Privacy Policy
Effective date: 21 September 2026. Version: 2026-09. Language: English.
1. Who is responsible for your data
Matolcsi Jákob, a sole proprietor registered in Hungary (Hungarian registered designation: Matolcsi Jákob egyéni vállalkozó), is the controller of personal data processed through the Skretchy mobile application and its related services. In this policy, “we”, “us” and “our” refer to the controller.
- Registered office: 2373 Dabas, Kun utca 24., Hungary.
- Postal address: 2373 Dabas, Kun utca 24., Hungary.
- Email for privacy enquiries, support and complaints: jakob [at] matolcsi [dot] com.
- Telephone: +36 / 70 / 452 / 25 / 90.
To email us, replace [at] with @ and [dot] with a full stop, and remove the spaces. To call us, dial the telephone number without the spaces or slashes, retaining the +36 country code. The operator personally handles privacy enquiries.
This policy explains how we process personal data in connection with accounts, photo cards and messages, profiles and Discovery, security and customer support. We refer to Skretchy's services as the “Service”. The Service is offered in the member states of the European Union through the Apple App Store and is available only to people aged 18 or over. We record an age declaration; registration does not require a date of birth or an identity document.
Processing is subject to Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”) and applicable Hungarian data protection law. Acknowledging this policy is not blanket consent to processing. Where we rely on consent, we request it separately for the identified feature.
Website visits. The website is hosted by a hosting provider in the European Union, identified in section 5. Skretchy accounts, photo cards, profile photos and messages are stored through Supabase, not on the website's hosting. We do not use a separate CDN, third-party analytics, advertising trackers, embedded third-party forms or cookies on the website. Your browser transmits technical request data needed to deliver the pages, including its IP address, the requested URL, request time and browser information. The web server does not keep an access log of these requests. Error and security messages are written to a small diagnostic log that is overwritten automatically and not retained beyond that. An invitation URL can contain a username and a connection code; as there is no access log, these are not recorded. We process necessary request and security information under Article 6(1)(f) GDPR for our legitimate interests in delivering a functioning, secure website and investigating faults.
2. Where the data comes from and what is optional
We receive data from you, from Sign in with Apple, from other users who interact with you and from events generated when the Service is used. A person without an account can also submit a report.
Without the data needed for sign-in, account operation or content delivery, we cannot provide the relevant feature. Profile photos, Discovery and notifications are optional. You can manage camera, photo library and notification permissions in your device settings; these permissions do not replace the need for a lawful basis under the GDPR.
The app does not request access to your contacts or device location. It removes EXIF metadata, including location metadata, when preparing images for upload. The image itself or text added to it can still identify a person or location. We do not display advertisements or use external analytics tools. Section 3 separately describes our internal usage statistics.
3. Data, purposes and legal bases
In the table below, references to points (b), (c) and (f) mean the corresponding points of Article 6(1) GDPR. Section 8 explains how to object to processing based on legitimate interests.
| Purpose | Personal data | Legal basis |
|---|---|---|
| Sign-in, account creation and account management | Apple account identifier; email address or private relay address supplied by Apple; name you provide; internal account identifier; username; time zone; authentication data | Point (b): steps you request before entering into a contract and performance of that contract |
| Recording contractual declarations and applying the age requirement | Accepted Terms version, acceptance time and age-declaration time | Point (b): entering into and performing the contract |
| Securely ending the Apple sign-in connection | Apple refresh token obtained from the sign-in authorisation code, where available | Point (f): our legitimate interest in securely managing access when an account is closed |
| Delivering cards and messages and maintaining conversations | Images, captions, drawings, message text, sender and recipient identifiers, friendships, friend requests and associated times | Point (b): providing the communication service you request |
| Displaying your profile | Name you provide, username and optional profile photo | Point (b): providing the profile feature you request |
| Discovery and mutual connections | Discovery setting, name, username, profile photo and mutual-friend count; a mutual friend's name and photo only when that friend has enabled Discovery | Article 6(1)(a): separate consent that can be withdrawn |
| Game features and virtual balances | Sending, opening and unlocking events; scratch state; streaks; diamond balance and transaction history | Point (b): performance of the contract |
| Connection codes | Temporary code associated with a username, validity information and connection records | Point (b): providing the connection feature you request |
| Delivering notifications | Device push token, event and conversation identifiers, sender's display name and, for a text message, a message preview | Point (b): providing the notification feature you request |
| Internal usage statistics | Metrics derived from sending, opening, unlocking and connection events, including statistics for individual accounts | Point (f): our legitimate interest in evaluating operation, identifying faults and improving the Service |
| Handling abuse and maintaining security | Reporter and reported-user identifiers; reason and notes; reported content; reference to the profile photo in use at the time of a report; blocking records; profile-upload and moderation records; technical security events | Point (f): our legitimate interest in protecting people's rights and the security of the Service |
| Technical customer support | Contact information and the content of enquiries and responses | Point (b) for assistance relating to the contract; point (f), our legitimate interest in responding to enquiries, for people without an account |
| Consumer complaints | Information needed to identify and respond to the complainant; complaint, written record and substantive response | Point (c): section 17/A of Hungarian Act CLV of 1997 on Consumer Protection |
| Data protection requests | Information needed for identification, the request, action taken and response | Point (c): handling requests under Articles 12 and 15–22 GDPR. For the short correspondence retention proposed below, point (f): demonstrating our response and handling immediate follow-up |
Apple's platform terms are not, by themselves, a statutory obligation on which processing under Article 6(1)(c) GDPR can be based.
