DietMatchPrivacy Policy
Last updated: October 25, 2026
This policy explains what personal information the DietMatch app (on Android and iPhone) collects, why, who it is shared with, how long it is kept and what your rights are. It is written to comply with Québec's Act respecting the protection of personal information in the private sector (Law 25) and, for users located in the European Union, the General Data Protection Regulation (GDPR). If this English version and the French version differ, the French version prevails.
1. Who we are
DietMatch is a Québec project based in Montréal (Québec, Canada), founded by Samuel Cormier and developed by Xavier Beauchamp.
Person in charge of the protection of personal information: Samuel Cormier, founder.
For any question or request about your personal information:
dietmatch.app@gmail.com.
2. Information we collect
Information you give us
- Account: email address, password (stored hashed), or your Google identifier if you sign in with Google.
- Profile: first name, date of birth, gender, pronouns, city, bio, profile photos and food photos, search preferences (age, distance).
- Food preferences: diets (vegan, halal, kosher, etc.), favourite cuisines, cooking level.
- Health-related information: allergies, intolerances and health conditions you choose to add (for example celiac disease, diabetes, irritable bowel syndrome, SIBO). See section 3.
- Identity verification (optional): a selfie and a photo of your ID document, to get the "verified profile" badge. See section 3.
- Content and interactions: messages sent to your matches, recipes and posts, reports and blocks.
Information collected automatically
- Location: your device's approximate location, only if you allow it, to calculate the distance between profiles. It is rounded to about 1 km before being saved: your exact location is never stored or shown to other users.
- In-app activity: likes, swipes, matches, use of Premium features.
- Technical data: IP address, device type and model, app version, notification token (to send you notifications), error logs.
- Main photo check: a face detection tool checks that a face appears on your main photo. It runs entirely on your device: the photo is not sent to any provider for this check and no biometric data is kept.
Payments
Premium subscriptions are paid through Google Play (Android) or the App Store (iPhone), and managed with RevenueCat. We never receive or store your card number: we only receive the status of your subscription (active, free trial, renewal or expiry date).
3. Sensitive information
Health. Your allergies, intolerances and health conditions are sensitive information. Adding them is optional and done with your explicit consent. They are only used to calculate your food compatibility with other profiles. They are never sold, never used for advertising, and you can edit or remove them at any time from Profile → Edit.
ID document. Photos sent for identity verification are stored in a private space, accessible only to the moderation team reviewing the request. They are never shown on your profile or shared with other users.
4. Why we use it
| Purpose | Legal basis |
|---|---|
| Create and manage your account, show your profile, suggest compatible profiles, enable messaging between matches | Performance of the contract (the Terms of Use) |
| Calculate compatibility using your health information | Explicit consent |
| Calculate distances using your location | Consent (device permission) |
| Verify your identity | Explicit consent |
| Send notifications (new match, new message) | Consent (device permission) |
| Manage your Premium subscription | Performance of the contract |
| Keep the service safe: moderation, handling reports, preventing fraud, harassment and fake accounts | Legitimate interest and legal obligations |
| Send service emails (address verification, password reset) | Performance of the contract |
We do not do targeted advertising and we do not sell any personal information.
5. What other users can see
Other users see your public profile: first name, age, photos, city, bio, food preferences, and an approximate distance. Your messages are only visible to the person you are talking with, except when a report is made: the moderation team can then read the latest messages of the conversation concerned to handle the report. Your email address, exact date of birth, precise location and verification documents are never shown. Recipes you publish are visible to all members.
6. Who we share it with
We use the following service providers, who process data only on our behalf:
- Supabase: database, authentication and file (photo) hosting.
- Google: Sign in with Google (if you use it), notifications (Firebase Cloud Messaging) and payments through Google Play.
- OpenStreetMap (Nominatim): finding the name of your city from the name you type or your approximate location.
- RevenueCat: management of Premium subscriptions bought on Google Play or the App Store. RevenueCat receives your DietMatch account identifier and your purchase history, never your payment details.
- Resend: account emails (address confirmation, password reset).
- Cloudflare: hosting of this website (receives visitors' IP address).
- Expo: delivery of app updates (receives the IP address and device model).
- CARTO: map tiles shown in "Recipes near me" (receives the IP address and the map area displayed).
- jsDelivr, unpkg and Google: download of the map and face detection tools. They receive the IP address, never your photos.
Your data is hosted outside Québec: the database and files are located in the United States (Supabase, Virginia region), and our other providers may also process data in the United States. We make sure these transfers provide adequate protection for your information. We may also disclose information to authorities when required by law.
7. How long we keep it
- Active account: as long as your account exists.
- Account deletion: your profile, photos, verification documents, matches, messages, swipes and preferences are deleted immediately.
- Legal obligations: billing information and information needed to fight fraud may be kept for up to 7 years.
- Sign-in IP addresses: as long as the account exists, for security (bans, fake accounts); deleted with the account.
- Technical logs: 90 days.
To delete your account, see Delete your account.
8. Your rights
- Access and portability: export your data from Settings → Export my data, or write to us.
- Correction: edit your information from Profile → Edit.
- Deletion: from Settings → Delete my account, or without the app.
- Withdrawing consent: remove your health information from your profile, or turn off location and notifications in your phone's settings.
- Objection and restriction: write to dietmatch.app@gmail.com. We reply within 30 days.
- Complaint: you can contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the data protection authority of your country.
9. Security
All communications are encrypted (HTTPS/TLS). Passwords are hashed. Database access is restricted by row-level security rules: a user can only read the data meant for them. Since no system is infallible, we will notify you and the relevant authorities of any privacy incident that presents a risk of serious injury.
10. Minors
DietMatch is strictly for people aged 18 and over. A date of birth and an age confirmation are required at sign-up. Any account belonging to a minor is deleted as soon as it is detected. If you think a minor is using DietMatch, report it to dietmatch.app@gmail.com.
11. Cookies
The app and this website only use strictly necessary cookies and local storage (login session, language choice). No advertising cookies or third-party trackers are used.
12. Changes
If we make a significant change to this policy, we will let you know in the app at least 14 days before it takes effect. The date of the last update is shown at the top of this page.
13. Contact us
For any question about your data or the app: dietmatch.app@gmail.com