Privacy

Private saved profiles

When you save a profile, we store your account, the saved account and your current choice privately. Saving does not send a notification or create contact permission. The list checks current discovery eligibility before displaying profile details; unavailable entries can be removed. Removed choices retain a private version marker to protect against delayed retries. No separate automatic expiry for these markers is claimed by this draft; account-deletion and retention procedures still need owner review.

Information you provide and why

Account information includes your email, password credential, account status and verification/security records. Passwords are stored as hashes. Phone information is used if you choose the phone-check flow. Profile and discovery information includes your name, date of birth, gender, location, relationship intentions, preferences, interests, biography, optional profile prompt answers and photos. We use it to create your profile and find compatible people. Dating preferences and free text can reveal sensitive information; share only what you want others to know. Do not put an address, financial information or someone else’s private data in your profile.

Messages, introductions, blocks, reports, appeals and restricted-account support statements are processed to deliver conversations, apply your controls and review safety/account concerns. Sessions, device descriptions, hashed network identifiers and rate-limit records help protect access and investigate misuse. First-party usage events and invitation/campaign attribution are also collected; see Cookies & storage. Exact production providers, log categories and category-specific retention are still owner-review fields.

What members and staff can see

Eligible signed-in members can see your discoverable profile and approved photos according to the discovery rules. Date of birth is private; age is displayed instead. Location is presented approximately, but location information is still stored to support distance search. Do not assume an approximate display makes your location anonymous.

Conversation participants can read authorized messages. Messages are not end-to-end encrypted. Authorized staff can access relevant report evidence and account-support records for review. Reporting information is not published as a public allegation. The release must confirm staff access controls, training and coverage; no confidentiality or security system can eliminate all risk.

Discovery visibility and inbox-preview controls are in Settings. Activity sharing is off by default. When enabled, eligible conversation partners can see online activity and a coarse last-seen hint. Switching it off removes that shared hint; it does not delete security/session records. Blocking prevents further contact and access to the thread through the service.

Languages and optional message translation

The site can remember a language preference. Where configured, choosing message translation sends that authorized message’s text, target language and an automatic source-language request to the configured translation service. Translation is machine generated and may change meaning; the original remains available. The application does not persist a completed translation cache.

The actual translation provider, processing country and its retention/training terms must be disclosed and reviewed before activation. Do not infer that no third party receives text or that the provider deletes it immediately. Translation can be unavailable and is not a safety check.

Email and notifications

Essential email covers account verification, recovery and security/account processes independently of optional message email. Optional unread-message email is off by default and can be changed in Settings. The staged implementation delays it, checks whether a conversation remains eligible, and limits attempts. Its generic email contains no message text or member name. Delivery is not guaranteed. In-app alerts and inbox previews have separate controls. Browser push is unavailable. There is no promotional-email enrollment in these controls.

Providers, countries and disclosure

Hosting, photo storage, email delivery, translation, backups and authorized staff may process information in different countries. OWNER REVIEW: identify each actual provider, purpose, processing location and applicable safeguards before admitting members. A country list has not been finalized. This draft does not claim that all information stays in Australia or that a small free beta is exempt from privacy laws.

Disclosures for a lawful request, urgent safety matter or legal obligation require a documented basis and appropriate scope. No advertising network or tracking pixel is integrated in the reviewed application source. That is not an audit of future deployment tags, proxies or providers.

Closure, deletion and retention

Closing your account revokes sessions, removes the active profile and identity records, clears account contact/attribution fields and queues profile-photo byte deletion. A failed storage deletion can remain queued for retry. Closure hides your conversation copy; the other member can still read the retained thread under “Deleted member” and cannot send new messages to the closed account.

Ordinary-message cleanup is implemented for messages at least 30 days old when both participants have deleted them, or at least 365 days old even when kept. Report-linked messages are excluded. Reviewed report text and reported-photo snapshots have separate 365-day eligibility rules and open-case holds. Decision/audit records can remain after their text expires. These are engineering cleanup rules, not proof that scheduled deletion is running or a complete approved retention policy.

Optional notification jobs contain identifiers/state rather than message bodies and have a seven-day cleanup rule in the staged worker. Backup, security, analytics, support and remaining case-record periods, legal holds and cleanup monitoring still need owner review. We do not promise immediate or complete deletion, or removal of copies another person has saved.

Access, correction, complaints and choices

You can edit your profile/preferences, change notification/activity controls and review closure in the member interface. A general privacy request, export, objection/consent withdrawal or complaint can be submitted through the public intake form when enabled; it needs no member session. Request email, statement and optional locating information are stored privately for staff. Image-removal requests also need a signature, claimed requester role and a good-faith non-consent statement. Receipt-code hashes and decision history are retained; the private code is held by you, not stored in clear on the server. No email is sent automatically, account ownership is not verified by a request and no content is removed automatically. Intake retention and staff coverage still need owner review. See Help and contact status. Country-specific rights, verification of requests and regulator routes must be completed before invitations. You retain rights provided by applicable law.