Last Updated: September 16, 2026
Most people have only a handful of real questions about their personal data: what you take, what you do with it, whether it gets handed on, how long it stays, and whether I have any say in the matter. Rather than scatter those answers across a long document, we set them out in the order the questions tend to arise. What follows is nine inquiries, each answered in place. CityDate is published and operated by Filandou, and the legal entity behind it is KENNETH RYAN-CODY OVERSTREET. This Policy takes effect for you on the first launch of the application after installation.
Four categories, each confined to what the service genuinely requires. No open-ended catch-all is used.
Location permission may be declined. The cost is that "People Nearby" can only be sorted loosely by city instead of by actual distance.
Five purposes, mapped one-to-one onto the four categories in Inquiry 1. No extra opening is carved out:
Should any category later be needed for a purpose outside these five, your consent will be sought separately before the processing begins. Having read this Policy is not treated as that consent.
No. Selling, renting, bartering or otherwise trading your personal information is not among the options available to us. To make the features work, CityDate integrates a number of third-party SDKs / services: Firebase Crashlytics (crash and ANR diagnostics), Firebase Analytics (event and retention analysis), Google Ad Manager (ad delivery and frequency capping), Firebase Cloud Messaging (push delivery), AWS S3 (object storage for photos and voice notes), Twilio (SMS verification codes for registration and password recovery), and Mapbox (map rendering and distance calculation). Advertising, analytics and push messaging — three of the processing activities on this list — are carried out by those third-party SDKs / services, each operating under its own privacy policy and handling data only to the extent its function requires.
Beyond that, information changes hands only in these situations:
(1) you have separately consented to, or expressly authorised, a specific transfer; (2) the transfer cannot be avoided operationally — SMS delivery or hosted storage, for instance — in which case the scope is cut to the minimum and the recipient is bound by confidentiality obligations no weaker than our own; (3) a court, prosecutor or regulator requests it under due legal process, or a statutory provision itself compels disclosure; (4) the personal safety of you or another person is under an actual threat and sharing is the only workable response; (5) a merger, acquisition or transfer of assets occurs, in which case data travels with the relevant business and the successor must maintain protection no weaker than the standard set here.
Account and operational data reside on cloud servers. Cross-border transfers occur only where the purposes of the service require them, and are arranged in accordance with applicable law. Protection is arranged in four layers, none of which is left to carry the whole load alone:
(1) In transit — TLS encryption is enforced end to end between client and server, leaving little room for interception or silent alteration; (2) At rest — identifier fields such as email addresses are stored under AES-256 encryption, with keys held separately rather than alongside the business data; (3) On access — permissions are split by job role (RBAC), so that what any individual member of staff can reach is narrowed to the minimum their duties require; (4) On review — sensitive operations are all logged, logs are sampled weekly, and anomalous access raises an alert that goes straight to human review.
Three supporting practices sit behind those four layers: a security self-assessment every six months and an external penetration test once a year; personal data protection training for all staff on a quarterly cycle; and a dedicated incident response plan for data breach or privilege abuse, which proceeds through containment, mitigation and notification, with affected users and regulators informed as the law requires.
Only for as long as the purposes of the service require. To make that estimable, the retention pattern for each category runs roughly as follows:
When a period runs out, or the law no longer requires retention, the data is removed, made anonymous or stripped of identifiers. A statute setting a longer term for a given category displaces the default, and that data is cleared or anonymised once the statutory term lapses.
Five rights, available at any time, exercisable without giving reasons and without affecting your continued use of the service:
Two channels are open for exercising them: the privacy settings inside the app, or an email to service@citydate-chat.com. Once identity is verified, we respond and act within a reasonable period.
No. The application serves adults aged 18 and over only and is not directed at minors. Date of birth is mandatory at registration, and any application showing an age below 18 is stopped at the point of submission.
We do not knowingly collect personal information from children. If such information nonetheless enters our systems — through a misstated age, fraudulent registration, or some circumstance we failed to anticipate — it is deleted once confirmed, and the associated account is restricted from further use of the application.
The full set of child protection arrangements, covering verification methods, reporting channels and handling rules, is set out in the CityDate Child Safety Standards, which parents, guardians and regulators are welcome to consult.
Yes. Product changes, shifts in the service model, or developments in law and regulatory expectations will each prompt a revision. New versions are published in the in-app notice area and on the official website, with the date at the top refreshed at the same time.
Where a revision touches rights that matter to you, notice will be given before it takes effect — by pop-up, in-app message, or another means prominent enough to be noticed. Where genuinely necessary, your consent will be sought afresh.
Questions, comments or complaints about this Policy, our processing practices, or the exercise of your rights may be sent through the channels below. We answer within a reasonable period:
App Name: CityDate
Developer Name: Filandou
Legal Entity: KENNETH RYAN-CODY OVERSTREET
Registered Address: 2022 Sherry's Ln Perkins - 30442-8516, United States (US)
Support Email: service@citydate-chat.com