Privacy policy

Last updated: 29 October 2026

Who we are

LINK is operated by Thena Holdings Limited (company number 17091225), registered at The Dye House, Thunderbridge, Kirkburton, Huddersfield HD8 0PU. We are the data controller for the personal data described here.

For anything about your data, contact hello@findyourlink.co.uk.

We are not affiliated with, endorsed by, or connected to the University of York or York St John University.

What this app is

LINK introduces University of York and York St John University students to each other, either for dating or to find study partners. You choose which. It is for adults only — you must be 18 or over.

What we collect, and why

When you sign up: your email address, a password (stored by our authentication provider as a hash — we never see it), and your date of birth.

Your date of birth is used to check you are 18 or over and to show your age to other users. Your actual date of birth is never shown to anyone else — other users only ever see your age in years.

You can correct it once, if you typed it wrong at sign-up. If the corrected date would make you under 18, the correction is refused: the database enforces the same 18-or-over boundary on the corrected date that it enforced at sign-up, and that refusal sends us an email so a person can look at it, carrying your account id, the age your attempted date implied and when you attempted it, never the date of birth itself. After a correction succeeds, it is locked again and refuses every further change. We keep the old date, the new date and when the change was made, in a separate record kept only for this purpose. Together, the record and the refusal email are a safeguarding control, not just a log of what changed: the record is what lets us look again at a correction that landed and looks wrong in hindsight, and the refusal email is what tells us about an attempt that did not land at all, since a refusal writes nothing to that record for anyone to find later. A successful correction that moves your age by two years or more also sends us a similar email so we can look at it.

Your profile: display name, course, year of study, college, a short bio, your module codes, your interests, answers to a few personality questions, and one to four photos. You also choose which modes you appear in and whether you are discoverable in each.

If you use dating mode: your gender and which genders you want to see. Together these can reveal your sexual orientation, which UK data protection law treats as a "special category" needing extra protection. We ask for it only because dating mode cannot work without it, we use it only to decide who sees whom, and you can turn dating mode off at any time, which stops us using it for matching.

If you say you belong to a society: which societies you tell us you are in. This is personal data in its own right, and for some societies it is more than that: a faith society, a political society, an LGBTQ+ society or a disability network can reveal your religion, political opinion, sexual orientation or health, which UK data protection law treats as a "special category" needing extra protection. Joining a society never tells anyone you joined it: for each society separately, you choose whether other members of that society can see you're one of them, that choice is off by default, and you can switch it off again at any time — we stop showing it to anyone else immediately. We do not verify that you actually belong to any society you say you're in; see "Who else sees your data" for exactly what a switched-on membership shows, and to whom.

How you use the app: who you have liked or passed on, who you have matched with, who you have blocked, and any reports you make. Likes and passes are never shown to the person concerned unless you both like each other.

If you check in at a venue on the Mini Map: which venue, and when. To check in, the app asks your phone's location permission and takes your position once, only while you are using it, and sends that one position to our server to confirm you are actually at the venue. The position itself is not stored, only the fact of the check-in is: you, the venue, the time. Other users only ever see check-ins as counts ("5 in town", "9 check-ins this week"), never as names, and never at all until enough different people have checked in that nobody could be identified from the number.

While the Mini Map is open, the app also follows your position to draw a dot showing where you are on the map, and when you open a venue's details it takes one more position to work out how far away that venue is. All of this stays on your phone: it is never sent to us, and it is never stored. We read your location for three things only: to confirm a check-in, to draw that dot while the Mini Map is open, and to work out the distance shown when you look at a venue. We do not read it anywhere else in the app, and the map works without location too, so if you say no, you can still browse every venue.

If you subscribe to Stats: a record of the subscription that Apple or Google sends us: which store, whether it is active, when it renews or ends, and the store's identifier for the purchase. Your card or bank details never reach us; Apple and Google take the payment.

