Privacy Policy

Last updated: October 6, 2026

1. Introduction

Salonat (“Salonat”, “we”, “us”, or “our”) provides a friends-first social and matchmaking platform: trusted people host private “salons,” introduce friends they know, explore matches through icebreakers and optional deeper flows, customize avatars and 3D salon spaces, decorate their space with Salon Coins, and communicate in-app. Salonat is not only a dating app—it combines social networking, introductions, user-generated content, avatar experiences, virtual goods, and messaging.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and what choices and legal rights you have — including rights that vary depending on whether you are in Egypt, the EU/UK, the United States, or elsewhere in the Middle East. It applies to the Salonat mobile application, our websites (including this marketing site), and related online services (collectively, the “Service”).

By using the Service, you acknowledge this policy. If you do not agree, do not use the Service. Our Terms of Use govern your use of Salonat and work together with this policy.

2. Information we collect

We collect information in the categories below. What we receive depends on how you use Salonat.

A. Information you provide

• Account and profile (matchmakers): email, password (stored as a secure hash, never in plain text), phone number (required at registration, confirmed by double entry), public handle (user_handle), display name and signup name, profile photos (typically at least one at signup), bio, birthdate (used to verify you are 18 or older — see Age restrictions), pronouns, gender, location text, occupation, education, interests, relationship and matching preferences, Instagram username (if you link it), and other profile fields you choose to complete.
• Avatar and appearance data: avatar model selection, colors, outfit choices, and optional custom avatar asset URLs you save.
• Salon and social graph data: people you add to your salon (“participants”) including their name, phone number, how you met them, descriptions and preferences you enter about them, avatar gender for salon display, and records of matches you create between participants.
• Consent and responses: when someone you invited responds (including via WhatsApp links), we store consent status and timestamps (for example consent_given_at) associated with that participant record.
• Messages and match activity: in-app icebreaker chat text, voice notes (recorded with your microphone permission and stored as audio files during icebreaker games and Daily Salon activities), game state, revealed profile information during matched flows, Mashroobat (“مشروبات”) session answers when you use that feature, and optional notes you send (for example a “salon knock” message to a public salon owner).
• 3D salon and room content: furniture placement, floor and wall styles, and related layout data for your salon space, which may be visible on your public salon page.
• Ratings and feedback: salon ratings you submit about other users (including star values and whether the rating is anonymous), subject to product rules (for example ratings among connected friends).
• Purchases (Salon Coins): if you buy Salon Coins or other virtual items, the purchase is made through the Apple App Store or Google Play billing system, not a payment form inside Salonat. We receive and store a purchase/transaction identifier, product ID, price tier, purchase timestamp, and a receipt or purchase token, which our server sends to Apple’s or Google’s servers to verify the purchase before crediting your account. We never receive or store your card number or full billing details — those are handled entirely by Apple or Google under their own privacy policies.
• Support and legal requests: information you send when you contact us (email content, reports, attachments).

B. Information collected automatically

• Device and app data: device type, operating system, app version, language/locale, and general diagnostic data needed to operate and secure the Service.
• Log and usage data: server logs (including IP address, request timestamps, and error information), API activity, and security-related events (for example rate limiting).
• Push notification tokens: if you allow notifications, we register a device push token (via Expo’s push service, which relays to Apple Push Notification service or Firebase Cloud Messaging depending on your device) so we can send you match, invite, and knock notifications when the app is backgrounded. You can disable this at any time in your device’s notification settings.
• Crash and product analytics (when enabled): in production and TestFlight builds, we use Sentry for crash reporting, and we may receive stack traces, device/OS context, session identifiers, and product funnel events (such as signup, salon opened, match created) and screen paths (for example which app screen was active). We configure Sentry not to receive email, phone numbers, passwords, chat text, or voice note content in analytics properties. After login, Sentry may receive an internal numeric user id and optional public handle to group crashes—not your legal name or email. Behavioral/funnel analytics (screen views, taps, feature usage) are also recorded to our own database for our internal Control Center dashboard; they are not sent to a third-party advertising or analytics network.
• Realtime connection metadata: when you use live features (Socket.io), we process connection and room membership data needed to deliver events (for example new chat messages) to the right session.
• Landing site analytics (this website): this marketing site does not use cookies or third-party trackers. It generates a random, non-persistent session identifier in your browser’s sessionStorage (cleared when you close the tab) and records page views, referring page, and campaign/UTM parameters to our own first-party analytics endpoint — not to Google Analytics, Meta Pixel, or any ad network.
• Approximate location: we do not run GPS or background location tracking. Profile location fields and distance preferences are information you type, not automatic location data, unless we introduce that separately and update this policy.

C. Information from your device contacts (invite flow)

On supported mobile platforms, you may use the system contact picker to choose one person at a time to invite. With your permission, the app reads the name and phone number of the contact you select and pre-fills the invite form. We do not upload or store your full address book on our servers. Only the name and phone you submit when creating a participant are sent to Salonat.

