system version and IP address. The Meta SDK also collects crash and diagnostic data. Trial starts, subscriptions and purchases are not sent to Meta from the app: they reach Meta through our subscription-management provider RevenueCat, and only if you allowed tracking. We do not share your names, relationship details, drawings or answers with Meta. Meta processes this data under its own privacy policy. For people in the European Economic Area, the UK and Switzerland, we and Meta Platforms Ireland Ltd are joint controllers for collecting these events in the app and sending them to Meta; Meta alone is responsible for what it does with them afterwards. The main points of this arrangement are set out in Meta's Controller Addendum on Meta's website, and you can exercise your rights regarding Meta's processing directly with Meta.

Tracking permission. On iOS, the app asks for your permission before tracking, using Apple's App Tracking Transparency prompt. If you allow it, your device advertising identifier (IDFA) is shared with Meta, Google (Firebase Analytics) and RevenueCat to measure our ads. If you decline, no IDFA is shared, and the app tells Meta that tracking is not permitted, which limits how Meta may use the events described above. You can change your choice anytime in iOS Settings → Privacy & Security → Tracking.

6. How we use information

• To provide and personalize the app's features;
• If you choose to use it, to connect you with your partner, sync your shared profile, quizzes on two phones and the shared Flame, deliver drawings and notifications, update your widgets, and share Premium with your partner;
• To keep partner connection safe by limiting abuse, reviewing reports and acting on them, and respecting blocks;
• To understand usage and improve the product;
• To find and fix crashes and errors;
• To manage subscriptions and restore purchases;
• To measure the performance of our marketing;
• To answer your questions and requests, using the technical details you choose to send, and to meet our legal obligations.

7. Legal bases

If you are in the European Economic Area, the UK or another place with similar data-protection laws, we rely on these legal bases:

• Performance of our agreement with you (GDPR Art. 6(1)(b)): providing the app, restoring purchases, answering your support requests and, if you use it, partner connection, drawings and widget updates, quizzes on two phones, the shared Flame, notifications about your partner and shared Premium.
• Legitimate interests (Art. 6(1)(f)): product analytics, including the relationship status tags and the support code, to understand and improve Malvi; crash reports and error diagnostics to keep the app working; advertising measurement that does not use your advertising identifier (Apple Search Ads attribution and the basic Meta app events in Section 5); and reviewing reports, preventing abuse and keeping the service secure. You can object to this processing at any time (Section 14).
• Consent (Art. 6(1)(a)): using your advertising identifier to measure our ads with Meta, Google and RevenueCat, only if you allow tracking in the iOS prompt. You can withdraw your consent at any time in iOS Settings.
• Legal obligations (Art. 6(1)(c)): keeping records needed for tax and accounting and responding to lawful requests from authorities.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automatic safety limits, such as pausing code entry after several wrong codes or limiting how many drawings, quiz rounds or notifications can be sent, only restrict the feature for a time.

8. Data retention and deletion

The details you enter live on your device and are removed when you delete the app or reset your data in the Menu tab (Reset progress and start over). Resetting keeps your app language, theme and Amplitude device ID, and neither resetting nor deleting the app removes the random ID of your app installation, and so your support code, from your iPhone's Keychain (Section 3). Resetting or deleting the app does not delete data already sent to our providers. It also does not delete partner connection data on our servers: resetting does not disconnect you, and after a reset, or after reinstalling the app on the same phone, your pair is restored. If you use partner connection, the app also keeps on your phone a copy of the pair data it has loaded, and the pair ID and widget key the widget needs; deleting the app removes them.

Analytics data is kept by Amplitude and Google for as long as it helps us understand how Malvi is used over time, within the retention settings of our accounts with them. Firebase Crashlytics keeps crash reports for 90 days, after which Google begins deleting them from its systems. RevenueCat and Apple keep subscription and purchase records for as long as needed for purchases, taxes and fraud prevention. We keep support emails for as long as we need them to answer your request and any follow-up, and you can ask us to delete them.