Stats is built from likes and passes people have already made on your profile, counted once a week: how many people saw your profile and decided, how many liked it, and which of your photos and prompts people react to most. It never shows who. Your like rate appears only once a week has at least 40 views, and it is rounded to the nearest 25%, so no single person's like can be worked out from it. Photo and prompt comparisons still show nothing until enough people have reacted that no single reaction could be identified. We count these weekly numbers for every account, subscribed or not, so that Stats has something to show from the day you subscribe.

If you chat with a match: the messages you send and receive, stored for as long as the match exists. We also record when you last opened each conversation, so the app can show you which messages are unread — that timestamp is private to you and is never shown to the other person, and it is not a read receipt: the other person cannot tell whether or when you have read what they sent.

Automatically: LINK runs its own first-party analytics, described below under "Our own analytics and customer records." We do not use advertising identifiers or any third-party analytics or tracking SDK, and we do not track you across other apps or websites.

Legal bases

Providing the service (your profile, matching, messaging): performance of our contract with you.
Stats, if you subscribe: performance of our contract with you. Counting the weekly numbers for accounts that have not subscribed: our legitimate interest in offering the feature, which only ever shows a person counts about their own profile.
Our own hub's customer ledger (the nightly email and account number feed, and what Apple tells us about a subscription): our legitimate interest in keeping one financial record across the app and our shop, so a payment made in either place can be found and explained.
Gender and dating preferences: your explicit consent, which you give by turning on dating mode and which you withdraw by turning it off.
Showing a society membership to other members: your explicit consent, given separately for each society by switching its visibility on, and withdrawn by switching it off. Telling us you belong to a society at all — before you switch anything on — rests on the same basis as the rest of your profile, below.
Your location, to show you on the map, work out a venue's distance and to confirm a check-in: your explicit consent, given through your phone's location permission the first time you either check in or tap the control that centres the map on you, and withdrawn at any time in your phone's Settings. The map works without it.
Safety, moderation and abuse prevention (content screening, blocks, reports): our legitimate interest in keeping users safe, and yours in being safe.
Meeting our legal obligations, where they apply.

Identity verification, and face data

LINK does not verify identities, and the app does not collect face data. There is no way to submit an ID document or a selfie, nothing in the app photographs your face, and no profile shows a verified tick. Nothing in LINK performs facial recognition, face matching or any other biometric processing, and no image of you is sent to a verification partner.

An earlier version of the app offered an optional verified tick. It was removed on 18 September 2026 and no replacement is planned for this release. If identity verification is ever added back, this policy will be updated to say exactly what is collected, who processes it and on what lawful basis, before a single check is run.

Automated content screening, and AI features

Text you write — your bio, your questionnaire answers and any interest tags you add yourself — is sent to a third-party AI provider to be checked for unsafe content before it is published. Content that fails the check is rejected and never appears on your profile. A human does not review this decision. If your text is rejected and you think that is wrong, email us and we will look at it.

The app also offers optional AI features:

"Why you two?" — when you tap it on someone's profile, we send both profiles' text (names, course, college, bio, interests, modules, questionnaire answers) to the AI provider to write a short compatibility summary. This means your profile text can be sent to the AI provider because someone else asked for a report about the two of you, not only when you ask.
Wingman — inside a chat, and only when you tap it, we send the last 12 messages of that conversation and the other person's profile to suggest what you might say.

Your photos are sent to the AI provider to be checked before anyone else can see them. A photo you upload is visible only to you until that check passes; if it does not pass, we tell you why and it is never shown to anyone. As with text, a human does not review this decision — if you think it is wrong, email us and a person will look at it.

We do not send your email address or your date of birth to the AI provider.

Our AI provider is Mistral AI, a French company. Your data is processed in the European Economic Area, not the United Kingdom. The UK recognises the EEA as providing adequate protection, so this transfer needs no additional safeguard from you or from us.

We are completing the data-processing agreement with Mistral, and we will not accept real users until it is in place.

