ForUs Privacy Policy

Last updated: September 16, 2026

Every item of information we record travels the same route: it leaves your fingertips as a single action, enters our systems, is put to a specific purpose, and finally exits when its retention period runs out. This Policy follows that route stage by stage — where information comes from, what it is used for, whose hands it passes through, the conditions under which it is stored, and when it is erased. ForUs is published by BBCS Kennedy, and BBCS KENNEDY LLC acts as the operating legal entity. The nine sections below correspond to nine points along that route; read them in order, or turn only to the part you care about.

One premise runs through the whole document and should be stated first: this service is open to adults only. Accordingly, we make it explicit that the service is not directed to minors, and no one under the age of 18 falls within its scope.

01 — Where data begins: the sources of information

Collection is confined to the minimum set required for features to function; information unrelated to a concrete feature is never sought from you. Four categories of information form the entrance to this route.

Account information

The following details are handed to us directly by you during registration, sign-in and profile completion:

1. your email address, which serves as the account credential;
2. your nickname, avatar and gender;
3. your date of birth, used to verify adult status;
4. your region, used to display distance and matching scope;
5. any other details you later add or edit yourself.

Where any one of these is missing, the account may not be created and other users will struggle to identify you.

Device and technical information

So that the application renders correctly across different handsets and so that faults can be traced when they occur, the following environment data is reported automatically:

1. CPU architecture, together with device manufacturer and model;
2. total RAM and free on-device storage;
3. the sensor types fitted to the device, such as gyroscope and accelerometer;
4. IP address, network access type (WiFi or cellular) and carrier name;
5. operating system version and system time zone.

Usage and behavioural information

Your operations inside the application generate records, which allow us to reconstruct a problem, improve the product and keep the community in order. They include:

1. sign-in timestamps and sign-out times;
2. the dwell time spent on each individual screen;
3. the keywords typed into in-app search;
4. the order in which feature entry points are tapped;
5. the swipe direction and dwell time recorded on matching cards.

Payment and transaction information

When membership benefits are purchased, charging and settlement are handled independently by the official Google Play Billing channel. Only the essential receipt data returns to our systems — order number, transaction status and the item purchased. Card numbers, payment passwords and payment verification codes neither enter our databases nor could be stored by us.

02 — How data is used: the purpose each category serves

Information is used for the five purposes set out below and no processing beyond them takes place.

1. Service operation: registration, sign-in, profile display, match recommendations and instant messaging are kept running by this purpose.
2. Service improvement: performance bottlenecks and weak points in the experience are located through usage data and fault records, and product iterations follow from them.
3. Security protection: fraud, spam, bulk registration and account takeover are identified under this purpose, and account safety and community order are maintained accordingly.
4. Customer support: your enquiries, complaints and appeals receive a response under this purpose, and fault reports and abuse tickets are handled alongside them.
5. Legal compliance: obligations imposed by applicable law and regulatory requirements are discharged through this purpose, and investigations lawfully conducted are assisted.

Should information ever need to be used in a new scenario outside those five purposes, your consent will be sought separately in advance.

03 — How data moves: third-party SDKs / services, and where sharing stops

Your personal information is not sold by us, not rented out, and not traded in any other form — that has never been our practice. To keep application features working, this app integrates third-party SDKs / services, among them Kochava (install attribution), CleverTap (behavioural analytics and audience segmentation), MoEngage (lifecycle messaging), Digital Turbine (app distribution) and AppLovin (advertising monetisation); analytics tooling and push notification services likewise fall within that scope. Advertising, analytics and push — these three categories of processing activity — are carried out through the third-party SDKs / services named above. Each partner processes information only to the extent its own function requires and remains bound by its own privacy policy.

Your personal information will not be provided to outside parties except in the following circumstances:

1. you have given separate consent to that particular sharing, or granted express authorisation for it;
2. implementing essential features such as payment, push and statistical analysis requires information within the minimum necessary scope to be delivered to a commissioned partner, which must assume an equivalent duty of confidentiality;
3. a mandatory disclosure request is made by law, by a judicial authority or by a regulator;
4. sharing is genuinely necessary to protect users' personal safety, platform security or a significant public interest;
5. a merger, acquisition, restructuring or transfer of assets occurs, in which case information moves with the relevant business and the recipient must continue to apply protection standards no lower than those of this Policy.

