This page says what tdar collects, why, who else can see it, and how long it stays. It is written in plain words. Nothing on it is a summary of a longer document.
Last updated October 2026 · English
That date is launch day, and it is correct if this page goes live with the app. Whoever actually deploys this page sets it to the day it publishes.
tdar is made and run by NiForge Works. We decide what tdar collects and why, so we
are responsible for it in law. For anything about your data, write to
privacy@tdar.app. For anything else, write to support@tdar.app.
Every kind of information tdar holds is one card below. Each card answers the same four questions in the same order: what, why, who sees it, how long. A card that cannot answer a question yet prints that gap instead of hiding the row.
When you remove a photo or your voice line, the file itself is deleted too, not only the link to it.not built · NB-19
Nobody can delete a message on tdar. Not you, and not the person you wrote to. Once a message is sent it stays. We built it that way on purpose, because a message that can be taken back is a message that cannot be reported.checked · firestore.rules:959, allow update, delete: if false
When you send a message, a short part of it, up to 90 characters, is put in the notice that appears on the other person's lock screen. Google and Apple carry that notice to the phone, so they see that text.checked · index.ts:805-808
We do not follow you. tdar never reads your position in the background. It asks once, while you are using the app, and keeps only the latest answer.
tdar needs your rough area. If you refuse, we do not read your position, and you cannot use tdar. You can take the permission back later in your phone settings. tdar checks every time you open it, so it will stop working the day you do.
A separate, currently-unused payment-history record type
(users/{uid}/payments) is declared in the rules but written by no code path
today. If that changes before this line does, it will need its own fix. Named here so it is
not forgotten.not built · row 429checked ·
firestore.rules:454, grep for zero writers
Some of these records still carry your account number beside the scrambled handle. Deleting your account does not remove them. We are changing both.not built · NB-12
A phone number is a short thing, so somebody who has one of these codes and a computer can work out the number it came from. The codes are safe because nobody except our servers can read them, not because the code cannot be undone. If you type a number in yourself to hide from it, we keep that number for as long as the contact shield is on. It is not scrambled.proposed · row 235checked · contact_shield.dart:213-220, 'number': e164
The law says we must have a reason for each thing we do with your data, and that we tell you what it is. Here they are, in plain words.
Both questions accept "Prefer not". The tap is required; the disclosure is not, and an unanswered fact is stored as a refusal rather than treated as a mismatch. Faith may be special-category data under Ethiopian and EU-comparable law, and a field you cannot skip is not freely given consent, which is why the answer gained a way out.
Withdrawal is built. The Faith and Children rows on the You tab reopen the same pickers as signup, and choosing "Prefer not" there stops us using what we learned from the old answer.
What is still open is Ethiopia's own sensitive-data list, which may include communications content and metadata. That would put every message on tdar in that category rather than only faith. That is a secondary reading, unconfirmed against the gazetted text.
This section exists on its own because the camera prompt makes a promise, and a promise needs a page behind it.
You take one picture of your face in the app. The camera view while you take it stays on your phone and is never sent anywhere. Only the final picture is sent to us. We do not measure your face. We make no face map and no template of any kind.checked · google_mlkit absent, storage.rules selfieSubmissions
One person on our side opens the picture, compares it to the photos on your card, and decides. Nobody else sees it, it is never posted and it never appears on your card. That person cannot keep a copy, and the picture is deleted the moment they decide, whichever way they decide.checked · verify.ts:163-164
If nobody has looked at your picture within 30 days, we delete it anyway, and you can take a new one.proposed · row 235not built · NB-10, today a submission nobody reviews has no clock on it at all
If you would rather not do this, you keep your account and you keep using tdar. You simply do not get the badge.
