Aedon

Privacy Policy

Last updated: August 27, 2026

This policy describes the data processed by Nelson Parrilla, sole proprietor, trading under the commercial name Naboat when operating Aedon, the purposes pursued, the legal bases relied upon, the retention periods applied, and the rights available to users.

For any GDPR request, rectification or deletion request, the primary contact remains aedon@naboat.fr.

Data we process

  • Identity and account : encrypted and hashed email, hashed password, encrypted and hashed username, age, gender, bio, creation date, last activity and account status.
  • Approximate location : selected city and country, city identifier and geographic coordinates corresponding to the center of that city. Aedon does not access the device's GPS position.
  • Preferences : preferred age range and gender.
  • Content : photos, voice introduction, text and audio messages, report reasons and comments.
  • Interactions : likes, skipped profiles, matches and message read status.
  • Subscriptions and in-app purchases : platform, purchased product, status, any expiration date, receipt or purchase token, and the date when current likes were unlocked or skipped profiles were reloaded.
  • Notifications : choices concerning match and message notifications, APNs and FCM tokens associated with an installation identifier, device platform and model, language, time zone, OS and app versions, and last token use.
  • Technical and security : quotas and usage volumes, temporary verification or reset codes, minimal technical logs, notification transport quality metrics and results of automated inappropriate-photo checks.
  • Data stored on the device : session token, account information, recent matches and messages, pending sends and cached media needed to operate the App.

Purposes

  • Create, secure and manage user accounts.
  • Recommend profiles based on mutual preferences and proximity between selected cities.
  • Enable likes, matches and real-time messaging.
  • Ensure moderation, abuse prevention, inappropriate-content detection and service security.
  • Manage push notifications, Premium subscriptions and one-time in-app purchases.
  • Apply storage and messaging quotas.

Where and how long

  • The main database and files are stored on infrastructure and S3-compatible storage with restricted access.
  • Active account data, photos, audio, interactions and messages are deleted when the account is deleted, except for data that must be retained temporarily for security or legal obligations.
  • Encrypted backups are purged no later than 30 days after deletion.
  • Inactive accounts are automatically deleted after 12 months of inactivity. A reminder email is sent approximately one month before deletion; signing in again stops this process.
  • Verification, email-change and reset codes are valid for 10 minutes; used codes are deleted.
  • Minimal technical logs and certain reports may be retained for up to 12 months when needed to prevent abuse or comply with a legal obligation, then deleted or anonymized.

Sharing

  • Aedon / Naboat team, Naboat being the commercial name of Nelson Parrilla, sole proprietor, strictly on a need-to-know basis.
  • Hosting, S3 storage and email providers needed to operate the service.
  • Firebase Cloud Messaging to deliver push notifications.
  • Apple and Google to process subscriptions and in-app purchases made through their stores.
  • Competent authorities when required by law.

Your rights

  • Access, rectification, erasure, restriction, objection and portability under the conditions provided by applicable law.
  • Withdrawal of notification permission at any time through device settings and modification of notification preferences in the App.
  • Direct account deletion from the App or deletion request by email.
  • Challenge an automated profile-content blocking decision by contacting Aedon support.
  • Contact: aedon@naboat.fr, reply within 30 days.

Security

  • Application-level encryption for the email address and username in the primary account record.
  • bcrypt password hashing.
  • Restricted access controls, environment separation and technical monitoring.
  • Automated moderation: before publication, profile content (username, bio and voice introduction) is checked automatically, without prior human review. Text messages are sent without a prior Llama Guard check; they are analyzed automatically at night on Aedon's infrastructure with Llama Guard 3 and surfaced to administration when considered suspicious. Audio analyzed by the service is transcribed temporarily on the same infrastructure with Whisper, then its transcription is analyzed and deleted. No content is sent to Meta, Hugging Face or OpenAI for inference. Human review may still occur after a report, appeal, legal requirement, automated escalation or security need. Built with Llama.