Privacy Policy

In short

• You don’t need an email address, a phone number, or a password to sign in.
• Your partner sees only the cards where you both answered “Yes” or “Maybe.” Your partner never sees your “Never” answers.
• We don’t sell data and we don’t show ads in the app. We advertise Cerise itself in Google, and if you turned statistics on, Google learns that you started using the app.
• Usage statistics, crash reports, and measurement of Cerise advertising run only if you turn them on.
• You can download your data and delete your account inside the app.

Who is responsible for the data

The data controller (the “operator” of the data) and the publisher of the app is Sergei Olegovich Afinogenov, sole proprietor (individual entrepreneur) registered in the Republic of Armenia, registration (tax) number 2408000572, address: Yerevan, Grigor and Sargis Gurzadyan str., 2, 0005. For any question about data, write to hello@cerise-app.com.

What your partner sees

There are three answers to a card: “Yes,” “Maybe,” and “Never.”

• A match appears when you both answered “Yes” or “Maybe,” in any combination. In a match, your partner sees which answer you gave.
• Your partner does not see your “Never” answers, your answers to cards without a match, or the list of topics you excluded. Access is blocked at the database level, not only in the interface.

But your partner can guess or find out some things:

• If there is no match, your partner may assume that you answered “Never” or haven’t answered yet: the order of the cards is shared by the two of you.
• If a heat level is on for your partner and off for you, your partner will see the “On for you only” label and will understand that this level is off for you.
• If you change your mind, the match disappears for both of you without a notification, but the match counter on the “Couple” screen goes down.
• If you decline a suggestion or a reward from your partner, it disappears from your partner’s “waiting for a reply” list.
• Your partner sees your name and gender, if you provided them. Anyone who has your active invite code can also see your name. Your partner sees the text of a reward that you wrote in your own words.
• If either of you has already used the free week of the subscription, the purchase screen will explain why it isn’t available.

What data we process

• Your answers, boundaries, and what you share with your partner. Your answers to cards (including “Never”), the heat levels you chose and the topics you excluded, the deck issued to you, matches together with the card texts, your couple’s history (suggestions, tasks, rewards, points), and the texts of rewards, if you wrote them. We need them to show you cards within your boundaries and to find matches. Legal basis: your explicit consent. We keep them for as long as your account exists.
• Account and profile. A random account identifier with no name or email, your time zone, the time you last opened the app, the size of your free allowance, technical markers (for example, the time of your latest data downloads), and your name and gender, which are optional. We need them to run the app; your name and gender are processed with your consent, because a couple’s composition can reveal something about private life. We keep them for as long as your account exists. Legal basis: contract; for name and gender, consent.
• Cerise Plus subscription. The plan, how long it is valid, whether access has been granted to your partner, and purchase information from the store. We do not have your bank card details. The free week is given once per person and once per couple, so we keep a marker that it has already been used. Legal basis: contract; for the free-week marker, legitimate interest (protection against abuse). We keep it for as long as your account exists.
• Notifications. The device token, your notification settings, and technical markers, so that we don’t send notifications at night or repeat them. Legal basis: contract, and only if you have allowed notifications.
• Invitations and profile recovery. An invite code is valid for 6 hours and is deleted 7 days after it expires. The recovery code is kept in the secure storage of your phone; we keep only its irreversible trace. To protect against code guessing, for no longer than two hours we keep the number of failed attempts from one address as an irreversible hash with a secret key: the address itself is not there. Legal basis: contract and legitimate interest (security).
• Checking that the app is genuine. The app gets confirmation from Google Play (on Android) or Apple (on iPhone) that it is an unmodified build from the store, and attaches it to its requests to our server. This is how we filter out programs that guess invite codes and abuse the service. Google Play and Apple receive information about the app and the device for this and process it under their own policies; your account, name, and answers are not in the confirmation. The confirmation is short-lived, and we do not store it. Legal basis: legitimate interest (security).
• Consent log. When you agreed and to which editions of the documents, your choice about statistics and ad measurement, the app version, and the platform. The operator must be able to prove consent (Art. 7(1) GDPR and the Armenian Law on the Protection of Personal Data). We keep it for as long as your account exists. Legal basis: legal obligation.
• Server logs. The connection address (IP), the type of app or browser, the time and kind of request; error records also include the account and couple identifiers. We need them to find failures and to repel attacks. We keep them for 30 days. Legal basis: legitimate interest.
• Support emails. The address you wrote from and the text of your email. Please don’t send your answers to cards or other intimate information in emails: we don’t need an email to give you a copy of your data or to delete it — you do both in the app. Legal basis: legitimate interest (answering your request). We keep them while the correspondence continues, and delete them sooner if you ask.

