Privacy Policy

1. Information We Collect

• Account information: email address, display name, age
• Profile information: photos, bio, location (city/region), gender, dating preferences, and self-selected personality traits ("red flags")
• Usage data: swipe actions, matches, messages, and in-app activity logs
• Device data: device type, operating system, IP address, browser/app version, push notification tokens
• Payment data: subscription status and transaction records (card details processed and stored exclusively by Stripe — we never see or store raw card data)
• Communications: support emails and bug reports submitted to us

2. How We Use Your Information

• To create, display, and manage your profile for other authenticated users
• To facilitate matches, swipes, and in-app messaging
• To send push notifications about new matches and messages
• To process membership payments and subscriptions via Stripe
• To enforce our Terms of Service and Acceptable Use Policy
• To investigate reports of policy violations and take action
• To improve app performance, fix bugs, and develop new features
• To comply with legal obligations and respond to law enforcement requests

3. Cookies & Local Storage

RED FLAGD uses minimal browser storage for essential functionality only. We do not use third-party tracking cookies, advertising cookies, or social media pixels.

What we store locally:

• Authentication token — keeps you logged in (localStorage, essential)
• GDPR consent preference — records your cookie choice (localStorage, essential)
• Language preference — remembers your selected language (localStorage, essential)
• Scroll position — restores your place when navigating back (sessionStorage, essential)
• Onboarding state — tracks profile setup progress (localStorage, essential)
• Push notification token — enables push notifications (localStorage, essential if enabled)

We use no analytics cookies, no advertising cookies, and no third-party tracking scripts. Our internal analytics track anonymous feature usage without cookies.

You can clear all locally stored data at any time via your browser settings or by deleting your account.

4. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Contract performance (Article 6(1)(b)) — processing is necessary to operate the platform, facilitate matches, and deliver the services you signed up for
• Legitimate interests (Article 6(1)(f)) — processing for app improvement, bug fixing, fraud prevention, and platform security
• Consent (Article 6(1)(a)) — for push notifications and any optional communications you opt into
• Legal obligation (Article 6(1)(c)) — when required to comply with applicable laws or respond to lawful requests

5. International Data Transfers

Your data is stored and processed on servers located in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses (SCCs) as approved by the European Commission.

By using RED FLAGD, you acknowledge that your data may be transferred to and processed in the United States. We take all reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy.

6. Japan (APPI Compliance)

For users in Japan, RED FLAGD complies with the Act on the Protection of Personal Information (APPI):

• Personal information handling — we collect and use personal data only for the purposes stated in this policy, with your consent
• Third-party provision — we do not provide personal data to third parties without your consent, except as required by law
• Data retention & deletion — you can request disclosure, correction, or deletion of your personal data at any time via support@embracethechao.com
• 跨境データ移転 — your data is processed on servers in the United States. By using RED FLAGD, you consent to this international transfer
• 苦情・問い合わせ — complaints about our data handling can be sent to our Data Protection Officer at legal@embracethechao.com

7. South Korea (PIPA Compliance)

For users in South Korea, RED FLAGD complies with the Personal Information Protection Act (PIPA):

• Consent — we obtain your explicit consent before collecting and using your personal information
• Purpose limitation — personal information is collected and used only for the purposes specified at the time of collection
• Data protection officer — inquiries about personal information handling can be directed to legal@embracethechao.com
• Rights — you have the right to request access, correction, deletion, and suspension of processing of your personal information at any time
• 개인정보 국외이전 — your personal information is transferred to and processed on servers in the United States. You consent to this international transfer by using the service
• Data retention — personal information is retained for the duration of your account and promptly destroyed upon account deletion

8. Information Shared With Others

• Your public profile (name, age, photos, bio, red flags, location city) is visible to other authenticated users of the platform
• We do not sell your personal data to third parties, ever
• Payment processing is handled exclusively by Stripe — we do not store card numbers, CVVs, or full payment details
• We may share data with law enforcement in response to valid legal process (subpoenas, warrants, court orders, or emergency disclosures involving imminent safety threats)
• CSAM or child safety violations are proactively reported to NCMEC without requiring a formal legal request

9. Age Verification & Children's Privacy

RED FLAGD is strictly for users 18 years of age and older. During registration, users must:

• Provide their age
• Check a mandatory checkbox confirming they are 18 or older

We do not knowingly collect personal information from anyone under 18. Accounts confirmed to belong to minors are immediately and permanently terminated. We do not allow minors to use our platform under any circumstances.

