English · Deutsch · Français · Español · العربية
Privacy Policy
Version 2026-11-01
This policy explains in plain words what Ladder knows about you, why, who helps us, how long we keep it, and what you can do. It covers the Ladder app, our website ladder.ink and our emails.
1. Who is responsible
The controller responsible for your data is JAIN GEOGO VALAVI, JÖLLENBECKER STR 1, 33613 BIELEFELD, Germany. For anything about your data, write to support@ladder.ink. We are a small team and do not have a data protection officer; your request reaches the person responsible directly.
2. Our promises in short
- We never show anyone a distance to you or your position on a map.
- We never sell your location or any other personal data.
- We have no advertising, no advertising trackers and no analytics trackers, in the app and on our website.
- A business never sees who looked at it, and never sees where a person is.
- We do not keep your position: it is deleted when you switch visibility off or log out, and at the latest when it is 30 minutes old.
- Photos, videos and other files are deleted together with the message, status or post they belong to.
- Ladder is only for adults (18 and over).
3. What we collect, why, and on which legal basis
The law (in the EU and UK the GDPR) asks us to name a legal basis for each use. We use these:
- Contract: we need the data to provide Ladder to you as agreed in the Terms of Use (GDPR Article 6(1)(b)).
- Consent: you have given permission, and you can withdraw it at any time (Article 6(1)(a)).
- Legitimate interests: we have a good reason, for example keeping Ladder safe, and it does not override your rights (Article 6(1)(f)). You can object to this use (section 11).
- Legal obligation: the law requires it, for example tax records (Article 6(1)(c)).
Your account
- Name, email address and password. The password is stored only as a one-way hash, so we cannot read it.
- If you sign in with Google or Apple: the identifier, name, email address and (Google) profile picture they give us.
- Whether your account is personal or business.
- That you confirmed you are 18 or older, and when. We check your date of birth once and do not keep it.
- If an account was locked because of age (see section 13): that it is locked, and since when. Not the date of birth.
- Which version of the Terms you accepted, and when.
Why: to create your account, sign you in and keep it secure. Legal basis: contract; the age check and the record of your acceptance also legal obligation and legitimate interests (protecting minors, proving what you agreed to).
Signing in safely
To protect your account against someone who has learned your password, the app creates a random identifier for each installation and keeps it in the phone's secure storage. When you sign in, it is sent to us together with the phone's model name (for example "Pixel 7") and its system (Android or iOS). We store only a keyed hash of the identifier, never the identifier itself, together with the model, the system, when the phone was first used with your account and when it was last used. We use this to recognise phones you have already used, to email you a code or a notice when your account is signed in on a new phone, to show you your signed-in phones in Settings > Security, and to let you sign a phone out from there. If you switch on two-step login, we also store the key of your authenticator app, encrypted, and your backup codes, only as a hash. Legal basis: contract and legitimate interests (protecting your account against misuse).
Your profile and settings
Username, bio, interests, profile picture, and your settings (for example who can call you or how long hello requests last). You decide what to write there. People who can see your profile see these details. Legal basis: contract.
What you post and send
- Posts, comments, likes and statuses, including photos and videos, and who you chose to show them to.
- Messages, voice messages, photos, videos, documents, contacts and locations you send in chats. Whether a message was delivered, read or heard.
- Live chat messages and likes.
- Hello requests.
- Who you follow, who follows you, and who you have blocked.
Why: to store them and show or deliver them to the people you chose. Legal basis: contract.
Your messages are encrypted on the way between your phone and our servers, but they are not end-to-end encrypted. We do not read them, except when you or the other person reports a message to us, or when the law requires it.
Calls
Voice and video calls run through our provider Agora. Calls are not recorded by us. We keep a record that a call happened: who called whom, when, whether it was voice or video and whether it was answered. Legal basis: contract.
Online status
People you have a chat with, and your mutuals, can see when you are online in Ladder. Blocked accounts never see it. Legal basis: contract.
Location
- When visibility is on and you have allowed location access, the app sends your device's position to our server while Ladder is open on your screen. We do not collect your location in the background.
- We use it to work out who is near whom: for the people shown on Home, for Live chat with people nearby, and for businesses nearby.
