Privacy policy

The short version

Pidge holds your profile, your photos, and a small amount of information about how you use the app. Conversations are deleted 48 hours after you match. We do not sell your data, there is no advertising and no tracking anywhere in the app, and you can delete your account whenever you like. The rest of this page is the detail.

Who we are

Pidge is a dating app for students at the University of Cambridge, operated by Thomas Thomson. For anything on this page, including exercising your rights, write to admin@pidgeapp.com.

Your account and profile

Your name, date of birth, college, what you write about yourself, your gender, and the gender and age range you want to be shown. College is on that list because Pidge is a Cambridge app: it appears on your profile, and it drives the setting that keeps you out of the pigeonholes of people at your own college.

Your photos are held for as long as your account is active. Delete a photo and it is removed immediately; delete your account and every photo goes with it.

Every photo is checked automatically before it is stored. The image is sent to Google Cloud Vision, which rates it for explicit and graphic content and sends that rating straight back to us; nothing else about you goes with it, and no person reads it. A photo that fails the check is discarded rather than stored, and all we keep is the rating and the decision, so we can explain ourselves if you think we got it wrong. We do this to keep illegal and explicit material off Pidge, and because the app stores require it of us. The basis is our legitimate interest in keeping Pidge safe to use.

Signing in needs your Cambridge email address and a password, which is scrambled before it is stored so that nobody, including us, can read it. Each device you sign in on keeps a session, and attached to it are the IP address it connected from and an identifier for the device or browser.

We also record the time you last opened your daily pigeonholes, and whether you have Pidge Gold and the date it runs until. It is how we avoid putting people in front of each other when one of them has quietly stopped using Pidge. There is no history kept, only the most recent time.

All of it is held while your account is active and deleted when you delete your account, on the basis of our contract with you.

Your conversations

Chats are temporary by design. One opens when you match and closes 48 hours later, counted from the moment you matched rather than from when you first open it. Messages are then permanently deleted within 5 minutes, and we keep no chat history.

There are three exceptions. A snapshot is kept when a report is filed during an active chat. Material is kept where a legal duty or an open safety investigation requires it. And where we report an account to the National Crime Agency, the law requires us to keep what we relied on for a year, so the conversations that account had are copied at the moment we report - otherwise they would be gone within 48 hours. That copy can contain your messages if you were one of the people that account was talking to, even though the report is not about you. Where the law stops us from saying so, we may be unable to tell you it has happened.

Matching

We record who was put in your daily pigeonholes and whose profile you opened, for 90 days, then deleted. It is what stops the same people coming round again and again.

A pidge is kept for 30 days from when you made it. Taking one back still uses up one of that day’s limit. If you pidge someone, they may find out before you match: Gold members are shown who has pidged them, and everyone else is shown only how many people have, never who.

A match is deleted when the chat expires or either of you unmatches, which takes every message with it. We keep a separate note that two accounts matched and when it started and ended - no messages, no content - for 2 months after it ends, which is what stops the app showing you someone you have matched with, or walked away from, again. Blocks are kept until you unblock the person or either account is deleted.

These rest on our legitimate interest in fair matching, and in keeping apart people who have chosen to be apart.

Proving you are 18

Pidge is an 18+ service and the Online Safety Act requires us to keep under-18s off it, so everyone verifies their age with a photo ID document. The check is run by Didit: you submit your document to them and never to us, and the only thing they are configured to send back is your date of birth.

That date becomes the date of birth on your profile, replacing anything you entered yourself, and cannot be edited afterwards. This is what stops someone verifying as an adult and then presenting themselves as a teenager. We never receive or hold your document, the images of it, your name or your document number - those stay with Didit under their own privacy policy.

That you passed, and your date of birth, are kept for as long as your account exists. A record that the check took place is kept for 30 days and then deleted.

Notifications

When you first get into Pidge your phone asks whether to allow notifications. If you allow them, your phone gives us a token that identifies the device so a notification can reach it. There is no switch for this inside Pidge: your phone’s own settings are where you turn them off, and that is the only place, so the answer you gave the phone is always the answer that counts. It is held until you turn them off, sign out, or delete your account, and it is tied to whoever is signed in on that phone rather than to the phone itself.

We send three things and nothing else: that you have a new match, that someone has messaged you, and one warning when a chat has six hours left. A notification never contains a name, a photo, or anything either of you has written, because it appears on a lock screen anybody nearby can read. The message one says only that a message arrived, not who sent it or what it says; you have to open Pidge to find out.

