Draft for legal review. Not legal advice.

Pilimon Connect Privacy Policy

Last updated: 26 October 2026

Pilimon Connect is not affiliated with, endorsed by, or operated by Pamantasan ng Lungsod ng Muntinlupa (PLMun). PLMun does not receive your Pilimon Connect data, and we do not receive any data from PLMun.

The short version

• One person runs Pilimon Connect and is responsible for your data. That same person is the Data Protection Officer.
• We collect what a dating app needs: your campus email, birthdate, profile, photos, likes, matches, messages, and reports.
• Your gender and "Show me" choice can reveal your sexual orientation. We use them only with your separate consent, only on our server, and we never show "Show me" to anyone.
• App data is stored on servers in Germany (Hetzner, Nuremberg). Payments go through Polar. Transactional email is sent by Brevo; support/privacy email uses the operator's Gmail.
• Chats are not end-to-end encrypted. Moderators only see messages that someone attaches to a report.
• Delete your account and we hide it right away and erase it within 30 days. A few safety records are kept longer, listed below.
• You can see, download, fix, or delete your data, and you can complain to the National Privacy Commission.

Contents

1. Who is responsible for your data
2. What data we collect
3. Sensitive personal information
4. How we use your data, and on what legal basis
5. Your consent for gender and "Show me"
6. Who can see your data
7. Moderators and report evidence
8. Photo screening
9. Service providers and where your data is stored
10. How long we keep your data
11. How we protect your data
12. Your rights
13. Data breaches
14. Cookies, local storage, and the app on your device
15. Notifications and emails
16. Under-18s
17. Changes to this policy
18. Contact and complaints

1. Who is responsible for your data

Pilimon Connect is run by its founder as an individual (not a company or registered business). Under Republic Act No. 10173 (Data Privacy Act of 2012), the operator is the personal information controller for your data.

The operator is also Pilimon Connect's Data Protection Officer (DPO).

• Name: Pilimon Connect, run by its founder as an individual (not a registered business)
• Address: Muntinlupa City, Metro Manila, Philippines
• Privacy email: [email protected]
• NPC registration: Not yet registered. The registration number will be added here once the NPC issues it.

2. What data we collect

You give us:

Feature requests are included in Download my data and are deleted when your account is erased. Avoid including private conversations or other people's personal details. The optional Buy Me a Coffee link opens an external site under its own terms and privacy policy; tips do not purchase or unlock Pilimon Connect+.

We create or record:

• Your age (calculated from your birthdate).
• When you confirmed and re-confirmed your campus email.
• When you were last active (updated when you open Discover). It is never shown to other students. It is used only on our server for the Plus "recently active" filter (active in the last 7 days).
• Results of photo screening (cleared, held, rejected), the nudity score, and whether a face was found. These are stored with the photo and deleted with it. A short technical log line (photo ID, result, score) is kept in server logs for up to 30 days.
• Matches, like counts, and blurred low-resolution previews of your photos (for free users' Likes tab).
• Your Plus status, plan, price, currency, renewal or end date, whether you cancelled, and Polar's IDs for your subscription and customer record, received from Polar. We do not receive your card details or billing address.
• When you start a Plus checkout, we send Polar your account ID, your campus email, and your IP address so Polar can process the checkout.
• Technical data needed to keep the service running and secure. Server logs may contain IP addresses, account IDs, browser details, and which features were used. The web app's own access logs are switched off. Other server logs are kept for up to 30 days.
• If you turn on notifications, a push subscription address and keys for your browser. They are deleted when you turn notifications off, when your browser's push service tells us the subscription has ended, or when your account is deleted.

Other students give us data about you when they like you, message you, plan a date with you, block you, or report you.

We do not collect: student IDs, government IDs, selfies for verification, or your phone contacts. We do not request your device's precise location. An uploaded original may contain location or camera metadata; it is kept privately only while it is processed and cleaned up, except where a legal hold requires preservation (section 8).

3. Sensitive personal information

Under the Data Privacy Act, some data is sensitive personal information and gets extra protection. On Pilimon Connect this includes:

• Your age and birthdate (RA 10173, Sec. 3(l)).
• Your gender combined with "Show me", because together they can reveal your sexual orientation. On a small campus, this can lead to being outed. We treat it with the highest care.
• Your education information (your course, year, and the fact that you are a PLMun student). The Data Privacy Act lists education as sensitive personal information (Sec. 3(l)), so we treat it as sensitive.

4. How we use your data, and on what legal basis

Automated processing. Two things are done by software on our server: (1) deciding which profiles appear in your deck, and (2) photo screening (section 8). A clearly explicit photo is rejected automatically. Photos the software is unsure about are always checked by a person. A rejected photo is deleted right away, so it cannot be checked again later. If you think your photos are being rejected by mistake, email [email protected] and a person will look into it.

