Privacy Policy

The rest of this page is the full detail. This is what matters most.

• Who we are. Sapiomate, [Registered entity name], India. Write to [email protected] about anything on this page.
• What we hold. What you tell us, what you send other members, a record of what you do in the app, your location only if you turn it on, and the results of your checks from our verification partner. We never receive your identity documents or a scan of your face.
• Why. To run the service you joined: showing you to the members your settings allow, carrying your messages, checking that members are who they say, and keeping people safe.
• Who sees it. Other members see only what your settings allow, and never your exact location, your date of birth, or your number or email unless you share them. In a pool's chat a woman is shown to men under an alias until she chooses to be seen. A few companies run parts of the service for us, all named in section 07. We do not sell your data, target advertising, or send marketing.
• How long. Until you delete your account, and then 30 days in case you change your mind. Some safety records stay longer, and section 04 lists every period.
• Software. Software can slow down, hide or lock an account for safety while a person looks at it. It never bans anyone. Section 09 explains.
• Your choices. Get a copy of your data, correct it, delete your account, turn location off, pause Crosspath, or withdraw a consent. It is free, and we answer within a month.
• If you are unhappy. Write to our Grievance Officer, or complain to the data protection authority where you live.

This policy covers everyone who uses Sapiomate: members, people whose application is being reviewed, and anyone who visits this website. By accepting it in the app you agree to what it says. If you do not agree, do not use the app, and write to us if you want anything we already hold deleted.

If you are applying. While your application is open, and if it is declined, you are not visible to any member and you cannot see members. No member can see that you applied, with one exception: a member who invited you can see that their invitation was used. Membership itself is not announced to anyone, and the app never shows which circle a member belongs to.

It does not cover other people's services, even when we link to them. That includes the application form run by our verification partner, the App Store and Google Play, an advertiser's site, a map you open from a safety alert, and anything a member sends you a link to. Each has its own policy.

Other people's details. Sometimes you give us information about someone else. If you name a trusted contact, we store their name, number and email address and send them a code. They can refuse, and if they do we stop. If you invite someone to apply, we keep their name, email address and mobile number until the invitation is used, or for 30 days after it expires or you withdraw it. Then we erase those details and keep only a fingerprint, so the same person is not invited twice. When you give us someone else's details you are telling us that you are entitled to, and that they would not object. If someone has given us your details and you object, write to us and we will remove them.

Account details. Your email address, mobile number and password. The password is stored only as a hash, never in a readable form. Each time you sign in we record the time, the IP address and the app or browser that signed in. That record is deleted when the session expires, or a day after you sign out of that device. The time, IP address and app of your most recent sign-in are also kept on your account until it is deleted. We also keep your country, your circle and plan, the channel you joined through, and who invited you, if anyone. While a new email address or mobile number waits to be confirmed we keep it too, and drop it if its code expires.

Your profile. Your name, date of birth, photographs, and the answers you choose to give: education, institute and field of study, work, employer, job title and industry, home city, religion and how you practise it, languages, lifestyle, relationship intentions, family plans, prompts and your bio. You may also give your height, marital status, gender identity, political view, income, pets and an Instagram handle. We also keep your biological sex, which decides who you are shown to and, in a pool, who speaks under an alias and who may enter from elsewhere, your time zone, and your member code. Almost every answer is optional, most offer "prefer not to say", and leaving an optional answer empty does not affect your membership. For each photograph we keep the image, a smaller copy, its dimensions and a fingerprint of the file.

Your settings. Who you want to meet, the conditions you have ruled out, your interests, your privacy and notification choices, and which circles you have chosen to be seen in.

Location, only if you turn it on. Location sharing is off by default. When you turn it on we store your most recent coordinates so we can show you people nearby, note when you have crossed paths, and show approximate distance on profile cards. After seven days an exact fix is reduced to a coarse cell, and after ninety days without an update it is deleted, unless a safety case requires us to preserve it. Other members never see your coordinates. They see a coarse distance band, only if they have also turned location on, and you can hide distance altogether, everywhere a distance is shown. When you and another member who has location on come within a short distance of each other, we record that crossing with its approximate place, the time and how many times it has happened. The record keeps that approximate place until you clear your crossings, either of you names a quiet place around it, or your account is deleted. You can pause Crosspath on its own, and you can keep up to five quiet places where no crossing is recorded; we store a quiet place as the area around it, with the name you give it if any, never the exact point. We also check whether a location came from a mock-location tool or an emulator, and whether a move between two fixes was physically possible. A failed check is kept for a year with the two positions it compared, and it also becomes a risk signal, which is kept with your safety record as described below. If you join a pool or check in at one, we keep the pool's place and your check-in. A pool has a fence of 30, 50 or 100 metres, set by the member who opened it. When you ask to join, your phone sends its position once, and we check that it is recent, exact enough and inside the fence. We keep the result, the time and how exact the position was, and not the position itself. A refused attempt is recorded, and after ten refusals in ten minutes you must wait before trying again.

