1. Data Controller

The data controller responsible for processing your personal data is:

As a data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring such processing complies with applicable data protection law, including GDPR 2016/679 and LO 3/2018 LOPDGDD.

2. Personal Data We Collect

2.1 Data you provide directly

• Account data — email address, password (hashed with bcrypt via Firebase Auth; never stored in plaintext), and date of birth.
• Profile data — display name, city, biography, profile photos, height, body type, life situation, education, and the optional contact fields you choose to fill in (Instagram handle, WhatsApp number).
• Application data — information submitted when requesting membership, including name, age, and Instagram handle provided for review purposes.
• Communications — messages, images, audio recordings, and location data shared through in-app chats. All messages are encrypted at rest using AES-256-CBC. Chat content is not accessed by Troy Circle staff except when required to investigate a safety or abuse report.
• Invitations — email addresses you enter when inviting someone to join the platform.
• Reports — content and context you provide when reporting another user.

2.2 Data collected automatically

• Usage data — number of profiles viewed per day, stored solely to enforce daily discovery limits. We do not build behavioural advertising profiles.
• Push notification token (FCM) — stored in a private, access-controlled subcollection within your account record, invisible to other users.
• Last active timestamp — the time you last opened or brought the app to the foreground. Displayed as an online indicator, controlled by your privacy settings.
• Profile view log — a record of which users have viewed your profile (for premium members who choose to enable this feature).
• Location data — approximate GPS coordinates, collected only when you explicitly share your location in a chat message or activate Travel Mode. We do not track your location in the background.
• Device information — operating system type and version, app version, collected for crash reporting and compatibility purposes.

2.3 Data received from third parties

• Google Sign-In — if you authenticate via Google, we receive your verified email address and display name from Google LLC. We do not receive your Google password, search history, or any other Google account data.

3. Special Category Data

The following fields are classified as special category data and are subject to heightened protection:

• Sexual orientation — implied by membership of a platform for adult networking. Governed by GDPR Art. 9(2)(a) — explicit consent.
• HIV status — an optional field you may choose to share on your profile. Classified as health data under GDPR Art. 9(1). Processed only with explicit consent (opt-in toggle within the app). Visible only to other users who have also opted in to sharing intimate details.
• Body type — may be considered health-adjacent data. Treated with the same heightened protection as other special category data.
• Sexual behaviour indicators (position, tribe) — optional fields processed only when you explicitly enable the "intimate details" toggle. Treated as sensitive personal data.

You may withdraw consent for special category data at any time by disabling the "Show intimate details" toggle in your profile settings or by deleting the relevant field from your profile. Withdrawal does not affect the lawfulness of prior processing.

Special category data is never used for advertising, shared with third-party data brokers, or disclosed to any party except as strictly required by law.

4. Legal Basis for Processing

We process your personal data only where we have a valid legal basis under GDPR Art. 6 and, where applicable, GDPR Art. 9. The table below sets out the legal basis for each category of processing.

Where processing is based on legitimate interests (Art. 6(1)(f)), we have conducted a balancing test and determined that our interests do not override your fundamental rights and freedoms. You may request a copy of our legitimate interests assessment by contacting us.

5. How We Use Your Data

We use your personal data solely for the purposes listed below. We do not use your data for automated individual decision-making that produces legal or similarly significant effects without human review.

• Creating, maintaining, and managing your account and profile.
• Reviewing your membership application and communicating the outcome by email.
• Displaying your profile to other approved members in the discovery feed, subject to your visibility settings.
• Facilitating connections, messaging, and interactions between members.
• Delivering transactional emails (verification, application status, invitation notifications, approvals) via Resend.
• Delivering push notifications for messages, connections, and platform activity.
• Computing and displaying your Moral Score based on anonymous peer ratings.
• Processing Troy Circle Premium subscriptions and verifying in-app purchases via Google Play.
• Enforcing community standards, investigating abuse reports, and taking enforcement action.
• Complying with legal obligations, including mandatory CSAM reporting obligations.
• Improving the platform through anonymised, aggregated analytics that cannot be linked back to individual users.

We will never use your data for: advertising by third parties, sale to data brokers, training of third-party AI models, or any purpose incompatible with the purposes listed above.

