Your experience, protected — from the very start.

This Privacy Policy describes how Avlli collects, uses, processes, and protects personal data when you use the Avlli website, application, and related services (together, the “Services”). It is intended to help you understand what information is involved when you create an account, complete a profile, take the archetype test, play games, send messages, or use Google Sign-In.

Avlli (“Avlli”, “we”, “us”) operates the Services. For privacy questions and privacy requests, contact:

trust@avlli.com

Avlli is intended only for people aged 18 or older. Date of birth is collected during profile completion so Avlli can check age eligibility. Users under 18 cannot complete profile setup or use the product.

Depending on how you use Avlli, we may collect or process the following categories of information:

• Account and authentication information, including email address and authentication identifiers used to create and access your account.
• Profile information you provide, such as display name, date of birth, gender, intent, city, bio, and profile photos.
• Archetype and personality-test responses, results, and related feedback.
• Game participation and activity, including rooms, invites, and connection-related activity.
• Messages and Direct Whispers you send or receive on Avlli.
• Referral-related information where you use or are attributed through referral features.
• Product analytics and events that help Avlli understand product use and reliability (for example, session, profile, game, and messaging-related events).
• Technical, session, and security information needed to operate, authenticate, and secure the Services.

If you choose Google Sign-In, Avlli may receive the following Google user data through Google OAuth and Supabase Auth, as applicable: your Google account email address; your Google account name; Google profile picture information; and a Google/provider account identifier.

Avlli uses this Google user data for authentication; creating or accessing your Avlli account; maintaining your authenticated Avlli session and account; and account security. Avlli’s product primarily uses your authenticated account identifier and email address. Your Google name and profile picture are not automatically copied into your public Avlli profile.

Google Sign-In authentication is handled through Google OAuth and Supabase Auth. Authentication and account information may be processed and stored as necessary to provide Avlli authentication and account functionality.

Avlli does not sell Google user data. Avlli does not share Google user data with data brokers or for targeted or personalized advertising. Relevant authentication data may be processed by Supabase, Avlli’s authentication and backend service provider, solely as necessary to provide and secure the service. Avlli may disclose information where required by law or where necessary to protect the rights, safety, or security of Avlli, users, or others, consistent with the rest of this Privacy Policy.

Avlli does not request access to Gmail, Google Drive, Google Calendar, or Google Contacts, and does not request access to the contents of those services.

Google-derived authentication and account data is retained only as necessary to provide the Avlli account and service and to meet applicable legal or security obligations. This policy does not invent a fixed retention period. You can delete your Avlli account through Delete Account in the product. You can revoke Google Sign-In access through your Google Account’s third-party access or security settings.

Google-derived authentication data is protected by Avlli’s technical and organizational safeguards, including authentication and database access controls. Avlli does not claim absolute security, and this Google Sign-In data is not end-to-end encrypted.

Avlli uses personal data for purposes such as:

• Creating and authenticating accounts, and keeping accounts secure.
• Operating profiles and profile-related features.
• Providing archetype and personality functionality.
• Providing games and social interactions.
• Enabling messages and Direct Whispers.
• Operating referral functionality where applicable.
• Maintaining safety and security, and helping prevent abuse.
• Maintaining and improving product reliability and functionality through product analytics.
• Complying with applicable legal obligations.
• Contract: processing that is necessary to create and authenticate accounts and to provide the core Avlli services you request, including your profile, the archetype experience, discovery and matching, games, Direct Whispers, and other service features you choose to use.
• Legitimate interests: where appropriate, processing for the safety of users and the service, the prevention and investigation of abuse, security and service integrity, and proportionate first-party product analytics used to understand and improve reliability and functionality. Product analytics are not treated as legitimate-interest processing in every context.
• Legal obligation: where necessary to comply with applicable legal obligations, including handling valid data-protection rights requests where the law requires it.

Avlli does not use personal data for advertising purposes described in this policy.

Some information may be visible to other Avlli users according to product, reveal, and privacy rules for a given experience (for example, profile details or identity that becomes visible under a game’s rules).

