What we collect.
And what we don't.

What we collect

How we use data

• Message content is used for AI moderation, for AI-based adjudication if a report is filed, and, in a chat with the AI companion, to write its replies. No person reads your messages to decide a moderation or report outcome. Engineers can access individual messages only under a formal legal obligation (a lawful request or an active legal hold).
• Device fingerprints are used to carry sanctions (restrictions and bans) across browser-clear attempts. They are not used to build a profile.
• We do not sell data, license data, use data for advertising, or use your conversations to train external AI models.
• If a message the check lets through contains contact details we detect (an email address, phone number, link, social media handle or crypto wallet address), we replace them with a placeholder in the copy we keep and deliver, so your chat partner sees the placeholder instead, and we tell you we did. We keep only which kinds were hidden and how many, not the details themselves.
• We also keep an internal reputation score for each account. It starts neutral and changes only when a warning is recorded against a message you send, when the same flagged text goes into three or more chats within a day, when our AI review upholds a report against you or a report you filed, and when you and a chat partner both choose to keep chatting. Skips, reports that are not upheld and panic-button reports never lower it, an appeal we accept removes what it covered, and anything older than 90 days stops counting. Nobody sees the score. It only affects matching: who you are paired with and how soon you are offered the AI companion while you wait for a person. Deleting your account deletes it.

Data retention

• Guest session data: cleared when session ends or browser storage is cleared.
• Message content: deleted 30 days after a conversation ends. Reopening a conversation restarts that clock; there is no other exception.
• Moderation audit logs: retained for up to 12 months.
• Error reports and session replays: Sentry keeps them for 90 days; PostHog keeps recordings for 5 years.
• Support requests: A support request sent from inside an account is removed when that account is deleted. A support request sent with no account session, such as from the support page while signed out, is stored with the contact email you gave and is not tied to any account. It is kept: deleting an account does not remove it, and no automatic job deletes it. A copy posted to Slack is not removed by account deletion either.
• Sanction records (the account's sanction type and dates, which the hashed device fingerprint links to): kept while a sanction is in force, then deleted once 2 years have passed since the account's last sanction event. The hashed fingerprint itself stays as a device record that is no longer linked to any sanction (see Your rights).

Third-party services

• Groq is our primary AI moderation provider, and OpenRouter is its fallback. Our instant filter runs on our own servers and blocks a short, fixed list of phrases on the spot; each message it lets through goes to Groq, and also to OpenRouter if Groq does not return a usable answer. A provider that reviews a message receives its text and returns a moderation decision; no personal identifiers are sent with it. When a report or appeal is filed, they also receive the report or appeal text, recent messages from the conversation(s) involved, and the case's moderation record (report category, earlier-report count, automated risk signals, the sanction appealed).
• OpenRouter also scans the images you send before they are delivered, and generates the AI companion's replies with OpenAI's gpt-4o-mini model. To answer a message you send the companion, it receives that message only once it has been delivered, together with recent messages from the same chat, yours and the companion's. OpenRouter passes each request on to a provider that hosts the model it names.
• Google Perspective API and Hive are additional text-scoring services that run only when their keys are configured. When they run, they receive message text the same way, and nothing else.
• How long each of these providers keeps what it receives is governed by that provider's own terms.
• Cloudflare sits in front of safemeet.now and app.safemeet.now, and the encrypted (TLS) connection from your browser ends at its edge, so every request to either site, including the messages you send, passes through its network on the way to our servers.
• Infrastructure providers (hosting, database) run our servers and the database that stores your data, as necessary to operate the service.
• Media storage uses Backblaze B2. Images sent in a conversation are stored there, and are deleted on the same 30-day clock as message text: 30 days after the conversation ends. It also holds encrypted backups of our analytics database.
• Notifications are delivered through Notifly, which receives your account identifier and, if you use a native iOS or Android app, a device push token, and no message content. Error reports go to Sentry and carry your account identifier. We run Sentry on our own servers. Product analytics in the chat app runs on PostHog on our own servers: page views and a closed list of named events carrying ids, counts, true/false flags and short fixed labels such as the page route, never message content. Analytics also records the domain of the website that sent you to us, such as www.bing.com, never the full address. Sendly (Devino) sends account emails and receives your email address and the one-time code to deliver it when you sign in with an emailed code.
• The chat app also records a small sample of sessions as masked replays, to find where people get stuck. Sentry samples sessions at a rate of 10% and also keeps the last minute of every other session in your browser, sending it only if an error happens; PostHog samples at a rate of 10%. All text on screen, including your messages and the other person's, and everything you type is hidden; images, icons and video are blanked; and no replay is recorded for a browser that sends Global Privacy Control or Do Not Track. Replays carry your account identifier once your session has started. The in-app privacy policy at app.safemeet.now/privacy lists what a replay can still contain.
• This marketing site also records a small sample of sessions as masked replays, to find where visitors get stuck, and sends error reports to Sentry. Sentry samples sessions at a rate of 10% and also keeps the last minute of every other session in your browser, sending it only if an error happens; PostHog samples sessions at a rate of 10%, and on this site it records replays only, not page views or named events. All text on screen and everything you type is hidden, and images, icons and video are blanked. Error reports and the page addresses we attach to a replay have their query strings removed, except the page markers a Sentry replay writes itself, which keep the full address. A recording can still contain web addresses written into the page, such as link targets, which can include the campaign tags (for example utm_source) you arrived with, and PostHog does not hide tooltips and screen-reader labels. No replay is recorded, and no error report is sent, for a browser that sends Global Privacy Control or Do Not Track. There are no accounts on this site, so a replay carries only a random identifier kept in your browser's storage, not an account identifier.
• Feedback and support requests you send from the app may also be posted to Slack, where our team reads them, with your account identifier, your contact email if you gave one, the page you sent it from or the action that failed, and ids that tie it to your analytics session or the AI reply you rated. Your chats are not attached.
• Google Analytics runs on this marketing site, and only after you give consent. Declining is one click and is remembered; you can change your answer at any time using the switch further down this page. It is not loaded in the chat app.
• We do not use Meta Pixel, Segment, Mixpanel, any ad network, or any cross-site tracking pixel.

Your rights

• You can delete your account yourself, from the profile menu in the app — no email required. It removes your profile, your messages, your stored images, your reports and blocks, and your sign-in details including the email address you signed in with or entered, the name from Google or Apple and any profile picture Google supplied, straight away. Any unused sign-in code sent to the address on your account is removed with it. It also removes your push-notification registration from our notification provider. Two limits: while a ban is active, deletion is blocked, because deleting would erase the ban; and the one-way hashed device fingerprint record is kept because other accounts on the same device can share it; after deletion it is no longer linked to you or to any sanction.
• You can also email hello@safemeet.now to request deletion, including of the analytics and error records, and the session replays, that the in-app deletion does not reach. We will process requests within 30 days.
• You can request an export of your data by emailing hello@safemeet.now.
• If you believe a moderation decision was wrong, you can appeal. If you believe we mishandled your data, you can escalate to your local data protection authority.

Security

• Connections to safemeet.now and app.safemeet.now use HTTPS with TLS 1.2 or newer; plain HTTP is redirected to HTTPS.
• Device fingerprint hashes use a one-way server-side salt.
• Production data sits behind SSH key access restricted to the operating team.

Changes to this policy

• Material changes will be announced on this page with a revised date and, for registered users, by email. Continued use constitutes acceptance.