Safety features, only if you use them. If you name trusted contacts, we store their name, mobile number and email address, and we send them a code so they can confirm or refuse. If a trusted contact opens a live-location link you sent, we note when, and the browser they used. If you raise a safety alert or set a check-in, we store the place, the note, the member you are meeting and, if you share it, your live location. The coordinates of an alert are erased after ninety days, and live location as soon as sharing ends. The rest of the alert stays with your account, and an alert that opened a case stays with your safety record.

Messages. The messages you send and receive, conversation requests, and the system notes a conversation carries. Messages and first messages are screened automatically. The screening looks for requests for money, pressure to move off the app before you have both shared contact details, threats, sexual messages the other person did not invite, phone numbers, email addresses and handles, known scam scripts, and terms that concern children or self-harm. A hit stores the message, up to 1,000 characters, so that a person can review it. It is kept with your safety record.

Pool chat. Inside a pool, a member can post one opening line and answer other members' lines. Each answer becomes a private chat between two people. We keep the line, the messages, the objects the two of you give each other, the stage the chat has reached, and where your Passion Potion is placed. In a pool of women and men, a woman is shown to men under an alias we give her for that pool, without her name or photographs, until the two have exchanged Passion Potions and she is revealed. She can open the profile of the man she is talking to. The alias hides her from other members, not from us: we know who she is throughout, and a person reviewing a report sees her account. In any other pool nobody is hidden. Pool chat is screened in the same way as other messages, and a message that contains a link is refused. When a chat is revealed, it is copied into an ordinary conversation between the two of you. The objects you are given stay with your account from one pool to the next. If you are a man, a woman you are chatting with in a pool can see which kinds of object you hold. Where the member who opened a pool allows it, a man can enter from elsewhere by spending Charms and Amulets. The objects spent are gone, unless we pause the pool, in which case they are returned. The women in the pool see that he entered from elsewhere.

Activity. Which profiles were shown to you and how often, which you saved, passed or skipped, whose profile you viewed, and your part in any pool, so the same people are not shown to you again and again. If you share your mobile number or email with a match, we record that you chose to. We also keep a log of the actions you take in the app, such as changing a setting, sending a request or joining a pool, which our support team uses to answer questions about your account.

Reports and risk. If you report someone, what you told us, including where and when it happened and whether you are in danger, and a copy of the content you reported. What happens to reports is in "Decisions made by software" below. We also keep a risk score for each member, from reports, screening hits, blocks, requests ignored or withdrawn, how often matches go nowhere, crossing and location patterns, links to a removed person, and any earlier enforcement. Our moderators read it, and at its higher levels it can limit an account by itself until a person decides, as set out below. It is never shown to other members. If your account has been reviewed, we keep the review: its case, any warning, restriction or slow-down, the notices we sent you, any appeal you made, and the reasons and notes behind a block.

Verification. Nothing is read from your social media, your contacts or your phone, by us or by our partner. An Instagram handle you add is kept on your profile for you alone: it is never shown to other members and never looked up. Admission rests on the documents you give the partner and, for some circles, a registry check on the qualification or employer you declare, not on who you know. Our partner arranges each check through specialist providers it instructs. For each check we store which check it was, which provider ran it, how and where, when, its outcome, its expiry, the partner's note on it and a reference to the evidence the partner holds. Any decision to override a check is recorded with who made it. We also receive the partner's decision on your application, any finding it reports, such as a document that appears forged, with its note, and a one-way fingerprint of your identity document number, email address and mobile number. One of the checks compares a live image of your face with the photograph on your identity document. That is biometric processing, and it happens entirely at the partner's provider, under the partner's policy: we never receive the image, the document or any measurement of your face, only the word that the two matched. For some circles the partner also asks for an education certificate and proof of employment, and confirms the qualification with the institution's registry and the employment with the employer. The employer is asked only whether you work there in the role you named; it is not told why, and it hears from the partner, not from us. The certificate and the proof never come to us, and no member and no member of our staff ever sees a document of yours. What a member sees is a label, "ID verified", "Education verified" or "Employment verified", and the label means one thing: that the partner confirmed that one fact on the date shown. It says nothing about the person's conduct or character, and we do not pretend otherwise. The partner deletes the selfie and the document 30 days after its decision and keeps only a fingerprint of each file. One year after the decision it removes your name, contact details, date of birth and identity numbers from its record, leaving the outcome and the fingerprints. A legal hold on your case stops both until it is released.