If you use partner connection, data on our servers is deleted automatically:

• Invite codes and the details they carry: 7 days after they are created (60 minutes for a code to connect a partner's new phone), or 1 day after a code is cancelled;
• Drawing images: 30 days after they are sent; in addition, a pair keeps only its latest 20 images, plus each partner's most recent drawing if it is older;
• Drawing details (strokes and viewing times) and pair events, including quiz records (Section 2): 90 days; because the app can redraw a drawing from its strokes, a drawing can stay visible in the history and on the widget for up to 90 days;
• Quiz rounds and answers: while your pair exists; in addition, each time either of you sends quiz answers, we delete rounds nobody answered after 1 day (and any beyond the 5 most recent of those), rounds only one of you answered after 90 days, and the oldest completed rounds once a pair has more than 40 rounds;
• Shared Flame: the dates of up to the 400 most recent counted days for each of you, while your pair exists;
• Device records, including the widget push token: 90 days after the app last updated them, or sooner if a push token stops working;
• Report records, including the copy of a reported drawing: 30 days;
• A disconnected pair and all its content, including drawings, quiz rounds and Flame days: 30 days after disconnecting (immediately if you disconnect within 10 minutes of connecting);
• Technical records used to update or remove shared Premium: up to 30 days;
• Server logs (which may include anonymous IDs, pair IDs and IP addresses, but not drawings or answers): 30 days;
• Backups: our database keeps point-in-time recovery versions for 7 days, so data deleted from it can remain in these versions for up to 7 days; we use them only to repair the database after a failure.

Automatic deletion usually completes within 24 hours after these periods end. Your anonymous account, your account record and an active pair are kept until you delete your connection data (or, for the pair, until one of you disconnects), even if you both stop using the app. If you move to a new phone and reconnect, the anonymous account and account record of your old phone stay on our servers until you ask us to delete them.

Deleting connection data. You can delete your partner connection data at any time in the app: open the Menu tab, tap the Us card (your couple profile) at the top, then More in the Connection section, then Delete connection data. This disconnects you.

Deleted or removed right away:

• your anonymous account and your account and device records, including the widget push token;
• the drawings you sent, your quiz answers and your Flame days;
• your name in the pair record and any shared date, statuses or goals you changed last;
• the reports you filed;
• the shared Premium your subscription gave your partner.

Kept for a limited time:

• the disconnected pair record, including your anonymous ID, the content your partner added (their drawings, quiz answers and Flame days) and when you viewed their drawings: until it is deleted 30 days later;
• your active invite code: cancelled at once and deleted 1 day later; codes you already used or joined with: until they expire, no more than 7 days after they were created;
• reports about drawings you sent: up to 30 days;
• technical records used to remove shared Premium, and server logs: up to 30 days;
• backup versions of our database: up to 7 days;
• your anonymous ID in your partner's account record: as the person who ended the connection, until your partner connects again or deletes their connection data; and in their block list, if they blocked you, until they unblock you or delete their connection data.

Anything already saved on your partner's phone can remain there. RevenueCat keeps your purchase history, the device identifiers it collected, your support code and your anonymous connection ID; we ask it to remove the app language and the Amplitude and Meta identifiers. Deleting connection data does not cancel your App Store subscription, does not change your support code and does not delete analytics data or crash reports.

To request deletion of any data associated with you, contact us at the address below. Because Malvi has no user accounts with names or email addresses, please include your support code (Section 3); emails sent with Contact Support include it automatically. With it we can find your data in Amplitude, Firebase Crashlytics and RevenueCat and, if you use partner connection, on our servers. Crash reports expire after 90 days, as described above, and we may not be able to delete them sooner. We may also ask for other information that helps us find your records, such as the App Store order ID of a purchase. Because anyone who has held your phone can see your support code, before we send you a copy of your data or delete it, we may ask you to confirm that the request is yours, for example by writing to us with Contact Support from the phone the code belongs to. Some analytics data, such as Firebase Analytics events, is not linked to the support code, and we may not be able to identify it.

9. Third-party services

We rely on the following providers, each with its own privacy policy:

• Apple (App Store, purchases, Apple Search Ads attribution and delivery of push notifications, including invisible pushes that update widgets);
• RevenueCat (subscription management and sharing Premium with your partner);
• Amplitude (product analytics);
• Google (Firebase Analytics, Firebase Crashlytics and Cloud Firestore; Gmail for support emails; and, if you use partner connection, Firebase Authentication, Cloud Functions, which your widget also contacts directly, Firebase Cloud Messaging, Firebase Hosting for the invite link page, and Cloud Logging and Cloud Monitoring for server logs and report alerts);
• Meta (advertising measurement).