| Who | What they see | Why |
|---|---|---|
| Other people on tdar | Your card: name, photos, voice line, bio, prompt, age, area, and the facts you filled in. Not your number, your email, unpublished answers, your settings, or anything you paid for. | Making a match possible |
| Google (Firebase) | Everything on this page. It is the database, file storage and server tdar runs on. | Running the app |
| Google FCM / Apple APNs | The device token, and a notification that can include the sender's name and part of a message. | Sending you a notification |
| Resend | An email address and a one-time code, only if you choose to add an email. | Verifying that address |
| Cloudflare | Runs this website and the web deletion page. When you use that page it sees your phone number, and checks that you are a person and not a machine. | Running the site and the deletion form |
| Apple App Attest / Google Play Integrity | A signal that your device is a genuine phone, not a script. | Keeping bots out |
| Your phone's own map service | Your blurred position, with no name or account attached. | Turning it into an area name |
| The police or a court | Your data, when the law requires it or when we believe somebody is in danger. Not because somebody asked nicely. | A legal obligation, or protecting somebody |
Nobody pays to be shown to you. There is no advertising, no analytics SDK and no data broker anywhere in tdar. No payment company holds anything of yours through tdar, because tdar never asks for a card, a bank account or a mobile money PIN. When you pay, you approve it in your own bank or wallet app, and that company tells us only that it worked.checked · one outbound call in the whole backend, mail.ts:380
tdar runs on Google's cloud, and your data is stored in Belgium, in the European Union. Google protects it there under its own agreement with us. We do not move it anywhere else, except that the notices you get on your phone pass through Google's and Apple's own worldwide networks.checked · terraform/env/prod.tfvars, firestore_location = europe-west1
Ethiopia's Personal Data Protection Proclamation No. 1321/2024, Article 22, is reported to require personal data collected in Ethiopia to be stored on a server located in Ethiopia, and to require the Authority's prior approval to move sensitive personal data across a border. Firebase has no Ethiopian region. If that provision applies to us as written, this paragraph describes a breach rather than a disclosure. That is a secondary reading, unconfirmed against the gazetted text, and the single highest-value open question on this page. proposed · row 410
Google guards the building, the machines and the network your data sits in. On top of that we decide who can reach what, and the rules that decide it are checked by tests every time we change them. Your selfie, the table that maps your number to your account, and the codes made from your address book are closed to every account including your own. Nobody at tdar can read them. Messages are different, and we say so rather than implying otherwise: our servers can read them.
If somebody breaks in and takes your data, we will tell you within 72 hours of finding out, and we will tell the authority in the same 72 hours. We will say what was taken, what it means for you, and what to do.not built · NB-41
The law says we may keep your data only as long as we need it for the reason we collected it. Each card above says how long that is; this is the whole list in one place.
| What | How long |
|---|---|
| Your phone number and your account | As long as your account exists |
| Your profile, photos and voice line | As long as your account exists. Hidden after 180 days without use, deleted after 365 |
| Your messages and your chats | As long as the chat exists. Deleted once both people have left |
| The notices list inside the app | 90 days |
| Your rough area | Until it is replaced |
| Your selfie | 30 days at the most, deleted as soon as somebody decides |
| Your contact codes | 30 days from the last time we saw them |
| Numbers you typed in to hide from | As long as the contact shield is on |
| Your email address, if you added one | As long as your account exists |
| The code we email you | 24 hours |
| Your device's push code | 270 days from the last refresh |
| Who looked at your card | 12 months |
| Counts of how the app is used | 13 months |
| What you paid | 10 years, and it survives your account being deleted |
| A report about somebody, and what we decided | 2 years |
| A block | Until the person who made it removes it |
| A record that you asked us to delete your account | 5 years |
Every row above except one is proposed · row 235, a number awaiting the CEO's yes, and not built · NB-08. This product has four automatic-deletion policies today and none of them is a class on this table. Payments (receipts and the ledger) is the one row that is built as well as ruled. See the Payments card above.
Settings you can change at any time, in the app under Settings:
You can edit your profile at any time: replace a photo, replace your voice line, change any fact. Turning a switch off stops us from that moment; it does not undo what we already did with it. You can delete your account at any time; the next section says what that does.