Your device. A token so we can send notifications to your phone, and, for each signed-in device, its type, operating system and app version. A one-way fingerprint of the notification token is kept with your safety record, so that a person we have removed cannot return under a new account on the same phone.

Crash reports. If the app crashes or meets an error it cannot recover from, a report goes to our crash-reporting provider: the device model, the operating system, the app version and what the app was doing at the time. Before the report leaves your phone, every email address, phone number and access token is replaced, the fields that hold names or anything you wrote are removed, and only an internal account number is kept to tell reports apart. Nothing else is sent: no performance measurements and no usage sessions. There is no other analytics or tracking software in the app.

Server logs. Every request to our servers passes through our hosting platform, which writes a line with your IP address, the time and what was asked for. Our own servers also write lines that carry an internal account number and, for some security events such as a reused sign-in token, an IP address. All of these are a short rolling log used to find faults. Our hosting platform does not keep them unless they are forwarded somewhere, and we do not forward them.

What the app asks your phone for. Four things. Your location, only while the app is open and only after you turn Human Ground on. Your photo library, to add portraits to your profile. Permission to send notifications. And Face ID or your phone's fingerprint, to confirm it is you before the app opens; that check happens on the phone, and nothing about your face or finger ever reaches us. The app does not ask for your camera, your contacts, your microphone, your calendar or your text messages: when a code arrives by SMS, it is your phone's keyboard that offers it, and we never read your messages. Each permission is asked for at the moment it is needed, not at install, and you can refuse it.

Purchases and support. Receipts from the App Store or Google Play for anything you buy. Apple or Google takes the payment, so we never see your card or bank details. The price of a plan is set in the store and is the same for every member in a country; we never price by person. No plan unlocks another member's information: what you can see of a member never depends on what either of you pays. A plan changes how many conversation requests and pools you can start, and can make you less visible; it never lets you see more of someone else. And the messages you exchange with support. To improve support, our staff may prepare a copy of support conversations in which names, contact details and account numbers are replaced by aliases; anything learned from it comes back as a note on the case, never as a change to your data.

Legal acceptances. Which version of these documents you accepted, when, and from which IP address.

Staff access. Each time a member of staff opens your safety record, a piece of evidence or your location, it is logged with their name and the time, and the log is checked automatically for unusual patterns. Other staff reads of your account, such as a support lookup, are written to our audit trail.

Answers that deserve extra care. Some of what you may tell us is the kind of information the law treats as sensitive: your religion, your gender identity, your political view, your income, your precise location, and the identity document our verification partner checks. Each of these is given by you, and all but the document are optional. We use them for what you gave them for, matching and the profile you have chosen to show, and for nothing else. The document itself stays with the partner.

This website. It sets no cookies and runs no analytics. The member gate stores one value on your device so you are not asked for the code again. The typefaces load from Google Fonts, so Google's servers see your IP address when a page opens.

Each thing we collect has a job, and we use it for that job and no other.

• To show your profile to the members your settings allow, and theirs to you.
• To carry conversation requests and messages between you and the people you have chosen to talk to, and to show a match the contact details each of you chooses to share.
• To show people nearby, crossings and distance, when you have turned location on, and to check that you are at a pool when you join it.
• To check, through our verification partner, that a member is who they say they are.
• To keep members safe: to screen messages, to act on reports, to run safety alerts and trusted contacts, and to stop a person we have removed from coming back.
• To take payment for a plan and to know which plan you have.
• To answer you when you write to support, or to the Grievance Officer.
• To send you the messages the service needs, such as a code, a security alert or a safety alert. Never marketing.
• To meet our legal duties, including a lawful request from a court or the police, described below.
• To find and fix faults, from crash reports and the server's own logs.
• To understand how the service is doing, in counts that identify nobody.