6. Data Processors and Third-Party Sharing

We do not sell your personal data. We engage the following third-party processors under written data processing agreements (DPAs) that restrict their use of your data to the provision of services to Troy Circle only:

We also share your data in the following circumstances:

• Other members — your profile (name, age, city, photos, bio, Moral Score, online status) is visible to other approved members. Intimate details (HIV status, position, tribe) are only visible when both you and the viewer have opted in. Contact details (Instagram, WhatsApp) are only visible after a mutual connection is established.
• Law enforcement and regulatory authorities — we may disclose data when required by law, court order, or where necessary to protect the safety of users or the public, including mandatory CSAM reporting obligations (see our Child Safety Policy).
• Business transfer — in the event of a merger, acquisition, or asset sale, your data may be transferred to the acquiring entity. We will notify you at least 30 days in advance and you will have the right to delete your account before any transfer occurs.

7. International Data Transfers

Some of our processors (Firebase/Google, Resend) are headquartered in the United States, which is a third country outside the European Economic Area (EEA) for the purposes of GDPR Chapter V.

We ensure that all transfers of personal data to the United States are protected by appropriate safeguards, specifically:

• Standard Contractual Clauses (SCCs) adopted by the European Commission under GDPR Art. 46(2)(c), incorporated into our DPAs with Google LLC and Resend Inc.
• Google's EU Data Boundary — where applicable, we configure Firebase services to store and process data within the European Union.

You may request a copy of the relevant SCCs by contacting us at hello@troycircle.app.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law.

Upon account deletion, your profile is immediately set to invisible across the platform. Physical deletion of all linked personal data occurs within 30 days.

9. Your Rights Under GDPR and LOPDGDD

As a data subject in the EEA (or Spain specifically), you have the following rights under GDPR Art. 15–22 and LO 3/2018 LOPDGDD:

• Right of access (Art. 15) — request a copy of all personal data we hold about you, including a description of purposes, categories, recipients, and retention periods.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data at any time directly from your profile settings or by contacting us.
• Right to erasure / "right to be forgotten" (Art. 17) — request deletion of your data. You may also delete your account at any time via Settings → Account → Delete account. Erasure may be limited where we are required to retain data by law (e.g. financial records, safety investigation records).
• Right to restriction of processing (Art. 18) — request that we limit processing of your data while a complaint or dispute is resolved.
• Right to data portability (Art. 20) — receive your personal data in a structured, commonly used, machine-readable format (JSON) and transmit it to another controller.
• Right to object (Art. 21) — object to processing based on legitimate interests at any time. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Rights related to automated decision-making (Art. 22) — Troy Circle does not make fully automated decisions with legal or similarly significant effects. The Moral Score is computed algorithmically but does not result in automatic account termination.
• Right to withdraw consent — where processing is based on consent (e.g. intimate profile fields, push notifications), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint — if you believe we have violated your data protection rights, you have the right to lodge a complaint with the competent supervisory authority: the Agencia Española de Protección de Datos (AEPD) at aepd.es, or the supervisory authority in your country of residence.

To exercise any of these rights, contact us at hello@troycircle.app with subject line DATA RIGHTS REQUEST and proof of identity. We will respond within 30 calendar days as required by GDPR Art. 12(3). Complex requests may be extended by an additional 60 days with notice.

10. Security Measures

We implement technical and organisational security measures appropriate to the risk, in accordance with GDPR Art. 32:

• AES-256-CBC encryption — all chat messages are encrypted at rest. Encryption keys are stored in Google Cloud Secret Manager, inaccessible to the application layer.
• Firebase App Check — enforced on all Firebase services (Firestore, Storage, Authentication, Functions). Only verified, genuine app builds can make API calls.
• Firestore security rules — granular, server-side access control ensuring users can only read and write data within their authorised scope.
• Password hashing — all passwords are hashed by Firebase Authentication using bcrypt. We never store plaintext passwords.
• Private data subcollections — sensitive data such as push notification tokens is stored in access-restricted subcollections, invisible to other users or the app layer.
• Screenshot prevention — FLAG_SECURE (Android) prevents screenshots, screen recording, and app-switcher thumbnail exposure. iOS privacy overlay prevents content capture during app switching.
• Invite-only access model — there is no public sign-up. Every user is individually reviewed and approved, drastically reducing the attack surface.
• HTTPS / TLS — all data in transit is encrypted using TLS 1.2 or higher.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours of becoming aware of the breach, as required by GDPR Art. 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay (GDPR Art. 34).

11. Cookies & Tracking Technologies

The Troy Circle mobile application does not use cookies. Authentication state is managed via Firebase Auth's secure token system.

The troycircle.app website uses only strictly necessary session cookies required for navigation. We do not use:

• Advertising or targeting cookies.
• Third-party analytics scripts (no Google Analytics, no Meta Pixel).
• Social media tracking pixels.
• Cross-site tracking technologies of any kind.