Your photos

Photos are stored privately. They are not on a public URL and cannot be found by guessing an address. When someone is allowed to see your profile, the app generates a temporary link that expires after about an hour. Photos are visible only to people who can already see your profile in a mode you have both enabled, and never to anyone you have blocked.

Who else sees your data

Other users, to the extent your profile is discoverable: your display name, age, course, year, college, bio, interests, modules, answers and photos. Never your email address or date of birth.
Other members of a society, only for a society where you have switched visibility on: that you are a member of that society, nothing more. Members of a society you have not switched on for see nothing — not even that you joined it. This is a separate choice for every society you are in.
Supabase, which hosts our database, authentication and file storage, as our processor.
Mistral AI, our AI provider, as described above, as our processor.
Resend, a US email delivery provider, as our processor, for one purpose only: sending us (not you, and not any other student) an internal alert when a report or a block is filed, when a date of birth correction moves someone's age by two years or more, or when a correction is refused because it would put someone under 18. The date of birth alert is the only one of the four that carries real personal content rather than just an identifier: the old and new date of birth involved in the correction. The refusal alert never carries a date of birth, only the age the attempted date implied. These alerts are emails sent to us, not rows in our database: deleting your account removes our record of you, including any correction record, but it does not reach into an email already sent, and we do not currently promise a retention period for that mailbox.
Apple and Google, which distribute the iOS and Android apps respectively, take the payment if you subscribe to Stats, and tell us whether your subscription is active.

We do not sell your data. We do not share it for advertising. We have no advertisers.

Our own analytics and customer records

LINK runs its own measurement and customer records at hub.findyourlink.co.uk, operated by Thena Holdings Limited, the company behind LINK. There is no Google Analytics, no advertising SDK and no third-party tracker in the app.

From the app, what reaches it is:

Usage counts: things that happen, like an app being opened or a match being made, tied to a random session number that is scrambled daily and cannot be traced back to you. An approximate country and whether you are on a phone or a computer are stored alongside this, worked out from your connection rather than sent by the app;
Your Apple subscription: if you subscribe through Apple, what Apple tells us was paid, when it renews, and your LINK account number, so the subscription belongs to somebody;
Your email address and LINK account number: sent nightly, so a subscription bought in the app and an order placed on our website are recognised as the same person. Your email is hashed and encrypted when it arrives and is never shown on a screen.

What never reaches it: who you liked, who you matched with, anything you wrote in a chat or on your profile, your precise location, or your device identifiers. Your IP address does reach it, the same way it reaches any server you connect to, and is what the approximate country above is worked out from; we never record it, the same as on our website below.

Deleting your account in the app permanently removes your LINK account itself, as described under "How long we keep it" below. It does not yet also erase these hub records automatically: the route that would do that has not been built. Asking at findyourlink.co.uk/privacy always works, covers purchases made anywhere including our shop, and is the way to have these hub records erased today. Purchase records themselves are kept for six years because tax law requires it, with you removed from them.

How long we keep it

We keep your profile while your account exists. When you delete your account, your profile, photos, likes, matches, messages, questionnaire answers, check-ins and any date of birth correction record are deleted along with it. That promise is about our database. A safety alert email, described above under Resend, is not a database row: by the time you delete your account it may already have left our systems for our email provider and for an inbox, and deleting your account does not recall or delete it.

Once account deletion also asks our hub to erase its copy of your email and account number automatically, that request can sit in our queue for up to 24 hours before it succeeds or is given up on. Asking directly at findyourlink.co.uk/privacy does not wait on that queue.

Weekly Stats counts are kept for eight weeks and then deleted. A subscription record is kept while your account exists and is deleted with it. If you help us test purchases (for example as an app store reviewer), we record that your account is a store tester, with a short note of why, until you stop testing or delete your account. Deleting your account does not cancel the subscription itself; only you can, in your Apple or Google settings.

Check-ins are kept for seven days and are then deleted, whether or not your account still exists. Nothing reads one older than that — "this week" is the longest window the map ever shows.

