Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Grindr retains device identifiers (IDFV and Android ID) and limited log information for up to two years after account deletion for internal reporting, metrics, and statistics purposes, separate from the general 28-day deletion timeline.
This analysis describes what Grindr's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that device identifiers linked to deleted accounts are retained for up to two years, which may engage data minimization and storage limitation obligations under GDPR Article 5 and equivalent frameworks, and requires assessment of whether internal reporting and metrics constitute a lawful basis for retention of identifiers associated with deleted user accounts.
Under this clause, deleting a Grindr account does not result in immediate deletion of all associated data; device identifiers (IDFV and Android ID) and limited log information are retained for up to two years following account deletion for internal reporting purposes, in addition to carve-outs for safety, security, fraud, and legal compliance.
Cross-platform context
See how other platforms handle Post-Deletion Device Identifier Retention and similar clauses.
Compare across platforms →Monitoring
Grindr has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We also retain a device identifier (i.e., IDFV and Android ID) and limited log information for a period of up to two years following account deletion to support internal reporting, metrics, and statistics. If you decide to delete your Profile, it will no longer be visible to other Grindr users and your personal information will generally be deleted within 28 days. In limited circumstances, we may retain certain information for purposes including safety, security, fraud prevention, and compliance with our legal obligations.Excerpt from Grindr's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR Article 5(1)(e) (storage limitation principle), which requires that personal data be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it is processed. Retention of device identifiers for two years post-deletion for internal metrics purposes requires documented necessity and proportionality assessment. Relevant enforcement authorities include EU member state DPAs and the UK ICO. Under CCPA/CPRA, consumers who request deletion have the right to have personal information deleted; whether device identifiers retained post-deletion satisfy deletion request obligations may require evaluation. 2. GOVERNANCE EXPOSURE: Medium. The stated retention of IDFV and Android ID for up to two years post-deletion for internal metrics is a specific and disclosed practice, but the necessity and proportionality of this retention period relative to the stated purpose (internal reporting and statistics) may require documented justification under GDPR storage limitation principles. 3. JURISDICTION FLAGS: EU/EEA and UK create heightened exposure under GDPR storage limitation requirements. California CPRA deletion rights may engage if device identifiers are considered personal information subject to deletion requests. The policy does not specify whether the two-year retention applies globally or is jurisdiction-limited. 4. CONTRACT AND VENDOR IMPLICATIONS: If retained device identifiers are shared with or accessible to service providers during the two-year post-deletion window, data processing agreements should address the scope and purpose of such access. Vendor assessments should confirm that access to post-deletion retained identifiers is limited to the stated internal reporting purpose. 5. COMPLIANCE CONSIDERATIONS: Legal teams should prepare a retention schedule documenting the legal basis and necessity assessment for two-year post-deletion device identifier retention. Data subject access request workflows should account for whether retained post-deletion identifiers are in scope for access or deletion requests. The policy should be assessed for whether the two-year retention period is communicated with sufficient specificity to meet GDPR transparency requirements.
This provision establishes that device identifiers linked to deleted accounts are retained for up to two years, which may engage data minimization and storage limitation obligations under GDPR Article 5 and equivalent frameworks, and requires assessment of whether internal reporting and metrics constitute a lawful basis for retention of identifiers associated with deleted user accounts.
Under this clause, deleting a Grindr account does not result in immediate deletion of all associated data; device identifiers (IDFV and Android ID) and limited log information are retained for up to two years following account deletion for internal reporting purposes, in addition to carve-outs for safety, security, fraud, and legal compliance.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Grindr.