Last updated: October 15, 2026
This is a translation of the original Spanish text, provided so you can read it in your language. If the two versions differ, the Spanish version prevails.
In one line
Gamba keeps what it needs to show you people and parties near you. We don't sell your data and we don't show ads inside the app. What leaves the app without you entering it is an error report when something breaks, to fix it, and a notice to Meta that you installed Gamba and finished signing up, to know whether our ads on Instagram and Facebook work (§7). On iPhone, the latter carries your advertising identifier only if you allow it.
1. What data we keep
You enter everything below yourself, except where it explicitly says the app measures it.
·
To have an account: your email address. If you sign in with Google, we receive your email and your account identifier from Google; nothing else. If you sign in with Apple, the same, and if you choose “Hide My Email” what we get is the forwarding address Apple creates: we don't see yours. Your password, if you use one, is stored encrypted by Supabase and we never see it.
·
Your profile: name, date of birth (to calculate your age and check that you are an adult), gender or group makeup, city, photos, bio, music genres, artists and what you are looking for.
·
Your location: only if you give permission. See §2, which is long because it is the most sensitive thing after your face.
·
Your activity: who you liked, passed or super liked, your matches, the messages in those chats, which parties you said you are going to and who you blocked.
·
When you were last here: a timestamp of the last time you used the app, updated at most once an hour. It keeps us from sending you a reminder about something you already saw. We also record which days you opened it and from what kind of device (iPhone, Android or web), without the time, to measure how many people come back.
·
How you use the app: when the Premium or Super Likes screen was opened and from which button; when Discover ran out of profiles to show you, with your area rounded to about 10 km; and whether each notification we sent reached your phone. They tell us what works and where people are missing, not to show you ads or to share with anyone.
·
Where you came from: if you installed Gamba from someone's referral link, that link's code. On Android, Google Play passes it at install time; on the web, the link itself. It tells us which referrals work. On iPhone we don't receive it.
·
To measure our advertising: we don't keep this ourselves: Meta receives it directly from the app. See §7, “Meta”.
·
Your time zone and language: reported by your phone. The time zone lets us send notifications at a reasonable hour where you are and not in the middle of the night; the language, to write to you in the one you use. It is not your location: it is the time zone, the size of a continent.
·
Your devices: an identifier provided by Expo so we can send you notifications. It is deleted on its own if you uninstall the app.
2. Your location
The app asks for location permission and does not work without it: if you decline, Discover shows you a screen to turn it on instead of the deck. We would rather say it this plainly than pretend it half works.
·
Only while the app is open: there is no background location, no service and no continuous tracking. While Gamba is minimized nothing runs. Your position is read once when you open it and once each time you come back to it, if more than 15 minutes have passed.
·
Nobody receives your coordinates: not even approximate ones. All anyone else sees is a distance in kilometers.
·
That distance is not measured from where you are: it is measured between cells of a grid of roughly 1.6 km. This is on purpose: if it were calculated from your exact point, someone could request the deck from three different places and cross the three distances to work out where you live. With cells, that calculation gives the cell, not the house. The smallest figure you will read is “1 km away”, never “0 km”.
·
You don't need to touch GPS to stop appearing: there is Pause, in Settings. And if you don't want Gamba to see your location, you remove the permission from your phone's settings. We didn't add a third switch inside the app because two similar controls are confusing.
·
The city on your profile is something else: you choose it, it is public, and it is what we use for group profiles, which have no GPS. A group is located by the city it declared and nothing else.
3. Your face, if you verify your profile
Verification is optional. If you do it, this is exactly what happens, and we describe it in detail because a face is biometric data and deserves no surprises.
·
You take a selfie in a pose we ask for: the pose is chosen by the server, not the app, so an old photo can't be reused.
·
Your phone looks at it first: with a face detector that runs on the device and sends nothing anywhere. It is only a filter so we don't spend a comparison on an obviously bad photo.
·
Then it is compared with your profile photos: and that comparison is done by Amazon Rekognition, an AWS service, on servers in the United States. It is sent the selfie and your profile photos, and returns a similarity percentage.
·
The selfie is deleted right away: whatever the result. We don't keep it, and we don't create any face collection in AWS: no “template” of your face remains that could be used to recognize you later.
