Privacy

This notice covers the website and the app. It describes what happens today, not what we plan to do later.

What the app stores

Your email address, encrypted, with a separate hash so we can find your account without reading the address. Your password as a hash, never as text. Your display name, your city and the year you were born. Your gender, pronouns, orientation, transition note, bio, what you are looking for and your prompt answers, all encrypted at rest. Your photos and, if you record one, a single voice note. Your messages, encrypted at rest. Every field carries its own visibility setting, stored alongside it. So does each of your photos, except your main photo, the one that shows your face, which every verified member can see.

When you create an account, we also record in one word where your visit came from, for example ChatGPT, a search engine, social media or a direct visit, so we can see which channels bring people who join: it is a category, never the link you followed or your IP address, and your browser only keeps it until you close the tab.

What the app never stores

Your IP address. A fingerprint of your browser or device. Your exact position. There is no column for any of them, and the test suite checks that there still is not. If you turn on notifications, we do keep something tied to that device: what it needs to receive them, meaning the address and keys your browser creates for that or, in the app installed on your phone, its push token. Turning notifications off on that device deletes it, and so does deleting your account.

Location

We store an approximate point, never the one your phone reports. It is offset by up to 250 metres, always by the same amount for you, so repeated readings cannot be averaged back to your address. There is no map any more: we removed it because the point it drew was stable enough to outline the area around your home. Distances are measured from a one-kilometre cell instead of from your point. Photos are stripped of their EXIF metadata before they touch the disk, because the first photo taken at home would otherwise undo all of it.

Verification selfies

A selfie sent for verification is kept apart from your photos, so it cannot appear on your profile by accident. It is deleted when a moderator decides, and in any case within seven days, by a job that runs whether or not anyone opens the moderation queue. Before deciding, the moderator compares the selfie with your main photo, only to check that both show the same person.

Who else sees anything

Cloudflare serves this site and sees the address of every visitor, as any host would. We count visits with Matomo, which we run ourselves: no cookie, address anonymised, Do Not Track respected. Google Analytics, Microsoft Clarity and our mailing tool load only if you say yes, and none of them ever runs inside the app. Place searches are relayed by our own server, so the service that answers them never learns who is looking, or where. Push notifications travel through your browser vendor or, in the app installed on your phone, through Expo and then Google, and they never contain a name, a photo, or the text of a message.

The newsletter

If you ticked the newsletter box and your email address is confirmed, two things are copied to Mautic, the mailing tool we run on our own server in the European Union: your address and your language. Nothing else: no name, no gender, no profile. Letters leave from our own mail server. Mautic counts opens and clicks so we know whether a letter was read; that information stays on our server. Every letter has an unsubscribe link, which also withdraws your consent in the app and removes your address from Mautic, and deleting your account removes it too.

Consent

When you create an account we record which statements you agreed to, their exact wording, the date, and a fingerprint of that wording. Processing gender identity requires explicit consent under Article 9 of the GDPR, and that is the basis we rely on.

Deletion

One action deletes your account. It removes the rows rather than flagging them. The encrypted backups made before that still hold them until they rotate out and are erased for good, which takes about forty days at most.

Your rights

Ask for a copy of your data, or its deletion, at privacy@t4tspace.com from the address on your account. We answer within 30 days, usually sooner.