Version 2026-10-25
SMOLDR LLC, a Florida limited liability company, is the company that collects and holds everything described below.
The written route to SMOLDR about your own data:
SMOLDR LLC
c/o Northwest Registered Agent LLC
7901 4th St N Ste 300
St. Petersburg, FL 33702
Support inside the app stays the fastest route, and privacy@joinsmoldr.com reaches a team member.
SMOLDR is for adults, and a person under 18 may not create an account or use the app under any circumstances. This is the one rule with no exception and no appeal.
SMOLDR does not knowingly collect anything from anybody under 18. A birthdate is taken at signup and an account that does not reach 18 is refused. If SMOLDR learns that an account belongs to somebody under 18, a team member reads the report and the account is hidden or removed, and what was held about it is deleted.
Anybody can raise it, and no account is needed to do so. From inside the app it goes through Account, then Support. From outside, help@joinsmoldr.com reaches a team member, and joinsmoldr.com/report sets out the route. A parent or guardian who believes their child has an account should use either and does not need to prove anything first.
Phone number. It is how somebody signs in: SMOLDR texts a six-digit code to it. There is no password on a SMOLDR account and none is stored. The code is kept by the authentication provider only until it is used or expires ten minutes later.
Display name and bio: shown to other members
Birthdate: collected once at signup, never editable after. Only the calculated age is ever shown to others, never the raw date
Looking For preference: used for matching, never shown on a profile
Profile photos (up to 6)
Chat messages and any images sent in chat. Inside the app these are visible only to the two people in that match. They are stored in readable form, which means whoever administers SMOLDR's database can read them. That is set out in full under Admin access below.
Swipes (like/pass): never shown to the other person directly; drives matching and the Likes tab
Matches and blocks
Support requests and reports: category, free-text message, optional screenshot, optional reported-member id
Support messages sent by SMOLDR to a member, and any reply, are kept with the request they belong to.
A member can remove their own sent messages from the Support screen, and SMOLDR keeps its copy. Hiding a message takes it off their phone. It does not withdraw a report or stop SMOLDR acting on one.
Which of SMOLDR's own messages a member may delete outright depends on the message. Anything that is a live constraint on the account stays. Anything that exists for the member's convenience can go.
Bookkeeping timestamps that are not about anybody else: when setup was finished, and which of two people completed a match. Neither is shown to another member.
Deletion feedback: anonymous, collected with no member id attached at all
Membership level, end date, and Notes balance
Relationship status and relationship style, if a member fills them in. Both are optional, both can be cleared back to empty at any time, and both are shown on that member's card to anybody who can see the profile.
Gender and sexuality, if a member fills them in. Both are optional, both take a write-in rather than a fixed list, and both are shown on that member's card to anybody who can see the profile. They are also what the Gender and Sexuality filters read, so leaving either blank changes who a member appears to.
When the app was last opened. One timestamp, overwritten each time, so there is no history and no pattern, only the most recent time. Members on a paid plan see it on other people's cards, as a day rather than a time: Active today, Active yesterday, or a number of days. A clock time is never shown to anybody, and a free member is not sent the value at all. It also drives one filter, Recently Active, which lets a paying member leave out profiles nobody has opened in the last week.
Where the member is, read from their phone's GPS. What happens to it is set out in the four paragraphs below.
The position is rounded to about a third of a mile before it is written down, so what is stored is a neighborhood rather than an address. Only the latest one is kept: there is no location history, no record of anywhere a member has been, and nothing that could reconstruct a journey.
No other member is ever given a position. What they are shown is a distance in whole miles, worked out on the server and sent as a single number.
Location is read while the app is open and never in the background. It is used for one thing, which is deciding who appears in Discover and how far away they are. It is not used for advertising, it is not sold, and it does not leave SMOLDR.
A member who declines the location permission keeps their account, their matches and their messages. Only Discover stops working.
One number is recorded about attempts to fake a location: how many times the phone reported a position that the operating system had flagged as coming from a fake-GPS app. The faked position itself is discarded rather than stored.
Visibility preferences (Hidden, match-preference toggles)
Push notification device token, one per device. It identifies the phone, not the person, and it is re-pointed to whoever signs in on that device. Signing out deletes it.
A device code SMOLDR creates for your phone. The app makes up a short random code the first time you sign in and keeps it on that phone. It is not your phone's serial number, it is not tied to your name, and it is never shared with anyone. It exists so SMOLDR knows which phone is currently signed in, can sign out any other, and can tell the phone being signed out why it happened.
Notification preferences, one on/off switch for each of the six notification categories.
Crash reports. When the app hits an error it records what broke: the error message, a shortened copy of the technical trace, which screen it happened on, whether it closed the app, the app version and whether the phone runs Android or iOS. It is linked to the account it happened on, so a member who deletes their account is unlinked from it.
Nothing from a conversation is in a crash report. No message text, no profile text and no photo paths. It is stored in SMOLDR's own database and is not sent to any outside service.