D. Information from other users about you

Other users may add information about you when they invite you to a salon or create a match involving you—for example your name, phone number, and descriptions they provide. If you already have a Salonat account linked to that phone, we may connect their participant record to your account and notify you in-app instead of sending a WhatsApp message where product rules allow.

Your responsibility: users who invite others should only add people they know, should provide accurate contact details, and should respect that person’s expectations and applicable law (including consent for outreach). If you believe someone added you without permission, contact us (see Contact).

E. Sensitive information

Some profile fields — including gender, pronouns, and relationship/matching preferences — may reveal or imply sensitive characteristics such as sexual orientation. Under the GDPR (Article 9), Egypt’s PDPL, and similar laws, this is treated as a special or sensitive category of data that requires a stronger legal basis to process. By choosing to enter these fields, you give us your explicit consent to process them for the purpose of operating matchmaking and profile features described in this policy. You are never required to fill in every profile field, and you can leave sensitive fields blank.

F. Information we do not collect (today)

• Card or bank details: Salon Coin purchases are billed entirely by Apple or Google; we never see or store your card number, expiry, or CVV.
• Generative AI chats: we do not offer a general-purpose AI companion that stores your conversations with a large language model provider today; see Automated systems.
• Background/continuous location: see “Approximate location” above.

3. How we use information

We use personal information to:

• create and authenticate accounts, verify you meet our 18+ age requirement, and maintain sessions;
• operate salons, participant lists, matching, icebreakers, Mashroobat, and related social features;
• display avatars, salon layouts, and public salon pages to the audiences described in this policy;
• send in-app and push notifications (matches, knocks, invites, and similar);
• send WhatsApp messages through Meta’s WhatsApp Business Platform when configured (for example salon invites, match notifications, and “ping” invites to join Salonat), and log message metadata in our database;
• verify and fulfil Salon Coin purchases by validating your receipt/purchase token with Apple or Google before crediting your account;
• link phone numbers to existing accounts to avoid duplicate outreach and deliver in-app notices;
• enforce consent and response flows for participants;
• provide realtime delivery of match and chat events;
• host, back up, and retrieve photos, voice notes, and 3D-related assets;
• improve reliability, performance, and security (including crash analytics);
• detect, investigate, and address abuse, fraud, and policy violations;
• comply with law and respond to lawful requests;
• communicate with you about the Service and support requests.

We may use aggregated or de-identified information that cannot reasonably identify you for analytics and product improvement.

4. Social visibility — who can see what

Salonat’s trust model depends on clear visibility rules. The following describes our current product behavior at a high level; specific screens may show additional context.

• Matchmakers (salon hosts): can see full participant names, phone numbers, descriptions, match status, and high-level progress on matches they created, as implemented in host tools.
• Participants without a full account: interact through secured links and limited flows; they do not receive the full matchmaker dashboard. Profile details revealed during icebreakers follow game and match rules.
• Matched pairs: can see each other’s icebreaker chat, voice notes, and progressively revealed information according to match state—not the entire salon roster’s private notes.
• Public salon visitors: anyone with your public handle can view your public salon page (3D room layout and related public profile elements we expose there). Visitors who are logged in may “knock” on your salon; you receive an in-app notification that can include their display name, handle, and optional note.
• Public search: limited public discovery features may expose handles and display-oriented fields—not your email or password.
• Identity reveal: some information stays anonymized or partial until match steps complete; when the product reveals identity (for example connected accounts or post-icebreaker profile views), that reveal is intentional within the flow—not a public directory of all users.

You control what you submit. Do not put sensitive information in bios, salon notes, or messages unless you intend to share it with the recipients who can access that part of the Service.

5. Messaging and communications

• In-app messages: chat and voice content in matches are stored so both sides can participate and so we can investigate abuse reports. You are responsible for what you send.
• WhatsApp: we send transactional messages through Meta’s WhatsApp Business Platform (Cloud API) to phone numbers you or your matchmaker supplied — for example when you are added to a salon, matched, or invited to join Salonat. These messages may include links with scoped tokens. Message templates, delivery status, and recipient phone numbers are logged in our whatsapp_message_logs table (and, for legacy messages, sms_logs). Meta processes this content on our behalf as described in its WhatsApp Business Data Processing Terms and Privacy Policy. Standard carrier data charges (not SMS charges) may apply to recipients who receive WhatsApp messages.
• Push notifications: we send push notifications through Expo’s push notification service, which relays to Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android). See Expo’s privacy policy.
• Email: we may send account-related or support email using Google Workspace/Gmail SMTP; today primary account identifiers include email for login, but not every account is required to have one.
• In-app notification feed: stored in our database and shown inside the app.

