Privacy Policy for Hiylora
Last Updated: November 14, 2026 · Effective Date: November 14, 2026
Applicable Domains: https://hiylora-dating.vercel.app · https://hiylora.vercel.app · Package ID: com.hiylora.dating
1. Overview & Data Controller Identity
Welcome to Hiylora ("Hiylora", "we", "our", or "us"). Hiylora is a modern dating platform designed to foster authentic relationships, genuine intentions, and verified human connections.
This Privacy Policy governs the manner in which Hiylora collects, uses, maintains, and discloses information collected from users (each, a "User") of the Hiylora mobile applications (Android/iOS package: com.hiylora.dating) and web services hosted at https://hiylora-dating.vercel.app and https://hiylora.vercel.app.
Data Controller & Developer: Hiylora Engineering Team
Primary Support & Contact Email: adhfatheha@gmail.com / support@hiylora.com
Primary Web Portal: https://hiylora-dating.vercel.app
2. Google API Services User Data Policy Compliance & Limited Use Disclosure
Hiylora integrates Google Cloud APIs and Firebase Services (including Firebase Authentication, Firebase Phone OTP, and Firebase Cloud Messaging).
Hiylora's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Scope of Google Data Accessed: When you use Firebase Authentication or Google Sign-In, we collect only your authenticated identifier (UID), verified phone number, or primary email address strictly to authenticate your account session and prevent spam bots.
- No Transfer for Advertising: We do not transfer, disclose, or sell Google user data or Firebase user data to third parties, data brokers, advertising platforms, or information resellers.
- No AI Model Training: We do not use Google or Firebase user data to train, retrain, or fine-tune generalized machine learning or artificial intelligence models.
- Internal Operations Only: Humans are not permitted to read your personal Google data unless you provide explicit consent for technical support, it is necessary for security investigations (such as preventing account hijacking), or it is required to satisfy applicable statutory law.
3. Types of Data We Collect
We collect information you provide directly to us, information collected automatically during app usage, and information from third-party identity providers:
A. Account & Authentication Information
Your mobile phone number is collected to transmit a secure One-Time Password (OTP) via Firebase Authentication. We use this to verify real human identity, eliminate automated bots, and secure your account. When utilizing Google Sign-In, we receive your Google ID and verified email.
B. Profile Data & Preferences
Information you voluntarily provide: display name, birthdate (used solely to verify 18+ eligibility and calculate integer age), gender identity, sexual orientation, relationship intentions (e.g., long-term love, intentional dating), lifestyle preferences, biography prompts, and uploaded photos.
C. Optional Biometric Selfie Verification
To receive a "Photo Verified" badge, you may opt into live selfie verification. A real-time camera capture is compared with your uploaded profile photos to confirm identity and eradicate catfish accounts. Biometric captures are encrypted with TLS 1.3, stored in isolated storage with Row Level Security, never sold, and deleted upon account termination or manual request.
D. Approximate Geographic Location
With your explicit device permission, we collect coarse GPS coordinates to compute approximate distance between you and nearby matches (e.g. "5 km away"). We never display your precise GPS coordinates, address, or street location to any other user.
E. Chat Messages & Discovery Interactions
Swipes (likes/passes), matches, and real-time private messages are encrypted in transit and stored securely in PostgreSQL to deliver the core dating and messaging functionality.
4. Purpose of Data Processing & Legal Grounds
We process your data strictly under the following lawful bases and purposes:
- Service Delivery: To authenticate your login session, generate your profile, and calculate compatibility with prospective matches.
- Safety & Trust: To detect, investigate, and ban catfish profiles, fraud, harassment, hate speech, and spam.
- Communication: To deliver real-time messages, match notifications, and critical account security alerts.
- Billing & Purchases: To process optional premium subscriptions through Google Play In-App Billing or Apple In-App Purchases.
- Legal Compliance: To satisfy statutory legal requests and enforce our Community Terms of Service.
5. Third-Party Service Providers & Subprocessors
We do NOT sell, rent, or monetize your personal information. We share data only with trusted infrastructure providers who maintain enterprise security certifications (SOC 2, ISO 27001):
Google Cloud & Firebase
Phone OTP SMS delivery, bot mitigation (App Check), and serverless backend execution.
Supabase (PostgreSQL & Storage)
Encrypted relational database, media file storage, and real-time WebSocket messaging.
Vercel Inc.
Global edge hosting and SSL termination for web applications and legal documentation.
Google Play / Apple Payments
Secure payment processing for optional subscription upgrades.
6. Data Retention & Mandatory Account Deletion Mechanism
We retain your personal data only as long as your account remains active. You possess the absolute right to delete your account and personal data at any time.
Step-by-Step Instructions to Delete Your Account:
Method 1 — In-App Self-Service (Instant):
Open the Hiylora mobile app → Tap Profile tab (bottom right) → Tap Settings (top right gear icon) → Scroll down to Danger Zone → Tap "Delete Account" → Confirm your registered phone OTP.
Method 2 — Direct Web or Email Request:
Email our data protection desk at adhfatheha@gmail.com or support@hiylora.com, or submit a request on our Support & Deletion Portal.
Purge Timeline: Once requested, our automated 5-stage deletion cascade permanently removes your profile, photos, biometric selfies, matches, likes, and chat logs across all active database tables and storage buckets within 30 days.
7. Technical & Organizational Security Safeguards
We implement comprehensive technical and organizational safeguards to protect your personal information:
- Encryption in Transit: All communications between mobile apps, web clients, and servers are encrypted using TLS 1.3 / HTTPS.
- Encryption at Rest: All stored database records and storage buckets are encrypted using AES-256 standards.
- Hardware Keystore Storage: Mobile session tokens reside in native Android Keystore and iOS Keychain via
expo-secure-store. - PostgreSQL Row Level Security (RLS): Database-level policies enforce that only authorized users can read or write their own private records.
8. Children's Privacy (Strict 18+ Prohibition)
Hiylora is strictly restricted to individuals who are 18 years of age or older. We do not knowingly solicit or collect data from anyone under the age of 18. If we become aware that an account belongs to a minor under 18, we immediately terminate the account and permanently purge all associated data.
9. Contact Information & Privacy Inquiries
For questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:
Application Name: Hiylora Dating App
Developer Contact Email: adhfatheha@gmail.com
User Support Email: support@hiylora.com
Official Homepage: https://hiylora-dating.vercel.app
Alternative Domain: https://hiylora.vercel.app