Privacy policy

Kilig is operated by JVANET PTY LTD (Australia). This policy explains what we collect, why, who else sees it, and how long we keep it.

Who we are

JVANET PTY LTD, Australia, is the entity responsible for your personal data. Our Data Protection Officer can be reached at [email protected]. General privacy requests go to [email protected].

What we collect

You give us

• Account details — email address and/or phone number
• Your full legal name, which you give when you create your account, so that the account is held in your own name. It is stored apart from your profile, and no other member can see it.
• Profile details — display name, date of birth, gender, city and country, photos
• Interests and profile text you choose to write
• Messages you send to other members and to our help assistant
• Reports you submit about other members

Collected automatically

• Approximate location, stored only coarsely — city, country, and a broad area
• Basic usage events needed to operate and secure the service
• Server logs when the app talks to us — a request identifier, the time, and the outcome, so a failure you report can be traced to the request that caused it

Deliberately not collected or not retained

• Identity documents and biometric templates are never stored on our systems. They are processed by a specialist verification provider. We keep only which provider checked, their reference, the result, a reason code, and the date.
• Your precise coordinates are never readable by other members. Distance is calculated on our servers and returned only as an approximate range.
• No crash-reporting or error-monitoring service receives your data. The app sends no diagnostics to a third party, because no such service is integrated. If one ever is, it will be named here before it ships.

Why we use it

• To operate your account and show your profile to other members
• To deliver messages and matches
• To verify identity, where you choose to
• To check that a phone number is a mobile number in a country we support before we text a code to it. Refused attempts are logged with the reason, the number’s country or calling code, and the number masked to its first two or three characters and its last two digits.
• To detect and act on fraud, abuse, and prohibited behaviour
• To meet legal obligations, including financial record keeping

Who else receives it

We do not sell personal data, and we do not share it for third-party advertising. Data is shared with service providers strictly to run the service:

• Cloud hosting and database — infrastructure hosted in Singapore
• Website hosting (Vercel) — serves this website and receives the request telemetry any web host sees: your network address, browser and the pages you open. What you type into the account deletion form on this site goes from your browser to our database provider directly, not through the host.
• Email delivery (Resend) — receives your email address and the content of each email we send you, such as a sign-in code.
• SMS delivery — receives your phone number and the message that carries your code, so it can text the code to you. We will name the provider here once one is engaged.
• Identity verification provider — receives your document and face scan directly, and returns only a result to us
• AI provider (Anthropic) — receives the text of your conversations with the in-app help assistant, in order to answer them. It does not receive other members’ profiles, your private messages with other members, your payment records, or your verification data.
• Payment processing — Apple and Google handle in-app purchases; we never see your card details
• Subscription management — receives purchase and subscription events from the app stores together with an account identifier, so a membership bought on one device is recognised when you sign in on another. It never receives your card details; the stores keep those.
• Law enforcement and regulators — where the law requires it, or where there is a risk to someone’s life or safety, we may disclose account records, reports made about a member, and the moderation decisions we took. We do not provide bulk or standing access, and we disclose only what the request or the risk requires.

Where your data is held

Primary storage is in Singapore, chosen for proximity to members in the Philippines. JVANET PTY LTD is Australian, so data is also accessible from Australia. Some providers above operate in other countries.

How long we keep it

While your account exists, and then as described on the account deletion page. In short: your profile, photos, private details and messages are purged 14 days after you ask, or within the hour if you choose to delete immediately.

Three retentions deserve to be stated plainly. Each keeps a phone number only as a one-way scrambled form (a keyed hash), never the number itself, and each is used only for the purpose stated with it.

• If an account is banned, we keep a scrambled form of its phone number, and of its ID-verification reference if it has one. This is kept only for accounts that were banned: it is written when the ban is applied and again if the account is deleted, it is kept while the ban stands, and it is removed if the ban is overturned on appeal. A ban with an end date stops counting when it ends, and its scrambled form is deleted within the hour after. The phone number is the part that is checked — whenever a phone number is confirmed it is compared with these, so a banned member cannot register again with the same number.
• If someone you blocked deletes their account, or changes or removes their phone number, we keep a scrambled form of that number linked to your account. If that number is confirmed on an account again, your block is re-applied automatically to that account, as an ordinary block you can lift. The scrambled form is deleted once the block has been re-applied, when you lift that block, or when your account is deleted; there is no other time limit.
• If you report someone, the report carries a scrambled form of your phone number, so that one phone number counts as one reporter however many accounts it has been used on: deleting an account and registering again cannot add a witness towards an automatic suspension. It is stored when you submit the report and deleted 48 hours later: reports are counted together only within 24 hours, and it is never read for anything else. No part of the app can read it. The report itself is kept after either account is deleted, as the moderation record.

We think a safety measure that relies on you not knowing about it is not a safety measure worth having, which is why all three are here.

Financial records associated with purchases are retained for the period Australian and Philippine tax law requires.

Your rights

Under the Philippine Data Privacy Act (RA 10173) and the Australian Privacy Act you can ask us to give you a copy of your data, correct it, delete it, or object to how we use it. Email [email protected]. Account deletion is self-service — you never have to ask a person for it.

If you are not satisfied with our response, you may complain to the National Privacy Commission in the Philippines or the Office of the Australian Information Commissioner.

Decisions made automatically

Two things about you are decided by software rather than by a person, and RA 10173 gives you the right to know about both.

• Who you see in discovery is ordered automatically. It does not weight or order by nationality or citizenship, and nothing about the ordering is for sale.
• An account can be suspended automatically. When several unconnected members report the same account within a short window, and the reports are serious enough, the suspension is applied immediately rather than waiting for a person. It is deliberately not triggered by a single report, and reports a reviewer has already dismissed do not count towards it.

If your account is suspended you are told why and when it ends, and you can appeal from inside the app. An appeal is read and decided by a person, not by the same process that applied the suspension. You may also object to automated processing, or ask for a human to look at a decision, by emailing [email protected].

Children

Kilig is strictly for adults aged 18 and over. Age is enforced when an account is created, and accounts found to belong to minors are removed.

Where we receive a corroborated report of sexual content involving a minor, the account is suspended immediately and the record is preserved — including if the account is afterwards deleted — so that it can be provided to the authorities. Removing the account alone would destroy the evidence.

Security incidents

If a breach occurs that is likely to put you at risk, we will notify the relevant regulator and affected members within 72 hours of becoming aware of it, as RA 10173 requires.

Changes

Material changes will be announced in the app and on this page before they take effect.