You can revoke device permissions (contacts, camera, photos, microphone, notifications) in your device settings; some features will stop working without them.

6. Automated systems (current and future)

Today: matching and introductions are driven by users and salon hosts, not by an opaque autonomous dating algorithm that decides your relationships without human involvement. We use software rules to enforce product logic (eligibility, consent, deduplication, rate limits).

Not yet implemented: large-language-model features, AI-generated profile copy, automated moderation classifiers, or paid recommendation engines. If we add them, we will update this policy to describe what data is processed, whether outputs are shown to you or others, and any third-party AI providers involved.

7. Sharing information

We do not sell or “share” your personal information for cross-context behavioral advertising, as those terms are defined under US state privacy laws, and we do not use your data to serve you targeted ads. We share information only as described below:

• Service providers (processors) that help us run Salonat, under contracts that require them to protect data and use it only for our instructions:
  • Neon (managed PostgreSQL database hosting) and Render (application/API hosting);
  • Amazon Web Services (S3) or Cloudflare R2 (object storage for photos, voice notes, and other files) and Cloudflare (CDN and, in aggregate, edge traffic analytics for our internal operations dashboard — not per-user profiling shared externally);
  • Redis/Valkey-compatible infrastructure for caching and realtime message delivery;
  • Meta Platforms, Inc. for WhatsApp messaging (see Messaging) and, if you choose to link your Instagram account, for the Instagram API used to verify and display your Instagram username;
  • Apple Inc. and Google LLC for verifying Salon Coin purchases (App Store Connect / Google Play Developer API) and, for Google, for relaying push notifications via Firebase Cloud Messaging;
  • Expo (push notification relay and app build infrastructure);
  • Sentry for crash and product analytics when enabled;
  • Google Workspace (Gmail SMTP) if we send you email.
• Other users, as described in Social visibility, according to salon, match, and public-page rules.
• Legal and safety: when we believe disclosure is required by law, to protect users and the public, or to enforce our Terms.
• Business transfers: if we merge, acquire, or sell assets, information may transfer subject to this policy or a successor notice.

Provider privacy practices also apply — for example Sentry’s privacy policy, WhatsApp’s privacy policy, Apple’s privacy policy, Google’s privacy policy, and Expo’s privacy policy.

8. User-generated content

Photos, text, voice notes, avatar customization, salon layouts, messages, and similar materials are user-generated content (“UGC”). You retain ownership of your UGC as between you and Salonat, but you grant us the rights described in our Terms — License so we can host and operate the Service.

We may—but are not obligated to—monitor UGC. We may remove content, restrict features, or suspend accounts when we believe content violates our Terms, creates risk, or is required by law.

9. Safety and moderation

We take harassment, impersonation, non-consensual sharing, and illegal content seriously. You may report concerns using the in-app Report/Block tools — on profiles and public salons, in salon chat and match chat, on knocks, and on Daily Salon answers and comments — or by emailing hello@salonat.co with details (screenshots, usernames, match ids). Consistent with Apple App Store Guideline 1.2 (safety / user-generated content), we aim to act on good-faith abuse reports promptly. EU users may also be entitled to notice-and-action mechanisms under the EU Digital Services Act as our EU user base grows.

We may preserve information related to safety investigations even after you delete content or close an account, as allowed by law.

10. Age restrictions

Salonat is intended for people 18 years of age or older (or the age of majority in your jurisdiction, if higher). This is enforced, not just stated: registration requires a birthdate, and both the app and our server calculate your age and reject registration if you are under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided data despite this, contact us and we will take appropriate steps to delete it where required.

Providing false age information violates our Terms.

11. Data retention

• We keep information while your account is active and as needed to provide the Service, comply with law, resolve disputes, and enforce agreements.
• Account deletion (current state): requesting deletion in the app or by email immediately deactivates your account — your profile and salon are hidden from other users and matchmaking is frozen. We are actively building automated, cascading erasure of associated participants, matches, messages, voice notes, and message logs across all systems. Until that ships, if you want that data permanently erased (rather than deactivated), email us at hello@salonat.co and we will manually erase or anonymize it, normally within 30 days, except information we must retain for legal, safety, security, or accounting purposes (for example moderation records or transaction records for Salon Coin purchases).
• WhatsApp/message logs and server logs are retained for operational and abuse-prevention purposes for a period consistent with our internal schedules (contact us for specifics if you need them for a rights request).
• Backups may retain deleted data for a limited time before being overwritten.
• Inactive accounts: we may deactivate or anonymize dormant accounts after notice where permitted by law.
• Moderation records may be kept longer to prevent repeat abuse.

12. Your rights and choices

Depending on where you live, you have rights over your personal information under local law. The rights are broadly similar across the laws below — access, correction, deletion, portability, objection, and the right to complain to a regulator — but the exact mechanics differ. This section is a summary, not legal advice; see our citations document reference for the underlying statutes.