Statistics, crash reports, and ad measurement — only if you turn them on

On the first screen and on the invitation screen, under the consent checkbox, there is a second one: “I agree to usage statistics, crash reports and Cerise ad measurement via Google.” It is not checked by default and does not hold up your sign-in. This is a single consent for everything listed: there is no separate checkbox for ad measurement. You can turn it on and off at any time: Settings → Account and data. While it is off, the app and the server send nothing: no events, no crash reports, and no information for ad measurement. In a couple, each person decides for themselves: an event about the couple goes only to the person who turned statistics on. This is a separate consent and does not affect the processing of your answers.

When statistics are on, we measure how a person uses the app:

• which screens are opened and how the first steps go;
• steps with your partner: invitation sent, opened, accepted, the couple linked or broken up, the first match appearing;
• the fact that a card was answered and matches were opened, and the number of answers — without the cards or the answers themselves;
• the fact of suggestions, rewards, tasks, and games, and for games a summary of the round (how many cards, how much time), without their content;
• your response to the request to allow notifications, and opening notifications;
• showing the purchase screen, taps, cancellation and errors, and subscription events from the store: start, renewal, cancellation, refund, product, platform, and amount;
• the app’s request to rate it in the store.

Each event carries: a pseudonymous account identifier, a session number, the time, the platform (iOS or Android), the app version, the day since installation, and the couple’s state (no couple, invitation sent, in a couple). Linked couples also have a couple pseudonym — we use it to count how many couples use the app; it is not the couple’s identifier in our database. Amplitude receives the statistics. We do not put the connection address (IP) into events, but Amplitude, like any server, receives it with the request and can use it to determine the country and city.

Firebase Crashlytics receives crash reports: technical details of the crash, the device model, and the system and app versions. They do not contain your account identifier. On Android, if statistics are on, the report also includes the latest Google Analytics technical events.

Ad measurement. We advertise Cerise ourselves in Google Ads; there are no ads from other companies in the app. So that this advertising reaches people who actually use the app, when statistics are on, the app tells Google Analytics for Firebase two facts: that you gave five new answers to cards (only answers given while statistics are on are counted) and that you reached the end of the introductory setup on first launch. These events have no properties: they contain neither the answers themselves, nor cards, nor your name, nor your account identifier. Each of them is sent once per installation of the app. Google Analytics passes them to the linked Google Ads account, where they serve as conversions: Google uses them to assess and optimize Cerise advertising, that is, to decide whom to show it to. Ad personalization is turned off: this information is not used to show you ads based on your interests. Google’s automatic screen events are not sent.

The app does not collect the device’s advertising identifier (the Android advertising ID): the permissions for it have been removed from the app, and its collection is turned off. Apart from the two events, Google Analytics itself receives technical details: an installation identifier (it is not an advertising one), the app and system versions, the device type (phone or tablet), the language, the country and region based on the connection address (the city is not determined, and the address itself is not stored), technical events about installing, updating, sessions, and removing the app, crash information, and the install source: which advertising campaign and which tap on a Cerise ad the installation came from (Google Play passes on the ad tap identifier and its time). Google uses it to link the events to the tap on a Cerise ad. Google Analytics has no Cerise account identifier, name, answers, cards, or screens.

For now, ad measurement works only in the Android version; on iPhone it is not turned on yet. If we turn it on there too, we will publish a new edition of this policy and of the consent. When you turn statistics off, new events stop being sent immediately, and the app asks Google Analytics to reset the installation identifier.

Neither statistics nor ad measurement ever include: answers to cards, texts of cards, rewards and suggestions, which cards you have seen, your name, your gender, the couple identifier, the device’s advertising identifiers, and its location coordinates. Legal basis: your explicit consent. Cerise is an app about a couple’s intimate life, so the very fact that you use it may reveal something about your private life.

What is stored only on your phone

A copy of your data for working offline, downloaded cards and tasks, the counters of free game turns, and technical markers (for example, whether you have been asked about allowing notifications). For ad measurement, it also holds a counter of new answers to cards (only answers given while statistics are on go into it) and a marker that the event has already been sent; neither contains the content of the answers. This does not come to us and is deleted together with the app. The exception is the recovery code on iPhone: it is kept in the keychain and survives deleting the app, so that your profile can come back after a reinstall.