We prepare aggregate operational reports from service events. Calculating those reports can involve account-linked records, and our internal tools also support account-level operational metrics. We treat these underlying records and identifiable outputs as personal data. Only reports from which individuals cannot reasonably be identified are treated as anonymous. The analysis does not create advertising profiles. We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects on you within the meaning of Article 22 GDPR.
An image or information about another person may come from the user who uploads it. That person can request information and exercise their rights without having a Skretchy account. Our contract with the uploader does not, by itself, provide a lawful basis for processing the other person's data. Any reliance on legitimate interests in lawful communication or protecting rights must be assessed against the affected person's rights. Processing special categories of personal data also requires an applicable condition under Article 9 GDPR; accepting the Terms does not supply that condition.
4. Who can access content and profile information
Cards and messages. Within the app, the sender and recipient can access them according to the relevant permissions. When a photo is sent to several recipients, the underlying image file can be shared, while access to each card instance is controlled separately. The Service does not use end-to-end encryption: we and our infrastructure providers can have technical access. Within our business, access is limited to Matolcsi Jákob personally and to what is necessary for operation, troubleshooting, report investigation or compliance with a legal obligation. There are no other authorised staff or external moderators.
Profile photos. Your friends can see your profile photo. The recipient of a friend request can also see the requesting user's photo. Sending a friend request does not, by itself, let the requester see the recipient's photo. Discovery can provide additional visibility as described below. Profile photos appear after upload without prior human content review. Users of the Service can see the official Skretchy account's profile photo.
Discovery. When you enable Discovery, your name, username and profile photo can appear to friends of friends who also use Discovery. The number of mutual friends is shown. A mutual friend's name and photo appear only if that friend has also enabled Discovery. Within a small social circle, even the count can allow someone to infer a mutual friend's identity. Discovery does not publish private photo cards.
You can withdraw your Discovery consent at any time by switching off the setting. Your profile will then be excluded from new Discovery queries, and you will also stop using Discovery yourself. A list or image already loaded on another person's device can remain until it is refreshed or its cache is cleared. Withdrawal does not affect the lawfulness of earlier processing based on your consent.
Notifications. Push notifications are delivered through Apple's notification service and can include the sender's name and part of a message. Depending on the recipient's device settings, this information can appear on the lock screen.
Reports. The operator can access the data and content needed to investigate a report. We do not disclose the reporter's identity to the reported user. Where a lawful request from a competent authority or court requires disclosure, the required information can be provided to that body.
