What we keep, and what we refuse to.
Dating carries real physical risk, so privacy here is an architecture decision rather than a page of promises. Most of what follows is enforced by the database itself — not by our code remembering to check.
We never store where you are
No coordinates for any person exist anywhere in our database. You pick a city, and we store a reference to that city. Cities have coordinates, because a city’s location is a public fact; people do not.
Distance between two people is worked out between their cities. If our database were ever read by someone who shouldn’t, they would learn that you are in Dallas. They would not learn where you sleep.
If you use “use my location”, your device’s coordinates are compared against the city list inside your browser and then discarded. They are never sent to us.
Your answers are private until you share them
Answers are yours alone by default. Sharing is per answer and per person — you name someone, and only that person can read it. There is no “share with everyone”.
Revoking works: once a share is removed, no new link to that recording can be created. A playback link already issued keeps working until it expires, which is at most sixty seconds. That short window is the guarantee, which is why it is so short.
Sharing the words never shares the recording. Voice is a separate choice each time, because a recording of your voice identifies you far beyond this app.
Photos, recordings and pictures you send
All three live in private storage. Nothing is served from a public URL — every view is a short-lived signed link. Your photos are visible only to you, except your main picture, which people you have matched with can see.
You decide who you're shown to
Rather than filtering other people, you declare who you are for — what you are here for, gender, an age range, distance, kids. Both people’s choices have to agree before either appears to the other.
You can also mark your exact date of birth and what you do as private. Switching those off removes them from other people’s reach entirely — the data is not sent to their browser and hidden; it is not sent. Your age is always shown.
Blocking, and reports
Blocking is enforced by the database in both directions. A blocked person disappears: their answers, their recordings, your conversation, and the messages already in it. Nobody can message you unless you have both liked each other.
Reports are one-way. The person you report cannot discover that you reported them — a report someone can see is a report people are afraid to file.
What we don't do
There is no analytics, no tracking and no advertising code in this site. We do not sell or share your data with anyone. There are no read receipts and no “last seen”, because those leak your daily pattern to anyone watching.
The only cookies we set are the ones that keep you signed in.
Who processes your data
The site runs on our own server. The database, authentication and file storage are hosted by Supabase. Email confirmation messages are delivered through their mail provider. If you turn on the bot check, Cloudflare sees the challenge but not your account.
Getting your data, or deleting it
Deleting your account removes your profile, answers, recordings, photos, messages and likes. Some records that exist to protect other people — a report you are the subject of — are kept, because deleting your account should not erase a safety record somebody else filed.
To request your data or deletion, contact us at the address below.
Still to come
Being straight about the state of this page: it accurately describes what the software does today, and it is not yet a complete legal notice. A contact address, retention periods, and the sections a UK/EU or California user is entitled to are not written yet, and should be reviewed by someone qualified before this product is open to the public.
We would rather publish an honest, incomplete page than a boilerplate one that describes a product we did not build.