Privacy Policy

This policy explains what personal data Sisterra collects, why, who processes it on our behalf, how long we keep it, and what rights you have. It covers the Sisterra app inside Telegram, the Sisterra bot, and this website (sisterra.app).

We wrote it to be read, not scrolled past. If anything is unclear, write to us: [email protected].

1. Who is responsible for your data

The data controller is Individual Entrepreneur Galina Litvinova (ID 304783045), Tbilisi, Krtsanisi district, Nino and Ilia Nakashidze Street N 1 (ex Avlevi), Building N 3l, Apartment N 3, Georgia (in this policy — “we”).

Contact for anything related to your data: [email protected].

2. What we collect

Account data. Your Telegram user ID, Telegram username and display name — Telegram provides these when you sign in. If you link a Google or Apple sign-in, we also store that provider’s account identifier and the e-mail address it reports.

Profile you fill in. Name, date of birth, country and city, goals, interests, the “about” text, your profile photos, and your public @handle. You decide what goes into your profile; everything except the required basics is up to you. If anything you choose to write reveals sensitive information about you, we process it only because you chose to share it (see section 3).

Your profile photos are delivered through a content delivery network, so they load quickly wherever you open the app. Each photo has its own long random address that cannot be guessed and is listed nowhere — but opening that address needs no sign-in, so anyone you send it to can see the photo. The address works for exactly as long as the photo does: delete the photo, or your account, and the file goes with it (a copy already cached by that network can still answer for a time afterwards). The verification selfie is not served this way — see section 4.

Verification selfie. One selfie taken during verification — section 4 describes exactly what happens to it.

Activity. Likes, matches and your conversations - after a match, by follow, or after an accepted message request - we store messages to deliver the conversation to both of you; a request stays visible to the recipient until she accepts it and is deleted together with either account. Also your notification preferences and interface language.

Feed. Your posts, replies, reposts and quotes, the pictures attached to them, bookmarks, the accounts you follow and those following you, blocks, post views, post reports and “spam” marks. Posts and follows are visible to other members under the feed’s rules; bookmarks, views, reports, spam marks and blocks are visible only to you (reports and spam marks also to moderation). With a post view we also note whether you stayed on the post - half of it on your screen for half a second - and when: such views tell us how often members respond to the posts they actually looked at, and we keep it to order the “Feed”. Only we can see this mark; it is deleted together with your account. We also record what the “Feed” tab (not “Following”) sent to your app, even if a post never made it onto your screen: which post, at which position and when. The record also holds how your “Feed” was ordered - by our ranking or by time (including when the ranking did not finish in time) - and whether you had seen the post before: your views are what puts the posts you have not seen yet higher. The order of the “Feed” also depends on how close the author of a post is to you: following her, your like of her profile or a match with her, similar interests and goals, and the distance between your cities from your profiles - which we measure between city centres from a reference list of cities, not from your location. The record holds how much that closeness lifted a post and why. Only we can see this record; it is kept for 30 days and deleted together with your account. If you follow a member from one of her posts, we keep which post it was: only we can see it, and it is deleted together with the follow and with your account. If one of your posts has been reported, its pictures and the picture of its link card are kept until a moderator decides on the report - even if you remove them from the post or delete the post itself.

What moderation sees. In the moderation panel, a moderator sees your account data, profile and online status (whether you are online now and when you were last seen); your posts, replies, reposts and quotes with their pictures, including those hidden by moderation; follows in both directions; the reports you filed and those filed against you, and your “spam” marks; and the history of moderation decisions on your account. A moderator does not see your bookmarks, views or blocks, does not see whom or what you liked (the account card shows only the number of likes and matches), and does not read your conversations with other members - except a message someone reported. Every time your account card or profile is opened in the moderation panel, it is recorded in the view log (section 6).

Support conversations. If you write to us — a question, a complaint, or an appeal against a moderation decision — we keep that conversation and anything you attach to it, so we can answer you and settle a dispute if one arises. How long it lives after you delete your account is in section 6.

Technical data. Server logs (which can include IP addresses and basic device information), an online status (the “online” flag lasts while the app is open, and the time you were last seen is kept while your account exists), and view/click events for the partner-catalog cards inside the app, linked to your account ID.

