lingr
DE Waiting list

Privacy Policy

Last updated: 5 November 2026

1. Controller

The controller for data processing on this website and in the lingr app is:

lingr Labs UG (haftungsbeschränkt)
represented by its managing director Johannes Lenz
Auenstr. 68, 80469 München, Germany
Email: datenschutz@lingr.online

2. Collection and processing of personal data

2.1 When visiting the website

We host lingr.online on Cloudflare Pages. As part of delivery, Cloudflare temporarily processes the following data:

  • IP address (anonymised after 24h)
  • Date and time of the request
  • Browser type and version, operating system
  • Referrer URL

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, performant delivery). Details: Cloudflare Privacy Policy.

2.2 At registration & in your profile

lingr is exclusively for people aged 18 and over. When you register and in your profile, we process:

  • email address (for login and communication) – if you sign in with Apple, the address Apple passes to us, or an Apple relay address if you choose
  • password (stored only as a hash, never in plain text; there is none if you sign in with Apple)
  • mobile number – only as a check value, see section 2.8
  • date of birth (required, to check that you are at least 18). We never show it to others; your age is only visible to people you share it with in a chat (section 2.10)
  • profile name (@name), photos, bio, pronouns, city and district, interests, what you are here for ("Here for") and up to three answers to questions from a fixed list
  • optionally your sexuality (see section 2.4)
  • optionally your names on Instagram, TikTok and X as well as private albums – both are only visible to people you share them with (section 2.10)
  • your online status: when you were last in the app. Anyone who can see your profile sees "Online" or, for example, "12 min ago"
  • your settings, such as who can find you, which notifications you get and whether you have switched on "Open to dates" (section 2.4)

Location (only with your permission). lingr does not store your location on the server and never shows others where you are or how far apart you are. The app uses the location on your iPhone to

  • determine your city and district and keep them up to date – Apple turns the coordinates into a place name for this; only the place name is stored,
  • find places within 50 km – the app sends your coordinates with the request to our server, which uses them only for this search and does not store them,
  • check that you are really there when you check in at a place – here, too, the coordinates are only checked, not stored,
  • show and filter distances to events on your device.

An exact coordinate is only stored if you share it yourself: as a location in a chat (section 2.3) or as the meeting place of a Safe-Meet (section 2.7).
Only while you are using the app. lingr only requests the "While Using the App" permission, never "Always" – so iOS cannot give us your location in the background at all. The app has no background location services, no movement tracking and no geofencing. You can withdraw location access at any time in your iOS settings. You can also enter your city and district yourself when you sign up.

Details from the earlier test version. If you used lingr before version 2.0, you may have entered further details there – such as body data, relationship status, details on safer sex and HIV, or about a second person in a couple profile. lingr 2.0 no longer asks for them and no longer shows them to others. They remain stored until the earlier version is switched off; then we delete them. You can find them in your data export and ask us to delete them earlier at any time.

Legal basis: Art. 6(1)(b) GDPR (performance of the usage contract). For special categories of data (including sexual orientation), section 2.4 also applies.

2.3 During app usage

  • connections, contact requests including their first message (up to 300 characters), and blocks
  • messages in one-to-one, group and meetup chats as well as photos and locations shared in them. Messages are transmitted encrypted via TLS and can only be retrieved from the database by the chat's participants. Shared photos are kept in protected storage: only people in the chat can load them, and only while the period you chose is running. A shared location is stored as an exact coordinate; after the period you chose, we delete the coordinate
  • "End conversation": which chat was ended by whom and when
  • searches for an exact @name: whom you found, so that you can then message the person – for 30 days
  • groups, meetups and events, check-ins and event ratings (sections 2.4 and 2.11)
  • confirmations of authenticity: who confirmed whose profile as real
  • shares in the chat (section 2.10)
  • reports you submit (with a copy of the reported content) and appeals (with the text concerned)
  • push device token (linked to your account, for notifications)

Legal basis: Art. 6(1)(b) GDPR (contract).

2.3a How people are suggested

Under "People", lingr suggests members you share a group with, or a meetup or event with up to 50 people going. For this we look at which groups you are in and which meetups and events you are going to (going counts until seven days after the event), as well as – if you filter – interests, "Here for" and "Open to dates". Those you share the most with come first. We do not store the selection itself; it is created anew every day. We only store how often you have reshuffled today. Nothing is permanently decided about you, and no decision is made that affects you legally. Legal basis: Art. 6(1)(b) GDPR.

2.3b How photos and texts are checked

Before uploading, the app checks photos for your profile, albums, chats, the board and events for nudity on your device; the photo does not leave your iPhone for this, and no third party is involved. If the check detects nudity, the photo is not uploaded.