Technical service providers may process information only as needed to operate and secure the Services. Avlli uses Supabase for authentication and relevant backend infrastructure (including database and storage functions used by the Services).

Avlli may disclose information where required by law or where necessary to protect the rights, safety, or security of Avlli, users, or others.

Avlli does not sell personal data. Avlli does not share personal data with data brokers for targeted advertising.

Avlli keeps personal data only for as long as necessary for the purposes described in this policy, subject to applicable legal, security, and operational requirements.

You can delete your Avlli account using Delete Account in the product. That process removes the authentication account used to sign in and removes account-owned profile data according to Avlli’s deletion process.

Some shared game, message, or thread history may remain where needed to preserve records or the experience of other users. Where applicable, Avlli removes or anonymizes the deleted user’s identifying information and may remove or replace content associated with that user.

Safety and moderation reports may remain after account deletion, with account identifiers removed or detached where appropriate.

Closed moderation reports are subject to Avlli’s current retention period of 24 months from case closure, measured from the recorded review or closure date. This describes the current policy period. It does not mean that closed reports are deleted automatically when that period ends.

Active moderation cases may remain for as long as necessary for safety, investigation, or related purposes.

Some technical logs, security records, backups, or other information may remain for limited periods where necessary for security, operation of the service, legal compliance, or the establishment, exercise, or defence of legal claims.

Identifiable raw product analytics are retained for up to six calendar months. Avlli applies that limit on a UTC calendar-month cycle. An event is not deleted at the exact instant it becomes six months old. This period applies only to those identifiable product-analytics events. It does not expire accounts, profiles, photos, archetype or personality information, games, messages, Whispers, moderation reports, or other user data. If Avlli accepts an analytics objection, or if you delete your account, identifiable analytics about you can be removed sooner. Those paths do not wait for the six-calendar-month cycle.

Anonymous aggregated statistics may be retained for longer, including permanently, where they no longer identify a person or single a person out.

If identifiable product analytics are later removed under that cycle, this policy does not claim that copies in provider backups disappear on the same schedule.

Other retention periods may vary by the type of data and the purpose of the processing.

Avlli uses technical and organizational safeguards intended to protect personal data, including authentication and database access controls. No method of transmission or storage is completely secure, and Avlli does not claim absolute security.

Messages, game content, and archetype-related data on Avlli are not end-to-end encrypted. Access to that data is limited through authentication and database access controls.

Depending on your circumstances and the legal basis for the processing, applicable data-protection law may give you the rights below. Whether a right applies, and how far it applies, depends on the situation.

• Access to personal data Avlli holds about you.
• Rectification of inaccurate personal data.
• Erasure of personal data, including through Delete Account where that option is available.
• Restriction of certain processing, where that right applies.
• Objection to certain processing, where that right applies.
• Data portability, where that right applies: the right to receive the applicable personal data in a structured, commonly used, machine-readable format. This does not mean that every field stored by Avlli is portable, and Avlli does not currently offer an automated self-service export.

To make a privacy request, contact trust@avlli.com. You may also be able to exercise certain controls directly in the product, including account deletion. Avlli generally responds to valid privacy-rights requests within one month. If a request is complex, or if requests are numerous, applicable law may allow an extension of up to two additional months. If Avlli needs that extension, it will tell you within the first month and explain why. Avlli may take proportionate steps to confirm that a request comes from you or from someone authorised to act for you, without routinely asking for a government identity document. A response may need to protect the rights and freedoms of other people, and Avlli may redact or limit information where the law allows or requires that. If you are in France, you may lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés).

Avlli uses service providers for functions such as hosting and infrastructure, backend and authentication, transactional email, and other technical services. Some of that processing may take place outside the European Economic Area, including in the United Kingdom and the United States. Where a transfer requires it, Avlli relies on applicable transfer mechanisms or safeguards, which may include adequacy decisions and Standard Contractual Clauses. This does not mean that every provider acts only as a processor, or that all personal data is hosted in France.

Avlli may update this Privacy Policy from time to time. Material changes will be reflected on this page.