Privacy Policy
Last updated: 30 October 2026
What's changing. From 9 November 2026, to keep OneMessage safe, our small team may read messages: first messages, and chats when someone is reported or an account looks like spam, a scam, a fake or an underage user. See "Reviewing messages" in section 3.
This policy explains what personal data the OneMessage app ("OneMessage", "we", "us") collects, why, who we share it with, and the choices and rights you have.
1. Who is responsible for your data
The controller of your personal data is Andreas Chouliaras, 28is Oktovriou 43, 45333 Ioannina, Greece.
For any privacy question or request, email privacy@getonemessage.com.
2. What we collect
| Data | Details |
|---|---|
| Mobile number | Used to sign you in with one-time SMS codes, and so that each person has only one account and banned users can't return. It is never shown to other users, and we don't use it to contact you. We don't use passwords. |
| Email address | Only for accounts created before we switched to mobile numbers: used to sign in with one-time codes. If you turn on email notifications, the address you give us, used only to tell you about new messages. You can remove it at any time in Profile > Notifications. |
| Profile | First name, date of birth (to confirm you are 18+ and show your age), gender, the genders you want to see, bio, photos, interests and, if you add them, your favourite artists and bands. Other users see your name, age, bio, photos, interests and favourite artists. |
| Preferences | The age range and maximum distance you choose on Discover. |
| Approximate location | With your permission, your phone's approximate location. Your phone rounds it to about 2 km before sending it to us, so your precise location never leaves your device. Other users never see your location, only a rounded distance such as "3 km away". |
| Travel mode (Plus) | If you use travel mode: the town you choose. Others see "Visiting [town]". Removed when you turn travel mode off, after 30 days, or when you delete your account. |
| Profile views | When you look through someone's photos on Discover (move past their first photo or open one full screen) or open their profile, who you viewed and when. Not recorded if you have Plus and use incognito. |
| When you were last online | While the app is open, the time you last used it (updated about once a minute). Our team can see it and is notified when members open the app, to understand how the service is used. |
| Messages | Your one message to each person, whether it was accepted, declined or expired, and your chat messages and photos after acceptance. |
| Safety | People you block, and reports you make about other users, including the reason you give. |
| Device | Whether you use iOS, Android or the web app (in a browser), the app version, and your device's language and time zone, recorded once when you create your profile. If you answer it, how you heard about OneMessage (for example Instagram or a friend), which only our team sees. If you delete your account and tell us why, we keep that answer without anything that identifies you (only the answer, the date and how long the account existed). Whether the app could get your approximate location (for example, that location permission was blocked), so we can help fix problems; never the location itself. Whether notifications are turned on for you (for example, blocked in your phone settings) and where in the app you turned them on, so we can make sure people hear about their messages. If you allow notifications, a push notification token (in a browser, a push subscription address and keys). |
Sensitive information. The genders you choose to see may reveal your sexual orientation, which the law treats as a special category of data. We only process it with your explicit consent, which you give when you set up your profile, and only to show you relevant people. You can change it at any time in the app, or withdraw consent by deleting your account.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account, showing your profile, matching you with people nearby, and delivering messages and chats | Performance of our contract with you (the Terms of Use) |
| Using your approximate location | Your consent, given through your phone's location permission. You can withdraw it in your phone settings. |
| Using the genders you want to see | Your explicit consent (see above) |
| Sending push notifications | Your consent, given through your phone's notification permission |
| Keeping the service safe: enforcing the one-message rule, daily limits, blocking, reviewing reports, and preventing abuse, fraud and underage use | Our legitimate interest in running a safe service, and our legal obligations |
| Reviewing messages (from 9 November 2026): our small team may read first messages to spot spam, scams, harassment, fake and underage accounts. We read chats only when someone is reported, or when an account shows signs of abuse, for example sending the same message to many people. We don't read chats for any other reason, and the text of messages is never shown in our team's app or alerts. | Our legitimate interest in keeping users safe and preventing abuse |
| Telling our small team about each new member and each new Plus subscription (profile details except the genders you want to see, email, mobile number, approximate town, device and plan), so we can keep an eye on growth and spot fake or underage accounts early | Our legitimate interest in running and protecting the service |
| Emailing you about new messages, accepted messages and replies, if you turn this on (never the text of messages) | Your consent, which you can withdraw in Profile > Notifications |
| Sending sign-in codes and essential service emails | Performance of our contract with you |
| Counting visits to the web app (pages viewed, browser, country and loading speed) with Cloudflare Web Analytics, which uses no cookies and does not identify you, so we can see how the web app is used | Our legitimate interest in understanding and improving the service |
| Measuring whether our Google ads work: only if you accept cookies on our Greek home page, Google stores an advertising cookie and we record that you came from an ad, the page you visited and whether you tapped a button to get the app | Your consent, which you can withdraw with "Ρυθμίσεις cookies" (cookie settings) at the bottom of that page |
We do not sell your personal data, show you third-party advertising, or use your data to train AI models.
4. Who we share it with
Other users see your profile (name, age, bio, photos, interests, favourite artists) and a rounded distance. Members with OneMessage Plus can see who looked through their photos or opened their profile (others only see how many people did), unless the viewer uses incognito. They can also see roughly when you were last online (now, today, this week or longer ago, never an exact time), unless you turn off "Show when I'm online" in Profile or use incognito with Plus. People you message see your message. People you chat with see your chat messages and the photos you send them.
