Moreish app privacy policy

Moreish app · Last updated 2 November 2026

This policy covers the Moreish app. The website and its email list have their own privacy policy.

This policy explains what we collect, why, who sees it, how long we keep it and your rights. We collect as little as we can, never sell your data, and show no ads.

1. Who is responsible

Moreish, 173 rue de Courcelles, 75017 Paris, France, SIRET 802 123 844 00028 ("Moreish", "we", "us"). Contact: [email protected]. We are the controller of your personal data. For anything about your data: [email protected].

2. What we collect

Account: first name, date of birth (only your age is shown), and the email of the sign-in you choose (Apple, Google or a code by email).

Your card: photos, your dish (and up to 2 more), your answer to a question, languages, district and city, when you are free, how you like to meet, and what you are looking for.

Sensitive data, only with your explicit consent: who you would like to meet for dating ("show me", which can reveal your sexual orientation), your diet and allergies (which can reveal health or beliefs), and the selfie verification (a biometric comparison).

Your activity: tables, invitations, cherries, boosts, messages, feedback after meals, blocks and reports. When you last used the app: other members only see “Active today” or “Active this week”, and you can hide it in Settings.

Technical: the push notification token, the app version, and error reports.

Payments go through Apple or Google: we receive a purchase receipt, never your card details.

3. Why, and on what legal basis

To provide Moreish (your card, tables, invitations, chats, payments): the contract with you.

To suggest tables and people ("why this suggestion" is always shown): the contract; you can switch personalised suggestions off in your profile, and they are then ordered by distance only.

Sensitive data: your explicit consent, which you can withdraw at any time in Settings (we then stop using it and delete it; one-to-one suggestions and dating need it).

Safety, moderation and fraud prevention (blocks, reports, reliability after meals): our legitimate interest in keeping members safe, and our legal obligations.

News from Moreish: your consent, off by default, which you can turn off at any time in Settings or from any email.

City alerts: you asked to be told when a table opens near you; we only use it for that.

Accounting and tax: legal obligation.

4. Who sees what

Other members see your card: first name, age, district, photos, dish, question and answer, and the tags you chose. Never your date of birth, email, phone or exact address.

Your diet and allergies are only shown to the people at the same table or meal.

An at-home address is shared by the host in the chat, only with accepted guests.

Your trusted contact never hears from us. If you tap "I need help" in the safety check-in, your phone opens a text to them with the meal details, which you send yourself.

People you block no longer see you, and you no longer see them.

5. Our service providers

We use a few providers who process data only on our instructions, under a data processing agreement. By category: hosting of the database and photos (in the EU); selfie verification (the video is deleted right after the check); subscriptions and purchases; app stores, sign-in and notifications; maps and address search; emails (news only if you agreed); error monitoring.

The current list of providers, with their names and where they process data, is available on request at [email protected]. Today it includes Supabase, Amazon Web Services (selfie verification, in Ireland), RevenueCat, Apple, Google, Expo and Brevo.

When a provider handles data outside the European Economic Area, it is protected by the European Commission's standard contractual clauses or an adequacy decision.

Selfie verification

The selfie video is processed by AWS Rekognition Face Liveness (Amazon Web Services EMEA, eu-west-1 region, Ireland), acting as our processor, to confirm that a live person matching your profile photos is taking it. The result (verified or not) is stored on your profile, with two technical scores from the attempt (liveness confidence and similarity to your photos), kept for safety and fraud prevention. No faceprint of you is kept. Verification is optional; it is required only to host at home.

6. How long we keep it

Your account data: as long as your account exists. When you delete it, it is erased within 30 days (and from backups within 30 more days).

Chat messages: deleted 90 days after the meal, unless a report about that meal is still being reviewed.

The verification video: deleted right after the check; we keep only the result.

Reports and moderation decisions: up to 3 years, to keep members safe (reporters are never identified to the person reported).

Invoices and payment records: 10 years, as French law requires.

An account inactive for 24 months: we write to you, then delete it.

7. Your rights

You can access, correct, delete or download your data, restrict or object to its use, and withdraw a consent at any time. Most of it can be done in the app (profile, Settings); for the rest, write to [email protected]. We answer within one month.

You can also complain to the French data protection authority (CNIL, cnil.fr), or to the authority of the country where you live (in Spain, the AEPD, aepd.es).

Suggestions are ranked automatically, with no legal or similarly significant effect on you, and you can switch personalisation off.

8. Security

Data is encrypted in transit, access is limited to what each person needs, members' private data is protected in the database itself (row-level security), and we keep a record of consents.

9. Minors

Moreish is only for adults. If we learn an account belongs to someone under 18, we delete it.

10. Changes

If we change this policy in a way that matters, we tell you in the app before it applies.