Last updated: 23 October 2026
This Policy explains what data the Ahoy app processes, where it is kept, who can access it, and what rights you have under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Greek Law 4624/2019.
The controller for the data that actually reaches us (see section 6) is BlackTree Software, Greece (“we”, “us”).
Contact for anything in this Policy, including exercising your rights: info@blacktree.app.
Ahoy has no accounts, no login and no server that receives your content. It finds people who are physically near you over Bluetooth Low Energy, and whatever you exchange travels directly from your phone to the other person’s phone.
We therefore do not receive, store or have any technical means of accessing your profile, photos, messages, matches or location. We cannot read, copy, delete on your behalf or hand them over to anyone, because we do not hold them.
While discovery is on, your phone broadcasts a small Bluetooth packet containing only:
Your name, photo, bio, age, email, phone number, position and any permanent device identifier are never broadcast.
Important: this packet is not encrypted. Someone with a Bluetooth scanner in the same room can tell that somebody present is running Ahoy, and whether that phone is in Anonymous mode, without learning who. Earlier versions of the app could broadcast a category such as dating, which in some places could reveal something sensitive (for example sexual orientation); since build 64 every phone broadcasts the same value.
The same applies to the Megaphone: the line is received by everyone with Ahoy near you. People who already have you on their radar see who sent it, as they see you there — with your name and photo, or without them if Anonymous is on — and can wave at you; everyone else sees only the line. The Megaphone sends nothing else.
Only after a successful cryptographic handshake between the two devices (Noise XX, X25519, ChaCha20-Poly1305) are the following exchanged: the public profile you chose to show, waves, and, after a mutual wave, messages. All of it is end-to-end encrypted.
In Anonymous mode you appear as “Someone nearby” with no name and no photo. Your name and photo are revealed to another person only if a wave becomes mutual or you send them a Super Wave.
«See who» (from 6 October 2026, build 86; paid in the Google Play version, open in the version from our website): when someone sends you an ordinary wave and you have not waved back, you can pay to see who it was. Only the wave becomes visible: the sender's name and photo are those their phone already shows to everyone nearby, so a wave sent in Anonymous mode is never shown this way, not even if its sender later switches Anonymous off — Anonymous sends nothing about you until a match. Waves sent from a version older than build 86 were sent as secrets and stay secret. The sender is not told. All of this happens on the recipient's phone; nothing reaches us.
This exchange happens between users, on their own initiative, and never passes through us. Whatever you send to another person is then also on their device, and we cannot recall it.
All app data is stored only on your device, encrypted, with a key protected by the Android Keystore. Retention periods are enforced automatically by the app:
An encrypted backup is created only if you ask for one, is saved to your device’s Downloads folder and is protected by a password only you know. If you lose the password, nobody can recover the backup. The backup also carries what you have bought, which cannot otherwise be restored.
(a) Update check (only the version downloaded from our website). When that version opens or returns to the foreground, it requests a small file from our website to see whether a newer version exists. The request carries no user or device identifier. Like every internet request, however, it discloses to the hosting provider your IP address, the time and a generic client type. Purpose: providing security and functional updates. Legal basis: legitimate interests (Article 6(1)(f) GDPR) in the secure operation of the app. We do not log or analyse this data; the hosting provider processes it to serve the file and may keep it briefly in technical logs. The Google Play version makes no such request; Google Play updates it.
(b) Contacting us. If you email us (for example a question, a rights request, a user or bug report), we process your address and whatever you choose to include. Purpose: responding and investigating. Legal basis: legitimate interests (Article 6(1)(f)) and, where applicable, compliance with a legal obligation (Article 6(1)(c)). Retention: up to 24 months after the matter is closed, unless longer retention is needed to establish, exercise or defend legal claims or is required by law.
(c) User reports. A report about a person is created on your device after you confirm it. It contains that person’s app identifier, their public profile (name, bio, interests), when they were first and last near you, the report category, any note you add and the time of the report; making it also blocks the person and deletes your conversation with them. It is not sent anywhere automatically: the app offers to email it to us or share it, and you choose. If you send it to us, point (b) applies.
(d) Crash reports contain the app version, device model and the place in the code where the failure happened, not messages or people. They are never sent automatically.
(e) Detecting devices around. While the radar is on screen and the setting is on, the app counts, for two seconds every half minute, the Bluetooth devices around you that do not have Ahoy, so it can tell you whether inviting someone is worthwhile. It reads only what a device declares about its own kind (for example headphones), so as not to count it. It shows them on the radar as unnamed grey dots at their approximate distance. Each dot has a temporary key that changes every time you open the radar and does not correspond to a device address; no address or device identifier is stored, logged or sent anywhere, and everything is discarded when the radar closes. It can be switched off in Settings.
(f) Purchases (Google Play version). Payment is handled entirely by Google Play: we never receive your card or bank details. Google Play tells the app on your phone that a purchase succeeded, and the app records it on the device (section 5). Through Play Console, Google gives developers order records (such as the order number, product, price, country and time, and limited buyer information where Google provides it). We use them only for accounting, tax, refunds and preventing fraud. Legal basis: performance of the contract (Article 6(1)(b)) and legal obligations (Article 6(1)(c)). Retention: as long as tax and accounting law requires.
(g) Visits to our website (not the app). The website counts page views with Vercel Web Analytics: no cookies and no identifier that follows you. It records the page without anything after the «?» (so never an invite code) — except the name of the source, if the link carries one (e.g. utm_source=tiktok) — the country, the device type and browser, and where you came from; a visitor is told apart only by a pseudonym that changes every day. Purpose: knowing which pages and which links bring visitors. For the same purpose, the page keeps in your browser tab (sessionStorage, gone when it closes) which network you came from and adds it to the links to Google Play, so that Google Play shows us, in aggregate, which network brings installs. If you choose English, the choice stays in your browser (localStorage). None of this identifies you. Legal basis: legitimate interests (Article 6(1)(f) GDPR).
The app uses no advertising identifiers, no analytics and no third-party SDKs that collect data. We do not sell or share data for advertising. No decisions are made solely by automated processing or profiling.
The app does not request the camera, microphone, contacts, call logs or SMS. Your profile photo is chosen by you through the system picker.
Ahoy is for adults only. Before first use you declare that you are 18 or older. We do not verify age with identity documents, because that would require collecting far more data. We have zero tolerance for child sexual abuse and exploitation; see our Child Safety Standards. If you believe a minor is using the app, report them in the app and tell us at info@blacktree.app.
You have the rights of access, rectification, erasure, restriction, portability and objection (Articles 15 to 21 GDPR). Because app data lives only on your device, you exercise most of them directly and immediately:
For data we hold (section 6(b) and 6(f)) write to info@blacktree.app. We respond without undue delay and within one month at the latest, extendable by two further months where the law allows. To object to the processing in point 6(a), you can also use the app without an internet connection; it works normally.
You have the right to lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr) or with the supervisory authority of the Member State where you live.
Identity keys and app data are encrypted on the device with Android Keystore keys. Conversations use an authenticated encrypted channel. Two people can confirm that nobody is in the middle by comparing the safety number both phones display.
No method is perfectly secure. A compromised device (for example rooted or infected with malware) defeats these protections.
Material changes to this Policy will be announced in the app before they take effect. The date of the last update appears at the top.
BlackTree Software · info@blacktree.app