Service providers process data on our behalf, under contracts that require them to protect it:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, photo storage | United Kingdom (London) |
| Stripe | Taking card payments for OneMessage Plus bought in the web app (card details, billing country, payment history) | European Union (Ireland), with the provider based in the United States |
| RevenueCat | Managing OneMessage Plus subscriptions (which plan you have and until when). Payments themselves are handled by Apple, Google or, in the web app, Stripe; we never see your card details. | United States |
| Anthropic | Automatically checking each photo you upload before it can be shown on your profile or sent in a chat (photos that break our rules are deleted straight away), and giving tips on your message draft when you, as a Plus member, ask for them. We don't keep the drafts. Anthropic doesn't use this data to train its AI models. | United States |
| Twilio | Sending the SMS code that verifies your mobile number | United States |
| Resend | Sending sign-in code emails (older email accounts), message notification emails if you turn them on, and safety reports and new-member notices to our team | European Union (Ireland), with the provider based in the United States |
| Google (Gmail) | Our team's inbox, which receives the new-member and new-subscription notices | United States |
| Google (Google Ads) | Measuring our ads, only if you accept cookies on our Greek home page (advertising cookie, ad click identifier, IP address, the page you visited and the buttons you tapped there) | United States |
| Expo (650 Industries) | Relaying push notifications to your phone | United States |
| Google (Firebase Cloud Messaging) | Delivering notifications to Android phones, and to Chrome and other Chromium browsers if you turn on notifications in the web app | United States |
| Apple (Push Notification service) | Delivering notifications to iPhones, including the web app added to your Home Screen, and to Safari on Mac | United States |
| Cloudflare | Hosting our website and the web app, and anonymous visit counts for the web app (no cookies, no profile details) | Global network, with the provider based in the United States |
| Mozilla and Microsoft | Delivering notifications in Firefox or Edge, only if you turn on notifications in the web app there | United States |
MusicBrainz. When you search for favourite artists, your phone or browser sends what you type directly to MusicBrainz, a free music catalogue run by the MetaBrainz Foundation (United States), and they see your IP address. Our server looks up the artists you save there by their catalogue ID. No name, account or profile details are sent.
Notifications only contain a person's first name and a short line such as "New message" or "📷 Photo". They never include message text or photos.
Where data is transferred outside the European Economic Area, we rely on an adequacy decision (for example for the United Kingdom, or for US companies certified under the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.
Law enforcement. We never give one user's contact details to another user. We only disclose data to authorities when legally required, for example in response to a valid request from the police or a prosecutor, or when necessary to protect someone's life or safety. We check each request before responding.
5. How long we keep it
- We keep your data for as long as you have an account.
- A message request that hasn't been answered expires after 14 days.
- Profile views are kept while both accounts exist and deleted when either account is deleted.
- When you were last online is kept while your account exists, only the latest time and the one before it, and deleted with your account.
- We keep a record of the notifications we send you (the title and short line shown, never message text) for 90 days.
- When you delete your account, we immediately delete your profile, photos, location, message requests, blocks and the reports you made. Copies in encrypted backups are overwritten within 30 days.
- Chats after deletion. The people you chatted with keep their copy of the chat, marked as a deleted account, and no one can reply in it. It disappears from the app when they delete their account too.
- Safety record. To protect users and to help with legal claims (for example if someone reports a crime after meeting through OneMessage), we keep a minimal record of a deleted account for 12 months: email address, mobile number, first name, date of birth, and when the account was created and deleted. It is locked away, used for nothing else, and deleted automatically after 12 months.
- Locked copy of chats. To help if someone reports a crime after a deleted account contacted them, we keep a locked copy of a deleted account's first messages and chats (who wrote what, and when, including photos sent in chats) for 12 months. It is used for nothing else, only reviewed for a safety report or a valid legal request, and deleted automatically after 12 months.
- Returning with the same number. So that deleting and re-creating an account can't be used to message people again or to escape a block, we keep a one-way fingerprint of the mobile numbers involved in each first message and each block (not the numbers themselves, and it can't be turned back into a number). These fingerprints are deleted after 2 years without use.
- Reports. When you report someone, we save a copy of your conversation with them (their first message and your chat, including photos) together with the report, so we can review it even if either of you deletes your account. It is deleted 12 months after the report is resolved.
- If we must keep specific data to meet a legal obligation, or to deal with a serious safety report, we keep only what is needed, only as long as needed.
6. Your rights
Depending on where you live, including under the EU and UK GDPR, you have the right to access your data, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent at any time (this doesn't affect processing that happened before). You can edit your profile and delete your account directly in the app. For anything else, email privacy@getonemessage.com. We reply within one month.
You also have the right to complain to a data protection authority, for example the Hellenic Data Protection Authority (dpa.gr) in Greece, or the authority where you live.
7. Age requirement
OneMessage is only for adults aged 18 and over. We ask for your date of birth at sign-up and don't allow younger users. If we learn that a user is under 18, we delete their account. You can report a suspected underage user in the app or at hello@getonemessage.com. See our Child Safety Standards.
8. Security
Data is encrypted in transit. Access is restricted by database security rules, so users can only read what they are allowed to see. Our small team can read messages only as described under "Reviewing messages" in section 3. Your precise location never leaves your phone. No system is perfectly secure, though, so please don't share anything in chats that you wouldn't want someone else to see.
9. Changes
If we make important changes to this policy, we'll tell you in the app or by email before they take effect.