Privacy Policy
1. Introduction
Luma ("the App," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.
By using Luma, you agree to the practices described in this Privacy Policy.
2. Information We Collect
2.1 Information You Provide
When you create an account and use Luma, you may provide:
- Account information: Phone number, email address, name
- Profile information: Birthday (age), gender, pronouns, photos, bio, occupation, school, height, interests, and prompt answers
- Location: Your neighborhood name and approximate coordinates. Where you grant permission, we access your device's location at the point at which you set your neighborhood, in order to center the map; you may alternatively place the pin manually. See Section 2.4
- Preferences: Who you want to see (gender preference), age range, height range, distance range, and dealbreaker settings
- Messages: Text messages sent to your matches
- Reports: If you report another user, the reason and any details you provide. To assess the report we also review the conversation between you and that user, and that user's profile photos — see Section 8
2.2 Sensitive Personal Information
Some of the information we collect is considered "sensitive" under privacy laws like the CCPA. This includes:
- Sexual orientation — inferred from your gender preference ("Show Me") setting
- Approximate geolocation — neighborhood-level coordinates used for nearby matching
- Private communications — text messages exchanged with your matches
We only use this sensitive information for the specific purposes described in this policy (providing the matching service, delivering messages, and nearby discovery). We do not use sensitive personal information for advertising, profiling, or any purpose unrelated to operating the App.
2.3 Information Collected Automatically
- Authentication data: Login timestamps, session tokens
- Usage data: Matches created, messages sent, profile interactions
- Device information: Device type, operating system (collected by Expo for app functionality)
2.4 Information We Do NOT Collect
- We do not track your location in the background or on a continuous basis. Where you grant permission, the App accesses your device's location on a single occasion, at the point at which you set your neighborhood, in order to center the map and suggest your approximate location. You may alternatively place the pin manually. We store only the resulting approximate coordinates, which are used solely to display nearby users. We do not access your location while the App is not in use
- We do not conduct background checks on users
- We do not read your messages for advertising purposes
- We do not sell your data to third parties
3. How We Use Your Information
We use your information to:
- Provide the service: Show your profile to potential matches, deliver messages, process matches
- Verify your identity: Phone number verification during signup
- Enforce our Terms: Review reports, moderate content, and take action against policy violations
- Improve safety: AI-assisted report triage to identify and prioritize safety concerns
- Communicate with you: Push notifications for matches and messages (if enabled), app updates
- Maintain the App: Debug issues, monitor performance, and improve features
4. How We Share Your Information
4.1 With Other Users
Your profile information (name, photos, age, bio, interests, prompts, occupation, school, height, neighborhood) is visible to other users of the App. Your phone number, email, and exact coordinates are never shown to other users.
4.2 With Service Providers
We use the following third-party services to operate the App. These providers only access your data as needed to perform their services and are bound by contractual obligations to protect your information.
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication, message storage | Account and profile data, messages, preferences |
| Cloudflare R2 | Photo storage | Your profile photos |
| Twilio (via Supabase) | SMS verification codes | Phone number |
| Expo | Push notifications and app updates | Push notification token, device type and operating system |
| Google Gemini | AI-assisted report triage | Only when a report is filed: the report text, the reported user's name and bio, the conversation between the two users, and the reported user's profile photos — see Section 8 |
| Resend | Email delivery | Your email address. Used to deliver your data export, which contains your personal data as an attachment, and to deliver report notifications to our safety team, which include the reported user's name and the details of the report |
We do not engage any other artificial intelligence provider, advertising network, or analytics service.
4.3 For Legal Reasons
We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect the safety of any person or to prevent illegal activity.
4.4 We Do NOT
- Sell your personal data to anyone
- Share your data with advertisers
- Use your data for targeted advertising
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Profile data | Kept while your account is active. Deleted when you delete your account. |
| Photos | Kept while your account is active. A photo you remove from your profile is deleted from our storage right away. When you delete your account, your photos are removed from the App immediately and permanently deleted from our storage within 90 days — during that window they are retained only in a restricted archive used for safety, moderation, and legal purposes. |
| Messages (active match) | Kept while the match is active |
| Messages (expired match) | The conversation remains visible to you within the App for thirty (30) days following expiry. The messages are permanently deleted from our systems ninety (90) days after expiry. The additional period enables us to investigate reports submitted after a conversation is no longer visible to you. |
| Messages (reported conversation) | If a user is reported, the conversation between the reporter and the reported user is kept for 5 years from the date of the report, for safety and legal purposes. This applies whether or not the report is upheld. Other conversations of the reported user are not affected. |
| Messages (banned user) | Kept indefinitely while the ban is in place |
| Reports | Kept indefinitely for safety and legal purposes |
| Account data after deletion | Your profile ceases to be visible to other users immediately upon deletion. We retain a restricted archive of your account — profile details, prompts, interests, compatibility answers, preferences, matches, and messages — for ninety (90) days following deletion. The archive is accessible only to authorized safety personnel and is retained solely to enable us to respond to reports, safety investigations, and lawful requests. It is deleted automatically upon expiry of that period. Certain data may also persist in encrypted backups for up to thirty (30) days. |
| Ban record (banned accounts only) | Where an account was banned prior to deletion, we retain a record of the ban — name, email address, and telephone number — for five (5) years, for the purposes of enforcing the ban and responding to subsequent legal or safety enquiries. |
| Ban blocklist (banned accounts only) | If an account is banned for violating our Terms, we keep the phone number and email address on a restricted blocklist so the ban cannot be evaded by deleting the account and re-registering. Used only to enforce the ban. |
Matches expire 7 days after creation.