04 — Where data is kept: storage, safeguards and retention

Our safeguarding of personal information rests on four concrete links in the chain:

1. In transit — TLS/SSL encryption runs the full length of the connection, leaving as little room as possible for data to be intercepted or altered on the way;
2. At rest — sensitive fields in stored data are uniformly encrypted with the AES-256 algorithm, and keys are held separately rather than mixed in with business data;
3. On access — permissions are allocated by role (RBAC), and the data range each staff member may read is limited to the minimum set their own work requires;
4. On audit — every read of data leaves a log, logs are sampled at regular intervals, and an anomalous access triggers an alert immediately.

Beyond those four links, security assessments and penetration tests are carried out at least once each year; personal information protection training is delivered to all employees on a regular basis; and a dedicated contingency plan exists for data security incidents, so that locating, containing and reporting an anomaly can be completed promptly.

Retention is governed by one principle: records are kept only for as long as the service purpose genuinely requires. Once that period ends, or once the law no longer requires retention, the data concerned is deleted, anonymised or de-identified. If you apply to delete your account yourself, the full account of what is erased and what is exempted can be found on the ForUs account deletion page.

05 — Where data ends: erasure, anonymisation and your five rights

Full control over your information is reserved to you by us. Through the in-app settings entry or the support mailbox, the five rights below — access, rectification, erasure, withdrawal of authorisation and obtaining a copy — may be exercised in accordance with law:

1. Right of access — your account details and the processing records associated with them may be retrieved, reviewed and checked at any time;
2. Right of rectification — where a record is found to be inaccurate or incomplete, you may ask us to correct, supplement or refresh it;
3. Right of erasure — you may ask for your personal information to be erased, or start a deletion request through the in-app entry or the account deletion portal;
4. Right to withdraw consent — consent previously given for a specific processing activity may be withdrawn at any time; withdrawal does not affect processing already completed beforehand;
5. Right to a copy — a structured copy of your personal information can be supplied at your request.

Beyond these five rights, enquiries, objections and complaints about personal information processing are equally welcome. Once identity verification has been completed, a reply will be given within a reasonable period.

06 — A special case: why this service is not directed to minors

ForUs is a social platform for adults, and minors fall outside its scope. The age threshold sits at the registration step, where date of birth is a mandatory field; applications that do not reach the age of 18 cannot pass validation. Should a user's misreported age, fraudulent registration or some other circumstance we failed to anticipate cause a minor's personal information to enter our systems, once this is confirmed the information concerned will be deleted and the corresponding account restricted from further use of this app. The complete arrangements for child safety are set out in the ForUs Child Safety Standards.

07 — The boundaries of this Policy: scope and exceptions

All processing of personal information by the ForUs mobile client and its accompanying web services (together, "this app" and "we") is governed by this Policy. In the course of that processing, five baselines — lawfulness, legitimacy, necessity, transparency and security — are observed at all times.

Services operated independently by third parties fall outside the scope of this Policy. When you follow a link from this app to an external page, or invoke a feature supplied by a third party, the information is processed by that third party under its own privacy policy; reading the other party's notice before using such a feature is advisable.

Continued use of this app means that you have read and understood this Policy. If any part of it is unacceptable to you, please do not register for or use the service.

08 — How this Policy evolves: revisions and notice

This Policy is not set in stone. Where product features are adjusted, service models change, or new requirements emerge in laws and regulations, the Policy is revised accordingly, the new version is published in the in-app announcement area or on the official website, and the date at the top is refreshed at the same time. Should a revision touch on your material rights, we will tell you before it takes effect by pop-up, in-app notice or another sufficiently prominent method; and where genuinely necessary, your consent will be sought afresh.

09 — Beyond the data route: how to reach us

If you have questions, comments or complaints about this Policy, the way your personal information is processed, or the exercise of your rights, please contact us through the channels below: