The data controller is [ legal entity name and registered address not yet established ]. A data protection officer [ whether one is required, and who — for counsel ]. Questions, requests and complaints: [ contact route not yet established ]. You also have the right to complain to a supervisory authority: [ lead supervisory authority, once an establishment exists ].

We collect a topic only because the matching uses it. There is no “interesting to know” question anywhere in the bank, and there is not going to be one.

• We never ask about race or ethnicity, and you cannot filter on it. Values are chosen. That is not. The same goes for disability, national origin and health status as distinct from health choices.
• There is no analytics on this product. No analytics SDK, no session replay, no advertising pixel, no tag manager, no heatmap, and no third-party script of any kind. This is enforced by the content security policy the server sends with every page rather than by a policy anybody has to remember: the browser is not permitted to load one.
• Even the fonts are ours. They are served from this domain, because a stylesheet fetched from somebody else’s server still tells them who is reading the page. The only outside origin the browser is ever allowed to contact is our payment provider, and on the screens that render your answers it is not allowed to contact even that.
• We never sell anything and we do not advertise. Your answers are not used to target advertising here or anywhere else, and they are not shared with anyone outside the service.
• No metadata survives an upload. Photographs are decoded and re-encoded from scratch, so the GPS coordinates, the camera identifiers and the timestamps are gone by construction. A file we cannot re-encode is refused before it is stored rather than kept.
• Your coordinate is never sent to a browser and never shown to another member. Not as a number, not in a payload, and not to you either — the one place it is readable is your own data export, which is yours by right. Other members are shown a distance band, calculated from the snapped position rather than the real one.

Political opinions, religious and philosophical beliefs, health, and sex life are special category data. Processing them is prohibited outright unless a specific exception applies, and ours is your explicit consent — which is a term of art. It has to be a separate, specific, unbundled, affirmative act, not a line inside a terms acceptance. That is why it is its own screen with its own decision, why refusing is a button of equal weight, and why the exact wording you were shown is stored alongside the record of what you decided.

Those answers live in a separate database schema that is not exposed to the internet at all. Not protected by a rule that could be weakened — absent from the list of schemas the data API is allowed to serve, so a request for them over the web is answered with an error about the schema not existing, even by something holding our own administrative key. The only route to them is a direct database connection from the server, and there is a build check that fails if that schema is ever added to the exposed list.

Another member sees an answer of yours in exactly one situation: you have both agreed to roll out the chart, in that conversation, at the same time. Matching happens on numbers derived from your answers, never on the answers themselves, so nobody reads them to rank you.

Every read is logged before it happens. The row recording who opened your chart and when is written and confirmed before a single answer is rendered, and if it cannot be written the chart is not shown. That log is the most valuable section of your data export and the only part of it you cannot reconstruct from the product’s own screens.

• Other members see your display name, your age, your photographs, your bio, the city you are in, and how far away you are rounded to the nearest kilometre. They do not see your date of birth, your email address, your coordinate, your filters or your dealbreakers.
• A member you have both agreed with sees the chart: every topic you have both answered, both positions, both ranks, and how old each answer is. Frozen at the moment it opened, so it does not change under either of you afterwards.
• We reach your answers through one audited path and nobody browses them. A moderator handling a report reads the messages in the conversation it concerns, which is what the report is judged on.
• Nobody else. Not an advertiser, not a data broker, not a partner. If we are compelled by a lawful order we will comply with it, and [ transparency-report and notification policy — for counsel ].

There is no cookie banner because there is nothing to ask you about: none of these is for advertising or measurement, and there is no third party in any of them.

• Your session. Set when you sign in, so that the next page knows it is you. Cleared when you sign out.
• A referral code, for thirty days. Written when you arrive on somebody’s referral link, read once when you create an account, and deleted at that point. It is the only clock in the referral system.
• The quiz, for one day. The five answers you gave on the public quiz, signed, stored on your own device so that the result page can be rendered without an account existing. It never becomes a profile and nothing joins it to one.
• An unsent message, for ten minutes. So that a half-typed reply survives a page reload on a product where every screen works without JavaScript.

Take everything. One button exports every record we hold about you as a single JSON file, including the log of who opened your chart. It is streamed to you rather than generated and stored, deliberately: a generated file would be a second, durable, downloadable copy of the most sensitive data in the company, sitting somewhere with a lifetime nobody owns. The last thing in the file says complete, so you can tell a truncated download from a whole one.

Destroy everything. One button deletes the account for real: the answers, their history, the access log, the photographs and their stored files, the messages, the matches. No holding period, no hidden archive, no retention offer in front of it. There is a check built for it that walks every identifier column in the entire database looking for anything the deletion left behind — not a list of the links we remembered, every column — and the deletion is tested against it with nothing as the only acceptable result.

Correct anything. Every answer, every rank, every filter and every profile field is changeable at any time, as often as you like, with no delay and no limit.

Restriction of processing, objection, and the route for a complaint: [ for counsel, once an establishment and a supervisory authority exist ].

• Your answers are kept while the account exists. Changing one keeps the previous version, dated, because the chart shows both of you how old an answer is — that visibility is the whole of our anti-gaming design, and it only works if the history is there.
• The log of who read your chart is kept while the account exists, because it is the record you are entitled to.
• Everything above is destroyed when you delete, immediately and irreversibly.
• One legal exception. Where the law requires us to report material to an authority, it also requires us to preserve that material for a fixed period. That preservation outlives a deletion request. It is the only thing that does, and it is why a photograph that was refused is not simply thrown away.
• A retention schedule for everything else — logs, reports already resolved, the anonymous departure rows — [ no retention periods are set yet; for counsel ].

We are a small operation and we do not run our own datacentre. These are the services this software is built to use, and what each one sees:

• The database, authentication and file storage provider holds everything, including the isolated schema. It is the one processor that touches the sensitive answers.
• The application host runs the server that renders these pages.
• The payment provider holds your card and your billing record. We hold the status and the price, not the card.
• The photograph screening provider receives an uploaded image in order to check it before anybody can see it. It never receives your name, your account, or anything else about you. This is not yet connected, which is why no photograph is currently visible to anybody.
• The content delivery network, once configured, will serve photograph files from an unguessable address. Not yet connected either.

The named list, the data processing agreements, and [ international transfer mechanism — for counsel ]: not settled, because choosing them is part of incorporating.

A privacy notice that lists only strengths is a marketing document. Two things this one will not imply:

• Distance is banded, but the radius edge is still exact. What another member sees is a band — “~12 km” — measured between two positions that have each been snapped to a grid about a kilometre across, so asking again, or moving a little and asking again, returns the same answer and teaches nothing. That is the part that defeats the repeated-reading attack dating services get. What it does not cover: whether you fall inside somebody’s search radius is still decided against your exact coordinate, so somebody who changes their own radius and watches for the moment you appear or disappear learns roughly how far away you are. Narrower than what it replaced, and not nothing. Treat a band as approximate, not as a shield.
• We do not currently restrict which countries can sign up, so nothing here should be read as a claim that the service is limited to one region.

Bearing is for people aged 18 and over. We do not knowingly hold data about anybody younger. If you believe an account belongs to somebody under eighteen, report it — that report jumps the queue automatically.

A new version gets a new number and date at the top of this page. If a change affects what we do with the answers you have already given, we will ask you again rather than assume the old permission covers the new thing.