- Home compares people only by small squares of a fixed map grid (each about the size of a few streets), never by exact positions. People in nearer squares come earlier in the list, in a few groups. The order inside each group is shuffled and changes every few minutes, so it does not tell anyone who is nearest or how near anyone is.
- Live chat shows messages from a smaller area where many people are writing and a larger one where few are, always in the order they were written.
- We store only your most recent position, as your device reports it (it is not rounded when stored; it is snapped to the grid before it is compared with anyone). We do not keep a history of where you have been, in any form.
- When you switch visibility off, other people can no longer find you nearby, the app stops sending your position, and the stored position is deleted in the same moment.
- When you log out, the stored position is deleted. To use another account on the same phone you log out of the first one, so its position is deleted then.
- While visibility is on, a stored position is deleted once it is 30 minutes old (we check every minute). The app sends a fresh one while Ladder is open on your screen. So once Ladder is closed or in the background, we hold no position of yours after 30 minutes.
- Live chat: each message keeps a rough area for the 4 hours it exists, so that it stays visible to the people near where it was written after its writer has left. The area is one square of a fixed grid, about the size of a neighbourhood; we store only which square, never your position inside it, and everyone who writes from the same square stores the same value. It is used only on our servers to decide who is near the message, is never shown or sent to anyone, and is deleted with the message. A message from a business keeps the square of its shop or event.
- For "businesses nearby" the app rounds your position before sending it, and the server uses it only to answer that one request. It is not stored and not logged.
- To show you the name of your area, the app asks your phone's own map service (Google on Android, Apple on iPhone) to turn your position into a place name. That request goes from your phone to Google or Apple under their privacy terms.
- Nobody ever sees a distance or your coordinates. Other people only see that you are near them.
- If you send your location in a chat, the exact position is part of that message and is visible to the person you send it to. To draw the small map, that person's app loads a map picture from the OpenStreetMap map service (staticmap.openstreetmap.de, Germany) using those coordinates, and opening it in maps uses Google Maps.
- We never sell or share your location for advertising.
Legal basis: contract (you switch the nearby features on yourself). The location permission on your phone is your choice, and you can withdraw it at any time in your phone's settings.
Business accounts
- What a business enters for its page is public: name, category, description, logo and cover photo, address, phone number, website, opening hours, location of the shop, country, photos, catalogue, offers, events and "Live" posts.
- Verification documents and photos are stored privately, can be opened only by Ladder staff for the check, and are deleted 30 days after our decision. For a shop-front photo the app sends the phone's position with the photo; we only compare it with the place of the business and do not store it.
- Statistics for a business are totals only (for example how many people opened the page this week). They contain no names and no user ids. To count a person only once per day we keep a keyed hash for about a day, which cannot be turned back into a person.
- A business sees the names and profile pictures of the people who follow its page, only inside its own Ladder account, so that it can ask to follow them back. You decide whether to accept. If you accept and you follow its page, the business can see what you share with your mutuals, like any mutual, and you can send each other photos, videos and files. A business never sees who viewed its page and never sees a person's location.
Legal basis: contract; verification also legitimate interests (making sure business pages are real).
Payments (business accounts only)
Payments are processed by Stripe. Card details are entered on Stripe's pages and never reach our servers; we never see or store your full card number. We store the status of your plan, Stripe's customer and subscription identifiers, your price group and currency, and a fingerprint of the card that Stripe gives us, which we use only to make sure a card gets one free month. Stripe sends receipts and invoices by email. Legal basis: contract; tax and accounting records legal obligation; the card fingerprint legitimate interests (preventing abuse of the free month).
Notifications
To send push notifications we store a token for your device. Notifications are delivered through Google's Firebase Cloud Messaging and, on iPhone, Apple's push service; for incoming calls on iPhone we also store a separate call-notification token (VoIP) and send the call directly through Apple. On Android a notification can contain the sender's name and the beginning of a message, and for calls the caller's name and picture. On iPhone, notifications about messages only say "New message". These travel through Google's or Apple's service to your phone and are shown by your phone; we cannot take back a notification that has already been delivered. The list of notifications inside the app is stored on our servers for 90 days. Legal basis: consent (notification permission on your phone) and contract.