What we do not do. No advertising trackers or third-party ad SDKs. No selling or renting of personal data. No precise geolocation. No access to your contacts. This website sets no cookies: your theme and language choices stay in your own browser (localStorage), and site analytics (Cloudflare Web Analytics) is cookie-free and does not identify or profile visitors.

3. Why we process it (legal bases under the GDPR)

• Running the service — account, profile, feed, likes, matches, chat, notifications: necessary to perform our contract with you (Art. 6(1)(b) GDPR).
• Verification and safety — keeping Sisterra a verified, women-only space: performance of the contract as described in the Terms, and our legitimate interest in protecting the community (Art. 6(1)(f)).
• Moderation - reviewing reports and appeals, hiding posts and blocking accounts under the rules in the Terms: performance of the contract as described in the Terms, and our legitimate interest in protecting the community (Art. 6(1)(f)). When reviewing a new report, a moderator sees the history of past decisions on your account - how many of your posts are hidden and were not restored, whether moderation has blocked your account, how many reports against you led to action, whether an appeal is open - to tell a one-off mistake from repeated violations. A person always makes the decision: the history is only shown to the moderator and decides nothing by itself.
• Optional profile details — interests, goals, “about”, extra photos: your consent (Art. 6(1)(a)), given by filling them in. If something you share falls under special categories of data, we rely on your explicit consent (Art. 9(2)(a)) — sharing it is always your choice, never a requirement.
• The record of what the “Feed” tab sent you - comparing ways of ordering the feed and explaining why a post stands where it does: our legitimate interest (Art. 6(1)(f)).
• Noting that you stayed on a post - telling how often members respond to the posts they actually looked at, to order the “Feed”: our legitimate interest (Art. 6(1)(f)).
• The order of the “Feed” - posts by members closer to you come higher. Follows, profile likes, matches and the city from your profile: our legitimate interest (Art. 6(1)(f)). Interests and goals: within the consent you give by filling them in (see “Optional profile details”); you withdraw it by clearing them.
• Technical logs and telemetry — operating, debugging and securing the service: our legitimate interest (Art. 6(1)(f)).

You can withdraw any consent at any time — by editing or removing the data in the app, or by writing to us.

4. Identity verification, honestly

Every profile passes verification before anyone else can see it. Here is the whole process, without embellishment:

• You take a selfie in the app.
• A human moderator compares the selfie with your profile photos and approves or declines the profile. If declined, you see the reason and can submit a new selfie.
• There is no automated facial recognition. No biometric algorithms, no face-matching software, no third-party identity-verification vendors. Under the GDPR, a photograph analysed by a person — not by specific technical means — is not biometric data in the Art. 9 sense. We still treat the selfie with elevated care: it is stored in access-restricted storage, used only for verification, and never shown to other users.
• Every verification decision is made by a person. There is no automated decision-making with legal or similarly significant effect (Art. 22 GDPR).
• Moderators review selfies in a private moderation channel on Telegram, so the selfie transits Telegram’s infrastructure on its way to the moderator. The copy in the channel is deleted immediately after the moderator’s decision; regardless of outcome, every copy is additionally removed by a scheduled automatic cleanup (normally within a day).

If we ever introduce automated face-matching, we will update this policy and ask for your explicit consent before it applies to you.

5. Who processes data on our behalf

We do not sell or share your data for advertising. The following providers process data for us, under their data-processing agreements incorporating the EU Standard Contractual Clauses where data leaves the EEA:

If you link Google or Apple sign-in, Google LLC or Apple Inc. act as independent providers of that sign-in, under their own privacy policies.

GIFs in Sisterra come from KLIPY (KIKLIKO, Inc., USA), an independent provider acting under its own privacy policy. GIFs load from KLIPY’s servers: your device requests each one from KLIPY directly, and KLIPY sees your IP address and browser, but not your account - we never pass it to KLIPY. When you search for a GIF or open the trending ones, your device asks KLIPY directly as well, and KLIPY also sees your query and which GIF you pick, and may see the country from your profile or your interface language.

