AMS Solutions d.o.o. · Frenkova ulica 23, 6280 Ankaran, Slovenia
Mandatory DPIA executed under Article 35(3)(b)/(c) GDPR for real-time proximity processing and voluntary special category data.
1. Assessment Scope & Privacy by Architecture
Tremble processes real-time location using a Privacy by Architecture framework. Exact GPS coordinates exist exclusively in Cloud Function RAM during distance evaluation and are immediately converted to a geohash cell (~75m × 38m precision). Coordinates are never saved to persistent database storage during ordinary operation.
Under ADR-012, gender and matching preference (interestedIn) are classified under Article 6(1)(b) GDPR (contract necessity for core matchmaking delivery), while voluntary religion and ethnicity remain strictly consent-gated under Article 9(2)(a) GDPR.
2. Identified Risks & Architectural Mitigations
Risk: Stalking & Unauthorised Tracking
Mitigation: Dual BLE + GPS requirement (Mutual Detection). Profiles appear only when physical BLE signal is present. Geohash obfuscates position to ~75m. Security rules block client-side proximity reading (read: false).
Risk: Precision Finding Location Exposure
Mitigation: Opt-in only session. 2-minute hard TTL in server RAM/DB. Ending session deletes record immediately. Match receives distance and arrow bearing only — never raw coordinates.
Risk: Special Category Data Disclosure (Art. 9)
Mitigation: Bilateral consent gate + STRIP architecture (`getPublicProfile` explicitly excludes religion, ethnicity, gender from public payloads). Field processing is server-side only.
Risk: Safe Zones Bypass
Mitigation: Dual-layer enforcement — client stops broadcasting radar position, and server `getProximityMatchCandidates` excludes user-defined obfuscated geohash zones regardless of client payload.