Reports, safety and the law

When someone files a report we keep that it was filed, by whom, the reason and the date, for 12 months. The basis for that is our legitimate interest in keeping people on Pidge safe, and in some cases our duties under the Online Safety Act 2023. If it concerns a live chat we also keep a snapshot of that conversation. A snapshot holds both sides, so it contains your messages whether you filed the report or were the subject of one. Snapshots are kept for 12 months where the report concerns someone being under 18, 6 months for harassment or threats, 90 days for anything else, and 30 days if the report is dismissed.

Where we report suspected child sexual abuse material to the National Crime Agency, the law sets the periods and we cannot shorten them, including on request: the reference number for 5 years, and the content, what we submitted and the account data for 1 year.

We also record whether your account has been warned, put under review, suspended or banned. It is kept while your account exists and deleted with it, on the basis of our legitimate interest in keeping people safe.

Separately, we may have to preserve material and suspend the schedule above for it - after reporting to the NCA, on an Ofcom preservation notice, on a court or police order, or while a safety investigation is open. The first three are legal obligations; the last is our own legitimate interest and is reviewed on the shortest schedule of the four. We set a date to review each one so that none is left in place longer than it needs to be. This can apply after you delete your account, in which case what the duty covers is copied out and the rest of your account is deleted as normal.

Who can see your data

Your profile is visible to the people it is shown to in their daily pigeonholes. Chat messages are visible only to the two matched users. Reports and chat snapshots are accessible only to the app administrator, who can also see every profile on Pidge rather than only the ones a normal account is shown. Nobody, including the administrator, has any way to read your messages; the single exception is a snapshot captured inside a report.

We do not sell your data and we do not share it for advertising. A handful of companies handle it on our behalf, and these are the main ones. Supabase stores everything in EU data centres in Ireland. Didit runs the age check described above. Google Cloud rates each photo for explicit content before it is stored, also described above. An email provider sends the account emails, meaning the one confirming your address and the one resetting your password; it receives your email address and the contents of those messages, and nothing else about you. If you subscribe to Gold, the App Store or Google Play takes the payment and tells us only that a subscription is active and when it runs to, with a subscription service possibly in between that receives an identifier for your account and no payment details either. Expo delivers the notifications, if you have turned them on, and receives the device token and the wording of the message; from there your phone’s own notification service, Apple’s or Google’s depending on the phone, carries it the last step. And your phone checks for app updates the way any app does, which shows the update service your IP address, your platform and your app version.

Some of these companies are outside the UK. Where they are, the transfer is made under the safeguards UK GDPR requires, and we will name any provider on request.

Paying for Gold

You pay the App Store or Google Play, never us. We hold no payment data of any kind - no card number, no billing address, not even the name on the card - and we have no way to charge you even if we wanted to. All that reaches us is that a subscription is active and the date it runs to. Cancelling is done in the store rather than in Pidge, and the purchase record stays with the store, so deleting your Pidge account does not remove it from your store account.

Your rights

You have the right to see the personal data we hold about you, to correct it if it is wrong, to ask us to delete it, to object to anything we do on the basis of legitimate interests, to ask us to restrict what we do with it, and to receive it in a portable form. Write to admin@pidgeapp.com and a person will answer.

A few things we cannot delete on request, and they are named above: the periods set by law around a report to the National Crime Agency, and anything covered by a preservation requirement for as long as it lasts.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. You do not have to come to us first, though we would rather you did.

Account deletion

You can delete your account at any time from Settings, and it permanently and immediately deletes your profile, photos, selections, matches and messages.

Two things can outlive it. Reports survive, whether you were the person reported or the person who reported - and because a snapshot captures both sides of a conversation, your own messages can remain inside a report you filed. And where we are under a legal duty to preserve material, or while a safety investigation is open, what that covers is kept for the periods set out above while the rest of your account is deleted as normal. Where the law stops us from saying so, an ongoing criminal investigation being the clearest case, we may be unable to tell you that this has happened.

Cookies and tracking

There are none. We do not use cookies, and there is no third-party analytics or advertising anywhere in Pidge.

Changes to this policy

If we change this policy in a way that matters, we will tell you in the app and ask you to accept the new version. We keep a record of which version you accepted and when, and nothing else about it.

Contact

admin@pidgeapp.com

See also the Terms of Use, and the separate privacy notice for the waitlist at this website.