Reports and moderation
If you report something, we store your report and a copy of the reported content (for example the text of a message, or a name and profile picture), and it is emailed to our moderation inbox. The person you report is not told who reported them. A report and its copy are deleted after 2 years. Legal basis: legitimate interests (safety on Ladder) and legal obligation (handling notices of illegal content).
Emails from us
We send emails that belong to your account: codes, security notices (for example when your password changes), the confirmation when your account is deleted, your data export, and for businesses emails about the page, the plan and verification. We do not send newsletters or advertising. Legal basis: contract. When your account is signed in on a phone we do not know yet, we email you a notice or a code with the phone's model name and the time, and we email you when two-step login is switched on or off.
Support
If you write to support@ladder.ink, we use your email and what you write to answer you. Emails to our @ladder.ink addresses are forwarded by our domain provider Namecheap to our support inbox at Google (Gmail) — Google Ireland Limited, Ireland. We keep support emails as long as needed to help you and for at most 3 years after the conversation ends. Legal basis: contract or legitimate interests (answering questions).
Technical data
Our servers keep short technical logs to find errors and prevent abuse. They can contain account ids, the time of a connection, the names and addresses of uploaded files, and error details. They do not contain message texts, email addresses, codes, dates of birth or positions. These logs are held by our hosting provider for a limited time that we do not set ourselves, and deleting a message or a file does not remove a log line about it. We use IP addresses to limit repeated requests and do not use them to locate you; for this we store only a keyed hash of the address, for at most a day. Legal basis: legitimate interests (security and a working service).
Crash and error reports
When the app closes unexpectedly or an error occurs in it, and when an error happens on our servers, a report is sent to our error-monitoring service Sentry. It contains the type of error and its technical message (with names, addresses, numbers and other values removed), the place in the program code where it happened, the app version, the phone model and the version of its operating system, the name of the screen that was open, and the time. It does not contain your messages, posts or other content, your name, email address, phone number, account number or position, and no number that identifies your phone or your installation; while a locked chat is open, nothing is sent. Sentry receives the IP address of the connection when a report is transmitted; we have set Sentry not to store it. The reports are stored in Sentry's EU region (Germany). Legal basis: legitimate interests (finding and fixing errors so that Ladder works reliably and securely). You can switch the app's reports off at any time in Settings > Privacy > Send crash reports; this applies at once, on this phone. Reports about errors on our servers are made in the same way and contain no data about you.
On your phone
The app keeps some data on your phone so that it works: your sign-in token in the phone's secure storage, the hashes of your App Lock and chat lock PINs, your settings, and copies of chats and media you have opened (a cache). If Ladder ever closes unexpectedly, the app also keeps a short technical record of the error on your phone and shows it to you the next time; this record itself is only sent to us if you copy it and send it yourself (for the reports we receive automatically, see "Crash and error reports"). Fingerprint or face unlock is checked by your phone; Ladder only learns whether it succeeded. Signing out removes your account's data from the phone. The app also keeps the random identifier of this installation (see "Signing in safely") in the phone's secure storage; it is forgotten when you uninstall Ladder.
Things we do not do
- We do not upload your address book. The app reads your contacts on your phone only when you choose to share one contact in a chat; then that one contact's name and number are sent as a message. Saving a contact you received to your phone happens only when you choose it.
- Photos and videos are chosen with your phone's own picker; Ladder does not get access to your whole gallery.
- We do not use advertising or analytics trackers.
- We do not record calls.
- We do not make decisions about you that are based only on automated processing and have legal or similarly significant effects, with one exception: if a date of birth entered for an account shows an age under 18, the account is locked automatically. If you think this is a mistake, write to support@ladder.ink and a person will look at it.
4. Who can see what
- Your profile: other Ladder users who can find you (for example nearby, in search, or through mutuals).
- Posts and statuses: the audience you choose (Public = anyone on Ladder, Mutuals = people you follow who also follow you).
- Messages and calls: only the people in the chat or call.
- Live chat messages: people near where the message was written, for 4 hours.