Reports you have made about other users, and records of moderation action, are kept for 12 months from the date the report was made, and are then deleted. They outlive the accounts involved, so that deleting an account does not destroy the record of what was reported. Those records keep the reported account's identifier and the display name it used at the time. They do not let us recognise someone who deletes their account and signs up again with a new email — we hold nothing that would link the two.

When you report someone, we keep a copy of your conversation with them. It is taken at the moment you file the report and stored with it, so that we can actually review what you are telling us about. This includes messages that would otherwise have been deleted: a Casual chat closes 48 hours after you match and its messages are removed, but a copy of one you have reported is retained with the report, and is deleted with it after 12 months. We keep only the conversation between you and the person you reported — not their conversations with anyone else.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to another service. You can object to processing based on our legitimate interests, and you can withdraw consent for dating-mode data at any time by turning dating mode off, or for a society by turning its visibility off — in both cases we stop straight away.

To exercise any of these, email hello@findyourlink.co.uk. We will respond within one month.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first.

Children

This service is for adults. You must be 18 or over to use it, and we block sign-ups with a date of birth under 18. We do not knowingly hold data about under-18s; if you believe we do, email us and we will delete it.

York Match: the quiz on our website, and your match in the app

York Match starts on the website and can, if you ask it to, follow you into the app. This section covers both halves: what findyourlink.co.uk/match stores when you take the quiz, and what LINK does with your answers once you join. One company runs both, so one section.

If you take the York Match quiz. The quiz asks about your music first: your top three genres in order, three to five artists you are into and, if you like, the song you have on repeat. Then whether you would rather a night in or a night out, which uni and year you are in, your college if you are at the University of York, your course and, if you want, up to three societies or hobbies. Every answer is chosen from a list; there is no free-text box anywhere in the quiz. When you ask for your results we store, in one record against your email address: your first name, so the emails can address you; your uni email address, which we only accept from a University of York or York St John domain; your three genres in order; the artists you picked (the identifier Apple's catalogue gives each one, its name and genre, and whether you tapped it on our grid or found it through search); the song you picked, if any (its catalogue identifier, name, artist and genre); night in, night out or a bit of both; your uni, year, course and college; your societies or hobbies; that you ticked "I'm 18 or over"; whether and when you ticked "Use my answers in LINK when I join"; which advert or link brought you to the quiz (the utm_source, utm_campaign and utm_content tags on the address, if any), which names a campaign and not you; and the dates you submitted and confirmed, whether and when you tapped a store badge and which store, and when we sent your results. No phone number, no IP address, no device identifier, no location, nothing from your social accounts. If Apple files an artist or song you pick under a religious genre, we store the pick without its genre, so nothing in your record says anything about faith. The quiz asks nothing about religion, ethnicity, health or politics, and its societies list leaves out faith, cultural, LGBTQ+ and political societies for the same reason. It does not ask your gender or who you are interested in.

Searching for an artist or song. Our artist grid is built in advance, so tapping a tile sends nothing to anyone. Typing into the artist search or the song search is different: what you type goes from your phone straight to Apple's iTunes Search API, and Apple sees your IP address, as it would for any website you visit. It does not pass through our servers and we do not keep your search terms; we store only the artist or song you pick. The artwork on the tiles loads from Apple's servers whenever the quiz shows it, so Apple sees your IP address then too, search or no search. Apple's own privacy policy covers what it does with that.

Confirming your email. Nothing counts until you tap the link in the single confirmation email we send. Until then your answers sit unconfirmed and are deleted automatically seven days after you submitted them. If someone else types your address into the quiz, the confirmation reaches you and not them, and nothing stays against your address once it expires. If you have already confirmed and take the quiz again, your new answers wait, unused, until you confirm again from your inbox; if you do not, they are discarded after seven days and your original answers stand.