Our server compares profile texts, answers to questions, pronouns, texts of groups, meetups and events, and board posts with a list of demeaning and excluding terms. A text containing such a term is not saved, and we do not log the match. We do not check chats. If you appeal, we store the text, the term found and your note so that a person can review the case.

Reports and appeals are only seen by those who moderate at lingr. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) – our legitimate interest is protecting members from nude images, demeaning remarks and exclusion.

2.4 Special categories of personal data (Art. 9 GDPR)

lingr is for queer, gay and bisexual men. Simply having a lingr account can therefore suggest your sexual orientation – information that is specially protected under Art. 9 GDPR. That is why we treat everything we store about you accordingly: no tracking, no advertising, no disclosure for other purposes. This applies in particular to:

  • your sexuality, if you state it in your profile. Anyone who can see your profile sees it
  • the "Open to dates" setting. We only store whether and since when you have switched it on, separately from your profile and not retrievable by others. A hint only appears mutually: if you have both switched it on, share an occasion and can see each other
  • Check-ins at queer places and events. Anyone who checks in at a queer place indirectly reveals something about their sexual orientation – even without a word in their profile. That is why we treat check-ins like Art. 9 data: they are voluntary. At a place, others only see a tiered number without names ("3+", "10+"); at meetups and events, others who are checked in see your profile. Your connections only see a check-in if you explicitly share it on your board (section 2.9). It is deleted after 48 hours
  • Details from a Safe-Meet (meeting place, time, with whom) – see section 2.7

We process this data on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give separately when registering. Sexuality, "Open to dates" and check-ins are entirely voluntary: you can change, switch off or remove them at any time. You can withdraw your consent with effect for the future; processing up to the withdrawal remains lawful. Because lingr cannot be used without it, withdrawing it entirely means we delete your account – which you can also do yourself in the app.

2.5 Waitlist & email updates

On lingr.online you can voluntarily join our waitlist to be notified at launch and about important news. For this we process:

  • your email address
  • the time of sign-up and the language version of the site (de/en)
  • where available: information about how you reached us — the campaign tags from the address you opened (UTM parameters such as source/medium/campaign) and the website you visited before (referrer)

This origin information is used solely to evaluate which channels bring sign-ups. We use no tracking pixels and no cross-device profiling for this; the evaluation is based on the address parameters you send along, stored in our own database.

Sign-up uses a double opt-in process: you first receive an email with a confirmation link; only after you click it do we add you to the list. This ensures the address really belongs to you.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future — via the unsubscribe link in every email or by messaging datenschutz@lingr.online. We store your address until you withdraw consent — at the latest until three months after the app launches — and delete it afterwards.

We use Klaviyo (see Processors; a US provider, see section 4 on transfers) to send and manage the list; we additionally store the sign-up in our own database at Supabase.

2.6 Our presence on social media (Facebook/Instagram)

We maintain publicly accessible profiles on the social media services Instagram and Facebook (provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland). When you visit or interact with these profiles, Meta processes personal data (e.g. your usage behaviour) and provides us with anonymised statistics about the use of our pages ("Insights"). We have no access to the underlying raw data and no influence over its further processing by Meta.

For the collection of these statistics we are joint controllers together with Meta (Art. 26 GDPR); all other processing is Meta's sole responsibility. The legal basis is our legitimate interest in an appealing public presence and reach analysis (Art. 6(1)(f) GDPR). You can find out which data Meta processes in detail and what rights you have towards Meta in Meta's Privacy Policy.

If you prefer to join the waitlist or send app enquiries in a data-minimising way rather than via social media, please use our form on lingr.online or write to datenschutz@lingr.online. For our advertising on Meta we use no tracking pixels and do not upload any contact lists to Meta; ads are delivered solely by Meta based on interest/audience categories.

2.7 Safe-Meet

Safe-Meet involves the most sensitive data in the whole app, which is why it has its own section. When you set up a Safe-Meet, we store:

  • the meeting place — as text and, if you set it on the map or choose a place from lingr, as an exact coordinate
  • the time by which you intend to check back
  • whom you are meeting, if you pick that person from the app
  • an optional note
  • which trusted contact you chose for it

Sealed until the check-back fails. While the Safe-Meet is running, your trusted contact only sees that one is running and until when. The meeting place, the person and the note are stored on the server in such a way that they cannot query them — this is not a setting anyone could forget, it is the access rule itself. If you check back, the entry is deleted and your trusted contact never learns the details. If you do not check back, the server releases them and notifies that person. Released details are deleted 48 hours after the release.

Legal basis for creating and holding the entry: Art. 6(1)(b) GDPR (performance of the usage contract); for the special categories of data your explicit consent under Art. 9(2)(a) GDPR, which you give by setting it up. For the release in the case of a missed check-back we additionally rely on Art. 6(1)(d) and Art. 9(2)(c) GDPR (protection of vital interests) — which is precisely what the feature is built for.