- A business page: everyone.
- We share data with authorities only when the law obliges us to, and we check every request. If there is an immediate threat to someone's life or safety, we may inform the police.
5. Who helps us (service providers)
We use these companies to run Ladder. They process data on our behalf, only to provide their service to us, under a data processing agreement. Where a provider processes data outside the EU or the European Economic Area, we rely on an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's standard contractual clauses.
- Render Services, Inc. (USA): runs our servers and keeps their technical logs. Traffic to our servers passes through Cloudflare, Inc. (USA), which Render uses to protect and deliver its services.
- Supabase, Inc. (USA): hosts our database.
- Cloudinary Ltd. (Israel; storage in the USA): stores photos, videos, voice messages and documents. Israel has an adequacy decision of the European Commission.
- Agora Lab, Inc. (USA; worldwide network): carries voice and video calls. Call data may travel through Agora's servers in other countries.
- Google Ireland Limited (Ireland) and Google LLC (USA): Firebase Cloud Messaging for push notifications, Google sign-in if you choose it, and the map service of Android phones.
- Apple Distribution International Limited (Ireland) and Apple Inc. (USA): push notifications on iPhone, Sign in with Apple if you choose it, and the map service of iPhones.
- Resend, Inc. (USA): sends our emails (codes, notices, business emails).
- Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (USA): process payments for business accounts. Stripe also uses some data as its own controller, for example to prevent fraud and to meet financial laws; Stripe's privacy policy applies to that.
- Namecheap, Inc. (USA): our domain and the forwarding of emails sent to @ladder.ink addresses.
- Functional Software, Inc., doing business as Sentry (USA): error and crash monitoring (see "Crash and error reports"). The reports are stored in Sentry's EU region in Germany; Sentry can access them from the USA to operate and support its service.
- Google (Gmail) — Google Ireland Limited, Ireland: our support inbox.
Not service providers of ours, but you should know: Google and Apple run the app stores and your phone's operating system under their own privacy terms; the OpenStreetMap map service (staticmap.openstreetmap.de) receives the request for a map picture when someone opens a shared location; and Google Maps opens when you choose "open in maps".
You can ask us for a copy of the safeguards we use for transfers (section 11).
6. How long we keep things
Content:
- Statuses disappear for everyone after 24 hours and are then removed from our database.
- Live chat messages are removed from our database after 4 hours, together with the rough area stored with each of them.
- Chat messages stay until you or the other person deletes them, one of you blocks the other, or an account is deleted. If you set a disappearing-messages timer (24 hours, 7 days, 30 days or 90 days), messages you send after that are removed from our database when the time is up.
- View-once photos and videos are deleted from our storage as soon as they have been opened, or after 14 days if they are never opened.
- Posts and comments stay until you delete them or delete your account.
Photos, videos, voice messages and documents:
- A file is deleted from our file storage together with the status, message, post, comment or business post it belongs to: when that is deleted, when it expires, or when a conversation is wiped because one person blocked the other. This usually takes between a few minutes and an hour.
- When you replace your profile picture, or a business replaces its logo, its cover or the photo of a post, the old file is deleted in the same way.
- A file stays only while another record still uses the same file: for example a copy that was forwarded to someone else, a post that was shared in a chat, or a report that contains it. It is deleted when no other record uses it any more.
- The photo of a business's offer, event or "Live" post that has ended is kept for 30 days, because the business can still see its ended posts, and is then deleted. A post that is deleted, or removed by us, loses its photo at once.
- A file that was uploaded but never sent or posted (for example because sending failed) can stay in our storage until you delete your account.
- Until a file is deleted, anyone who has its exact address can open it without signing in. The addresses are long and hard to guess, and we only give them to people who are allowed to see the content, but they are not protected by a password. Share only what you are comfortable sharing.
Records:
- Your position: see "Location" above. Deleted when you switch visibility off or log out, and when it is 30 minutes old.
- Hello requests run out after the time the receiver has chosen (24 hours by default). A request that was not accepted is deleted 7 days after it ran out, together with the messages sent with it. If the receiver has chosen that requests never run out, a request stays until it is answered or withdrawn, one of the two blocks the other, or an account is deleted.
