privacy policy
effective 31 August 2026 · last updated 31 August 2026
this is the plain-english version of how small talk handles your data. it describes what we actually collect and do — nothing more. if anything here is unclear, email us at hello@thesmalltalksocial.com.
who we are
small talk is operated by EBOLOWA STUDIOS LTD ("we", "us"), the data controller for the personal data described here. you can reach us at hello@thesmalltalksocial.com. registered address: 66 Paul Street, London, EC2A 4NA, United Kingdom. we haven't appointed a data protection officer; you can reach our privacy contact at hello@thesmalltalksocial.com.
who can use small talk
small talk is for adults only — you must be 18 or over. we collect your age (as a number) to enforce this and do not knowingly collect data from anyone under 18.
what we collect
account & login. your email address and password (stored only as a secure hash by our provider), or, if you sign in with Google or Apple, the identity that provider returns to us. if you use Apple's “hide my email”, the address we receive is a private relay address that Apple forwards from — not your real one.
your profile. first name, age (a number — we do not store your date of birth), your chosen cup avatar, and — if you fill them in — details like work, where you live, what you studied, hobbies, languages, and similar.
your gender and who you want to talk to. we ask your sex/gender and the gender(s) you want to be matched with, to run matching. see "sensitive data" below — together these can indicate your sexual orientation.
verification (optional). if you choose to get verified, a selfie and a posed photo, held privately and reviewed to confirm you're a real person, then deleted from storage once reviewed.
your content. your "takes" (prompt answers), open-floor topics, swipes, matches, chat messages, photos/voice you add, and any reports or blocks you make.
device & notifications. if you enable notifications, a push subscription for your browser so we can deliver them. a login session is kept in your browser's local storage so you stay signed in.
support & safety records. reports you file, and limited logs we keep to deliver email and keep the service safe.
sensitive data (sexual orientation)
the combination of your gender and who you want to talk to can reveal your sexual orientation, which is "special category" data under UK GDPR. we use it only to match you. we rely on your explicit consent as the Article 9 condition for using it — we ask for that consent when you set your matching preferences during setup. you can withdraw it at any time by changing your preferences, deleting your account, or emailing us; withdrawal won't affect matching we did beforehand.
why we use it, and our legal basis
we use your data to create and run your account, match you with people, deliver conversations and notifications, keep the service safe, and provide support.
our lawful bases under UK GDPR are: performance of a contract — to create and run your account and match you with people; legitimate interests — to keep the service safe, prevent abuse, and improve it; consent — for optional notifications and for the sensitive data described above; and legal obligation — where the law requires us to act (for example, responding to lawful requests).
who we share it with
we don't sell your data. we use a small number of processors to run the service:
Supabase (via Lovable Cloud) — hosts our database, login, and file storage.
Lovable — hosts the app, brokers Google and Apple sign-in, sends our account and login emails through a specialist email delivery provider, and receives crash reports (the error and which screen it happened on — not your content).
Google — if you choose to sign in with Google, it confirms your identity to us. (we self-host our fonts, so loading a page does not share your details with Google.)
Apple — if you choose to sign in with Apple, it confirms your identity to us. if you use “hide my email”, Apple gives us a relay address and forwards our messages on to you; Apple stops forwarding if you later withdraw that permission.
your browser's push service (e.g. Google, Mozilla, or Apple, depending on your browser) — delivers notifications you've enabled. these can contain another person's first name (e.g. "you and Sam matched").
we don't currently process payments in the app. if that changes, we'll update this policy to name our payment provider before taking any payment.
some of our providers may process data outside the UK or EEA. where they do, those transfers are protected by appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses.
how long we keep it
we keep your profile and content for as long as your account is active. we age out operational logs (used for email delivery and safety) after 30 days, and we delete verification photos from storage as soon as your verification has been reviewed. when you delete your account, we erase your personal data and content as described in "your rights" below.
your rights
under UK GDPR you have the right to:
• access a copy of your data; • correct it; • delete it ("right to be forgotten"); • restrict or object to certain uses; • port your data; and • withdraw consent at any time (this won't affect what we did before).
you can do the main ones yourself in the app, under you → account: download my data gives you a copy of your data (access and portability), editing your profile keeps it correct, and delete forever permanently erases your account and data. for anything else — a correction we can't make in-app, restriction, or objection — email hello@thesmalltalksocial.com.
if you're unhappy with how we handle your data, you can complain to the UK's regulator, the Information Commissioner's Office (ICO) at ico.org.uk — though we'd appreciate the chance to put things right first.
cookies & local storage
we use your browser's local storage for things the app needs to work — keeping you signed in and remembering preferences (like whether you've seen the intro). we don't use advertising or analytics cookies, and we self-host our fonts, so opening a page doesn't share your details with third-party ad or font networks. because we only use storage that's strictly necessary to run the service, we don't show a cookie banner. if the app hits an error, a minimal crash report (the error and which screen — never your messages) is sent to Lovable so we can fix it.
security
access to your data is controlled by database security rules so people only see what they're meant to. passwords are hashed, and verification photos are kept in private storage. no system is perfectly secure, but we take reasonable steps to protect your data.
changes
if we change this policy we'll update this page and the "last updated" date. for significant changes, we'll let you know by email or in the app.
contact
questions or requests: hello@thesmalltalksocial.com, EBOLOWA STUDIOS LTD, 66 Paul Street, London, EC2A 4NA, United Kingdom.