Before you confirm your age

The first screen asks about your age and consent. Until you answer, the app signs in to an account without an email and password, checks with Google Play or Apple that the build is genuine, creates a recovery code, and downloads the catalog of cards, which contains none of your data. Your profile, boundaries, deck, and consent log appear only after “I’m 18 or older” or “Accept invite” with the consent box checked, and without a recorded consent the server does not accept answers. Purchases are connected only after consent, notifications only after you allow them, and statistics and ad measurement only if you turn them on. If you don’t pass the age question, the sign-in account without a profile is kept without a time limit; it has no name and no answers.

Notifications

The app asks for permission to send notifications from the person who accepted the invitation and from the person who sent it. Declining breaks nothing. Notifications are about new matches, suggestions, the Weekly Spark, and rewards (each can be turned off separately), “New cards are ready” (sent no more than once a day between 9 AM and 11 PM your time, and only if you haven’t opened the app that day; it can be turned off in settings), “Partner joined,” and a reminder three days before the charge after the free trial. Notification texts do not name cards or answers.

Who receives data

• Google (Google Cloud and Firebase) — the database, server functions, sign-in, checking that the app is genuine, notifications, this website, crash reports, and service logs, and, when statistics are on, also the measurement of Cerise advertising (Google Analytics for Firebase and Google Ads: two events without answers or names and the technical details described above). The database and functions are located in the europe-west1 region (Belgium, EU); sign-in, logs, app verification, Google Analytics, Google Ads, and some Firebase services run in Google’s global infrastructure.
• RevenueCat — accounting for purchases and subscriptions: the account identifier, purchase information from the store, and technical details of the request (IP address, device type, system version). Servers are in the United States.
• Amplitude — statistics, only if you turned them on. The data is stored in the EU (Frankfurt).
• Apple and Google Play sell the subscription and process the payment as independent controllers under their own policies; only they have your card details. They also confirm that the app is genuine. On iPhone, Apple delivers notifications.
• Support email. Emails to hello@cerise-app.com are forwarded by the ImprovMX service (servers in the EU and the US) to a Google mailbox.

Google, RevenueCat, and Amplitude process data on our behalf and under data processing agreements. The exception is Google Ads: it uses the two ad measurement events and the information by which Google links them to a tap on a Cerise ad as an independent controller, under its own rules. Google describes how it handles such data on the page “How Google uses information from sites or apps that use our services”. We give recipients only what the app needs in order to work and, if you turned statistics on, for statistics and ad measurement. We do not sell data. The only thing we send for advertising purposes is the ad measurement information described above: it goes to Google only when statistics are on, contains no answers, names, or account identifier, and serves to assess and optimize Cerise advertising, not to show you ads based on your interests. We give data to public authorities only on a demand that is legally binding on us.

Transfers of data outside Europe

We work from Armenia, and there is no European Commission decision that Armenia provides an adequate level of data protection. The data you send from the app comes to us, and then the recipients listed above receive it, including in the United States. The transfer is protected by the European Commission’s standard contractual clauses, which are part of the agreements with Google, RevenueCat, and Amplitude; Google and Amplitude are also certified under the EU–US Data Privacy Framework. Google Ads receives the ad measurement information as an independent controller: if you are in the EU or EEA, it is received by Google Ireland Limited (Ireland, EU), and Google itself safeguards any further transfer outside Europe, including under the Data Privacy Framework; if you are in the United Kingdom, it is received by Google LLC (United States) under standard contractual clauses. You can request a copy of the clauses at the address above.

How long we keep data

• Answers, boundaries, deck, name, settings, consent log — for as long as your account exists. Deleting your account erases them immediately.
• What the couple shares, and the couple’s history — for as long as both accounts exist. After a breakup they are not available in the app to you or to your partner, but they are included in your data copy. They are kept until one of you deletes the account: then the couple’s data is deleted entirely. As the operator, we have technical access to the database, but we do not open this data.
• Inactive accounts are deleted together with all their data if the app has not been opened for 24 months. In a couple, the account is deleted only if neither partner has opened the app. This does not apply to accounts with an active Cerise Plus (bought by the person or received from a partner) or with a “Lifetime” purchase.
• Invite codes — 6 hours, and another 7 days after they expire; immediately when the account is deleted.
• Server logs — 30 days.
• Crash reports are kept by Google for 90 days.
• The notification token may be kept by Google for up to 180 days after the account is deleted.
• Statistics events are kept by Amplitude for 24 months from receipt, after which they are erased automatically. They are deleted sooner together with the account: after you delete the account, we send a deletion request, and the events are erased no later than 40 days later.
• Data in Google Analytics. Technical events are kept by Google Analytics for 2 months. The installation identifier and the data linked to it, including the two ad measurement events, are kept for 14 months from receipt and then deleted automatically. Aggregated reports without identifiers keep only overall numbers. Conversions passed to Google Ads are kept by Google under its own rules.
• The subscriber record in RevenueCat is deleted when the account is deleted. The purchase itself stays in the App Store or Google Play under their rules.
• There are no database backups. Deleted data technically remains in the service version of the database for no more than an hour.

