Privacy Policy

Last updated: July 30, 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Michael Steiger
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany

Email: info@thelastfirst.de
Phone: +49 152 33530479

2. General Information

Protecting your personal data is important to us. This Privacy Policy explains which personal data is processed when you use the TheLastFirst dating app and the associated website.

TheLastFirst is a dating app for adults. Use of the app is only permitted for persons who are at least 18 years old.

Personal data is processed only to the extent necessary to provide the app, to perform contractual obligations, based on consent, to protect legitimate interests or to comply with legal obligations.

3. Legal Bases for Processing

Personal data is processed in accordance with the GDPR.

Where processing is necessary for registration, provision of the user account, profile display, matching functions, communication, safety functions or premium features, processing is carried out on the basis of Article 6(1)(b) GDPR.

Where users voluntarily provide information or use optional functions, processing is carried out on the basis of consent pursuant to Article 6(1)(a) GDPR.

Where special categories of personal data are processed, in particular information relating to sexual orientation, such processing is carried out only on the basis of explicit consent pursuant to Article 9(2)(a) GDPR.

Where processing is necessary for security, stability, abuse prevention, error analysis, moderation, enforcement of our rules of use or further development of the app, processing is carried out on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR.

Where we are legally required to process or retain certain data, processing is carried out on the basis of Article 6(1)(c) GDPR.

4. Registration, User Account and Profile Data

Creating a user account is required in order to use the app. In the first version of the app, registration is carried out using an email address and password.

In particular, the following data may be processed:

Certain information is required in order to create a user account and provide the basic functions of the app. Other information is voluntary, but may improve profile presentation and the quality of profiles shown.

Profile information and profile pictures may be displayed to other users within the app, in particular in the discovery section and to matched users.

5. Special Categories of Personal Data, in Particular Sexual Orientation

TheLastFirst may allow users to voluntarily provide information about their sexual orientation or comparable personal preferences.

Information relating to sexual orientation is a special category of personal data within the meaning of Article 9 GDPR. TheLastFirst processes such information only if the user voluntarily selects and saves this information and thereby explicitly consents to the processing of this information.

Processing is carried out solely in order to display the respective information in the profile, suggest suitable profiles, provide search or filter functions and enable the use of the app as requested by the user.

In the app, the relevant input field will indicate that this information is voluntary and can be changed or deleted at any time.

Consent may be withdrawn at any time with effect for the future by changing or deleting the relevant information in the app or by contacting us at info@thelastfirst.de. The lawfulness of processing carried out before withdrawal remains unaffected.

6. Location Information

TheLastFirst does not use GPS tracking and does not automatically determine your exact live location.

Users manually enter their location or city. This information may be displayed to other users in the profile and is processed in order to provide suitable profiles and search results.

7. Likes, Matches and Communication

To provide the dating functions, TheLastFirst processes interactions between users. This includes, in particular, likes, profile decisions, matches, chat messages, voice messages, timestamps of interactions and the status of a match or chat.

After a match, users can communicate with each other within the app. TheLastFirst processes the text messages, voice messages, metadata and technical delivery information required for this purpose.

Under the current functional model, TheLastFirst may limit the number of active matches and parallel chats. In addition, a voice message may be required in order to continue a match after a certain period of time. The necessary deadlines, status information and timestamps are processed for this purpose.

8. Reports, Blocking and Moderation

Users can report profiles, block users, report chats and report profile photos. A chat report may include text messages and voice messages.

When a report is submitted, in particular the following data may be processed:

This processing is used to review possible violations of our Terms, handle user complaints, remove unlawful or prohibited content, protect other users and maintain the safety of the app.

At launch, moderation is generally carried out manually based on user reports. There is no permanent or complete pre-screening of all content or private communications.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in providing a safe, respectful and legally compliant dating platform, preventing misuse and enforcing our rules of use. Where processing is necessary to comply with legal obligations, it is additionally carried out on the basis of Article 6(1)(c) GDPR.

9. Push Notifications

Technical device identifiers and push tokens are processed and stored in order to deliver push notifications.

Push notifications may inform users, for example, about new matches, messages, voice messages, reply reminders, safety information or important app notices.

Event-related data such as notification type, match reference, timestamp and involved user identifiers may be processed for this purpose.

Users can disable push notifications via the app settings or through the settings of their device.

10. Firebase Cloud Messaging

We use Firebase Cloud Messaging, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for the technical delivery of push notifications.

Push tokens, device information and technical message data may be transmitted to Google in order to deliver notifications to the respective device.

Google processes this data in connection with Firebase Cloud Messaging in accordance with the applicable Google and Firebase terms. Where Google acts as a processor, processing is carried out on the basis of corresponding data protection agreements.

