Privacy notice
This notice explains how DateInOz (dateinoz.com) handles personal data about members. The same practices apply whether you live in Malaysia, elsewhere in Oceania or Asia, or anywhere else. The site is for adults only. It is not directed at anyone under 18, and an account requires a birthday showing the person is at least 18.
Who is responsible
[Company name] is the data user for the purposes of the PDPA. The registered address to insert is [Registered address in Malaysia]. Until that name is published, questions go through the help form.
What we collect
Information you type in:
- Email address, username, and a hash of your password. We do not store the password itself.
- Birthday, gender, who you hope to meet, and the city and country you choose.
- Profile text, hashtags, and photos you upload.
- Messages, likes, pins, blocks, hides, reports, and voice-call signalling needed to place a call.
- An invite code, and a record of who joined from your link, if you use that feature.
Information collected as you use the site: the time you last opened a page, which profiles you opened, whether a message stayed on screen long enough to count as read, a random device cookie so the same browser can be recognised, and the push subscription your browser gives us if you turn alerts on. Server logs may briefly hold an IP address for security and abuse checks.
Why we collect it
We collect this personal data to run the noticeboard you asked to join: to publish the profile you chose to make public, to deliver messages and calls, to apply the house rules, to detect duplicate or abusive accounts, and to send the service emails you need (confirmation, and a warning before an unfinished or long-quiet account is removed). That is the purpose we will describe in the PDPA notice given at sign-up. We do not sell the member list, and we do not use your information for an unrelated marketing list.
Commercial email, if any is sent, will include a working way to opt out. Account and safety mail is a service message, not marketing. By creating an account you acknowledge the notice on this page. You can stop optional alerts in Settings.
Who can see it
Other members see your public profile: username, age, city, country, text, photos, and whether you have been on the site recently. They do not see your email, your birthday date, or your password hash. People you message can see those messages. A member you block should not be able to open your profile or write to you.
Signed-in members can open a city map. A pin is the centre of a city, with a count of members who named that city. It is not a street, a suburb, or a GPS reading, and the site does not store one. You can leave the map in Settings and remain in search. People you have blocked, people who left search, and people who turned the map off are not in that count.
Staff who handle reports can read the report and the content it points at. A preview build stores mail in a local outbox instead of sending it. A live site would use an email provider. Personal data is processed for an operator in Malaysia. If a provider, an ad network, or a photo-scanning service would hold personal data outside Malaysia, the operator will not turn that on until a lawyer confirms the transfer meets section 129 of the PDPA, or an exception in that Act applies. This draft does not turn those processors on.
Cookies and storage on your device
A single httpOnly cookie, oz_session, keeps you signed in. A second httpOnly cookie, oz_device, is a random id for this browser. The colour theme and a few prompt choices sit in local storage, not in a cookie. The ad choice, personalised or non-personalised, is also stored on this device and is not sent as a profile field. If you install the site, the service worker may cache the home page, the icons, and the coast drawing so the shell can open offline. Member data is still requested from the server. See the cookie note.
How long we keep it
Profile and message data stay while the account is open, which is no longer than the service needs them. Deleting the account removes the profile, photos, and messages tied to it from this database. A short safety log of a ban or a report may be kept where we need it to prevent the same abuse returning, or where a law requires it. Unfinished and inactive accounts are removed on the timetable in the terms, after an email warning.
Security and accuracy
Passwords are stored as hashes. The session cookie is httpOnly. Access to the moderation tools is limited to staff accounts. You can correct your profile yourself. No method of storage is perfect. If a breach is likely to cause harm, the operator will assess it and notify affected people and the Personal Data Protection Commissioner where the PDPA requires that.
Access and correction
You can see and edit most of your information on your profile and on the account page. You can ask for a copy of the personal data we hold, and you can ask us to correct it, as the PDPA provides. If you live outside Malaysia, ask us and we will also handle an access, correction, or deletion request that the law of your country requires. You can delete the account yourself. Some requests may be refused where the law allows it, for example where giving access would unreasonably affect another person’s privacy. We will explain a refusal.
Complaints
Write to [Company name] through the help form. We will acknowledge the complaint and aim to respond within 30 days. If you are not satisfied, you can contact the Personal Data Protection Commissioner of Malaysia. If you live outside Malaysia, you can also contact the privacy regulator in your country. This draft does not yet name a contact person at [Company name]. Add that name before publication.