5. Service providers and international transfers
| Provider or service | Role and relevant data |
|---|---|
| Supabase Pte. Ltd. | 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513; privacy@supabase.io. Processor for authentication, database, image storage, real-time updates and server-side processing, using necessary account, content and technical data. The project is in Frankfurt, AWS eu-central-1. The standard Data Processing Addendum forms part of the Terms of Service. |
| Sign in with Apple | Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Republic of Ireland, is the Apple privacy controller for EEA users under its Privacy Policy and entity list. Apple supplies an app-specific identifier and the name and email or relay address you authorise. It separately controls its Apple Account and sign-in security processing under its Sign in with Apple notice. We control our use of the information received to operate your Skretchy account. |
| Apple Push Notification service (APNs) | Apple Inc., One Apple Park Way, Cupertino, California 95014, United States, provides APNs under the Apple Developer Program License Agreement, Attachment 1. It handles device addressing, tokens and notification payloads, including the name and message preview described in section 4, to deliver notifications. Apple's processing for its own device and service purposes is governed separately by its Privacy Policy; this row does not designate all Apple activities as processing on our instructions. |
| Contabo GmbH | Welfenstrasse 22, 81541 Munich, Germany; support@contabo.com; legal notice. Hosts the website in the European Union and handles the technical request data described in section 1 on our behalf. The app's accounts, photos and messages are not hosted there. Contabo processes this technical request data as a hosting provider under its standard terms; it does not receive app data. |
| Google Workspace (Gmail), Google Cloud EMEA Limited | 70 Sir John Rogerson's Quay, Dublin 2, Ireland, as identified in Google's standard contracting-entity schedule for a Hungarian billing address. Processor for correspondence content, attachments and delivery information under the Cloud Data Processing Addendum. We use no separate helpdesk or forwarding service. Google's infrastructure and subprocessors operate internationally; we do not claim that correspondence stays exclusively within the EEA. |
Each provider's role depends on the relevant processing purpose and contract. A processor acts on our instructions; an independent controller is responsible for its own purposes. Apple is not automatically our processor for every activity.
An EU hosting region does not mean that all support, logging or subprocessor activities take place within the European Economic Area (“EEA”). Supabase's contracting entity is in Singapore; its DPA incorporates the European Commission's Standard Contractual Clauses for covered transfers, including the controller-to-processor module. Google's Workspace subprocessors include Google LLC in the United States. Google's DPA provides for recognised transfer mechanisms and Standard Contractual Clauses as applicable. Neither arrangement means that all data is physically stored in the EEA.
Apple's Privacy Policy describes international processing, including by Apple Inc. in the United States, and Standard Contractual Clauses for transfers of EEA personal data. Information about those safeguards can also be requested through Apple's privacy contact.
The linked DPAs describe the safeguards. Further recipient information is available in the Supabase subprocessor list and Google Workspace subprocessor list. You can request information about the safeguards at the contact address in section 1. The providers' published lists describe their service arrangements; they do not mean that every listed recipient receives every Skretchy user's data.
No external advertising, analytics or content-moderation service is integrated. We do not sell your content or use it to train artificial intelligence models.
6. Retention and deletion
Service data and case-handling records serve different purposes. Deleting an account does not automatically delete consumer complaint records that must be retained by law.
Retention schedule. The rules below describe current deletion behaviour. Provider-controlled deletion periods must be verified rather than replaced by our own limits.
| Data category | Retention and deletion |
|---|---|
| Account and profile data, contractual declarations, connections, messages, game state and your diamond history | Until the account is deleted, or an earlier action deletes the relevant data. Successful account deletion also removes the associated active database records. |
| Card photo | Retention follows the card's lifecycle. Withdrawal, expiry or consumption of a view-once card and physical deletion of its file are separate steps. Routine cleanup is scheduled every five minutes; this is not a guaranteed five-minute deletion deadline. A shared file can still be needed by another remaining card instance. |
| Card history | After the image file is deleted, sending, unlocking and other event records can remain in the conversation history. Account deletion removes the associated records. |
| Profile photo | Replacing or removing a photo removes it from the profile. Routine cleanup covers unreferenced files more than one day old, measured from upload. Separate rules apply to reported files and files needed for moderation. |
| Reported card photo | The routine cleanup rule protects a reported card for 30 days from reporting. Current shared-file and withdrawal deletion paths do not consistently preserve that protection, and account deletion can remove evidence earlier. A guaranteed 30-day preservation period cannot currently be offered. A file still needed for another active card follows that card's lifecycle. |
| Reported profile photo | Protected from routine cleanup for 30 days from the report. A new report or continued use as a profile photo can result in longer retention. Account deletion is a separate process and can remove the photo earlier. |
| Report and profile-moderation records | Retained while the accounts concerned exist; there is no separate time-based deletion. Deleting the reporter's or the reported user's account also deletes the report; deleting the profile owner's account deletes the moderation records. A specific ongoing case follows the exception below. |