- Notifications in the app are deleted after 90 days.
- Call records are deleted after 1 year.
- Reports and their copy of the reported content are deleted after 2 years. Until then they stay even if the reported or reporting account is deleted, without a link to that account.
- Verification files of a business: 30 days after our decision.
- Codes we email you (to confirm your address, reset your password or reset your PIN) are valid for 15 minutes. We store them only as a keyed hash, never the code itself. One-time links we email you are also stored only as a hash. What is left of a code or link is deleted 1 day after it stopped working.
- You stay signed in for up to 30 days. The sign-in token on your phone contains your account number, not your email address.
- Your signed-in phones (the hash of the identifier, the model, the system and the dates): until you sign the phone out in Settings > Security or delete your account. We keep at most 50 per account; beyond that the one used longest ago is removed.
- Codes that confirm a sign-in on a new phone are valid for 10 minutes and are stored only as a keyed hash; what is left of them is deleted 1 day after they stopped working.
- The encrypted key of your authenticator app and your backup codes: until you switch two-step login off or delete your account. A backup code works only once.
- Business statistics: daily totals without names; the keyed hashes used to count a person once are deleted after about a day.
- Records of payments are kept by Stripe and by us as long as tax and accounting law requires (in Germany usually up to 10 years). Our technical note that a payment event was processed is deleted after 1 year.
- The record of what Ladder staff did on the admin page (for example a verification decision): deleted after 3 years. Short entries that only record that a plan was paused or resumed because of a lock or suspension hold nothing but the business's number and are kept without a time limit, so that a plan can always be resumed correctly.
- Support emails: at most 3 years after the conversation ends.
- Crash and error reports at Sentry: deleted automatically after at most 90 days.
What we cannot delete at once:
- A push notification that has already been delivered to a phone (it went through Google's or Apple's service and is on that phone).
- Lines in our technical logs (see "Technical data").
- Copies in the routine backups of our service providers, which are overwritten after a limited time.
- Anything another person has saved, forwarded outside Ladder or captured from their screen.
7. Deleting your account
You can delete your account in the app (Settings, Account, Delete account) or at ladder.ink/delete-account. Deleting your account removes your profile, posts, statuses, comments, likes, messages, hello requests, call records, follows, blocks, your files in our storage, and, for a business, its page and its plan. Your conversations are removed for the other people too.
What stays: reports that involve you (without a link to your account), the card fingerprint used for the free month, records we must keep by law, and what our payment provider must keep.
8. Getting a copy of your data
- In the app: Settings, Account, Download my data. We email a file with your data to the email address of your account. You can ask for it once a day. The file is in a common format (JSON) that other services can read.
- It contains your account and profile details, your settings, your posts, comments and statuses that still exist, the messages you sent, your hello requests, your follows and blocks, your call records, your notifications, your reports and, for a business, its page, catalogue, posts and plan status. It contains links to your photos and videos while they still exist, but not the files themselves. It also contains the list of your signed-in phones (model, system and dates).
- For your safety it does not contain your password, codes, sign-in tokens or your stored position, and it does not contain messages other people sent you, because those are their data too. You can see your full conversations in the app.
- If you cannot use the app (for example your account has no email address), write to support@ladder.ink from the email address of your account. To protect your data we may ask you to confirm the request from inside the app or to answer a code we email you. We answer within one month.
9. Security
We protect your data with encrypted connections, hashed passwords, emailed codes that are stored only as a keyed hash, PINs that are hashed on your phone, limited access for staff, protection against repeated sign-in attempts, and database rules that block every access except our own server. No system is perfectly secure; please use a strong password and keep your phone locked. If a data breach puts you at high risk, we will tell you. You can also switch on two-step login with an authenticator app in Settings > Security; then every sign-in needs a code from that app or one of your backup codes.
10. Where your data is processed
We are based in Germany. Our service providers process data in the EU and outside it, mainly in the United States (section 5). We use the safeguards the law provides for these transfers.
