MeetGO privacy policy
Effective from: 13 September 2026 Β· Version 2.0
Applies to the meetgo.pl website and the MeetGO mobile app (iOS and Android), which connect to the same MeetGO server.
1. Who the controller is
The controller of your personal data is Adrian Kemski, trading as Adrian Kemski AmbitioKod, ul. Sokola 11/4, 82-500 Kwidzyn, Poland, tax ID (NIP) 5811981075, REGON 528568849 ("we" or "MeetGO").
Contact for personal data matters: privacy@meetgo.pl or by post to the address above.
2. What this policy covers
- the meetgo.pl website (information pages, blog, registration and login),
- the MeetGO mobile app (profile, matches, conversations, meeting arrangements, notifications),
- the MeetGO server that the website and the app connect to.
You can browse the blog and information pages without an account. Social features (matches, conversations, meetings) require an account and are available in the mobile app.
3. Age
MeetGO is for adults only (18+). When you complete your profile we ask for your date of birth and we do not admit profiles of people under 18 to matching. If we learn that an account belongs to a minor, we delete it together with its data.
4. What data we process, why, on what legal basis and for how long
| Purpose | Data | Legal basis (GDPR) | How long |
|---|---|---|---|
| Creating and running your account (registration by e-mail or Google) | name or nickname, e-mail address, password (stored only as a cryptographic hash), e-mail confirmation, one-time 6-digit verification and password reset codes, account creation date, last activity date | Art. 6(1)(b) β contract for the service | until the account is deleted; one-time codes are deleted after use |
| Profile and matching | profile photo, date of birth (others only see your age), gender, district chosen from a list, interests, languages, nationality, "about me" text, availability, purpose of use, visibility setting | Art. 6(1)(b) β contract; if you yourself type information about health, orientation, views or religion into free-text fields β Art. 9(2)(a) (your explicit consent by voluntarily entering it) | until the account is deleted; you can change or clear each field in profile settings |
| Conversations | message content, time sent and read, participants | Art. 6(1)(b) | until the account is deleted |
| Arranging meetings | proposed times and venues, chosen venue or manually entered place, time, meeting status, no-show reason, post-meeting survey answers (whether the meeting took place, rating of the person 1β5, rating of the venue), formed friendships | Art. 6(1)(b) | until the account is deleted; a rating you give is never shown to the rated person |
| Push notifications | device token (Firebase Cloud Messaging), platform (iOS/Android) | Art. 6(1)(b) | until you log out of the device or delete the account; inactive tokens are removed automatically |
| Security and abuse prevention | blocks of other users, reports (text entered by the reporter, up to 500 characters), moderation decisions, IP address at registration, password reset and login (attempt limits), technical error logs | Art. 6(1)(f) β our legitimate interest (a safe service) and Art. 6(1)(c) β obligations under the Digital Services Act (DSA) | blocks: until the account is deleted; reports: 12 months after review; IP address in the attempt counter: up to 1 hour; error logs: 30 days |
| Statistics on how the meeting features work | technical events from a fixed vocabulary (e.g. "proposal created", "meeting cancelled") linked to an account identifier; no user-entered text | Art. 6(1)(f) β improving the service | the account identifier is anonymised when the account is deleted |
| Handling enquiries, complaints and appeals against moderation decisions | account data, correspondence | Art. 6(1)(b), (c) (DSA) and (f) | until the matter is closed, then until limitation periods for claims expire |
| Establishing, exercising and defending claims | account data, history of significant account actions | Art. 6(1)(f) | until limitation periods expire |
| Newsletter and product news (only if you sign up) | e-mail address, name | Art. 6(1)(a) β consent (including consent to electronic communication under the Polish Electronic Communications Law) | until consent is withdrawn |
| Visit statistics for meetgo.pl | aggregated page view and performance data (Vercel Web Analytics and Speed Insights): page address, country, device and browser type, referrer, the events "register click" and "register success"; no cookies and no persistent identifier β a temporary request hash is discarded after 24 hours | Art. 6(1)(f) β measuring website traffic | data is aggregated immediately; the request hash for at most 24 hours |
Providing a name, e-mail address and password is required to create an account. A photo, date of birth and district are required to take part in matching. The remaining profile fields are optional.
5. Where your data comes from
- From you β at registration, when completing your profile and while using the app.
- From Google, if you sign in with a Google account β we receive the e-mail address and the first and last name from your Google account (we ask Google only for the "email" scope). We build your profile name from the first and last name; you can change it.
- From other users β reports about you, blocks and post-meeting survey answers.
6. Location
MeetGO does not collect GPS location from your device and does not ask for location permission. In your profile you choose a district from a list (currently 8 districts of GdaΕsk and 8 districts of PoznaΕ). To calculate distances between users we use the coordinates of the centre of the chosen district, not your actual position. Other users only see an approximate distance in kilometres. A manually entered meeting place is stored as text, without geocoding.