10. Data Retention

Your data is retained for as long as your account is active. You may delete your account and all associated data at any time via:

• Profile → Delete Account (in-app)
• Visiting embracethechao.com/delete-my-data
• Emailing support@embracethechao.com

All data is permanently erased upon deletion. Certain records may be retained for a limited period to comply with legal obligations.

11. Photo & Personal Data Protection

We understand that sharing photos and personal information on a dating app requires trust. Your safety and privacy are our top priority — here's exactly how we protect your data at every step.

How Your Photos Are Stored & Handled

• Encrypted storage: All uploaded photos are stored on secure, access-controlled servers with encryption at rest. They are never stored on your device's local storage in a retrievable format.
• Visible only to authenticated users: Your photos are shown exclusively to other logged-in RED FLAGD members who appear in your match pool. They are never indexed by search engines, never visible to unauthenticated visitors, and never publicly listed anywhere on the internet.
• Blur until match: You can enable "Blur until match" to keep your photos blurred in the swipe deck until you've matched with someone — giving you full control over who sees your face before any connection is made.
• No third-party sharing: Your photos are never shared with, sold to, or made accessible to any third party — including advertisers, data brokers, or analytics providers.
• Instant deletion: When you delete a photo or delete your account, the image is permanently removed from our servers. There is no hidden cache, no soft-delete, and no delayed removal.
• Watermark-free screenshots: We do not add watermarks to your photos, but we actively monitor for and take action against users who screenshot or redistribute others' photos without consent.

How Your Personal Information Is Protected

• End-to-end encryption: All data transmitted between your device and our servers is encrypted using HTTPS/TLS — the same standard used by banks and healthcare platforms. No data travels in plain text.
• No payment data stored: All payment information is handled exclusively by Stripe's PCI-DSS Level 1 certified infrastructure. We never see, store, or transmit your card number, CVV, or full payment details — ever.
• PII auto-redaction: Our security system automatically scans all profile bios and prompt answers for accidentally exposed personal contact information (email addresses, phone numbers, social media handles, home addresses) and redacts them before they're visible to other users. This prevents you from inadvertently sharing contact info in a public field.
• Rate-limited profile access: Every user's profile viewing is rate-limited to prevent automated scraping or bulk data extraction. If someone attempts to view an unusual number of profiles in a short time, they are blocked automatically and the activity is flagged for security review.
• Scraping & breach detection: Our security monitor runs continuously to detect anomalous access patterns that could indicate a data breach or automated scraping attack. If suspicious activity is detected, affected users are notified by email immediately and our admin team is alerted for investigation.
• Identity-level blocking: If you block someone, we block them at the identity level — using phone number and social handle hashes — so they cannot create a new account to circumvent your block. This goes far beyond the profile-level blocking that most dating apps offer.
• Strict access controls: Only you can access and edit your own profile data. Our administrative staff can only access records when investigating reported policy violations, and all admin actions are logged and auditable.

Your Control Over Your Data

• Delete anytime: You can delete your account and all associated data — photos, messages, matches, profile info — permanently at any time, with one tap in the app or via embracethechao.com/delete-my-data.
• Photo privacy toggle: You choose whether your photos are public or blurred until match. You can change this setting at any time in your profile.
• Hide from discovery: You can hide your profile from the swipe deck and discovery surfaces entirely, letting you browse without being seen — while still being able to swipe and match.
• Export your data: You can request a full export of all data we hold about you at any time by emailing support@embracethechao.com.

In short: your photos and personal information are encrypted, access-controlled, actively monitored, and never sold or shared with third parties. You are always in control, and you can delete everything with a single tap — no questions asked.

12. Non-Consensual Content

Sharing intimate images or content of another person without their explicit consent is strictly prohibited. Users can report such content immediately via the in-app Report button or by emailing safety@embracethechao.com. Confirmed violations result in immediate account termination and referral to law enforcement.

13. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access, update, or delete your profile at any time in-app
• Request a full export or deletion of your data
• Opt out of marketing communications at any time
• Lodge a complaint with the appropriate data protection authority in your jurisdiction

For EU/EEA users: rights under GDPR including access, rectification, erasure, data portability, and the right to lodge a complaint with your local supervisory authority.

For Japanese users: rights under APPI including disclosure, correction, addition, deletion, and suspension of use of your personal information.

For South Korean users: rights under PIPA including access, correction, deletion, and suspension of processing of your personal information.

14. Contact Us

15. Changes to This Policy

We may update this policy periodically. We will notify users of material changes via email or in-app notification. Continued use of the app after any update constitutes acceptance of the revised policy.