Region-specific rights

🇪🇬 Egypt — Law No. 151 of 2020 on the Protection of Personal Data, and its Executive Regulations (Decree No. 816/2025), overseen by the Personal Data Protection Center (PDPC). You have the right to be informed of, access, review, correct, and request erasure of your personal data, to object to or withdraw consent for processing, and to lodge a complaint with the PDPC. Because you entered profile fields that may reveal sensitive characteristics (see Sensitive information), we rely on your explicit consent for that processing, which you can withdraw at any time by editing or deleting those fields or your account.

🇪🇺🇬🇧 EEA, UK — under the GDPR / UK GDPR, our legal bases include performance of our contract with you (running your account and salon), legitimate interests (security, fraud prevention, product analytics), consent (for sensitive profile fields and, where applicable, marketing), and legal obligation. You may access, correct, delete (“right to be forgotten”), restrict, or object to processing, receive a portable copy of your data, and complain to your national supervisory authority. Where we transfer personal data outside the EEA/UK (for example to US-based hosting or Meta), we rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses together with a transfer risk assessment.

🇺🇸 United States — several US states (including California under the CCPA/CPRA, and Colorado, Connecticut, Virginia, Texas, Oregon, and others under their own comprehensive privacy laws) give residents rights to know/access, correct, delete, and port their personal information, and to opt out of the sale or “sharing” of personal information and of certain automated-decision profiling. We do not sell or share personal information as those terms are defined by these laws. If you are a California resident and retain personal information with us for more than 12 months, you may request access to all of it. Salonat is not directed to children and does not knowingly collect data from anyone under 18 (see Age restrictions), so COPPA does not apply. WhatsApp messages we send are transactional, not marketing, but where any communication could be read as “marketing” under the TCPA, you can opt out at any time by replying to stop the conversation or contacting us — we do not require SMS/WhatsApp opt-in as a condition of using the Service beyond what is necessary to operate salon invites and match notifications.

🌍 Middle East (outside Egypt) — if you access Salonat from the UAE, we aim to honor the rights set out in UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (access, correction, erasure, objection, and restriction, and the right to complain to the UAE Data Office). If you access Salonat from Saudi Arabia, we aim to honor the rights set out in the Saudi Personal Data Protection Law (as amended, regulated by the Saudi Data & Artificial Intelligence Authority — SDAIA), including access, correction, and deletion rights. Other Gulf and Levant countries have their own, broadly similar frameworks; contact us if you need a country-specific summary.

What this looks like in the app today

Self-service: authenticated matchmakers can download a profile JSON export via GET /api/auth/me/data-export. Today this covers your matchmaker profile fields only — participants, matches, messages, and voice notes are not yet included. If you want a full export, email us at hello@salonat.co and we will compile one manually, normally within 30 days. Automated full export and automated cascading deletion are in progress — this policy will be updated when they ship.

To exercise any of the rights above, email hello@salonat.co from the address or account tied to your profile. We may verify your identity before responding, and we will respond within the timeframe required by the law that applies to you (for example, without undue delay and within one month under the GDPR, extendable by two further months for complex requests).

13. Security

We implement commercially reasonable administrative, technical, and organizational safeguards (for example password hashing, HTTPS in production for API and WhatsApp links, upload type checks for images, JWT authentication, and access controls on matchmaker data). We never store your payment card details — Salon Coin purchases are billed and secured entirely by Apple and Google. No system is perfectly secure; we cannot guarantee that unauthorized access, loss, or alteration will never occur.

14. International users and cross-border transfers

Salonat is operated from Egypt. Our infrastructure providers (database, storage, hosting, CDN, messaging, and analytics — see Sharing information) may process and store data outside Egypt, including in the United States and the European Union. If you access the Service from outside those regions, your information will be transferred to, stored in, and processed in countries that may have different data protection laws than your own.

Egypt: under the PDPL and its Executive Regulations, transferring personal data outside Egypt requires either the data subject’s consent, an adequacy finding, or a license/permit from — or contractual safeguards approved by — the Personal Data Protection Center. We are working through this licensing process ahead of the law’s 31 October 2026 enforcement deadline.

EEA/UK: our legal bases may include contract performance, legitimate interests (security, analytics, fraud prevention), and consent where applicable, and we use the safeguards described in Region-specific rights for transfers outside the EEA/UK. Contact us for a jurisdiction-specific summary if needed.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the “Last updated” date. If changes are material, we will provide additional notice as required (for example in-app notice or email).

16. Legal references

A companion document listing the specific statutes, regulations, and official sources this policy was aligned against (Egypt, EU/UK, US, and Middle East data protection and platform law) is available on request at hello@salonat.co.

17. Contact

Privacy questions and rights requests: hello@salonat.co

General support uses the same address unless we publish a dedicated support channel on salonat.app.