Further information can be found in Google's Privacy Policy: https://policies.google.com/privacy

Further information on Firebase and privacy can be found at: https://firebase.google.com/support/privacy

11. Payment Processing and App Stores

Paid features and premium subscriptions are processed through the respective app store.

On Android, payments are processed through Google Play. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

On iOS, payments are processed through the Apple App Store. Depending on the region, the provider may in particular be Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

Payment data such as full credit card details or bank details is not processed by TheLastFirst. Payment processing, subscription management, cancellation and refunds are handled through the respective app store.

TheLastFirst may, however, process app-related subscription information, such as product ID, subscription status, purchase time, term, renewal status, platform, technical transaction identifiers and information on whether premium features should be activated.

The data processing carried out by Google Play or the Apple App Store is governed by the privacy policies of the respective provider.

12. Hosting and Technical Infrastructure of the App

We use Supabase for app operation, authentication, database functionality, storage functions, edge functions and other technical infrastructure.

The provider is Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992, or the Supabase company responsible for the respective service.

The project region currently used by us is located in Frankfurt am Main, Germany.

Supabase processes personal data on our behalf to the extent necessary to provide the technical infrastructure. This may include, in particular, account and profile data, authentication data, database content, profile photos, messages, voice messages, technical logs and edge function data.

Further information can be found in Supabase's Privacy Policy: https://supabase.com/privacy

Information on data processing by Supabase can be found at: https://supabase.com/legal/dpa

13. Website and Website Hosting

The TheLastFirst website is used to provide general information about the app and legal information such as the Legal Notice, Privacy Policy, Terms and information on account deletion.

The website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany.

When you access the website, technically necessary access data may be processed. This includes, in particular, IP address, date and time of access, page accessed, amount of data transferred, browser type, operating system, referrer URL and technical server logs.

This processing serves the secure and stable provision of the website, error analysis and prevention of misuse. The legal basis is Article 6(1)(f) GDPR.

At this time, we do not use analytics or marketing tracking tools on the website.

14. Recipients of Data and Service Providers

Personal data may be transmitted to technical service providers to the extent necessary to provide the app, the website, push notifications, payment functions or to comply with legal obligations.

The service providers and recipients used may include in particular:

We do not disclose personal data to third parties for advertising purposes.

15. International Data Transfers

When using individual service providers, it cannot be ruled out that personal data may be transferred to or processed in countries outside the European Union or the European Economic Area.

Where such a transfer takes place, we ensure that appropriate safeguards within the meaning of the GDPR are in place. These may include, in particular, an adequacy decision by the European Commission, EU standard contractual clauses or other legally provided safeguards.

16. Automated Processing and Profile Suggestions

TheLastFirst may use profile information, search and filter settings, likes, matches, location information in the form of a city and other app interactions to show users suitable profiles or to sort search results.

As of the current status, no automated decision-making within the meaning of Article 22 GDPR takes place that produces legal effects concerning users or similarly significantly affects them.

17. Storage Period, Account Deletion and Backups

Personal data is generally stored only for as long as necessary to provide the app, fulfil contractual purposes, ensure platform security, process reports or comply with legal obligations.

Users can delete their account in the app under “Settings → Delete account”. When the account is deleted, the personal data associated with the user account is deleted from TheLastFirst's active system.

This includes in particular profile data, profile photos, profile answers, likes, matches, messages, voice messages, language settings, push tokens and other app data associated with the account, unless legal retention obligations or legitimate security interests prevent deletion.

If a user deletes their account, the matches, chat messages and voice messages associated with that account are also deleted. As a result, these contents may no longer be visible to other users.

Data in backup copies may, for technical reasons, be deleted or overwritten only after a delay. Such data is generally not actively used and is processed only in the context of technical backup, restoration or legal necessity.

A premium subscription purchased through Google Play or the Apple App Store is not automatically cancelled by deleting the user account. The subscription must be cancelled separately through the subscription management of the respective app store.

Further information on account deletion is available at: https://thelastfirst.de/en/delete-account.html.

18. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.

Protective measures may include, in particular, access restrictions, authentication procedures, transport encryption, role and permission concepts and technical logging.

Despite careful protective measures, no internet-based application can guarantee absolute security.

19. Your Rights

Under the GDPR, you have the following rights in particular:

Where processing is based on consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, you may contact us at any time via info@thelastfirst.de.

20. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

In particular, the supervisory authority at your place of residence or the supervisory authority responsible for us may be competent.

For Bavaria, this is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Website: https://www.lda.bayern.de

21. Changes to this Privacy Policy

We may amend this Privacy Policy if legal, technical or functional changes make this necessary.

The current version is available on this website.

22. Contact

If you have any questions about data protection or wish to exercise your rights, please contact us at:

info@thelastfirst.de