Privacy policy
Last updated October 26, 2026
K0mplexity is built so that its server knows as little about you as possible. Your messages and photos are end-to-end encrypted, your precise location never leaves your phone and there are no ads, analytics or trackers. This policy explains what the server does hold, why and for how long.
Who is responsible
K0mplexity is run by Lewis Hussey, a private individual in the Netherlands, who is the data controller under the General Data Protection Regulation (GDPR). You can reach him at support@k0mplexity.com.
What we never collect
- Your email address, phone number, real name or password. You sign in with a passkey.
- Your precise location. Your phone rounds it to a 5 km area before anything is sent.
- The content of your messages, photos and calls. Only the people you talk to can read or hear them.
- Your contacts, or anything for advertising, analytics or tracking. We don't sell or share data with advertisers.
What the server holds
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Username and passkey public key | To create your account and sign you in | Contract | Until you delete your account |
| Confirmation that you are 18 or older | To keep the app adults-only | Contract | Until you delete your account |
| Blurred placeholder of your profile photo, your bio and the day you joined | To show your public profile | Contract | Until you delete your account |
| Facets, interests and the archetype worked out from them | To show your profile and work out match scores | Contract, and explicit consent for facets about sensitive topics | Until you delete your account or remove them |
| The 5 km area you are in | To show people near you and rounded distances | Contract | Replaced each time it updates |
| When you last used the app | To show others whether you are online | Contract | Replaced while you use the app |
| How many messages, photos, profile photo shares, reactions and group messages you have sent, how many voice and video calls you have started, and on how many days you used the app | To understand how the app is used, improve it and help moderators judge reports | Legitimate interest | Until you delete your account |
| Your public encryption key | So others can encrypt messages to you | Contract | Until you delete your account |
| Push notification token | To notify you of messages and calls | Consent | Until you turn notifications off or delete your account |
| Encrypted messages, photos and reactions, with their type | To deliver them | Contract | Until delivered, 30 days at most |
| Who is calling whom, voice or video, and when | To ring the other phone and connect the call | Contract | Until the call ends, 1 day at most |
| Blocks and reports, including texts you choose to attach to a report | To keep people safe and moderate the app | Legitimate interest | Kept for moderation |
| Bans and fingerprints of banned passkeys | To stop banned people from coming back | Legitimate interest | Until unbanned, also after the account is deleted |
The counts of what you sent and started are only running totals that go up by one each time. They never record who you messaged or called, the date and time of anything you sent, how long a call lasted or what was sent, and other users can't see them.
Facets can describe sensitive things about you, such as your gender, orientation, beliefs or politics. These are always optional and only added when you pick them, which is how you give your explicit consent. You can remove them at any time in Edit profile.
If you don't open the app for 12 months, your account and all of its data are deleted from the server. If notifications are on, you get a reminder 30 days before. Opening the app at any time before then keeps your account.
What other people can see
Other users can see your username, the blurred placeholder of your photo, your bio, facets, interests and archetype, how long ago you joined, whether you are online or how long ago you were last seen, and a rounded distance such as “25 km away”. They only see your real photo if you choose to share it with them.
What stays on your phone
Your conversations, photos and private encryption keys are kept on your phone in encrypted storage. We can't read them and they are not part of what the server holds. Deleting the app or your account removes them from your phone. People you chatted with keep their own copy of your conversations on their phones.
Calls
Voice and video calls go directly between the two phones and are encrypted, so they never pass through our server. To connect directly, each phone learns the other's IP address, and the phones briefly contact public connection servers run by Google and Cloudflare, which also see your IP address. Calls are only possible between people who have already chatted for a while.
Reports and moderation
When you report someone, you can add a note and choose to attach the last 20 texts from your conversation. These texts are sent without end-to-end encryption so a moderator can read them, with only who sent each one and when. Photos and anything else from the conversation are never shared. Moderators can ban accounts that break the terms.
Who helps run K0mplexity
- Supabase hosts the server and database in Ireland, in the European Union.
- Expo, Apple and Google deliver push notifications. They receive your push token and the notification text, which is only the sender's username and what kind of message arrived, never its content.
- Google and Cloudflare run the public connection servers used to set up calls, as described above.
- Vercel hosts this website.
- Apple and Google store and sync your passkey in your iCloud Keychain or Google Password Manager, under their own terms.
Some of these providers are based outside the European Union. Where your data leaves the EU, it is protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. The server and our hosting providers may keep technical logs, which can include IP addresses, for a short time to keep the service running and secure.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy of it.
- Correct it. You can change your profile at any time in the app.
- Delete it. You can delete your account in Settings, which removes your data from the server and your phone.
- Restrict or object to how we use it, and withdraw your consent at any time.
- Complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority where you live.
To use any of these rights, email support@k0mplexity.com. Because we don't know your email address, we may ask you to confirm the request from inside the app.
Age
K0mplexity is only for people who are 18 or older. Accounts of people under 18 are removed when we learn about them.
Security
Encryption happens on your phone with libsodium, a well-tested cryptography library. Data in transit uses HTTPS, and access to the database is limited to what each person is allowed to see.
Changes
If this policy changes, the date at the top changes too. For important changes we will also let you know in the app.