For more on what happens on deletion, see the page “Deleting your account.”

Your rights

• Get a copy of your data in a machine-readable form: Settings → Account and data → “Download my data.” The app gives you two files: a table of your answers (CSV) and the rest of your data (JSON). The copy does not include your partner’s data that is not shared. You can download a copy three times a day. We do not send a copy by email: an email does not prove that the account is yours, and your partner also knows the account identifier.
• Delete your account and data: Settings → Account and data → “Delete account and data.”
• Correct your data. Your name, gender, levels, and excluded topics are changed in settings, and an answer is changed by answering the card again.
• Withdraw consent at any time. Consent to statistics, crash reports, and ad measurement is withdrawn with a switch in settings: new events stop being sent immediately, and the app asks Google Analytics to reset the installation identifier. Consent to the processing of your answers is withdrawn by deleting your account: the app cannot work without it, and there would be no basis for keeping the answers without consent. Withdrawal does not affect the lawfulness of processing that took place before it.
• Object to processing based on legitimate interest and ask us to restrict processing — by email to hello@cerise-app.com.
• Complain to a supervisory authority: in Armenia, to the Personal Data Protection Agency; in the EU, to the authority of the country where you live or work; in the United Kingdom, to the ICO. You don’t have to write to us first, but if you do, we will try to resolve the matter ourselves.

We respond to requests without undue delay and no later than one month; if a request is complex, the period can be extended, and we will tell you so within the first month. If the law of the Republic of Armenia applies to you, we respond within the periods it sets.

If your profile is lost. We do not have your email or phone number. If the phone with the app is gone and the profile has not come back from a backup, we cannot establish which profile is yours, and so we do not give out a copy or delete data based on a description: otherwise someone else could obtain or delete it. Such an account will be deleted on its own under the rule on inactive accounts, together with the data of its couples.

Decisions without human involvement

We do not make decisions that would have legal effects for you on the basis of automated processing. Cards are selected according to your boundaries and your couple’s shared deck, and matches are calculated under the rules described above.

Age

Cerise is for adults: from 18 years old, or from the age of majority in your country if it is higher. We do not knowingly collect data of minors. You confirm your age yourself; we do not ask for documents. If you answered “I’m not 18 yet,” no profile is created.

Applicable law

The operator is registered in Armenia, so the Armenian Law on the Protection of Personal Data applies to the processing. For data about private life we rely on your explicit consent; other grounds only where the law expressly provides for them. If you are in the EU, the EEA, or the United Kingdom, the GDPR or the UK GDPR also applies to the processing of your data. Their grounds — explicit consent (Art. 6(1)(a) and 9(2)(a)), contract (Art. 6(1)(b)), legitimate interest (Art. 6(1)(f)), and legal obligation (Art. 6(1)(c)) — are named for each purpose in the section “What data we process.” This does not limit the mandatory rules of the country where you live: if your law gives you more, it applies.

Changes

Every edition of this page has a date — it is at the top. When a new edition is published, the app shows a “We’ve updated our documents” notice at launch with a link to it. If the text of the consent changes, the app asks you to agree again and does not let you into the app until you do. Starting with the 2026-10-05 edition, every published edition is preserved unchanged at cerise-app.com/archive/privacy-YYYY-MM-DD, where the end of the address is its date; for this English text, starting with the 2026-10-06 edition, at cerise-app.com/archive/en/privacy-YYYY-MM-DD. We do not apply new purposes of processing to data already collected without your consent where consent is required. If the sole proprietor’s successor becomes the operator — for example, a legal entity — we will tell you in the app at least 30 days ahead, and you will be asked for your consent to the processing of your answers again: the earlier consent does not transfer to the new operator.