When others name you. If someone picks you in a Safe-Meet as the person they are meeting, your profile name becomes part of that entry — and, if the check-back fails, is shown to that person's trusted contact as well. This applies to every lingr member, even without a Safe-Meet of your own. We do this because a safety feature loses its purpose without the “with whom”; the legal basis is Art. 6(1)(d) or (f) GDPR. You may object to this processing under Art. 21 GDPR — write to datenschutz@lingr.online.

You can only choose trusted contacts from your confirmed connections, at most three. The role has to be accepted and is locked while a Safe-Meet is running.

2.8 Phone number and hiding from contacts

Phone number. Every account confirms a mobile number with a code sent by SMS. This serves two purposes: one number belongs to exactly one account, which makes fake and duplicate accounts harder, and the number is the basis for hiding from contacts. We do not store your number in plain text, only as a check value (HMAC with a secret key); the same applies to earlier numbers of your account for as long as the account exists. Your number is never shown to anyone. To send the code, we pass the number and the message text to our SMS provider (section 3), which logs the delivery. We count wrong code entries per number — only as a check value with a timestamp — and delete them after two days. If someone tries to confirm your number for another account, you get a notice.

Hiding from contacts. You can pick people from your address book who should not see you on lingr. The app uses the iOS contact picker for this and only receives the contacts you select, not your whole address book. The names stay on your iPhone. The numbers of the selected contacts are sent encrypted to our server, converted into check values there straight away, and only these check values are stored. We don't notify anyone. If a number on your list belongs to a lingr account, you no longer see each other, and whatever existed between you is deleted as with blocking; chats are only hidden.

Legal basis for the phone number: Art. 6(1)(b) GDPR (user agreement) and Art. 6(1)(f) (our legitimate interest in preventing fake and duplicate accounts). For hiding from contacts: Art. 6(1)(b) GDPR towards you; we process the check values of your contacts' numbers under Art. 6(1)(f) GDPR — the legitimate interest is protecting you from an unwanted outing. An entry stays on the list for at least 30 days and after that until you remove it; when you delete your account, your number and your list are deleted immediately.

2.9 Board

On the board you share with your connections what you are up to – and only with them; you can exclude individual connections. We store:

  • texts (up to 500 characters) and photos you post yourself
  • cards for meetups and public events you are going to (without an address), as well as check-ins at places and public events – but only if you explicitly share them after the respective action; nothing ends up on the board automatically, and check-ins at meetups cannot be shared at all
  • hearts you give
  • replies: they go into your chat as a message, together with the reference to the post and a copy of its content, so that you can see what the reply refers to
  • reports about posts, with a copy of the reported post for review

Photos are checked for nudity on your device before uploading (section 2.3b) and are kept in protected storage that only authorised people can retrieve. The app only accesses the camera when you choose "Take photo"; only the photo you post is uploaded. Posts are visible for 7 days and deleted afterwards. You can delete any of your own posts at any time. Legal basis: Art. 6(1)(b) GDPR; for shared check-ins at queer places, additionally your explicit consent under Art. 9(2)(a) GDPR, which you give by sharing.

2.10 Sharing in the chat ("More about me")

Your age, your social media names and your albums are only visible to people you share them with in a chat – for 24 hours, 7 days or without a time limit. We store what you shared with whom until when. Only your age is ever shared, never your date of birth. Nobody but you can retrieve your social media names directly, only through a share. You can withdraw a share at any time; blocking deletes all shares between you. Photos in albums are kept in protected storage that only people you shared them with can load from. An expired share no longer has any effect, but the entry remains stored until your next share with the same person or until your account is deleted.

The app shows shared photos with a watermark made of "lingr", the @name of the person viewing them and the date. During a screen recording it covers other people's private photos. If someone takes a screenshot of a photo in the chat, a notice appears in the chat. Legal basis: Art. 6(1)(b) GDPR.

2.11 Groups, meetups and events

Groups. We store a group's name, description, city, up to five interests and how people join, its members and their roles, requests to join, invitations and the invite link, as well as the group chat. Groups without activity are archived after 30 days. If you delete your account, your membership ends; groups you started remain for the other members, without your name.

Meetups. We store what the host enters – title, activity, time, description, spots, the group if any – and the meeting point as an exact address with a coordinate. Anyone not accepted only sees a rough area. The host and accepted guests see the address, the latter only once there are three participants; only accepted participants see the participants' names. If you request to join a meetup, the host sees your profile. We also store requests, acceptances, cancellations and invitations.

Events. We store events with their details and images, people going, check-ins and ratings.

