Privacy Policy

The Third Date (“we”, “us”, “our”) operates the website at thethirddate.app. We are the data controller responsible for your personal data.

Contact us for any privacy matter via our Twitter/X: @thethirddateapp

When you join our waitlist we collect:

• First name — to address you personally when we reach out.
• Email address — to notify you when your spot opens.
• What you're looking for (optional) — relationship intent (e.g. casual dating, friendship). This is sensitive personal data under GDPR Art. 9. We only collect it if you explicitly consent.
• How you heard about us (optional) — to understand our marketing reach.
• Submission timestamp — for waitlist ordering.

We do not use cookies, analytics trackers, advertising pixels, or fingerprinting on this website.

We process your personal data on the following legal bases (GDPR Art. 6 & 9):

• Consent (Art. 6(1)(a)) — you explicitly tick a checkbox before submitting the form, agreeing to be contacted about your waitlist spot.
• Explicit consent (Art. 9(2)(a)) — if you choose to share what you're looking for (relationship intent), you provide a separate explicit opt-in, as this constitutes sensitive personal data.

You may withdraw consent at any time by contacting us via @thethirddateapp. Withdrawal does not affect the lawfulness of processing before withdrawal.

Your data is used solely to:

• Notify you when your early access spot is available.
• Order and manage the waitlist queue fairly.
• Understand aggregate demand across relationship intent categories (anonymised).

We will never sell your data, use it for advertising, or share it with third parties for their own marketing.

We retain waitlist data for a maximum of 12 months from the date of submission, or until the platform launches and you either gain access or are notified that your spot is unavailable — whichever comes first.

After that period, your data is automatically deleted from our database. You can also request immediate deletion at any time (see Your Rights below).

Your data is stored in Supabase, a database-as-a-service provider. Supabase is our only data processor. We have a Data Processing Agreement (DPA) in place with Supabase as required by GDPR Art. 28.

Supabase may host data in the United States. Where this involves an international transfer of personal data from the EEA or UK, it is governed by Standard Contractual Clauses (SCCs) as approved by the European Commission. For more information, see Supabase's Privacy Policy.

Under GDPR (and equivalent UK/Swiss law), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Erasure— request deletion of your data (“right to be forgotten”).
• Rectification — correct inaccurate data.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — at any time, without affecting prior lawful processing.
• Lodge a complaint — with your national data protection authority (e.g. ICO in the UK, CNIL in France).

To exercise any right, contact us via @thethirddateapp. We will respond within 30 days.

All data is transmitted over HTTPS. Our database uses row-level security and is accessed server-side only — your data is never exposed to the browser. We use a service-role key exclusively on the server and do not expose any public API keys that could allow direct database access.

This service is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted data, please contact us immediately for deletion.

We may update this policy as the platform evolves. Material changes will be communicated via email to waitlist members. The “Last updated” date at the top reflects the current version.