Every copy of the app reads a public on/off setting for partner connection from Google Cloud Firestore, even if you never use partner connection; for this, Google receives technical data such as your IP address.

Google, Amplitude and RevenueCat process data on our behalf under their data processing terms; our Gmail support mailbox is provided under Google's own terms and privacy policy. Apple and Meta also act as independent controllers for their own purposes. We share data with these providers only for the purposes described in this policy, under contracts or terms that require them to give it the same or equal protection as this policy describes and Apple's App Store rules require. We encourage you to review their policies to understand how they handle data.

10. Legal disclosures

We may disclose information where we believe in good faith that it is necessary to: comply with a legal obligation or a valid request by a public authority; protect and defend our rights or property; prevent or investigate possible wrongdoing in connection with the app; or protect the personal safety of users or the public. In the event of a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; we will provide notice before any such transfer becomes subject to a different privacy policy.

11. Security

We use commercially reasonable measures to protect information. Data you keep only on your device is never sent to us. If you use partner connection, data travels over encrypted connections and is stored encrypted by Google Cloud. Access rules let only the two members of a pair read the pair's data, no other user can read your account and device records, and no user can read invite codes or reports. Invite codes expire, attempts to enter codes are limited (after several wrong codes you have to wait before trying again), and a code stops working after repeated attempts by someone who is blocked. Drawing images for notifications and widgets are delivered only with a long random key, which reaches your phone inside the notification or, for the widget, is kept on your phone: the key in a notification stops working once the drawing is deleted, and the pair's widget key stops working when the pair ends or one of you moves to a new phone. Our database keeps recovery versions for 7 days so that we can repair it after a failure. No method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

12. International users

Malvi is operated from Ukraine, and we access data from Ukraine to run Malvi, review reports and answer support emails. Our service providers process data in countries other than your own, where data-protection laws may differ: Amplitude, Google (Firebase Analytics, Firebase Crashlytics, Firebase Authentication, which holds your anonymous account, and Firebase Cloud Messaging), RevenueCat and Apple process data in the United States, and Meta in Ireland and the United States. Support emails are stored in Gmail, which Google may process in the United States and other countries. If you use partner connection, your connection data is stored in Google Cloud Firestore and processed by Cloud Functions in the European Union (Belgium). Server logs are kept in Google Cloud Logging, and the invite link page is served through Firebase Hosting's global network, so these may be processed outside the EU.

For transfers of personal data from the European Economic Area, the UK or Switzerland to countries without an adequacy decision, we rely on the provider's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where available, and otherwise on the European Commission's Standard Contractual Clauses in the provider's data processing terms. You can contact us for more information about these safeguards.

13. Children

Malvi is intended for adults and is rated 18+ on the App Store. You must be at least 18 years old to use it. It is not directed at children, and we do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will remove it.

14. Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal data, to restrict how we use it, and to receive a copy of it in a portable format. You can object at any time to processing based on our legitimate interests, including analytics and crash reports, by contacting us. The app does not yet have a setting to turn analytics or crash reports off, so we can act on an objection only for the data we are able to link to you; your support code helps us find it (Section 8). Where we rely on your consent (tracking), you can withdraw it at any time in iOS Settings → Privacy & Security → Tracking; this does not affect processing that took place before.

You can exercise many of these rights directly: data stored only on your device can be edited or removed in the app, by resetting your data or by deleting the app. Partner connection data can be deleted in the app with Delete connection data (Section 8); resetting or deleting the app does not remove it. For anything else, contact us; we will reply within one month.

You also have the right to complain to a data protection authority, for example in the country where you live or work. In Ukraine, this is the Ukrainian Parliament Commissioner for Human Rights.

15. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above, and where appropriate we will provide additional notice within the app. If this policy is available in other languages, the English version is the official one.

16. Contact

Questions about privacy? Email us at nazariy2410@gmail.com, or use Contact Support in the Menu tab of the app (Section 3). The controller of your personal data is Nazarii Kalinchuk, an individual developer based in Ukraine, and this address is also for any request about your data described in this policy.