7. How matching works and what happens automatically
- The match list is built by comparing your interests with other people's interests (overlap of the lists). We show the result as a match percentage. You can also filter by age, gender, languages, nationality and distance. Only visible, active and complete profiles (photo, age, district) are included.
- What others see: photo, age, gender, languages, nationality, common interests, match percentage and approximate distance. They do not see your e-mail address, date of birth or ratings.
- Meeting proposals: at the request of one party the system automatically composes two proposals (venue and time) based on both people's districts, venue opening hours and shared activity tags. Limits apply: 3 proposals per day, a 3-day pause after a decline, 2 manually reported meetings per conversation, 2 reschedules per person. Proposals expire automatically.
- After a meeting we send a survey. If both people confirm the meeting and rate each other at least 3/5, the system automatically marks them as friends. If you rate someone 1 or 2, that person stops being shown to you in matches for 2 years and is not informed.
- A block hides both people from each other and closes active proposals and scheduled meetings.
None of these operations is a decision with legal effects on you within the meaning of Art. 22 GDPR. Account deactivation and decisions on reports are always taken by a human, never automatically. We do not automatically scan message content, descriptions or photos.
8. Who we share data with
We use processors that handle data on our instructions (Art. 28 GDPR):
| Recipient | What it receives | Where |
|---|---|---|
| Hetzner Online GmbH (Gunzenhausen, Germany) β hosting of the MeetGO server, database and photo storage | all data from section 4, including profile photos and blog images (file storage runs on the same server) | Germany / Finland (EEA) |
| Vercel Inc. β hosting of meetgo.pl, Web Analytics, Speed Insights | requests to the website, aggregated visit statistics | USA (EU-U.S. Data Privacy Framework participant) |
| Google (Firebase Cloud Messaging) β delivery of push notifications | device token, notification title and body. For a new message this is the sender's name and the first 100 characters of the message; meeting notifications have neutral wording without names | USA (Data Privacy Framework) |
| Google β sign in with Google | sign-in identifier, e-mail address (only if you choose this option) | USA (Data Privacy Framework) |
| E-mail delivery provider β transactional e-mails (account confirmation, password reset, password change) | e-mail address, message content with the code | EEA |
| Functional Software, Inc. (Sentry) β server error monitoring | technical error data (request path, account identifier, stack trace); we do not send message content, passwords or tokens | European Union (Sentry EU region) |
We may also disclose data to authorised bodies (e.g. courts, police, the Digital Services Coordinator) when required by law.
9. Transfers outside the EEA
The server, database, photos and error data are stored in the European Economic Area. Vercel and Google are based in the USA. Transfers to these providers rely on the European Commission adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework) and otherwise on the Commission's standard contractual clauses. You can obtain a copy of the safeguards by writing to the address in section 1.
10. Your rights
- access to your data and a copy of it,
- rectification β you can correct most profile data yourself in settings,
- erasure β delete your account in the app: Settings β Account β Delete account; you can also use the "Delete account" page or write to the address in section 1. Deletion covers the profile, photos, messages, device tokens and meeting history. For the periods in section 4 we keep only: reports and moderation decisions (DSA obligation), data needed to defend claims, and anonymised statistics,
- restriction of processing,
- data portability β on request we send your data in JSON format,
- objection to processing based on legitimate interest, including marketing,
- withdrawal of consent at any time, without affecting the lawfulness of earlier processing,
- a complaint to the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
We respond to requests within one month. We may ask you to confirm your identity (e.g. with a code sent to the account's e-mail address).
11. Security
Connections are encrypted (TLS). Passwords are stored only as cryptographic hashes. The app session is based on a token valid for 1 hour. We limit registration, login and password reset attempts. Only administrators can access reports and moderation decisions. We do not write message or notification content to logs.
12. Cookies and technologies in the app
The meetgo.pl website uses only one strictly necessary cookie: meetgo_jwt (your session after login; deleted when you close the browser or log out; Secure and SameSite=Lax attributes). Visit statistics (Vercel Web Analytics, Speed Insights) work without cookies and without storing anything in your browser, so the website shows no cookie consent banner. We use no advertising cookies or tracking tools.
The mobile app uses no cookies, advertising identifiers (IDFA/AAID) or third-party analytics SDKs. It uses Firebase Cloud Messaging for push notifications; you grant notification permission in your phone's system settings and can withdraw it there. The app asks for camera or photo library access only when you add a profile photo.
13. Changes to this policy
We will announce significant changes by e-mail or in the app at least 14 days before they take effect. Previous versions are available on request.