"Use my answers in LINK when I join". This tick box on the last step is optional and unticked to begin with. Tick it and your quiz answers may be used in the LINK app once you join, and you can be put forward as someone else's match. Only records with the tick ever reach the app; a record without it stays on the website, is never passed across, and gets no results email, because the results email is about a match made in the app. You can withdraw the tick at any time, by emailing us or by unsubscribing through the link in any quiz email. The website then stops sharing your record and the app deletes its copy (see "How long we keep it" below).

What the app does with your answers. When you join LINK and verify the same uni email you used for the quiz, the app attaches your quiz record to your account. Nothing else links the two: a different email never attaches. Each night the app scores your answers against everyone else who ticked the box and has an account, with the same scoring the website uses, and pairs each person with at most one other person at a time. You are only paired when both of you have set, in the app, your gender and who you are interested in, each of you fits what the other is looking for, and you share at least three things: an artist, a genre in both your top threes, the same song, the same course or subject, the same college or year, the same kind of night, a society. Your gender and who you are interested in never leave the app: the quiz does not ask them and the website is never told them. When a pair is ready the app tells the website a random pair code and the two quiz record numbers, nothing else, so that the website can email you both; later it tells the website one word about how it went: revealed, connected or passed. The email never names the other person, and theirs never names you. You see who they are in the app, and only the two of you can see that screen. Two people who have blocked each other, or who have been paired before, are not paired.

Notifications. You hear about a match twice and no more: one email from the website, which says we have found your match and what the two of you share but not who they are, and one push notification from the app, which says only that we have found your match. No reminders, no second email. To send the push, the app keeps the delivery token Apple or Google gives your phone, from the moment you allow notifications; it is deleted with your account, and sooner if it stops working. You can turn push notifications off at any time in your phone's settings for LINK; the email still arrives, and the match still waits for you in the app.

Legal basis. Your consent: given by submitting the quiz and confirming your email, and, for the app and the results email, separately by the "Use my answers in LINK when I join" tick. Either can be withdrawn at any time, by unsubscribing, by withdrawing the tick or by emailing us.

How long we keep it. On the website, unconfirmed answers are deleted seven days after you submitted them; a confirmed record is deleted automatically 180 days after your results email, or 180 days after you confirmed if we never sent one; if you ask sooner, we delete it within a week and your answers stop counting for anyone. In the app, your answers are a copy of the website's record and follow it: the copy is deleted when the website deletes its record, when you withdraw the tick, or when you delete your LINK account, whichever comes first; the website's own record follows the website's rules above. The record that the two of you were paired is kept while you both have accounts, so the same two people are never paired again, and is deleted when either of you deletes your account. A pair that has not yet been revealed is cancelled at the next nightly update after either person's answers are deleted or their tick is withdrawn.

Who else sees it. Cloudflare hosts the quiz and its database, as our processor, and the quiz page is measured the same way as the rest of the site, described under "Measurement" below. Resend sends the quiz's emails. Apple sees your search terms and IP address if you search, and your IP address when artwork loads, as above. Apple and Google deliver the push notification to your phone; what passes through them is the words "We've found your match", a line asking you to open LINK, and a pair code, never the other person. In the app your answers sit in our database with everything else, hosted by Supabase as described under "Who else sees your data". Nobody else.

Our website, and the waitlist

Everything above is about the app. This section is about findyourlink.co.uk itself, including the waitlist, the shop and the advertising pages. One document, because one company runs both and you should not have to read two.

If you join the waitlist. We store your email address, so we can tell you when LINK opens; your phone number, if you gave us one (it is optional); your place in the queue and your referral code, so the queue has an order and your link works; which poster or link you came from (the src and utm_* tags in the address, if any), which tells us the posters in the library did better than the ones in Derwent and nothing about you; the referral code of whoever invited you, so we can move them up the queue; and the date you joined. That is the entire list. No IP address is stored against your record, no device fingerprint, no profile.

