Privacy

The minimum, and only for this.

What we keep, why, for how long and how you control it. No small print.

Who is responsible

blind bottle.

What data we process

Alias, date of birth, gender and who you’re looking for, age range, city, chosen label, message, your answers, your cards, connections and chat messages. Optional: height and body type. We don’t ask for email. Password and recovery key, only encrypted. An encrypted fingerprint of your IP to stop mass sign-ups. Pseudonymised usage logs (without your alias), to see what works.

Specially protected data

The politics and spirituality questions are sensitive data (GDPR, art. 9). We only process them with your explicit consent, given when you launch your bottle; you can withdraw it by sinking it. They only count towards the overall %: never shown to anyone.

Why, and on what legal basis

Providing the service (your account, affinity, cards and chat): contract, art. 6.1.b. Sensitive data: your consent, art. 9.2.a. Safety and moderation (filters, reports, blocks, stopping abuse): legitimate interest, art. 6.1.f. Statistics: only aggregated and anonymous, in groups of at least 50 bottles; never individual answers. Web analytics (Google Analytics 4, only if you accept it in the cookie banner): your consent, art. 6.1.a. No ads, no selling data.

The affinity %

An algorithm calculates it by comparing answers. It’s a guide: it has no legal effect and decides nothing for you (art. 22 doesn’t apply). You choose who to propose cards to.

What others see

Only your label, alias, age, city, height (if given), your message and your % with each person. Never your date of birth or answers. Your cards are only read by someone who agrees to play with you. Your bottle also has a share link (it doesn’t show up in search engines): anyone who has it sees your label, alias, age and message. No photos: nobody can recognise you unless you want them to.

Who else processes your data

Only providers who work for us under a processing agreement: web hosting (Webempresa, in the EU), data storage (Google Cloud / Google Workspace) and, if you accept it, web analytics (Google Analytics). Google may process data outside the EU under the EU-US Data Privacy Framework and standard contractual clauses. We don’t send emails or share data with anyone else.

How long

As long as your bottle exists. If you sink it, we immediately delete your account, profile, answers, cards, connections and messages. Reports are kept pseudonymised for up to 12 months for safety; blocks, while both accounts exist; usage logs, without your alias, for 13 months. Backups are encrypted, kept for 30 days and then deleted. The spreadsheet where we store the data keeps a version history that only the data controller can access.

Your rights

Access, correct, erase, restrict, object, take your data with you and withdraw consent. From My bottle you can download everything or sink your bottle. If something doesn’t convince you, you can complain to the Spanish DPA (aepd.es).

Age, security and cookies

Only for people aged 20 and over. Encrypted connection, bcrypt passwords and restricted access to data. Cookies: the essential ones plus two optional ones (invitation and analytics), explained in the cookie policy.

Updated 08/10/2026.