You consent to this when you accept these documents in the app, and you can withdraw a consent in privacy settings as described under "Your choices". A few things do not rest on consent, because the law allows or requires them whether you agree or not: answering a lawful order, protecting a person from serious harm, and keeping the safety record described below. Where that is so, this page says so.

• Your account and profile: until you delete your account.
• An account that never confirms its email address: deleted after 24 hours, together with everything written when it was opened.
• An account created by our verification partner that nobody claims: closed after 90 days, then deleted the same way as a deleted account.
• An application the partner declined: your details are kept 90 days, so that we can answer if you write to ask, and are then deleted the same way as a deleted account, about four months in all. A hashed record of the identifiers stays in the safety record, so the decision cannot be evaded by applying again.
• A deleted account: 30 days, then your personal data is destroyed. What remains is described below.
• An account left unused: after 23 months with no sign-in we write to you, and at two years, if still nobody has signed in, the account is closed. Closing is the same as deleting it yourself, with the same 30 days to come back. This applies to active and paused accounts; an account under review is left with the person reviewing it.
• The record that you accepted a document or gave a consent: 5 years after your account is purged, with the IP address removed at the purge.
• A sign-in record: until the session expires, or a day after you sign out of that device.
• Messages in a live conversation: while the conversation exists.
• Messages in a closed conversation: the text is destroyed 24 months after it closed.
• Pool chat: a chat can be read for 48 hours after its pool ends at the new moon. The text is destroyed 180 days after the pool ended. A chat that was revealed is copied into a conversation, and that copy follows the two rules above.
• The objects you hold and your potions: until your account is deleted, or until you spend an object.
• The record that you joined a pool, with the result of its location check: until your account is deleted.
• A message you unsend: the text is destroyed 90 days after you recall it.
• The first message of a request that was withdrawn, ignored or expired: the text is destroyed 90 days after the request ended.
• Your location: an exact fix is reduced to a coarse cell after 7 days, and deleted after 90 days without an update.
• A crossing: no longer shown after 7 days, or 30 days if you both expressed interest. The record, with its approximate place, stays until either of you clears your crossings or names a quiet place around it, or until your account is purged.
• A quiet place: until you remove it, or until your account is purged.
• The counts a cleared crossing leaves behind, so that clearing cannot reset the limits that protect the other member: 90 days, or until a report, hold or serious case about either member has ended, whichever is later.
• Location integrity checks: 1 year.
• The coordinates of a safety alert or check-in: 90 days. Live location: until sharing ends.
• Reports: the report itself, what you told us, is kept with the safety record. Every copy of the reported content is destroyed 1 year after the case is resolved; a fingerprint of each copy stays, so the record shows what was captured. A case that has not been resolved keeps its evidence until it is.
• A data export you request: the download link and the file last 48 hours, then the file is deleted. If the storage provider fails to delete it, we try again until it is gone.

Each period above is suspended while a preservation hold covers the record, as described at the end of this section.

About unsent messages. When you unsend a message it stops being visible to everyone immediately, and the other person sees only that a message was withdrawn. We keep the text itself for 90 days because "send abuse, then unsend it" would otherwise leave a victim with nothing to report. After 90 days the text is destroyed. The record that a message existed, and that you withdrew it, remains.

About deletion taking 30 days. When you delete your account it disappears from Sapiomate straight away and nobody can sign in to it. We keep your details for 30 days only so that you can change your mind, which happens more often than you might think, and so that a deletion made under pressure can be undone. After 30 days your personal data is destroyed and cannot be recovered. That means your profile, photographs, answers, settings, location, crossings, pool chats, objects and potions, trusted contacts, safety alerts, support messages, notices, sessions and devices, as well as the record of who was shown to you and the key that links any exported copy to you.

About backups. A copy of our database is taken every day, and each copy is kept for seven days. So a record we have destroyed can remain in a backup for up to seven more days, after which the backup itself is gone. Backups exist for one reason, to bring the service back after a failure. Nobody opens them for any other purpose. If one is ever restored, the deletion schedules on this page run again before the service reopens, and we will re-apply any deletion that was made after the copy was taken.

What deletion does not remove. An anonymous stub of your account remains, because other members' records point to it. An object you gave another member in a pool stays in their collection, no longer linked to you. Reports you made, and reports made about you, are kept with the safety record, so that leaving cannot erase a case. Your conversations remain for the other person, with your words removed from them, except in a conversation under a preservation hold, which keeps both sides until the hold ends.

