Privacy Policy

2. Data We Collect

• Account data: email address and name when you sign in with Google or Apple, and the profile picture Google provides.
• Email sign-in: if you choose Continue with email, we store the email address you enter as your account email (there is no password) and email you a 6-digit sign-in code. We send account emails through Sendly (Devino), which receives your email address and the code in order to deliver it. The code expires after 10 minutes, works once, and stops working after 3 wrong tries; we keep only a scrambled (hashed) copy of it.
• Guest data: a browser fingerprint and guest session token (no personal identifiers).
• Profile data: birthday, bio, display name, gender, and interest selections you provide. Your birthday is used to work out your age. Matching uses the age band it puts you in (13–17 or 18+) and, only if you are 18 or older, your age in years. The birthday itself is never shown to chat partners, but if you are 18 or older, people you chat with see your age in years on your profile card.
• Chat messages: text messages you send and receive, stored for delivery and safety moderation.
• Images: pictures you send are stored as files in our object storage (Backblaze B2) and scanned by AI moderation before they are delivered.
• Moderation data: AI safety verdicts, reports, appeals, and sanctions generated during content review.
• Technical data: device type and connection metadata. We don't use IP-based geolocation, and we don't retain raw IP addresses with your account. A one-way hashed device fingerprint is kept solely to enforce bans.
• Product analytics: we run PostHog on our own servers. It records page views and a closed list of 29 named events (for example "a match was found"), each carrying only ids, counts, true/false flags and short fixed labels such as the page route — never message content, never profile details. Analytics also records the domain of the website that sent you to us, such as www.bing.com, never the full address. When you first sign in with Google or Apple, our server also records one sign-up event: whether a guest session was upgraded, and where your first visit came from (a campaign label, the referring site's domain and the route of the first page). Autocapture is switched off, and page addresses on these events are reduced to the route before they are sent. From your very first session, guest or signed in, these events are keyed to your account identifier, so they are pseudonymous rather than anonymous. Google Analytics runs on our marketing site (safemeet.now) only if you accept it there; it is not loaded in the chat app.
• Session replay: to see where people get stuck, we record a sample of sessions in the chat app, using PostHog and Sentry, both of which we run on our own servers. PostHog records about 10% of sessions. Sentry records about 10% of sessions from the start; it also keeps the most recent minute of every other session in your browser's memory and sends it to us, and records the rest of that session, only if an error happens. A replay is a redrawn picture of the screen, not a video and not a copy of your messages: all text on screen is hidden, including what you and the other person write, anything you type is hidden, and images, icons and video are replaced by blank boxes. What a replay does show is the layout of the page, where you tap, click or move the pointer, how you scroll, and which pages you move between. We do not record the contents or headers of network requests, or what is written to the browser console. Once your session has started, replays are keyed to your account identifier, the same one that is on your analytics and error reports. No replay is recorded for a browser that sends Global Privacy Control or Do Not Track; the analytics events and error reports described above are still sent. A recording can still contain the address of a page or a link to a conversation, and the random identifiers of conversations and messages in the page's markup, and PostHog does not hide tooltips and screen-reader labels, such as the time shown for a message.

3. How We Use Your Data

• Check each chat message before it is delivered, and deliver the ones the check lets through.
• Generate the AI companion's replies when you chat with it.
• Match you with compatible chat partners based on your preferences.
• Enforce safety rules (age attestation, content moderation, sanctions).
• Maintain and improve the service.

4. AI Content Moderation

Every message is checked before delivery. An instant filter blocks a short, fixed list of phrases on the spot, and every message it lets through is reviewed by an AI moderation system. This system evaluates messages for safety concerns including harassment, threats, and inappropriate content. A message either check blocks is not delivered. A text message the AI system flags as borderline is still delivered. Either way, the sender sees a safety notice. A block from our full AI review can also record a warning on the sender's account, though not every one does: none is recorded when our text model is not confident enough to count it against the sender, when our own systems failed, or for a message about the sender's own crisis. A message stopped by the instant filter never records one. Enough reports from different people against the same user, each within 24 hours of the one before it, trigger an automatic, time-bound ban.

If a message the check lets through contains contact details we detect (an email address, phone number, link, social media handle or crypto wallet address), we replace them with a placeholder in the copy we keep and deliver, so your chat partner sees the placeholder instead, and we tell you we did. We keep only which kinds were hidden and how many, not the details themselves.

We also keep an internal reputation score for each account. It starts neutral and changes only when a warning is recorded against a message you send, when the same flagged text goes into three or more chats within a day, when our AI review upholds a report against you or a report you filed, and when you and a chat partner both choose to keep chatting. Skips, reports that are not upheld and panic-button reports never lower it, an appeal we accept removes what it covered, and anything older than 90 days stops counting. Nobody sees the score. It only affects matching: who you are paired with and how soon you are offered the AI companion while you wait for a person. Deleting your account deletes it.