·
Of all that, we keep the verdict: approved or not, with which photos, and the similarity percentage, which is deleted after 90 days. The whole record is deleted after a year.
·
On AWS's use of your face: AWS may use content processed by its artificial intelligence services to improve them, unless the customer expressly opts out. We opted out: the AWS account Gamba runs on has the “AI services opt-out policy” turned on for all services. According to AWS, that also deletes any content previously kept for that purpose. What we guarantee is that we made that opt-out; AWS's compliance is governed by its own terms.
4. What we use each thing for
To build your deck and calculate distances, to decide whether there is a match, to make chat work, to show you parties where you are, to let you know when something happens and to stop abuse. There is no other use: we don't profile, we don't sell, we don't hand anything to advertisers.
5. What other people see
Your profile —photos, name, age or number of members, gender or group makeup, city, bio, genres, artists, what you are looking for, your verification check if you have it and the parties you said you are going to— is visible to other accounts while they discover people. Plus the approximate distance explained in §2.
·
Your email is never visible: to anyone, at any time.
·
Who liked you is not shown: except for Super Likes, which are seen before deciding.
·
Chats are between the people in the match: we don't read them as a practice. We may access a specific message if we receive a report and need it to investigate.
5.b When you remove a photo
Removing it from your profile also deletes the file, not just the reference: it stops being available right then. A copy may survive a few minutes in the delivery network that serves the images, which is why we say “stops being available” and not “disappears instantly”. The same goes for a group's photos, which any of its members can remove.
6. Groups, and people added by hand
In Gamba a group profile can add its members —name, age and a photo— without those people having an account. That is what lets a single person set up a crew's profile, and the cost is that someone may be published who never agreed to anything.
·
Whoever adds them is responsible: the Community Guidelines only allow adding real members of the group who have given their consent.
·
And there is a way out without an account: anyone can ask to be removed without signing up. If the group insists, we take down the group's profile.
7. Who it is shared with
With nobody who isn't needed for the app to work. This is the complete list of providers, what each one is used for and what it receives:
·
Supabase: the database, the account system and photo storage. It is where everything in §1 lives. The project's servers are in Canada.
·
Expo: the service that delivers notifications. It receives your device identifier and the text of the notification.
·
Google (Firebase Cloud Messaging): the channel Android uses to deliver notifications. If you sign in with Google, it is also involved in signing in.
·
Apple: only if you sign in with Apple. Apple confirms it is you and gives us an identifier and an email address, which is the forwarding one if you chose to hide yours.
·
Amazon Web Services (Rekognition): only if you verify your profile, and only as described in §3. In the United States.
·
Geoapify: the city search and the location of the venues where parties happen. It receives the text you type when searching for a city, not your identity or your position. The answers are stored so the same question isn't asked twice.
·
Netlify: hosting for the web version. It sees what any web server sees: the address you requested.
·
Sentry: the service that gets notified when the app crashes. It receives what the error was and where in the code, the app version, the phone model and its operating system, and your account identifier —to know whether it happens to many people or just one. It does not receive your email, your photos, your messages, your location or your IP address. It is in the United States.
·
RevenueCat: only if you buy something. It checks with the store that the purchase is real and tells us what you are entitled to. It receives your account identifier —the same one as in Supabase—, which product you bought, when, and whether it is still active. It does not receive your email, your name, your photos or your location. Your card details don't go through here: Apple or Google charges you, and neither we nor RevenueCat see those details. It is in the United States.
·
Meta (Facebook and Instagram): to measure Gamba's ads on Instagram and Facebook: knowing how many people installed the app from an ad and showing it to similar people. The app tells it that it was installed and opened, that you finished signing up, and the store purchases you make (which product and at what price). With that it receives the phone model, its operating system, the app version, your IP address and the phone's advertising identifier: on iPhone, only if you accept the tracking prompt (§13); on Android, the one you can delete or reset from the phone's settings. It does not receive your email, your name, your account identifier, your photos, your messages, your location or anything from your profile. How Meta uses that data is set out in its own policy, at facebook.com/privacy/policy. It is in the United States.
·
Nothing else: we don't show ads inside the app or use any other third-party analytics. The little we measure (§1, “How you use the app”) we measure ourselves, it stays in our database and is not sent to anyone.