Our safety record about you is kept after your account is deleted. It holds one-way fingerprints of your email address, mobile number, identity document and devices. It also holds your risk signals and risk level, screening hits with the message that triggered each, the partner's findings, any slow-down, restriction or lock and your appeals against them, and your part in any pool that was reported. It is deleted 2 years after your account is purged, or 7 years after if you were ever banned, placed under a hold, the subject of an enforcement action, or the subject of a partner finding. Three records are kept longer, as oversight. They are the history of the partner's checks and decisions, which is meant to carry no document or contact detail; the safety cases and the decisions taken on them; and our audit trail of what staff did, including our tamper-evident safety ledger. These are kept for up to 10 years.

The record that you accepted each document, and gave or withdrew each consent, stays for 5 years with the IP address removed, so that "did this person agree" has an answer if it is ever asked.

Preservation holds. A hold is placed when a serious report or a legal request concerns a member, when a member raises a safety alert, or when a reviewer decides a record must be kept. While it lasts, every period above is suspended for the records involved. A hold from a report is lifted after the case closes, once a further period set by its seriousness has passed: three years for the most serious cases, then two years, one year and six months. A hold from a legal request lasts until our legal team releases it. We do not tell the member about the hold, because that would tell them a report exists; a member whose account is restricted while a case is open is told that their account is under review, as described below.

We do not sell your personal information to anyone, and we do not share it with advertisers or data brokers.

There is no list of who liked you. The one place you learn of interest before it is mutual is a crossing: if someone you crossed paths with expresses interest, the crossing shows it, so that you can decide whether to answer. We do not use read receipts or typing indicators. These are deliberate product choices, not features we have yet to build.

We do not send marketing. Every email, text message and notification we send exists because you did something or because your safety or your account needs it: a code, a reply, a security alert, a safety alert. There is nothing to unsubscribe from because there is no list.

We do not run analytics or tracking software in the app or on this website, beyond the crash reports described above, and there is no advertising software in the app either. Our emails carry no tracking pixel and no tracked link: we do not know whether you opened one.

We do not train any model on your photographs, your messages or your answers, and we do not use them for research.

Advertisements. Sapiomate does not carry advertisements yet. When it does, including placements from banks and insurers, each will be a space we chose and they bought, like a page in a magazine. The advertiser will be given nothing about you: not your name, not your answers, not that you saw it, not that you are a member. Nothing you have told us, and nothing the law treats as sensitive, will be used to decide which advertisement you see. If you tap one you leave for the advertiser's site, and from that moment their policy applies, not this one. No advertiser will be able to reach you inside Sapiomate.

We do not publish success stories. Your name, your photograph and what happened between you and another member are never used in our marketing or on this website without your written consent.

No profile is visible to anyone who is not a signed-in member: not on this website, not to a search engine, not to someone who has been sent a link. Photographs are sent to the app over private links that stop working fifteen minutes after they are issued, so a copied link is of no use for long. Other members see your profile as your privacy settings allow. They never see your exact location or your date of birth, and they see your age only if you have not hidden it. Your age is still used to place you inside or outside another member's chosen age range, so a member who keeps narrowing their range could estimate roughly how old you are. They never see your email address or your mobile number unless you choose to share one with a match, which is off until you turn it on, for that match alone. In a pool of women and men, the men are not shown who is in the pool, and they see a woman in its chat only under her alias, as described under "Pool chat". We do not tell other members who viewed your profile, and we do not tell you who viewed yours.

Our staff see only what their role needs. Support, verification, safety review and legal each have their own access. Reports and the content they concern are opened only by our safety and legal staff, and every time one of them opens a report and reads reported content, that is recorded with their name and the time. If you report someone, we tell you whether your report led to action, and never what the action was.

The partner organisation that reviews applications sees what it needs to make an admission decision.

A few companies do work for us, and to do it they handle some of your information. They may use it only to do that work, and never for themselves.