6. Data Security
We take reasonable measures to protect your data, including:
- Row-level security on our database — users can only access their own data
- Encrypted connections (HTTPS/TLS) for all data in transit
- Authentication tokens that expire and must be refreshed
- Restricted admin access — only authorized administrators can view reports and user data
No system is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
7. Your Rights
7.1 Access & Correction
You can view and update your profile information at any time through the App.
7.2 Delete Your Account
You can delete your account from the Settings screen in the App. This will remove your profile, photos, and preferences from the App immediately. Photo and message retention in our storage after deletion follows the schedule described in Section 5.
Retention following deletion. Deletion removes your profile from the App immediately. Certain data is retained thereafter, for the limited purposes and periods set out below:
- Restricted archive — ninety (90) days. We retain an archive of your account and conversations, accessible only to authorized safety personnel, for a period of ninety (90) days following deletion. This archive is retained solely to enable us to respond to reports, safety investigations, and lawful requests received after your account is closed. It is deleted automatically upon expiry of that period.
- Banned accounts. Where your account was banned for violation of our Terms prior to deletion, we retain your telephone number and email address on a restricted blocklist for the purpose of enforcing that ban, together with a record of the ban for a period of five (5) years.
- Photographs. Photographs are removed from the App immediately and permanently deleted from storage within ninety (90) days, as described in Section 5.
Data retained under this Section is processed solely for safety, moderation, and legal compliance purposes. It is not used for marketing, is not disclosed to other users, and is not used for any other purpose.
7.3 Notification Preferences
You can enable or disable push notifications (new matches, new messages, app updates) from the Push Notifications screen in Settings.
7.4 Download Your Data
You can request a copy of your personal data (profile, photos, preferences, compatibility answers, and messages) by tapping "Download My Data" in the Legal section of Settings. We will compile your data and email it to the address on your account. You can also request your data by contacting us at support@datewithintent.app. We will provide your data in a portable format within 45 days of your request.
7.5 California Residents (CCPA)
If you are a California resident, you have the right to:
- Know what personal information we collect and how it is used
- Delete your personal information (subject to legal exceptions)
- Correct inaccurate personal information we hold about you
- Opt out of the sale of personal information — we do not sell your data, so no opt-out is necessary
- Limit use of sensitive personal information — you may request that we limit our use of sensitive personal information (such as sexual orientation or geolocation) to only what is necessary to provide the service. Contact us to make this request.
- Non-discrimination — we will not treat you differently for exercising your privacy rights
- Appeal — if we deny your privacy request, you have the right to appeal that decision by contacting us. We will respond to your appeal within 60 days.
- Authorized agents — you may designate an authorized agent to make privacy requests on your behalf. The agent must provide written authorization and we may require you to verify your identity directly.
To exercise these rights, contact us at support@datewithintent.app.
8. Automated Decision-Making and AI
We use automated systems in the following ways:
- Report Analysis: When a user is reported, we use AI (Google Gemini) to analyze the report and assign a preliminary severity level and category. This helps our safety team prioritize concerns.
To assess a report, we send the following to Google Gemini: the report reason and any details provided, the reported user's name and bio, the conversation between the two users (if the report concerns a conversation), and the reported user's profile photos. We do this because some violations — such as harassment in a conversation, nudity in a photo, or a user who appears to be underage — cannot be assessed without looking at the content itself.
Google does not use this content to train or improve its models, and retains it only for a limited period to detect abuse of its own service. We do not send this content to any other AI provider. We do not use it to train any model of our own.
A human administrator reviews all reports before any action is taken against a user's account. No user is banned, suspended, or restricted by an automated system alone.
- Compatibility Matching: We use a rule-based system (not AI) to determine which profiles you see. If you or another user marks a preference as a "dealbreaker" and there is a conflict, that profile will not be shown to either of you. For profiles that pass your preferences, we calculate a compatibility score based on your answers to our compatibility questions (e.g., relationship goals, values, lifestyle) to help inform how profiles are presented. This system does not use machine learning or make decisions about your account.
- Profile Visibility: Your profile is shown to other users based on your stated preferences (gender, age range, distance) and dealbreaker settings. No AI-based profiling or behavioral tracking is used to determine who sees your profile.
You can contact us at support@datewithintent.app if you have questions about how these systems work.
9. Children's Privacy
Luma is not intended for anyone under the age of 18. We do not knowingly collect personal information from minors. If we learn that a user is under 18, we will immediately suspend the account and delete their data. If you are a parent or guardian and believe your child has created an account, please contact us at support@datewithintent.app and we will promptly delete their information.
10. Third-Party Links
The App may contain links to external websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make significant changes, we will notify you through the App. Continued use of the App after changes are posted constitutes your acceptance of the revised policy.
12. Contact Us
If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:
Email: support@datewithintent.app