Roza is a dating app for Bulgarians at home and abroad. This policy explains what personal data Roza collects, why, who it is shared with, how long it is kept, and the choices you have. It applies to the Roza app for Android.
Roza is operated by NGN Consulting Corp. (“we”, “us”), 6348 N Milwaukee Ave, Ste 330, Chicago, IL 60646-3728, United States. We are the data controller for the personal data described here.
Contact: roza.support@gmail.com
Your email address. You sign in either with a one-time code sent to that address, or with Google Sign-In. We never ask for or store a password.
If you use Google Sign-In, Google shares your email address, name and the address of your Google profile picture with us. Our sign-in provider stores these with your account record. We use only your email address to identify your account; your Google name and picture are not used in your Roza profile.
First name, birth year, gender, city and country, your connection to Bulgaria (for example, whether you live there, moved abroad or were born abroad), your family’s region of origin, the languages you speak, what kind of relationship you are looking for, an optional “about” text and prompt answer, the photos you add, and the age range you want to see.
Only if you turn on location sharing. The app can request approximate location only — precise location is disabled in the app itself, so it cannot read an exact fix. When your location reaches our server it is rounded to a grid of roughly 1 km, so everyone in the same grid cell is stored at the same point. Other users never see your coordinates; they see only an approximate distance, rounded to 5 km. You can stop sharing at any time, which deletes the stored location.
The profiles you like, your matches, the messages you send within a match, and when you were last active. Profiles you pass on are remembered only on your device.
Blocks you place and reports you file, including the reason and any details you write. If you report someone from a conversation, the report includes a copy of recent messages from that conversation (up to the last 30), so that we can see what was reported. We also keep a record of any suspension of your account and the reason for it.
If you subscribe to Roza Plus, Google Play handles the payment. We receive a purchase token, the plan you bought, and its status and renewal or expiry date, which we use to confirm your subscription with Google. We never receive your card or bank details.
If you turn on notifications, we store a push token for your device so we can notify you about new matches and messages.
A sign-in session stored on your device, and the basic request information (such as IP address) that servers process when your device connects to them.
Some things people share on a dating profile can be sensitive. Your family’s origin and your connection to Bulgaria may reveal national or ethnic origin, and your profile, the people you like and your messages may say something about your relationships and private life. Everything in your profile is optional apart from the basics needed to show you to others (first name, birth year, gender and photos), and you decide what else to add. By adding this information and making it visible on your profile, you consent to us processing it to provide the service. You can remove it, or delete your account, at any time.
| Purpose | Data used | Legal basis (where GDPR applies) |
|---|---|---|
| Create and run your account; sign you in | Account data, technical data | Contract |
| Show your profile to others and theirs to you; matching; filters and distance | Profile data, approximate location, activity data | Contract; consent for sensitive information and location |
| Messaging and notifications | Activity data, push token | Contract; consent for notifications |
| Roza Plus subscriptions | Purchase data | Contract |
| Keep people safe: handle reports and blocks, enforce the Community Guidelines, prevent fraud and abuse | Safety data, profile data, activity data | Legitimate interests (user safety); legal obligation where it applies |
| Send service messages such as sign-in codes | Email address | Contract |
We do not use your data for advertising, and we do not make decisions about you with legal or similarly significant effects based solely on automated processing. Reports are reviewed by a person.
Other signed-in Roza users can see your profile: first name, age (calculated from your birth year), photos, city and country, your connection to Bulgaria and region of origin, languages, relationship intent, your about text and prompt answer, and an approximate distance if you share location. Your matches can see the messages you send them.
Other users cannot see your email address, your exact birth year, your location, the profiles you have liked, or who you have blocked or reported. Who has liked you is shown only to Roza Plus subscribers, and people you block can no longer see you.
Please do not put information in your profile or messages that you would not want other users to see. People you talk to can take screenshots, and we cannot control what they do with what you send them.
We do not sell or “share” your personal data for targeted advertising. We share it only with the service providers that run Roza on our behalf, under contracts that limit them to that purpose:
| Provider | What for | Data involved |
|---|---|---|
| Supabase | Database, file storage, sign-in, server functions | All the data described in §2 |
| Google (Google Play) | Processing and verifying subscriptions | Purchase data |
| Google (Sign-In) | Signing in with a Google account, if you choose it | Account data |
| Email delivery provider | Sending sign-in codes and service emails | Email address |
| Expo and Google Firebase Cloud Messaging | Delivering notifications, if you turn them on | Push token and notification text |
We may also disclose data if the law requires it or in response to valid legal process; where needed to protect someone’s life or safety, including reporting serious harm to the authorities; or to a successor if Roza is transferred as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.
Your data is stored in the United States. If you use Roza from the European Union, the United Kingdom, Bulgaria or elsewhere, your data is transferred to the US. We rely on our providers’ data processing terms, including the European Commission’s Standard Contractual Clauses, to protect those transfers.
We keep your data while your account exists. You can delete your account in the app at any time: Me → Account → Delete account. Deletion is immediate and permanent. If you cannot sign in, see how to delete your account without the app.
Deleting your account removes your profile, all your photos, the likes you sent and received, your matches, the messages you sent, your blocks, your location, your push token, your subscription records and your sign-in account.
What we keep. Reports filed about you, and reports you filed about others, are kept after deletion so that removing an account cannot erase a record of harmful behaviour. Your account link is removed from them. A report can still contain the text of messages the reporter attached, which may include messages you wrote. Residual copies may also remain in our providers’ routine backups for a short period until they are overwritten, and we keep information for longer where the law requires it.
Deleting the app from your phone does not delete your account, and it does not cancel a Roza Plus subscription — manage that in Google Play.
Depending on where you live — including the EU, the UK and several US states — you may have the right to:
To exercise a right you cannot complete in the app, email roza.support@gmail.com from the address on your account. We may need to verify your identity first, and we will respond within the time the law requires (one month under GDPR). If we decline a request, we will tell you why and how to appeal.
Data is encrypted in transit. Photos are kept in private storage and shown only through short-lived links to signed-in users. Database access rules limit each account to its own private data and to the profiles and conversations it is allowed to see, and those rules are enforced on our server, not just in the app. Moderators cannot read your conversations unless someone in the conversation submits messages with a report. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.
Roza is only for adults aged 18 or older. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we remove it. If you believe someone under 18 is using Roza, report the profile in the app or email us.
We will update the date at the top when this policy changes. If a change materially affects how we use your data, we will tell you in the app before it takes effect and, where the law requires, ask for your consent.
NGN Consulting Corp.
6348 N Milwaukee Ave, Ste 330
Chicago, IL 60646-3728
United States
roza.support@gmail.com