5. Data Sharing

We do not sell your data. These are the outside services that receive any of it:

• Groq — our primary AI moderation provider. Receives the text of each message our instant filter lets through, for safety review, and returns a verdict. No personal identifiers are sent with it. When a report or appeal is filed, it also receives the report or appeal text, recent messages from the conversation(s) involved, and the case's moderation record (report category, earlier-report count, automated risk signals, the sanction appealed).
• OpenRouter — the moderation fallback: a message also goes to OpenRouter if Groq does not return a usable answer. It scans images too. Same data, same limits. It also generates the AI companion's replies with OpenAI's gpt-4o-mini model. To answer a message you send the companion, it receives that message only once it has been delivered, together with recent messages from the same chat, yours and the companion's. OpenRouter passes each request on to a provider that hosts the model it names.
• Google Perspective API and Hive — additional text-scoring services that run only when their keys are configured. When they run, they receive message text the same way Groq does, and nothing else.
• Backblaze B2 — object storage for the images you send, and encrypted backups of our analytics database.
• Notifly — delivers notifications. Receives your account identifier and, if you use a native iOS or Android app, a device push token; no message content and no email or name.
• Sentry (self-hosted) — error reports so we can fix crashes, and the session replays described in section 2. Configured not to send personally identifying request data, and cookies are stripped before sending. Reports and replays carry your account identifier so we can trace a fault.
• Google Analytics — marketing site only (safemeet.now), and only after you give consent there. It is not loaded in the chat app.
• Slack — feedback and support requests you send from the app may also be posted to Slack, where our team reads them, with your account identifier, your contact email if you gave one, the page you sent it from or the action that failed, and ids that tie it to your analytics session or the AI reply you rated. Your chats are not attached.
• Cloudflare — sits in front of safemeet.now and app.safemeet.now, and the encrypted (TLS) connection from your browser ends at its edge, so every request to either site, including the messages you send, passes through its network on the way to our servers.
• Authentication providers (Google, Apple) during sign-in.
• Sendly (Devino) — sends our account emails, and receives your email address and the one-time code to deliver it when you sign in with an emailed code.
• Infrastructure providers (hosting, database) as necessary to operate the service.
• Law enforcement when required by applicable law.

6. Data Retention

• Messages: an automated sweep blanks the text of every conversation 30 days after it ends. Nothing today exempts a conversation from that sweep — not even one you both chose to continue.
• Guest accounts: an expired guest session stops working immediately, and an hourly job erases the account's database records, together with the images it sent, once it has been expired for seven days, unless a ban is active on it.
• Moderation records and sanctions: kept while the account exists, so a ban cannot be shed by starting over.
• Images: deleted from storage 30 days after the conversation they were sent in ends, on the same clock as message text. They go sooner if the account that sent them is deleted from the profile menu, is erased by the guest expiry above, or on request.
• Error reports and session replays: Sentry keeps replays and error reports for 90 days. PostHog keeps recordings for 5 years.
• Support requests: A support request sent from inside an account is removed when that account is deleted. A support request sent with no account session, such as from the support page while signed out, is stored with the contact email you gave and is not tied to any account. It is kept: deleting an account does not remove it, and no automatic job deletes it. A copy posted to Slack is not removed by account deletion either.

7. Your Rights

• Access: request a copy of your data.
• Deletion: delete your account from the profile menu. This removes your profile, your messages, your stored images, your reports and blocks, and your sign-in details including the email address you signed in with or entered, the name from Google or Apple and any profile picture Google supplied. Any unused sign-in code sent to the address on your account is removed with it. It also removes your push-notification registration from our notification provider. Three limits, stated plainly: while you have an active ban you cannot delete (otherwise deleting would erase the ban); the one-way hashed device fingerprint record is kept, because the same record can belong to other accounts on that device — but after deletion it is no longer linked to you or to any sanction; and analytics and error records already sent to PostHog and Sentry, including session replays, are keyed to your identifier and are not reached by the in-app deletion — email us and we will remove those too.
• Correction: update your profile information at any time.
• Portability: request your data in a machine-readable format.

8. Cookies

The chat app sets essential cookies, for authentication and session management, plus two small optional ones described below. It sets no advertising cookies. Our analytics does store an identifier in your browser, but in local storage rather than a cookie, so the identifier is not attached to your requests. Session replay does the same: it keeps a session identifier in your browser's storage, not in a cookie. For half an hour after you press a sign-in button, the app does add one short note to its requests: where your first visit came from (a campaign label, the referring site's domain and the route of the first page), never an identifier, so the sign-up can be counted by source. The app also keeps that note in a cookie for the same half hour, because the live connection and page loads cannot carry it any other way. If your browser has opted out of analytics, the app instead keeps a cookie that says so, for a year, and our server then records no sign-up event for you. These two small cookies hold no identifier, and neither is needed to sign in or to chat.

Our marketing site (safemeet.now) is different: Google Analytics there does set cookies, so that site asks before loading it, and you can change your answer at any time on its privacy page.

9. Children

SafeMeet is for ages 13 and up. Age is self-declared during onboarding through birthday attestation — we do not verify it. If you are under 18, we strongly recommend a parent or guardian knows you're here. We do not knowingly collect personal information from children under 13.

10. Changes

We may update this policy. Material changes will be communicated through the service.

11. Contact

For privacy inquiries, contact us at privacy@safemeet.now.