What we never do: sell your data, use it for advertising, share it with PLMun, or use your photos to train any model. We do not use analytics or tracking tools in the app, and the app loads no outside scripts. Brevo collects email open/click statistics without associating those events with individual contacts. We do not send marketing emails or newsletters. If we ever want to, we will ask for your permission first.

5. Your consent for gender and "Show me"

• On the gender step of sign-up, there is a separate checkbox, not ticked in advance, asking you to consent to Pilimon Connect processing your gender and "Show me" preference for matching. It is not bundled with accepting the Terms.
• "Show me" is used only on our server inside the matching query. It is never sent to other users by any screen, API, or live update.
• You choose whether your gender appears on your profile ("Show my gender on my profile", on by default).
• Privacy mode ("Only show me to people I've liked") is a Pilimon Connect+ feature. It lets you browse while limiting discovery of your profile to people you have liked. Plus is coming soon; new subscriptions are unavailable. If Plus ends while privacy mode is on, your profile stays hidden and new matching pauses until you explicitly turn privacy mode off.
• Pause my profile is free. It hides you from Discover and pauses your own access to Discover, Likes and new matching actions. Existing matches and conversations remain available, subject to account restrictions.
• You can withdraw this consent at any time in Settings. This hides your profile from discovery and stops your access to Discover, Likes, and new matching actions; we no longer use your gender or "Show me" for discovery. Existing conversations remain available subject to account restrictions. Your other data is not deleted. You can give consent again later. Withdrawing does not erase your gender and "Show me": they stay stored so you can turn matching back on. To erase them, delete your account.

6. Who can see your data

• Other students see your profile (section 2). They never see your email, birthdate, "Show me", Plus status, or your role.
• People you like: free users see a count and a blurred preview of who liked them; Plus users see the full profile of people who liked them. Privacy-mode users are not revealed through counts or previews to people they have not liked.
• Your matches see your messages and date plans with them.
• Moderators see reports, report evidence, and held photos (section 7). They cannot read your chats.
• The operator has technical access to the database to run, back up, and fix the service, and is bound by this policy.
• Authorities, when the law requires it, or for suspected child sexual abuse material (RA 11930).
• People you choose to share with: "Share my date plan" sends your match's first name, the place, and the time through your phone's share menu. We do not store a share link or create a public page. Once you share it, that copy is outside our control.

7. Moderators and report evidence

• Chats are not end-to-end encrypted. Messages are stored on the operator's server.
• Moderators have no access to your messages, except messages included in a report.
• When someone reports from a chat, we save a fixed, unchangeable copy of the last 50 messages of that conversation, with sender IDs and times ("report evidence"). The reporter is shown which messages will be shared before sending. A report from a profile card attaches no messages.
• Report evidence stays even if the conversation is unmatched or blocked, or if either person deletes their account.
• Report evidence is deleted 1 year after the report is closed.
• A short outcome record (who was reported, the action taken, the date, and the reason category) is kept to spot repeat offenders while the reported account exists, and for 1 year after it is deleted. If the account was banned, the outcome record is kept as long as the ban stands.
• Moderators are chosen by the operator, who is the only person who can add or remove them. They see reported profiles, photos (blurred until they reveal each one), reports, and report evidence. They never see email addresses and cannot read chats. Each moderator agrees in writing to keep what they see confidential.

8. Photo screening

Every photo is checked on our own server before anyone else can see it. No third-party image service is used.

1. The photo is re-saved and its hidden metadata (EXIF, such as location and camera details) is removed.
2. An open-source nudity classifier, running on the same server, checks it.
3. A face detector checks your first photo.

Results:

• Clearly explicit: rejected and the original is queued for deletion.
• Unsure: held "In review". You and authorized moderators use a sanitized copy until a moderator decides.
• Clean: goes live.

The classifier is set to hold photos when in doubt. Its decisions are logged so they can be reviewed. Ordinary originals, including accepted and held uploads, are deleted after processing commits and usable sanitized copies are verified; failures are retried without deleting the only usable input. Originals are not displayed as profile previews. An explicit legal hold preserves the original, including its metadata, for authorities or legal claims and overrides this cleanup. We do not use any photo for training.

