Privacy Policy

This Privacy Policy explains how WantYou ("we") collects, uses, processes, and protects your personal data when you use the WantYou adult classifieds platform (the "Site").

We comply with the Swiss Federal Act on Data Protection (FADP / nDSG) and, where applicable, the EU GDPR. By using the Site, you are informed of the practices described below.

The data controller is WantYou, operator of the Site, Switzerland.

For privacy requests, you may:

• use your account tools (email/password change, account deletion);
• write to the privacy contact address published on the Site once available.

To be completed by the operator: full postal address and dedicated privacy email.

We collect only data necessary for the Service, as follows:

A. Data you provide:

• Registration / account: email address, password (hashed by the auth provider), pseudonym.
• Ads: title, description, demographic criteria, age bracket, location, up to 3 photos (JPEG/PNG/WebP), visibility options and auto-renewal settings.
• Ad contact details: email, phone, Telegram, Signal and/or Threema (at least one). These are not included in public HTML reads; they are revealed via a secure procedure to signed-in users.
• Engagement: favorites, ad reports (reason, optional comment).
• Credits: balance and transaction history (option purchases, renewals, welcome bonus).

B. Data collected automatically:

• Session and technical cookies: Supabase authentication, age-gate cookie (`wantyou_age_verified`), optional locale preference (`NEXT_LOCALE`).
• Audience analytics: Vercel Web Analytics (page views / performance via our host); no advertising cookies.
• View counter: increments an ad's lifetime view count.
• Technical / audit logs: internal traces of ad modifications (restricted operational access).

We use your data to:

• Provide the Service: account, publishing and displaying ads, favorites, credits and visibility options (Highlight, Star, Super Star), automatic renewal.
• Protect contacts: keep contact details out of public HTML; reveal them only to authenticated users on explicit request.
• Communicate: transactional emails (email verification, password reset, email-change confirmation).
• Moderate and secure: age gate, reports, abuse prevention, Terms compliance.
• Measure audience minimally: Vercel Web Analytics (hosting provider), without advertising cookies.
• Comply with law: legal obligations, authority requests, accounting retention of the credit ledger.

Under the FADP, we process data on the following bases:

• Contract performance: account, ads, credits, contact reveal, favorites — necessary to perform the Terms of Use.
• Legitimate interests: security, moderation, fraud prevention, minimal audience measurement via Vercel Web Analytics (no targeted ads).
• Consent: age-gate acceptance; optional preferences (e.g. language). No marketing newsletters are sent in the current Service.

A. Hosting and location:

• Database and authentication: Supabase, European Union region (eu-central-1, Frankfurt, Germany).
• Web application: hosting / CDN (e.g. Vercel), which may process technical connection data in the EEA or other regions depending on infrastructure.
• Ad images: Supabase Storage bucket (`ad-images`); image files are publicly accessible by URL only.

B. Strictly necessary cookies and trackers:

• Supabase session / authentication cookies;
• `wantyou_age_verified` cookie (age attestation);
• `NEXT_LOCALE` cookie (language preference, if used).

We do not use advertising cookies or tools such as Google Analytics. Audience measurement is provided by Vercel Web Analytics as part of our application hosting.

Your data is not sold, rented, or exchanged for commercial purposes. We share it only with:

• Technical providers: Supabase (database, Auth, Storage, transactional auth email); application host (e.g. Vercel). Access limited to operating the Service.
• Signed-in users: only contact details for an ad they choose to reveal via the secure procedure.
• Internal moderation: performed by our team.
• Hosting analytics: aggregated traffic metrics via Vercel Web Analytics.
• Authorities: when required by law or to protect our rights.

We retain data only as long as needed for the purposes above:

• Account: while the account is active. Account deletion immediately anonymizes the profile (pseudonym) and revokes sessions; access is blocked.
• Credit ledger: transaction history may be retained after account deletion for accounting and legal reasons (as stated in the deletion confirmation).
• Ads: standard active duration of 7 days, then automatic archiving, unless automatic renewal applies (when enabled and credit balance is sufficient). Ads may also be removed for Terms violations.
• Images: retained with the ad / associated storage; reachable via public bucket URLs while they exist.
• Audit logs: retained as needed for security; Vercel Analytics retention follows the provider's terms.

We implement appropriate technical and organizational measures, including:

• TLS encryption in transit;
• hashed passwords (authentication infrastructure);
• access control (Supabase RLS, roles);
• exclusion of contact columns from public reads (`ads_public`) and reveal via an authenticated procedure;
• restricted SELECT rights on contact data and audit logs;
• image storage constraints (MIME types, max size).

No measure is infallible; absolute security cannot be guaranteed.

Under the FADP, you have rights of access, rectification, erasure, restriction, and objection.

Via the Site:

• change email and password from your account;
• delete your account (immediate profile anonymization; possible retention of the credit ledger).

Portability / other requests: by written request to the address in section 2 (export is not automated in the current Service).

You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).

We may modify this policy at any time. Changes are published on this page with an updated version and effective date. Continued use of the Site after publication constitutes acknowledgment of the current version.