None of the following is collected today:
Analytics inside the app: none. Nothing a member does in SMOLDR is measured or sent anywhere. The website is separate and is covered under Third parties.
Payment data: handled by the app store or payment processor, not stored by SMOLDR directly
Any signed-in member can see an approved, non-hidden profile: name, age, Looking For (behind the scenes only), bio, and photos.
Profile photos are private files. They are not public links and cannot be opened by someone who is not signed in. Every request is checked against the same rule that decides whether that member may see the profile at all, so hiding, blocking, suspension and an unapproved profile each cut off the photos as well as the profile. A member always keeps access to their own. The limit is real: this cannot reach a picture somebody already saved to their own device, and it cannot stop someone re-posting one elsewhere. What it prevents is a photo remaining fetchable by anyone holding a link, indefinitely, whether or not they use SMOLDR.
Incognito Mode, an Amplify feature, hides a member from everyone except people they have liked, people they have sent an Introduction to, and people they already matched with. It hides the whole profile including the photos, not just the card in Discover. Nothing extra is recorded while it is on: no log of who looked, no history of when it was switched, only the setting itself. It stops applying by itself if the membership lapses.
SMOLDR does not detect screenshots and does not attempt to block them. Nothing is recorded when someone takes one, and no notification is sent to anyone. Sharing another member's private photos is prohibited by the Terms instead.
An unapproved or hidden profile is visible only to its owner, plus anyone with an existing match.
The two members in a match can see their own conversation and any images sent in it. Nobody else can, including by guessing a direct link.
Blocking is not symmetrical. The person who blocked somebody can see that person's name on their block list. The blocked person cannot see the blocker's profile at all.
Reports are one-directional: a reported member is never told who reported them.
A new Like reveals only a timestamp, never a name, below the paid level that unlocks identities.
Messages are not end-to-end encrypted. They travel encrypted, they sit on encrypted disks, and the app shows a conversation only to the two people in it. SMOLDR's own database holds them in readable form, and whoever administers that database can read any message in the app.
What is promised instead is restraint. Conversations are not read as a matter of course, they are not read out of curiosity, and there is no routine, automated or bulk reading of anybody's messages. A reported conversation may be read when the report cannot be answered from what was submitted with it: only that conversation, only when it is needed, and only as a team member's decision rather than automatically.
Moderation has no way to browse conversations. Reviewing a report shows what was submitted with it, not a door into two people's chat history.
SMOLDR tells one member some things about another member's activity. A paid member sees when you were last active, shown as a day rather than a time. Read receipts are separate and are not sold: they are free at every level, off unless you turn them on, and they only work between two people who have BOTH turned them on. If either of you has them off, neither of you is told when the other read anything.
Member-initiated deletion is frictionless: type the word DELETE, with no confirmation gauntlet and no retention offers or discounts to stay. It deletes the account and everything tied to it: profile, photos, messages, chat images.
Messages, Notes and Second Looks are kept for 90 days after a conversation ends, whether it ended because an account was deleted, or because somebody unmatched or blocked. When an account is deleted the profile, the photos and the account itself go immediately. Either way the messages disappear from the app in the same instant, for everybody including the other person in the conversation, and are erased for good 90 days later. After that there is nothing left to give anybody.
They are kept so that a complaint, or a request from law enforcement, that arrives just after somebody leaves can still be answered.
It is not a recycle bin. The account cannot be recovered and neither can the conversation. Deletion stays immediate and final, and somebody who wants to come back builds a new account.
Who can still see them. Nobody using the app can, and that includes the other person in the conversation: no screen anywhere shows them. SMOLDR can, through the database. They are not browsed. They are opened when a specific complaint or a lawful request names a specific conversation, and after 90 days there is nothing there.
What a member can ask for, and how.
Delete the account: Account, then Delete Account, inside the app. No retention offers and nothing to argue with.
Delete the account without the app: joinsmoldr.com carries a deletion request route that needs no sign-in and no install.
A copy of the data: privacy@joinsmoldr.com. What is sent back is the profile, the photos, the messages sent, and the reports filed. Answered within 45 days.
A correction: most of it is editable on the profile itself. Anything that is not, including a date of birth entered wrongly at signup, goes to the same address.
A question about any of this goes to the same address, and it reaches a team member rather than a queue.
US state privacy rights.
The right to know what is held about you, and to get a copy.
The right to have it corrected.
The right to have it deleted.
The right not to be discriminated against for asking. Nothing about an account changes because somebody exercised one of these.
SMOLDR does not sell personal information, and will not. It is not shared for advertising of any kind. There is no advertising in SMOLDR, no advertising identifiers, and no data broker relationship.
Moderation decisions are made by a team member.
How to exercise any of them: privacy@joinsmoldr.com, or the deletion route already described. Answered within 45 days. Identity is confirmed through the account itself, and nobody is asked to send documents.
Dormant accounts are deleted after 24 months. If nobody uses it for two years the account and everything tied to it is removed, the same as a deletion the member asked for.