9. Service providers and where your data is stored

• App data is stored in Germany. By using Pilimon Connect, your app data is transferred from the Philippines to Germany. We stay responsible for it under the Data Privacy Act wherever it is stored. Hetzner processes it only on our instructions, under its data processing agreement, which follows the EU General Data Protection Regulation (GDPR). Germany is covered by the GDPR. Checkout data goes to Polar in the United States under Polar's own terms; email is processed by the providers listed above.
• Transactional email uses Brevo. We send Brevo the recipient address, the sign-in code or renewal message, and delivery metadata, not your profile, photos or chats. Message previews are disabled. Delivery logs are kept for one calendar month, with up to 24 hours for automatic purging; Brevo's own backup arrangements are described in its storage information. Open/click tracking is anonymized so those events are not associated with individual contacts. Delivered emails are kept by the recipient's mailbox provider under its own rules. Support and privacy messages go to the founder-managed Gmail inbox at [email protected] and are processed by Google; they are not confined to our German app server.
• Polar. We never see or store your card number. Polar collects your payment details directly on its checkout page under its own privacy policy. Polar keeps its own order and tax records as Merchant of Record, even after you delete your Pilimon Connect account. For the payment, Polar is a separate controller: it decides how it uses your payment data under its own privacy policy and buyer terms. It is not our processor.
• Push notifications. If you turn on notifications, they are sent from our server through your browser's push service (run by your browser or phone maker). A notification only says "You have a new match!", "You have a new message.", or "You have a new date invite.", with a link into the app. It never includes names or message text. Notifications are sent for a new match, a new message (at most one waiting notification per conversation), and a new date invite or suggested new time.
• Fonts and other files are served from our own server. The app does not load fonts or scripts from Google or other outside services.

10. How long we keep your data

If your account or an affected conversation is under legal hold, erasure is deferred to preserve shared evidence, including date plans. Report evidence has its separate retention above. A full list is kept in our internal retention schedule.

11. How we protect your data

• Access rules on every database table, so each person can read only what they are allowed to.
• Your email, birthdate, "Show me", role, and subscription status are excluded from what other users can read.
• Photos are stored privately and shown through short-lived links. Free users' Likes tab gets only blurred low-resolution copies, never the real photo.
• Profile and review copies have hidden metadata (EXIF) removed before display. Originals are temporary private inputs, with the legal-hold exception in section 8.
• Admin tools and the database are not reachable from the public internet.
• Unique secrets for every part of the system; secret keys never reach your device.
• Daily backups, with a 30-day maximum life.
• Our app does not save your private data or photos in its offline cache.

No system is perfectly secure. If something goes wrong, we will tell you as described in section 13.

12. Your rights

Under the Data Privacy Act, you have the right to:

• Be informed about how your data is used (this policy).
• Access your data. Use Download my data in Settings for a copy of your profile, photos, likes, matches, and messages you sent. The download is a JSON file (a common text format that other apps can read), made on your device. It lists your photos but does not include the image files; email us if you want copies of them.
• Data portability: the same download, in a format you can reuse.
• Correct your data. You can edit most of your profile in the app. For anything else, email us.
• Erasure or blocking: use Delete account in Settings (section 10), or email us.
• Object to processing, and withdraw consent (for example, for gender and "Show me", which pauses discovery).
• Claim damages if you are harmed by unlawful processing.
• File a complaint with the National Privacy Commission (privacy.gov.ph).

To use a right that is not in the app, email [email protected] from your campus email, or we may ask you to enter a code sent to it, so we know it is really you. We will reply within 15 days. If a request is complicated, we may take up to 30 days, and we will tell you why. Some data may be kept after a request where the law allows, such as report evidence for safety and legal claims.

13. Data breaches

If a breach of your personal data is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and you within 72 hours of finding out, as required by NPC rules. We will tell you what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

14. Cookies, local storage, and the app on your device

Pilimon Connect is a web app (PWA) that you can add to your Home Screen.

• Sign-in session. Your browser keeps your sign-in session in local storage, under a key that starts with sb- and ends with -auth-token, so you stay logged in. It holds your sign-in tokens and basic account details (your account ID and campus email). Signing out removes it.
• App files. A service worker saves the app's basic files (the "shell") so it loads fast. It does not save your messages, profile data, or photos.
• No ad or tracking cookies. Pilimon Connect sets no cookies and uses no analytics or tracking tools.
• Notifications. If you turn them on, your browser keeps its own push subscription for Pilimon Connect.
• To remove this data, sign out and clear site data in your browser settings.

15. Notifications and emails

• Emails go to your campus email: sign-in codes, account deletion codes, yearly re-confirmation, and, for monthly and semester Plus plans, a reminder about 3 days before each renewal. We do not send marketing emails.
• Date reminders with safety tips and the 911 hotline are shown in the app, on the Dates screen, in the 24 hours before an accepted date. They are not sent by email or push notification.
• Push notifications are optional. You can turn them off in your browser or phone settings.

16. Under-18s

Pilimon Connect is for people 18 and older only. We do not knowingly collect data from anyone under 18. If we learn that a user is under 18, we hide the profile right away, review it, and ban the account. If you think a user is under 18, report them with the "Under 18" reason.

17. Changes to this policy

Whenever we change how we handle data, we update this policy at the same time and change the "Last updated" date. For important changes, we tell you in the app.

18. Contact and complaints

Data Protection Officer: the founder of Pilimon Connect (see section 1) Address: Muntinlupa City, Metro Manila, Philippines Email: [email protected]

If you are not satisfied with our answer, you can complain to the National Privacy Commission (privacy.gov.ph).

Pilimon Connect is not affiliated with, endorsed by, or operated by Pamantasan ng Lungsod ng Muntinlupa (PLMun).