Beyond Settings, in law, you can also: ask us for a copy of everything
we hold about you; ask us to correct something you cannot reach yourself; ask us to send your
data to another service; object to something we do, and if it is something we do to keep other
people safe we may carry on and tell you why; ask us to pause using something while we look at
a complaint. Write to privacy@tdar.app from the number or email on your account,
so we know it is you.checked · MX + Email Routing, message received 2026-08-30
To ask for a copy of your data, say so in your message. A person on our side puts it together by hand and sends it to you as a file. There is no button in the app for this yet, so it takes a person's time rather than a click. We answer within 30 days, or within 60 days if your request is complicated, and it is free.not built · NB-18
You can complain about us. Tell us first at
privacy@tdar.app. We have not named the authority you can also complain to. The
entity that will hold that answer is not registered yet, and whether the Ethiopian
Communications Authority is the right body for a complaint like this has not been confirmed.
We would rather leave this unnamed than name the wrong regulator, and we will fill this in once
both are settled.proposed · rows 547, 663, and the legal opinion on row
847
You can delete your account in the app, under Settings. It starts right away. You can also ask us to delete it from the web. You do not need the app for that.
What we delete: your profile, your photos, your voice line, your selfie, your answers, who looked at you and who you looked at, the contacts you hid from, and the codes made from your address book. Your phone number is released, so it can be used to sign up again.checked · deletion.ts full erase list
What stays: the messages you sent stay in the other person's chat. Your name and photo come off them, and the chat closes so nobody can write into it again. Once they leave too, the whole chat is deleted.not built · NB-08 If somebody blocked you, that block stays; it protects them, not us. Your receipts and spend record are kept, as described under Payments above. Counts of how the app is used currently stay, as described under "How you use the app" above.checked · deletion.ts severConversations, blocks kept
A record that you asked us to delete your account stays for five years, so we can show we did what you asked. It holds an account number, two dates and some counts. No name, no number and no picture.proposed · row 235not built · NB-08 If somebody reported you and we acted on it, we keep that for two years, so a person who is removed cannot simply come back.proposed · row 235not built · NB-05
One thing to know before you go: deleting your account does not keep people you removed away from you. If you sign up again on the same number, a block someone else filed against you still finds you, but a block you filed against someone else is not carried forward, so you would need to block them again.checked · deletion.ts restoreHeldBlocks vs holdBlocksAgainstTheNumber
How fast: we start as soon as you confirm. It is usually done within a minute, and always within 30 days.checked · deletionRequests/{uid} fires runAccountDeletion immediately, deletion.ts:327-331
proposed · row 299 Anything left in your wallet when you delete your account does not come back.
You must be 18 or older to use tdar. There is no younger version of tdar and no way to use it under 18.
We ask for your date of birth when you sign up. Our servers refuse to create or change an account with a date of birth under 18, so it is not only the app on your phone that checks.checked · firestore.rules:414-423, applied at :442,:449
A date of birth is something you type, and we do not check documents. So we also remove any account we believe belongs to somebody under 18.not built · NB-24, no age assurance beyond a typed date exists
If you tell us somebody under 18 is on tdar, we will remove them. Write to us
at childsafety@tdar.app, and read our
child safety standards.not built · NB-29, nothing can remove or ban an account
If we change this page, we will change the date at the top. If the change matters, we will tell you in the app at least 14 days before it takes effect.not built · NB-14 We keep the old version, so you can ask us what it used to say.
Write to us at privacy@tdar.app about anything on this page. For
anything else, write to support@tdar.app. For anything about a child, write to
childsafety@tdar.app.
tdar is made and run by NiForge Works.
The sign-in door draws this page's link and opens it, but only there. A signed-in person never sees it again, and nothing in the app can announce a change to anybody. "We will tell you in the app" has no mechanism yet.checked · door_screen.dart:11,152-159, app/test/door_legal_notice_test.dart:104-118
This page is written in English only. tdar's app ships in English and Amharic; an Amharic version is coming.not built · NB-33