• DigitalOcean runs the servers and the storage where everything described here is held.
• Amazon Web Services delivers our email, with Resend as the fallback route when it cannot. 2Factor delivers our text messages in India. Each sees the address or number and the message.
• Apple delivers notifications to iPhones. It sees your phone's notification token and the notification itself, which says only that something happened unless you have turned on notifications with details.
• Sentry receives crash reports, with the details described above removed.
• Google serves the typefaces this website uses, and so sees the IP address of anyone who opens a page.
• Apple and Google take payment and tell us what you bought. For that they are not our processors; they handle your payment under their own policies.
• Our verification partner reviews applications and arranges the checks described above through specialist providers it instructs under contract. It holds the documents under its own policy; what we hold is described under "Verification".

That is the whole list. Advertisers are not on it because they receive nothing. When a company on it changes, this page changes with it.

Two links can carry your information to a service that is not on this list, because you choose to open them. A safety alert sends your trusted contacts a map link with your position, which opens in Google Maps. And if a match has shared a mobile number with you, the app can open WhatsApp with that number.

Sometimes the police, a court or another authority asks us for information about a member. We built a fixed procedure for this, and the procedure is what happens, every time.

• Every request is logged with the authority that sent it and its contact, the law it relies on, what it covers, its dates, and the name of our own officer who handles it.
• A request to preserve records must name the member concerned, and places a hold at once, before anyone has checked that the request is genuine, so nothing can be lost while we check.
• Nothing is disclosed until a second member of our legal team, never the one who logged the request, has confirmed that it is genuine and lawful. What we hand over is recorded against the request, and is limited to what the request covers.
• Where there is an imminent risk to someone's life, a second person can approve disclosure before that check is complete. The record is made at the time.
• Whether we tell the member is decided per request by our legal and compliance staff, and the reason is recorded. In many cases the law does not allow us to tell you.
• Only our legal and compliance staff, and our administrators, can see these requests. They are kept out of the safety records other staff can read, and every time a request is opened that is logged too.

We also disclose information when we must to protect a person from serious harm, to enforce our Terms against someone who has broken them, or to defend ourselves when a claim is brought against us, and then only what the claim concerns.

Some decisions on Sapiomate are made by software before a person has looked. Here is each one, and what it can and cannot do.

• Who you are shown. There is no compatibility score. The people you see are the members who pass your settings and theirs. Within that, a member whose account is slowed down comes last, members who share a language with you come first, and members who have been seen by fewer people come ahead of those seen by many. On Discover, members of the Sapiomate circle are mixed in at a set share. The rest of the order is a shuffle fixed for each pair of members, which nobody can climb. If you choose to sort by distance, the nearest come first.
• Message screening. Messages and first messages are checked for the patterns listed under "Messages". Every hit adds to the sender's risk score, described below, and a threat also opens a case for a person to review. Two hits do more at once. A term that concerns the safety of a child locks the sender's account inside a conversation, and in a first message hides the sender from everyone; the hiding is silent, so as not to warn them. A term that suggests someone may harm themselves opens a case for the sender, with no action against them.
• Reports. When a report is filed, its category sets an interim response before anyone has checked it. The most serious lock the reported account: they cannot sign in, and they disappear from the app. The one exception is a report that someone may harm themselves, which opens a case to help them and takes no action against them. Serious reports hide the account from discovery and search and stop new conversations, while existing ones continue. Less serious reports slow an account down, so that it is shown less often and can send fewer first messages a day. That happens on the first report from someone who had been in touch with the member, or once several different people have reported the same thing. Locks and hides are placeholders, not verdicts, and only a person's decision lifts them. A slow-down ends by itself after at most seven days, or sooner if no case is open. Software never bans anyone.
• Identity. When an account is opened or admitted, one-way fingerprints of its email address, mobile number, identity document and device are compared with those of people we have removed or are reviewing. A match on the email address, mobile number or document to such a person, or to someone who failed an age check, holds the new account: it cannot sign in until a person has reviewed it.
• Verification. A serious finding from our partner, such as a document that appears forged or a face that does not match it, holds the account in the same way. If the partner declines a member who is already admitted, the account is hidden until a person reviews it. If a check has to be renewed, the account is slowed down until it is, and the app asks you to verify again.
• Age. If our partner finds that a member is under 18, the account is locked at once pending review, and a one-way record of the failed check is kept.
• Location. How often you can update your location or ask who is nearby is limited, and a probe far from where you are is refused. An unusual pattern becomes a risk signal, which adds to the risk score. A request to join a pool is refused by software when the position sent is outside the pool's fence, old, not exact enough, or comes from a mock-location tool or an emulator. The message is the same whatever the reason.
• Risk score. Reports and signals are combined into a score with three levels. At the middle level the account is slowed down. At the high level it is hidden, and a case opens for a person to review. At the high level with one of the most serious signals, it is locked and the case is escalated. The score is read by our moderators and is never shown to other members.
• Dormancy. The one thing software does to an account with no person deciding: after 23 months with no sign-in we write to you, and at two years the account is closed. Signing in at any point stops it, and after a close the ordinary 30 days to restore apply.