As we use only strictly necessary cookies, a cookie consent banner is not required under ePrivacy Directive 2002/58/EC and LSSI Art. 22.

12. Contact & Supervisory Authority

For all privacy-related enquiries, data rights requests, or to report a concern:

If you are not satisfied with our response, or if you believe we are processing your data unlawfully, you have the right to lodge a complaint with the competent supervisory authority:

• Spain — Agencia Española de Protección de Datos (AEPD): aepd.es · Tel: 901 100 099
• EU (other countries) — the supervisory authority in your country of habitual residence or place of work.

This Privacy Policy may be updated from time to time. We will notify you of material changes by email or via an in-app notice at least 14 days before the changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

1. Eligibility

To use Troy Circle you must:

• Be at least 18 years of age. Access by minors is strictly prohibited under any circumstances.
• Have received and accepted a valid invitation or been approved through the standard application process.
• Not be prohibited from using online services under the laws of your jurisdiction.
• Not have previously been banned or permanently suspended from Troy Circle.
• Provide accurate, complete, and current information during registration and maintain it up to date.
• Use the service solely for lawful purposes and in compliance with these Terms.

We verify minimum age at registration (date of birth required) and reserve the right to request identity confirmation at any time. Accounts found to belong to minors will be permanently removed without notice, and may be reported to law enforcement in accordance with our Child Safety Policy.

By registering, you represent and warrant that all of the above eligibility conditions are met.

2. Community Conduct

Troy Circle is a curated community built on respect. The following conduct is strictly prohibited and will result in immediate and permanent account termination, and may result in referral to law enforcement:

• Harassment, intimidation, threats, bullying, or abuse of any member in any form.
• Creating a fake profile, impersonating another person, or misrepresenting your identity or age.
• Generating, sharing, soliciting, or distributing child sexual abuse material (CSAM) in any form.
• Sharing another member's private information, photos, or communications without their explicit consent (doxxing).
• Non-consensual sharing or threat to share intimate images (revenge pornography).
• Using the platform for commercial solicitation, spam, escort or sex work advertising, or pyramid schemes.
• Attempting to manipulate the Moral Score system or any rating mechanism through coordinated or fraudulent actions.
• Reverse-engineering, scraping, crawling, or otherwise attempting to extract data from Troy Circle by automated means.
• Attempting to circumvent security measures, authentication systems, or access controls.
• Transmitting malware, viruses, or any code designed to disrupt or damage our systems.
• Any conduct that violates applicable law, including Spanish criminal law, EU consumer law, or international human rights standards.

We encourage members to report misconduct using the in-app report function available on every profile and in every chat. All reports are reviewed personally by our team within 24 hours.

3. Your Content

You retain full ownership of all content you post on Troy Circle (photos, messages, biography text, and other user-generated material). By posting content you grant Troy Circle a limited, non-exclusive, royalty-free, worldwide licence to store, display, and transmit that content to other members solely as necessary to operate the service. This licence terminates automatically when you delete the content or your account.

You represent and warrant that:

• You own or have all necessary rights and licences to post the content.
• The content does not infringe any third party's intellectual property, privacy, personality, or other rights.
• The content is accurate and does not constitute defamation, fraud, or any other unlawful act.
• The content complies with these Terms, our Community Conduct rules, and all applicable law.
• Any persons depicted in photos you upload have consented to their inclusion.

Troy Circle does not claim any ownership over your content and will not use it for any purpose beyond operating the service.

4. Troy Circle Premium Subscription

4.1 Subscription plans

Troy Circle Premium is available as a monthly or annual subscription purchased through Google Play In-App Billing. Current prices are displayed in the app at the time of purchase. All prices include applicable VAT.

4.2 Billing and renewal

• Payment is charged to your Google Play account at confirmation of purchase.
• Subscriptions renew automatically at the end of each billing period unless cancelled at least 24 hours before the renewal date.
• Your Google Play account will be charged for renewal within 24 hours prior to the end of the current period.
• You can manage and cancel your subscription at any time via Google Play → Subscriptions.

4.3 Free trial and promotional Premium

• Troy Circle may offer a free trial period. If you do not cancel before the trial ends, your subscription will begin automatically.
• Premium status may also be awarded as a reward for successfully inviting new members who are approved. This reward-based Premium is non-transferable and has no cash value.