No warning is sent first. An account with an active paid membership is never deleted for inactivity.
No fraud fingerprint is kept for one of these. A member who deletes their own account leaves behind a scrambled fingerprint of their phone number, described further down. An account SMOLDR deleted for inactivity leaves none, and somebody who comes back after that arrives as a new member.
Ending a match, by unmatching or blocking, closes that conversation for both people at once and keeps the same 90 days. It disappears from both Matches lists immediately, neither person can open it, read it, or add anything to it ever again, and the messages and the photos in them are erased on day 91. A report carries a category, a few lines of text and one optional screenshot, never the conversation.
Deletion feedback survives deletion but is anonymous and cannot be linked back to anyone.
Signing out deletes that device's push notification token, so a member who signs out stops being reachable on that phone. Signing in on a shared or resold phone moves the token to the person now signed in, rather than leaving it pointed at the previous account.
A scrambled version of the phone number survives account deletion, irreversible and one-way.
Two permitted uses. One: knowing whether a signup is somebody returning or somebody new, which is what decides the free Notes a new account starts with, since a returning account does not get another set. Two: stopping somebody who was removed from signing straight back up, and flagging a minor's number on deletion for the same reason. It is never used to profile behavior, target advertising, or reconstruct a deleted account.
It cannot be reversed back into a phone number by anybody, including SMOLDR. A number somebody already has can be checked against it, which is the one thing it is used for.
Law enforcement, and where the line falls. If an agency names a number, SMOLDR can run it through the same process and say whether it matches: that number held an account, deleted on this date, this many times. If an agency asks for the numbers behind our records, there is nothing to hand over. A request about a current member is a different thing and is answered in full.
A removal does not expire, so the phone number tied to it is kept indefinitely. It is a narrow keep, the number and the fact of the removal, not the profile, which is deleted like any other. A self-deleted account keeps its number too, so somebody who leaves and comes back is not treated as new.
A report outlives the member who filed it, with their identity replaced by an irreversible reference so that distinct reporters can still be told apart. It outlives the member it is about in the same way, so deleting an account does not erase what was reported against it. A report is kept indefinitely. It is a safety record, and a pattern only shows up over time.
Chat images do not expire on their own. A photo lives as long as the match and there is no timer of any kind. There is no option to send one that disappears.
Deleted data survives in backups for a while. Deleting an account removes it from SMOLDR immediately, but the hosting provider takes its own automated backups and a deleted row sits inside those until the backup itself ages out. Nobody at SMOLDR reads a backup to find deleted data, and a backup is only ever restored to recover from a failure, never to look somebody up.
A member who deletes an account and immediately creates a new one is a new account to SMOLDR, not a restored one. Nothing is pulled back out of a backup.
Supabase is the database, authentication and file storage provider, and the primary data processor.
Expo builds the app and delivers its updates.
Twilio delivers the sign-in code by text. It is given the phone number and the code, and nothing else: no name, no profile, and no indication of whether the number belongs to an account.
Expo delivers push notifications. It receives each phone's push token and nothing about the member's messages.
Twilio Lookup checks a phone number's type at sign-up. It receives the phone number and nothing else.
Website analytics. joinsmoldr.com uses Cloudflare Web Analytics and PostHog to count visits and record how a page is used, including the pointer, scrolling and clicks. Neither sets a cookie, so the site carries no cookie banner. Nothing typed into a form is recorded, neither can identify a person, and both run on the website only, not in the app.
Zoho runs the mailboxes for the addresses SMOLDR publishes.
Planned: a payment processor.
Nobody can find out whether a particular phone number has a SMOLDR account. Entering a number sends a code to that number, and the screen says the same thing either way, because the only place the answer appears is on the phone that owns the number. Somebody testing an ex's number, or a colleague's, learns nothing and reads nothing.
Nobody can learn anything by entering someone else's number, but they can make that person's phone buzz. The Terms treat repeatedly triggering codes to somebody else's phone as harassment in its own right.
The screen says so before the button, not after. Anyone entering a number is told that a code is going to that number, in those words rather than “your phone”, while they can still change their mind.
The text message names SMOLDR and carries the code, nothing else. Receiving one without asking for it creates nothing: an account exists only once a code has been entered back into the app.
No push notification names anyone. Every notification reads that someone did something, never who. The only exception is a message from SMOLDR itself, which shows its own subject.
Every version carries a date, and the date is shown at the top of the document inside the app.
A change that matters brings up one screen the next time the app opens. It links to both documents and asks for a tap before going any further. Until that tap the app cannot be used. Nobody is signed out for it, nothing about an account or its matches changes, and the same screen carries a Delete Account button.
A change that does not matter brings up nothing. Fixing a typo or rewording a sentence for clarity does not move the date and does not interrupt anybody. The test is whether the change takes something away or adds an obligation. If it does, the date moves and everybody sees the screen.
What is recorded is which version a member accepted and the moment they accepted it. That is kept for as long as the account exists.