| Apple refresh token | Until the stored token is replaced or the account is deleted. On deletion, the system attempts to revoke Apple access when a token and the required configuration are available. Failed revocation does not prevent deletion of the Skretchy account. |
| Push token and connection data | A token is retained until replacement or deletion, and no later than account deletion. Connection codes expire minutes after the code screen is closed; the record of who joined through a code is retained until the accounts concerned are deleted. |
| Local image cache and cards waiting to be sent | The image cache is cleared on sign-out and account deletion. The local queue of unsent cards remains on the device after sign-out so sending can resume; successful account deletion also clears that queue. |
| Internal statistics | Account-linked source records follow the retention rules for the underlying personal data. Routine reports are aggregates viewed by the operator; identifiable outputs are not exported routinely, and a temporary copy made for a specific request or investigation is deleted when that task is completed. |
| Supabase logs and backups | Supabase keeps API and database logs for one day on our plan, and does not provide database backups on it; we do not take manual backups. Auth audit records follow Supabase's plan terms. |
| Website logs and backups | The website hosting does not hold the app's user database, photos or messages, only the static website. The web server keeps no access log; the diagnostic log is small and overwritten automatically. We do not take backups of the website hosting. |
| Routine support and data protection correspondence | Kept in the operator's mailbox for as long as needed to handle the matter and demonstrate our response; unnecessary identity-document copies and temporary data exports are removed when their immediate task is complete. Consumer complaints follow the statutory rule below. |
| Deleted correspondence in Google Workspace | We use the standard mailbox settings without Vault or other retention holds. A deleted message is removed from the mailbox's Trash after 30 days, and Google removes remaining copies from its systems within the period stated in its Cloud Data Processing Addendum, at most 180 days, subject to applicable legal retention requirements. |
| Consumer complaints and responses | The complaint or written record of an oral complaint, and a copy of the substantive response, are retained for three years under section 17/A(7) of Hungarian Act CLV of 1997 on Consumer Protection. |
A specific ongoing request, investigation, legal obligation or legal claim may require necessary records to be kept beyond the routine period. We keep only what that matter requires and remove it when the reason ends, subject to any applicable statutory period. This does not permit blanket or indefinite retention of all data.
7. Account deletion and security
You can request account deletion from the Profile screen in the app. Successful deletion removes the account, associated active records and the image files eligible for removal. A technical failure can prevent completion; you can also contact us by email about your request. A shared image file associated with another user's card instance can remain while the conditions for storing it still apply.
Hiding a conversation on your side, blocking and account deletion are different actions. Clear conversation hides the conversation from your own view without deleting the other person's history. Screenshots and independent copies saved by others cannot be recalled. Provider logs, backups and separately retained records follow the rules in section 6.
Account-based access checks, permission controls, private image storage and separation of operator access help protect data. They do not eliminate all risk or provide end-to-end encryption. You can report suspected unauthorised access using the address in section 1.
8. Your rights and how to exercise them
Subject to the conditions in the GDPR, you have the right to:
- obtain information about and access to your personal data, including a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have data erased where the legal conditions are met, or request restriction of processing;
- receive data you have provided, where it is processed by automated means based on consent or a contract, in a structured, commonly used, machine-readable format, and request direct transfer where technically feasible;
- object, on grounds relating to your particular situation, to processing based on legitimate interests; processing can then continue only where the overriding grounds or legal-claims conditions in the GDPR apply;
- withdraw consent at any time, without affecting the lawfulness of earlier processing based on that consent.
Send requests to the email address in section 1. You do not need an account to exercise your rights. We respond without undue delay and normally within one month of receipt. For complex or numerous requests, we can extend the period by up to two further months, explaining the extension within the first month.
Requests are normally free of charge. The GDPR allows exceptions for manifestly unfounded or excessive requests; we will explain any exception we apply. We limit identity checks to what is necessary and do not routinely request identity documents. Where there are reasonable doubts about identity, we can request additional, proportionate information. Disclosure must also protect other people's rights and personal data.
If we do not act on your request, we will explain why and tell you about the available remedies.
9. Complaints and judicial remedies
You can lodge a data protection complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
- Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary.
- Postal address: 1363 Budapest, Pf. 9., Hungary.
- Email: ugyfelszolgalat@naih.hu.
- Telephone: +36 (1) 391 1400.
- Website and contact information: naih.hu.
You do not have to contact us before lodging a complaint. You can also seek a remedy before a competent court or contact another competent supervisory authority as provided for by the GDPR.
10. Changes to this policy
We will provide accessible, clear advance information about material changes to processing and state when the revised policy takes effect. If a change requires fresh consent, we will request it separately. Updating this policy or continuing to use the Service does not, by itself, replace any required consent.