When any of these locks or hides your account, apart from the silent hiding described under "Message screening", the app tells you that your account is under review and how to reach us: write to [email protected]. A slow-down is not announced. A person makes the final decision on every lock and hide, and if you believe software has got anything else wrong, write to the same address and a person will look.

See your data. Request a copy from Settings. We build an archive and email you a link, which works for 48 hours. It contains your account, profile and answers, your settings and preferences, photograph details and your current location. It also has your saved members, your crossings and quiet places, the messages you sent, the first messages of the requests you sent, your pool chat lines and messages, the aliases you were given, the objects you hold and your potions, and what you wrote to support. And it has the reports you filed, the notices we sent you and your appeals, your consents and legal acceptances, verification checks, and any trusted contacts and safety alerts. It does not include other people's messages, because those are theirs, the photographs themselves, blocks, pools or purchases, the log of your actions in the app, or our safety record about you. If you want any of those, or a summary of what we process about you and why rather than the data itself, write to us: this page is that summary, and we can send the list of tables and columns behind it.

Delete your data. Delete your account from Settings. See above for what happens and when. If your account is locked while a report is reviewed, you cannot sign in, so you cannot delete it until the case is decided; the record is evidence until then. Once the case is closed, deletion proceeds as above.

Turn off location. Privacy settings, at any time. Your current position is deleted at once, and you disappear from location-based results immediately. Crossings you already have are hidden and keep their approximate place until you clear them or your account is deleted, and a failed location check stays for its year.

Pause, quiet places and clearing crossings. In Crosspath settings, reachable from the Crossings page and from Privacy settings, with location on or off. Pausing Crosspath stops new crossings for you and for anyone who passes you, and takes you out of every list of crossings, while Nearby and pools stay on. A quiet place stops crossings there, and deletes the ones already recorded there. Clearing deletes every crossing you have, at once, including faded ones, together with the record of what you did on them and any notification about them not yet sent. A crossing is shared by two members, so clearing removes it for the other member too. Some things stay. A notification already delivered to a phone is beyond our reach. A risk signal a crossing raised, such as coming close to someone who had blocked you, is kept with your safety record as described above. Some counts stay, so that clearing cannot reset the limits that protect the other person: how many times interest was sent each way, how often you crossed in one place, and when you last crossed. The place is kept only as a code that cannot be turned back into a location. These counts are kept for 90 days, and for longer while a report between you, an evidence hold or a serious case about either of you is open. And if there is an open report between you and the other member, an evidence hold, or an open serious case about either of you, the crossing disappears for both of you at once. It is kept for the person reviewing it, and deleted when that ends.

Correct your information. Edit your profile at any time. Two things are different: religion is set once and cannot be changed afterwards, and once our verification partner has confirmed your date of birth, it can only be corrected through verification. If something we hold about you is wrong, write to support.

Your consents. Give or withdraw each one in privacy settings. Withdrawing takes effect at once for location, location in safety alerts, sensitive profile details, alerts to your trusted contacts and notifications with details. Verification is different: checks already done stay on your record, because admission rests on them, and no new check is ever run without a fresh consent you give to the partner.

If you cannot sign in. Write to [email protected] from the email address on your account. We will check that it is you before we show, change or delete anything, and we will tell you what we did. A reply usually takes a few days. We do not charge for any of this. We refuse a request in two cases only: when it would hand over someone else's information, or when we cannot confirm that it is you. We tell you which, and you can take the refusal to the Grievance Officer, to the data protection authority where you live, or to court.

How we answer. We answer every request in writing, by email, and within one month at the latest. If a request is complex, or you send several at once, we may take up to two more months; if so, we tell you within the first month, and why. If we do not do what you asked, we tell you why, and you can complain to our Grievance Officer or to the data protection authority where you live, or take the matter to court.

Someone acting for you. We have not yet built a way for you to name a person to act on your account if you die or cannot act yourself. Until we have, a relative may write to us with proof of who they are and of what has happened, and a person will decide what to do.