6. How long we keep data, and deletion

We keep your data while your account exists. There is no cool-down, no grace period and no “soft delete”:

• You can delete your account in the app at any moment (Settings → Delete account), or by writing to [email protected].
• Deletion starts immediately. Your profile, photos (including the verification selfie), likes, matches, your conversations (removed for both participants), verification records, notification data and everything under “Feed” - posts with their pictures, replies, reposts, quotes, bookmarks, follows in both directions, blocks, views, the record of what the “Feed” tab sent to your app, and the reports and spam marks you filed - are erased by an automated process that begins the moment you confirm. Other members’ replies under your posts stay with their authors but lose their parent; reports filed against you are deleted together with their record in the moderation panel, and only numeric ids remain in the moderator log (see below). Photo and post-picture files are removed from media storage by the same process; a scheduled cleanup sweeps any stragglers within hours.
• A moderation block is not deletion: your profile, posts and conversations are temporarily hidden from other members and come back if the block is lifted; you can delete your account while blocked.

Only what is listed below outlives deletion. The list is exhaustive:

• Rotating server logs and encrypted database backups. They expire automatically within 30 days and are never used to restore a deleted account.
• Other members’ “Feed” records - up to 30 days. The record of what the “Feed” tab sent to another member’s app can name your posts by their bare numeric identifiers - no text, pictures or author. Those entries expire with the record, within 30 days.
• Support conversations — 90 days. That is longer than the thirty days above, and deliberately so: if you come back to us after deleting your account with a dispute or an appeal, there would otherwise be nothing left to settle it with — the profile is gone. So your name, @handle, avatar and every attachment in the thread, including any photo you sent us, are erased along with the account, and what stays is the text alone, keyed to an anonymised identifier that points at nothing else. Your account cannot be restored from it, and we use it for nothing but settling a dispute. The legal ground is Art. 17(3)(e) GDPR (establishment, exercise or defence of legal claims). After 90 days the conversation is deleted for good.
• The moderator action log — indefinitely. It is the only record of what moderation did and why, and it is not erased with the account. An entry holds an internal numeric account identifier, the action, the time, and the reason for the decision, written by the moderator in their own words: it is free text, so what ends up in it depends on how that moderator phrased it. The log holds no profile and no photos. While the account exists, moderation takes its entries into account when reviewing new reports against it, to judge whether a violation is being repeated (section 3); after the account is deleted, we use the log for nothing but reviewing moderation’s own actions and settling disputes about them. Same legal ground: Art. 17(3)(e) GDPR.
• The moderation view log - indefinitely. When a moderator opens your account card or profile in the moderation panel, your photos and selfie during verification and photo review, or your support conversation, we record who opened what and when. An entry holds the internal numeric identifier of your account (for a support conversation after the account is deleted, its anonymised identifier), the moderator, the kind of view and the time; it holds no profile, posts, photos or conversation text. It outlives deletion on purpose: otherwise deleting an account would also erase the trace of how its data was handled. We use it for nothing but checking moderation’s access to data and settling disputes. Same legal ground: Art. 17(3)(e) GDPR.

7. Your rights

Under the GDPR you can, at any time:

• access the data we hold about you and receive a copy (data portability);
• correct inaccurate data — most of your profile you can edit directly in the app;
• delete your account and data (see section 6);
• restrict or object to processing based on legitimate interest;
• withdraw consent for anything based on consent;
• complain to your data-protection supervisory authority.

Write to [email protected] — we respond within 30 days. To protect your data we may ask you to confirm the request from the Telegram account the Sisterra account belongs to.

8. Age

Sisterra is for adults. You must be at least 18 years old; the app enforces this when a profile is created. We do not knowingly process data of anyone under 18 — if you believe we do, tell us and the account will be removed.

9. Changes to this policy

When this policy changes, we announce it in the app or via the bot before the change takes effect and update the “last updated” date at the top. If a change requires new consent, we ask for it — continued silence is not consent.

10. Contact

Individual Entrepreneur Galina Litvinova (ID 304783045), Tbilisi, Krtsanisi district, Nino and Ilia Nakashidze Street N 1 (ex Avlevi), Building N 3l, Apartment N 3, Georgia [email protected] — data requests and this policy [email protected] — everything else