We delete the exact address of a meetup one day after the meetup; after that the app only shows the rough area. The other details of past meetups and events remain stored until the host or organiser deletes their account. Legal basis: Art. 6(1)(b) GDPR.

3. Processors

We use the following service providers under data-processing agreements pursuant to Art. 28 GDPR:

  • Supabase Inc. (EU region) — database, auth, storage. Hosting in Frankfurt.
  • Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA) — sending and managing the waitlist and newsletter emails. The data processing addendum (DPA) incl. EU Standard Contractual Clauses is automatically part of Klaviyo's terms of service; Klaviyo is also certified under the EU–U.S. Data Privacy Framework.
  • Cloudflare — website hosting, DDoS protection, DNS.
  • Apple Inc. — App Store, push notifications, Sign in with Apple, maps and turning coordinates into place names.
  • seven communications GmbH & Co. KG (seven.io, Kiel, Germany) — sending the SMS codes to confirm phone numbers.

We check photos and texts (section 2.3b) without any third party: the app checks photos on your device, our own server checks texts.

4. Transfers to third countries

Where possible, we keep data in the EU. For Apple services (push notifications, App Store purchases) and for sending the newsletter/ waitlist emails via Klaviyo, data is transferred to the USA — in each case on the basis of the EU Standard Contractual Clauses (SCC) and the EU–U.S. Data Privacy Framework.

5. Retention period

  • Active accounts: as long as you use the account
  • Check-ins at places, meetups and events: you count as present until 30 minutes after your last sign of activity in the app; the entry itself is deleted 48 hours after the last activity
  • Safe-Meets: immediately when you check back; released details 48 hours after the release
  • Board posts: after 7 days, earlier if you delete them
  • Searches for an @name: after 30 days
  • Contact requests including the first message: as long as both accounts exist – they carry the rule of who may still request whom
  • Locations shared in chats: the coordinate at the latest 30 minutes after the period you chose has ended
  • Exact address of a meetup: one day after the meetup
  • Expired shares, appeals and past meetups and events without the address: until the account that created them is deleted
  • Phone number (as a check value) and the hidden-contacts list: until your account is deleted; list entries at the earliest 30 days after adding them, when you remove them. Wrong code entries: after 2 days
  • Photos you delete: the database entry immediately, the file itself shortly afterwards via a queue – deleted images do not linger as orphans in storage
  • Page views on the website (section 8): no personal reference, therefore no time limit
  • Deleted accounts: the profile is invisible immediately; phone number, hidden-contacts list and board posts are deleted immediately, everything else irrevocably after 30 days. Within these 30 days, support can restore an account at your request. So that nobody can take over your profile name straight away, a check value of the name remains stored afterwards, from which the name cannot be worked out
  • Logs (anonymised): max. 90 days
  • Billing data (if any): 10 years (§ 147 German Fiscal Code)

6. Your rights

You have the right at any time to:

  • access the data we store about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure ("right to be forgotten", Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • object to the processing (Art. 21 GDPR)
  • withdraw consent given, with effect for the future

You can change many details directly in the app (edit profile) or export them yourself (Profile › Settings › "Export my data"). For all other requests – including full access to your data – send a short email to datenschutz@lingr.online; we respond within the statutory period of one month (Art. 12(3) GDPR).

7. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority at any time — for a company based in Bavaria this is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

8. Cookies and audience measurement

This website sets no tracking cookies, no third-party analytics tool and no advertising pixels. Fonts are served locally from our own server — no data is transferred to third parties such as Google. Should any cookies be used, they are technically necessary; consent is not required for these (§ 25(2) German TDDDG).

We do, however, count page views in our own database, to see which pages are read and which campaign brought someone here. The only things stored are:

  • the path requested (e.g. “/community”)
  • the time of the request
  • the campaign parameters in the address (utm_source, utm_medium, utm_campaign)
  • the referring page, if you arrived via a link

What is not stored: IP address, browser fingerprint, session or device identifier. Nothing is placed on your device, and the entries cannot be attributed to you or to a single visit. No personal data arises in the process; consent is not required for it.

9. Push notifications (in the app)

If you grant push permission, we process the device token issued by the Apple Push Notification service. Notifications contain, for example, a person's @name or the name of a group or event, and for chat messages also their text (for photos and shared items only a note such as "Photo"). They are delivered to your device through the Apple Push Notification service. Whether the text appears on the lock screen is up to you in your iOS settings under "Notifications" › "Show Previews". You choose in the app which notifications you receive; only the notification to a trusted contact when a Safe-Meet check-back fails always gets through. You can disable push notifications at any time in your iOS settings.

10. Changes to this privacy policy

We reserve the right to adapt this policy if our processing changes or legal requirements evolve. Last change: 27 October 2026.

Profile photos are AI-generated