Everything that passes between the app and our servers, and between this website and your browser, travels encrypted. Passwords are hashed. Photographs are stripped of their embedded metadata, such as camera location, when you upload them, and they are served over signed links that expire after fifteen minutes rather than public URLs. Sign-in tokens live fifteen minutes, and the refresh token that renews them changes each time it is used. Sessions can be revoked, one device or all the others. A revoked session is usually cut off at its next request, and always within fifteen minutes, when its last sign-in token runs out. Deleting your account revokes all of them.

Sapiomate is for adults. We do not knowingly collect information from anyone under 18, and a date of birth under 18 typed into the app is refused. If our verification partner finds that an account belongs to a minor, it is locked at once and closed. We keep a one-way record of the failed age check, which makes it hard for the same person to return under a new account and a new date of birth. If you are a member and believe a profile belongs to someone under 18, report it from the profile and choose "Suspected minor": it goes to the top of the queue, and the account is locked while it is reviewed. If you are a parent or guardian and believe your child has an account, write to [email protected]. We will suspend the account while we check, and close it if you are right.

Sapiomate is available in more than one country. Today, every member's information is held on servers operated by our hosting provider in India, with photographs and data-export archives in that provider's object storage in Singapore. The providers that deliver our emails and text messages process your address or number where they operate: 2Factor in India, Amazon Web Services in the region we use it from, and Resend, our fallback, in the United States. Apple delivers notifications to iPhones from the United States. Crash reports, with the details described above removed, go to our crash-reporting provider, which stores them outside India.

Our intention is to hold each member's data in the country they joined from, as we open each market. When that is true for your country, this page will say so, and until it does the paragraph above is the fact.

If you live in the European Economic Area or the United Kingdom, the GDPR applies to everything on this page, and this section says how.

Why we are allowed to. Most of what we do with your information is needed to provide the service you asked for: your account, your profile, the people you are shown, your conversations, your plan. The optional answers, including the sensitive ones listed above, your location, and your trusted contacts rest on your consent, which you can withdraw in privacy settings. Screening, reports, the risk score and the safety record rest on our legitimate interest in keeping members safe, which we believe outweighs the intrusion because none of it is shown to other members and software never bans anyone. Answering a lawful request rests on legal obligation.

Your rights. You can see your data and take it with you, which is the export in Settings, in a machine-readable file; the photographs themselves are not in it, and we will send them if you ask. You can correct it, which is editing your profile. You can erase it, which is deleting your account. You can withdraw any consent. While a question is open, you can also ask us to restrict what we do with your data, or object to our doing it. Write to us, and while we look we will stop the processing you object to where we can. That may mean suspending your account until the question is settled. Software does not take any final decision about you with serious effect: the locks and hides described above are interim, and a person decides. The one exception is closing an account nobody has signed in to for two years, after a warning; signing in once stops it, and you can restore the account for 30 days after. We answer a request within one month, and if it is complicated we may take up to two more and will tell you so. We check that it is you first.

Where it goes. Your data is held in India, with photographs and exports in Singapore. The European Commission has not found that either offers equivalent protection. Each provider that handles your data outside the EU, which means our hosting, email, text-message, notification and crash-reporting providers, is bound to us by the EU's standard contractual clauses, and the UK addendum where it applies. You can ask us for a copy of the clauses.

Complaints. You can complain to the data protection authority of the country you live in, and in the UK to the Information Commissioner's Office, at any time. We would rather hear from you first. Our representative in the EU is [EU representative name and address].

If Sapiomate is sold, merged or reorganised, your information goes with it only under this policy, and whoever takes it on is bound by everything on this page. We will tell you before it happens, and you can delete your account before it does. If Sapiomate closes down, your information is destroyed, not sold: nobody who buys the remains of the company gets the members.

We record which version of these documents you accepted when you joined. A later version does not apply to you until we have told you about it and you have accepted it in the app.

Questions, or to exercise any of the choices above: [email protected]

The person responsible for your personal data at Sapiomate is [Name], who can be reached at that address or by post at [Registered entity name], [Registered address], India.

Our Grievance Officer, appointed under Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, is [Name of the Grievance Officer], [email protected], [Registered entity name], [Registered address], India. Complaints are received at any time and are read between 10 am and 6 pm India time, Monday to Friday, excluding public holidays. A complaint about content on Sapiomate, or about how a complaint was handled, goes there; this page explains what happens to it.