We email you once, when LINK opens, and text you once at the same time if you gave a number. That is the whole purpose. No newsletter, no selling or sharing the list, no advertisers. Legal basis: your consent, given by submitting the form, withdrawable at any time through the one-click unsubscribe in the email or by emailing us. We keep the list until we have sent that message and for no more than six months after; if launch is called off we delete it and tell you; if you unsubscribe or ask, we delete your row.

Measurement. We count what happens on the site (visits, pages, which posters worked, shop orders, advertising bookings) with our own measurement, on our own domain. Nothing is loaded from anyone else: no Google Analytics, no tag manager, no advertising trackers, no social media pixels. For each page view or action we keep the time, the page's address on this site and what happened; whether the device was a phone or a computer, not which one; the country the request came from, not anywhere finer; an order or booking amount where there was one; and a scrambled version of a random session id, so two clicks in one visit count as one visitor. The id is random, lives only until you close the tab, and the scrambling key changes daily, so we cannot tell that today's visitor is yesterday's. We also keep the name of the website you came from (not the page you were on) and any campaign tag on the link you used, so we know which poster or post worked; neither says who you are. We also count how far down a page you scroll, and whether a tap on something didn't work, as counts across everyone. If you switched "Remember me" on, these sit on your journey like any other tap; nothing is recorded as a video or a picture of your screen. We never record your IP address, precise location, browser fingerprint, email or any account identity, and the system refuses values shaped like those even if sent by mistake. Nothing in it identifies you, which is why there is no cookie banner. Legal basis: our legitimate interest in measuring our own site, which we can rely on precisely because the data identifies nobody.

Opting out of measurement. The switch on this page turns it off for this browser: the counting script sends nothing and our server ignores anything it might still receive. It works by setting one cookie, optout=1, which covers all of findyourlink.co.uk for five years; clearing your cookies clears it. With JavaScript off, the script never runs and the site sends nothing at all.

Your choices need JavaScript to show here. With it off, nothing is on and nothing asks.

Cookies and local storage. The site itself sets at most three cookies: optout=1 above, which tells us to leave you alone; lc, which records the two choices above (a version, two yes/no answers and a date — nothing else); and, only if you said yes to being remembered, lid, the random id. Only if you said yes to Meta, Meta's pixel sets its own _fbp cookie on this domain; withdrawing removes it. Measurement itself sets no cookies. The site uses your browser's own storage for two small things: which poster you arrived from, so it survives a tap through to the download page, and the measurement session id, which disappears when you close the tab. Both stay on your device.

Purchase records. If you buy from the shop or book advertising, we keep a record of the purchase: what was bought, when, for how much, the payment reference Stripe gives it, and the email address you paid with. That is what lets us fulfil the order, answer a question about it, and honour a refund. Legal basis: the contract you made with us when you bought. We also look at those records together — which surfaces someone has bought from, how much over time — to understand who our customers are. Legal basis: our legitimate interest in running a business that sells things, which involves no cookie, no tracking and nothing from outside our own records. You can object to that use at any time by emailing hello@findyourlink.co.uk, and we will stop. If your app account and a purchase share an email, we treat them as one person; that is the whole extent of it. We keep financial records for six years, as HMRC requires. Asking us to erase you does not delete the record of a sale — it removes you from it: the order stays, with nobody attached, and everything else we knew you by goes.

Erase your purchase data. Enter the email you paid with and we will send one email with one link. Open it within 24 hours and you are removed from every purchase record we hold, along with any consent, identity or journey data attached to you. We do not say on this page whether we hold anything for an address — the email is the answer, and only its owner gets it. Three requests an hour per address.

Who else sees website data. Cloudflare hosts the site, the waitlist database and the measurement data, as our processor; like every web host its servers log requests, including IP addresses, for security and uptime, and we do not join those logs to your waitlist entry or to the measurement data. Our email provider sends the one launch message. No measurement data leaves our own systems. Your rights over website data are the same as over app data, above, and the same email address answers both.

Changes

If we change this policy in a way that affects you, we will tell you in the app before the change takes effect.