8. How long it is kept
The general rule: what makes up your account lives as long as the account exists, and the way to delete it is to delete the account. What has a time limit is the auxiliary data, and it is deleted by a procedure we run periodically.
·
As long as your account exists: profile, groups, members, matches, chats, party attendance, blocks, preferences and history of likes and passes.
·
90 days: the similarity percentage of a verification, which is cleared keeping only the verdict; and the record of which reminders we sent you.
·
12 months: the full record of each verification; Rekognition usage counters; when you opened the Premium screen and when Discover ran empty; and your last known location if you don't use the app in all that time.
·
13 months: which days you opened the app.
·
30 days: photo upload permissions, group invitations already resolved and the record of whether each notification arrived.
·
1 hour at most: any verification selfie left halfway. Under normal conditions it is deleted immediately.
·
Never kept: your coordinates in another user's hands, or a model or template of your face.
9. Notifications
You can choose which ones to receive, by category, from Settings → Notifications: matches, messages, message likes, Super Likes, updates from your groups, and parties and promotions. The server respects each switch before sending anything. Parties and promotions is the only promotional one and it can also be turned off. On top of that, the operating system permission is still yours and overrides all of this.
10. Deleting your account, and what remains
You can delete it from Settings → Delete my account, or request it through the public account deletion page if you lost access. Everything of yours is deleted, including photos, which are removed from storage and not just from the database. It is immediate and cannot be undone.
·
Chats disappear on both sides: a conversation is a single shared thing.
·
A group that still exists keeps its photos: a group profile's photos belong to the group, not to whoever uploaded them. If you uploaded a photo to a group and then leave or delete your account, that photo stays there as long as the group exists, because it is the image its members show themselves with —and any of them can remove it whenever they want—. They are all deleted when the group is deleted. The same goes for a member entry the group added by hand: it stays with the group, and you ask for its removal as in §6.
·
A group of yours may outlive you: if you were the one managing it and another member with an account remains, the group passes to them instead of being deleted —with its photos—, so the others don't lose the profile they were using. If nobody remains, the group is deleted with you and so are its photos.
·
Remaining, without being tied to you: messages you wrote acting as someone else's group (which member wrote them is deleted), artists you suggested that are already in the catalog, invitations you used, reports you made and technical usage counters. In every case the reference to your account is removed and the data stays de-identified. A report stays because what you reported happened to the community, and it doesn't stop having happened because you leave.
·
If we close the account: because the community guidelines were broken, we keep a fingerprint of the email —a code that cannot be turned back into it— so it can't be used to sign up again. The email itself is not kept. An account's warnings and suspensions are deleted with it.
11. Your rights
You have the right to access your data, correct it, take it with you and delete it, and the first three don't depend on us doing anything.
·
Access and take it with you: Settings → “Download my data” builds a file with your profile, your members, your activity, your matches, your messages and your last location.
·
Correct: the whole profile can be edited, except the date of birth.
·
Stop appearing without deleting anything: Pause, in Settings.
·
Complain: if you live in Argentina, to the Agency for Access to Public Information (Agencia de Acceso a la Información Pública). If you live in the European Union, to the supervisory authority of your country.
12. Minors
Gamba is for people over 18. We ask for your date of birth when you create your profile and sign-up can't be completed by a minor. If we learn of an account belonging to a minor, we delete it. If you are a parent or guardian and believe there is one, write to us.
13. Permissions your phone asks for
Location, for what is in §2. Photos or camera, to choose your profile photos and for the verification selfie. Notifications, for alerts. On iPhone, also tracking, which is asked only once when you finish signing up: if you accept, Meta can link your install to the ad you saw (§7); if not, the app works exactly the same. All of them can be revoked from the system settings; the only one without which the app doesn't work is location.
14. Security
Access to data is restricted per user in the database itself, not only in the app: even with the application's public credentials, an account can't read what doesn't belong to it. Keys for external services never travel in the app. Even so, no platform is infallible; if a breach affecting you ever happened, we will tell you.
15. Changes
If something important changes, we will let you know inside the app and update the date at the top.
16. Contact
For anything about this policy, or to exercise your rights: info@joingamba.com.