How we handle your data.

Privacy

This privacy policy explains how prettymutual handles personal data on prettymutual.com and its app, including when you sign in with Google.

1 · Who controls your data

“Support Wing” EOOD (UIC 208345662), 13 Roza St., Karavelovo 4350, Bulgaria. Privacy contact: privacy@prettymutual.com. The controller is established in Bulgaria, in the European Union.

2 · What we hold, and why

We don’t ask for: Your precise location · your contacts · government ID · payment card details · health, income or disability information. You do not have to enter your surname; Google can supply your full name if you choose Google sign-in.

Sign in with Google

Google sign-in is optional. If you choose it, Google provides your account identifier, email address and email verification status, and basic profile information such as your name and profile picture URL. We request only basic sign-in, email and profile permissions. We do not receive your Google password or request access to Gmail messages, contacts, calendars, Drive files or other Google account content.

We use your Google identifier and email to authenticate you, connect you to your account, protect account security, and send account or booking emails, including email reminders you choose. Supabase, our authentication and database provider, stores the Google details with your sign-in record; Resend delivers the sign-in, account and booking emails. A copy of your sign-in session is stored in your browser so you stay signed in. Our app is hosted by Cloudflare. Access to account data is limited by account permissions and authorised staff access, and communication uses HTTPS encryption.

Your Google name and profile picture are not shown to other members. You choose the first name used in rooms yourself. We do not sell Google account data, use it for advertising or matching, or send it to AI providers to train models. Google processes the sign-in under its own privacy policy.

Google sign-in details stay with your account until it is erased. To request deletion, open Settings, then Pause or leave. Your account closes immediately, with 14 days to change your mind. Final erasure removes the Google sign-in record; an open safety case can delay erasure. A separate scrambled email marker may be retained for the life of a ban. You can also request deletion by writing to the privacy address. Removing access in your Google Account connections stops Google access; it does not itself delete the account or data already held here, or end an existing app session. Sign out in the app separately. Email sign-in remains available.

3 · Your face

When you join, our verification partner processes your camera capture and face template. We keep the outcome, dates, and an opaque reference to the check. We do not store your capture or template in our application. Other members never see them.

The check assesses liveness, estimates whether you are old enough to join, and looks for an existing face enrolment. It does not request identity documents. An uncertain age estimate needs review before you can book. These data are not used to decide who you meet.

The partner keeps these data for the life of your account, including its 14-day deletion recovery window. Final erasure can be delayed by an open safety case or a provider failure that we retry. When your account is erased, we also request erasure of the partner's captures and face templates.

A ban does not preserve face data after final account erasure. A separate scrambled email marker may remain for the life of the ban.

We do not sell it, license it, or profit from it in any way.

We ask for your consent to the face check, and record it, before any capture is taken. Our retention schedule for face data: the camera capture and face template are kept for the life of your account, including its 14-day deletion recovery window. Final erasure can be delayed by an open safety case or a provider failure that we retry; when your account is erased, we ask our verification partner to erase its sessions and the templates it keeps. We never sell or license face data.

4 · What happens in rooms

Rooms are live video. We do not save audio or video recordings. Conversation processing is optional: with your microphone permission, Groq turns your speech into text and OpenAI reads the text, for host prompts and matching. We keep facts, preferences and conversation observations for internal matching. With separate transcript-review permission, administrators can review text from your microphone for up to 7 days to improve analysis quality. Everyone chooses separately. Stop processing, stop review or forget learned data in Settings.

The audio and video of your rooms pass between the people in them through Cloudflare Realtime, a relay. They are encrypted, so the relay passes them on without seeing or hearing them. With your microphone permission, your audio also goes to our servers, which Cloudflare runs, and on to Groq to be turned into text.

We do keep measurements of what happened: how much of a room you spoke for, how often the turn changed, how often people spoke over each other, and when you dropped out and came back. A person reviewing a report can read them, and we delete them 180 days after the room. They are never used to seat you.

Who you sat with, when you joined and left, and how much conversation each room gave you is different. It stays with your account, and seating uses it (section 5).

5 · How we decide who you meet

Seating is automated. We use the answers you gave us — including your orientation and any optional answers about faith, politics or relationship structure — together with who you have already met or blocked, whether you came to the rooms you booked, and how much conversation your rooms gave you. We seat you with new faces first, and if a room gave you less conversation, you get priority for your next room that day. With separate microphone permission, information you share, preferences and repeated conversation observations can also improve matching automatically. These findings are used internally.

A person will explain any seating decision if you ask. Write to privacy@prettymutual.com.

6 · Reports and moderation

When someone reports you, we keep the report and our decision. We never tell you who reported you, what they wrote, or how many people have.

We delete reports and decisions 3 years after the case closes, or when a ban that came from it ends, if that is later. We delete warnings, restrictions and bans 3 years after a warning is given, or a restriction or ban ends. A ban with no end date is kept while it stands. If your account is deleted while a ban stands, the scrambled email marker described above stays until the ban ends, or for good if it has no end date.

7 · Your rights

You can see, correct, delete, restrict, take a copy of and object to what we hold, and withdraw your consent for the optional answers at any time. For any of them, write to the privacy address.

If you’re unhappy with how we’ve handled your data, you can complain to the Commission for Personal Data Protection (Bulgaria), cpdp.bg.

8 · Who else sees it

Which companies see your data depends on what you use. Unless a group says otherwise, each one handles it for us, only to do the job listed.

Always

• Supabase runs our database and sign-in. It holds your account and everything listed in section 2 that we keep. Location: Sydney, Australia.
• Cloudflare hosts and delivers this site and the app, and runs each live room on its servers, keeping the room’s state there for a short time. It sees your IP address, your browser’s details and what the site and the app send and receive, including your microphone’s audio on its way to be turned into text, when you allow it.
• Cloudflare Realtime relays the audio and video of your rooms. They are encrypted, so the relay passes them on without seeing or hearing them. It sees your IP address.
• Resend sends sign-in links and codes, our booking emails and the email reminders you choose. It receives your email address and each of those emails.
• PostHog (EU) measures how the site and the app are used. It receives the product measurement in section 2, error reports included, whatever you choose, and, only with a yes, recordings of how this public site is used, never the app. It also sees your IP address and your browser’s details.

When you join

• Didit runs the face check. It receives your camera capture and face template, as section 3 says.

With your microphone permission

• Groq turns the speech from your microphone into text. It receives your microphone’s audio. Its zero data retention setting is on for our account.
• OpenAI reads that text for facts, preferences, how each person takes part in the conversation, and a question for the host. It receives the text as it was spoken, names included, with a stand-in for each person in place of their account id. We ask it not to store our requests, but we have no written promise that it keeps nothing.

When you turn reminders on

The company that makes your browser runs its push service, for your browser and not for us. We only hand it each reminder.

• Your browser’s push service carries each reminder to your device. Each reminder is encrypted, so it cannot read it.

If you sign in with Google

Google does not work for us here: it is a controller in its own right, under its own privacy policy.

• Google signs you in, if you choose it. It gives us the details under “Sign in with Google” above.

[international transfer mechanism]

The measurement runs in your browser and reaches the processor directly, so it sees your IP address and your browser’s details, as any site you load does. We don’t use its automatic capture. It receives the events listed under product measurement in section 2, and error reports, whatever you choose: what failed, and on which page, without the page’s address details. Only with a yes does it also record how this public site is used, never the app.

We don’t sell personal data, and we don’t run advertising.

9 · Security

HTTPS protects data in transit. Account data is protected by authentication and access permissions; staff access is restricted by role. Sign-in sessions are stored in your browser, so use trusted devices and sign out on shared ones.