4.4 Refund policy

Refunds for in-app purchases are governed by Google Play's refund policy. Troy Circle may, at its discretion, issue refunds for exceptional circumstances. To request a refund from Troy Circle directly, contact hello@troycircle.app within 14 days of the charge. EU consumers have a 14-day right of withdrawal under Directive 2011/83/EU for digital services, subject to waiver upon commencement of the service.

4.5 Changes to Premium

We reserve the right to modify Premium features or pricing with at least 30 days' notice. Changes do not affect existing subscribers until their current billing period ends.

5. Intellectual Property

All intellectual property rights in the Troy Circle application, website, brand, design, trademarks, logos, and original content created by Troy Circle are the exclusive property of Borja de la Riva Ruiz / Troy Circle and are protected by Spanish intellectual property law (Real Decreto Legislativo 1/1996 LPI), EU trademark and design law, and international intellectual property conventions.

You are granted a limited, non-exclusive, non-transferable, revocable licence to use the Troy Circle application solely for personal, non-commercial purposes in accordance with these Terms. You may not:

• Copy, reproduce, distribute, or create derivative works of Troy Circle's proprietary content or code.
• Use Troy Circle's trademarks, logos, or brand identity without prior written consent.
• Remove or obscure any copyright, trademark, or other proprietary notices.

6. Service Availability and Disclaimer

Troy Circle is provided "as is" and "as available" without warranties of any kind, whether express or implied, including warranties of merchantability, fitness for a particular purpose, or non-infringement, to the fullest extent permitted by applicable law.

We do not warrant that:

• The service will be uninterrupted, error-free, or secure at all times.
• Profile information provided by other members is accurate, complete, or up to date.
• Any particular connection, interaction, or outcome will result from use of the service.

Troy Circle is a platform for connections between adults. We are not responsible for the behaviour, actions, or representations of other members, whether online or offline.

7. Account Suspension and Termination

By you: You may close your account at any time via Settings → Account → Delete account. Upon deletion your profile is immediately hidden, and your personal data is removed in accordance with our Privacy Policy.

By Troy Circle: We reserve the right to suspend or permanently terminate your account, with or without prior notice, if we determine that you have:

• Violated any provision of these Terms or our Community Conduct rules.
• Provided false information during registration.
• Engaged in conduct that poses a risk to the safety of other members or the integrity of the platform.
• Been subject to a final court order or regulatory decision requiring termination.

Upon termination by Troy Circle for cause, no refund of any unused Premium subscription will be issued. Troy Circle's decision to terminate an account is final and not subject to appeal, except where required by applicable consumer protection law.

8. Limitation of Liability

To the fullest extent permitted by Spanish law and applicable EU consumer protection regulations, Troy Circle's total liability for any claim arising out of or in connection with your use of the service shall not exceed the greater of: (a) the total amount paid by you to Troy Circle in the 12 months immediately preceding the event giving rise to the claim, or (b) €50.

Troy Circle shall not be liable for:

• Indirect, incidental, special, consequential, or punitive damages of any kind.
• Loss of data, profits, goodwill, or business opportunities.
• The acts or omissions of other members.
• Events outside our reasonable control (force majeure), including natural disasters, government actions, internet outages, or third-party service failures.

Nothing in these Terms excludes or limits our liability for: death or personal injury caused by our negligence; fraud or fraudulent misrepresentation; or any other liability that cannot be excluded or limited under applicable Spanish or EU law, including consumer protection rights under Real Decreto 1/2007 LGDCU and Directive 2019/770/EU.

9. Governing Law and Dispute Resolution

These Terms are governed by and construed in accordance with the laws of Spain, without regard to its conflict of law provisions.

Any disputes arising out of or in connection with these Terms or your use of Troy Circle shall be subject to the exclusive jurisdiction of the courts of Barcelona, Spain, except where applicable EU consumer protection law grants you the right to bring proceedings before the courts of your country of habitual residence.

EU consumers may also use the European Commission's Online Dispute Resolution platform at ec.europa.eu/consumers/odr to resolve disputes.

If any provision of these Terms is found to be invalid or unenforceable by a competent court, the remaining provisions shall continue in full force and effect (severability). These Terms, together with our Privacy Policy and Child Safety Policy, constitute the entire agreement between you and Troy Circle regarding your use of the service.

We reserve the right to modify these Terms at any time. We will notify you of material changes via email or in-app notice at least 14 days before they take effect. Continued use of the service after the effective date constitutes acceptance.

Troy Circle · Operated by Borja de la Riva Ruiz · Barcelona, Spain
hello@troycircle.app · troycircle.app