11. Your rights
You have the right to:
- see your data and get a copy of it (section 8);
- correct wrong data (most of it directly in the app);
- delete your data and your account (section 7);
- restrict how we use your data;
- receive the data you gave us in a format that machines can read, and have it sent to another service where that is possible;
- object to uses based on legitimate interests, for reasons related to your situation;
- withdraw any consent at any time, for example by switching off location or notifications in your phone's settings, without affecting what happened before;
- complain to a data protection authority.
How: use the app (edit profile, Download my data, Delete account) or write to support@ladder.ink. We answer within one month; if a request is complex, we may extend this by two more months and tell you why. Using your rights is free. To protect you, we may ask you to confirm that the request comes from you.
Our supervisory authority is Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (www.ldi.nrw.de). You can also complain to the authority of the country where you live or work.
12. Information for people in the UK, the US and other countries
United Kingdom
The UK GDPR gives you the same rights as section 11. You can complain to the Information Commissioner's Office (ICO).
United States (state privacy laws, such as California's CCPA/CPRA)
- In the last 12 months we collected these categories of personal information: identifiers (name, email, account id, device tokens), customer records (business details and plan status), commercial information (business plan status), internet or network activity (technical logs), precise geolocation (only while visibility is on, deleted after 30 minutes), audio and visual information (photos, videos, voice messages), and the content of your messages. The sources, purposes and retention are described in sections 3 and 6.
- Some of this is "sensitive personal information" (precise geolocation, account sign-in, the content of messages). We use it only to provide Ladder to you, which the law allows without a right to limit.
- We do not sell personal information and do not share it for cross-context behavioural advertising. We have done neither in the last 12 months. We do not knowingly collect data of anyone under 18.
- You have the right to know, access, correct and delete your personal information, and not to be treated differently for using these rights. Use the app or write to support@ladder.ink. We will confirm your identity through your account. An authorised agent may make a request for you with your written permission. If we refuse a request, you can ask us to reconsider by replying to our answer.
Other countries
Wherever you live, you can use the rights in section 11. If the law of your country gives you more rights, we respect them.
13. Ladder is for adults only
Ladder is not for anyone under 18. We ask for a date of birth when an account is created and do not allow people under 18 to create one. Accounts that existed before we asked are asked once. If such an account answers with a date under 18, it is locked: it is signed out, its stored position and notification tokens are removed, and it cannot be used again. While it is locked, other people cannot find or open it: its profile, posts, comments and statuses are not shown, it appears in no list, and it cannot be messaged or called. For a business account the page is hidden and we pause the collection of payments for its plan. Nothing is deleted, and we do not keep the date of birth, only the fact that the account is locked and since when. If this happened by mistake, write to support@ladder.ink; when our support has cleared the lock, everything is visible again as before and the app asks for the date of birth again. A locked account can still be deleted at ladder.ink/delete-account.
If you believe someone under 18 is using Ladder, write to support@ladder.ink.
14. Cookies and similar technologies
- Our website ladder.ink sets no cookies. It uses no JavaScript, no tracking pixels, no analytics and no fonts or scripts from other websites. This also applies to the pages for deleting an account, the business plan pages and the pages for shared posts. Pages for shared posts load the post's picture from our file storage (Cloudinary).
- The admin page used by Ladder staff keeps its access key only in the open browser tab's memory: no cookie, no local storage, no session storage.
- When a business starts or manages its plan, our page forwards it to Stripe's payment pages. Stripe sets its own cookies there, which are needed for the payment and to prevent fraud; Stripe's cookie policy applies.
- If you sign in with Google or Apple, their sign-in page opens in your browser and may set its own cookies under their policies.
- The app does not use cookies. It stores only what it needs to work on your phone (section 3, "On your phone").
- Because we use only what is strictly necessary for the service you asked for, the law (for example Article 5(3) of the EU ePrivacy Directive and section 25 of the German TDDDG) does not require us to ask for consent, and we show no cookie banner. If we ever add anything that is not strictly necessary, we will ask for your consent first.
15. Changes to this policy
We update this policy when Ladder or the law changes. Each version has a date. When a change matters for you, we show it to you in the app before it applies.
16. Languages
This policy is written in English. Translations are there to help you. If a translation says something different, the English version applies, unless the law of your country says otherwise.