Privacy Policy

Who this notice covers

This notice describes personal information handled by Vesper at https://vesperdating.app, operated by [COMPANY LEGAL NAME], [COMPANY ADDRESS]. Effective date: [EFFECTIVE DATE]. It is a draft. A lawyer has not reviewed it.

The related pages are the Terms of Service and the Community Guidelines.

Account and sign-in

When you sign in, the service stores an account id, a name, an email, whether the email is verified, an optional profile-image address, and created and updated times. Google provides those fields when Google sign-in is used. They stay on the sign-in record. Your public dating name and handle are separate and are whatever you type later.

A session record stores a token, an expiry, and can store your IP address and browser user agent. Sign-in tokens from Google (and from X, if that option is turned on) are stored encrypted so the session can continue. The account table can hold a password hash. Email-and-password sign-in is turned off, so that field is unused unless someone turns the feature on.

A short-lived auth record may also be stored for sign-in flows (the auth “verification” table). That record is separate from the Persona age or ID check described below.

Profile, age, and preferences

When you save your profile or accept the house rules, the service stores a date of birth (a calendar date), the age computed from it, sex (woman or man), a display name, a bio, a handle, a home city chosen from a fixed list, and a portrait path. It also stores deck filters: an age range, who you want to see (woman, man, or everyone), a distance (15, 40, 100, or 250 miles) measured from that city’s center, and up to eight desire tags. Desire tags are things like pace, touch, and similar labels. They are used to order your deck. They are not printed on someone else’s card.

The service does not ask for a street address, a phone number, or GPS. City coordinates in the product are the centers of the cities on the list.

House-rules acceptance is stored as a yes, the version of the rules, and the time you accepted them. Your lane is stored as Vanilla or Kink Lane, plus the time the lane last changed.

A likes-and-dislikes editor and a kink-interest editor are in the interface. Your height, weight, imperial-or-metric unit choice, height and weight filters, and the levels you set on catalog kinks are stored on the account database. Weight, body type, and ethnicity answers and other likes-and-dislikes rows may still be saved in this browser only until a later release. Weight and ethnicity are designed to stay private to you on the server. A custom interest name you suggest is stored for legal review, with who submitted it and whether staff accepted or rejected it. Other members cannot see a custom interest until it is accepted, and they never see your levels on it.

Photos

Portraits are image files the site can serve by their path. Someone who has the path may be able to open a portrait without an extra sign-in check.

Album photos are stored outside the public file area and are served only after a sign-in and an access check. Public album photos are available to any signed-in member. Secret album photos are available to you, and to a member you are paired with only after you approve them. The service stores a photo id, an unguessable storage key that is not sent to browsers, whether the photo is public or secret, why it was marked secret (you, or a classifier), and the time. The automatic classifier is a stub: it does not analyze the picture. Your private flag, or the default of private, is what places a photo in the secret album.

Other signed-in members can see the count of your secret photos. They do not receive the files until the rules above are met. Unlock requests store who asked, who owns the album, the status (waiting, open, no, or closed), and the times.

Community, reports, and verification

Rooms store a title, a summary, a kind, a lane, and who created them. Meetups store a title, a city id, a time label, a short place note, a lane, a handle, and who created them. Those fields are readable by members allowed into that lane. Notes store your handle, an empty body, ciphertext, a nonce, and wrapped keys. The words of a sealed note are not stored in plaintext.

A report stores your account id, the kind of target (note, meetup, or room), the target id, and the time. It does not store a written reason.

If you start a Persona check, Persona processes the selfie or the identity document under Persona’s own terms. Vesper stores one current result per member: provider (Persona), level (age estimate or government ID), status (pending, passed, or failed), the age threshold for an estimate, a provider reference, and timestamps including an optional expiry. The provider reference is readable by you on the server and is not returned by the app’s own status API. Vesper does not store the check photos, the document images, or an estimated age from Persona. The age threshold used for a pass can be from 18 to 30. ID-check attempt times are kept for up to 24 hours for rate limiting and deleted with the account.

What stays on your device

The private key for sealed notes is stored in this browser (IndexedDB). It is not uploaded. There is no recovery code. Likes, dislikes, and kink interests in the current editors are stored in this browser’s local storage. A preview sign-in mode can keep a session token in session storage when a cookie is not available. On the public site, sign-in uses cookies, described below.

Sensitive information

Sex, who you want to meet, desire tags, and Kink Lane membership are information about your sex life or sexual interests. Kink Lane is optional: you switch it on. Desire tags are saved when you choose them. The house-rules checkbox records that you accepted the short in-app rules. It is not a separate consent form for sensitive data under the GDPR, US state privacy laws, or similar rules.

Any signed-in member is allowed to read a public profile slice that includes your handle, your lane (Vanilla or Kink Lane), your public portrait, and your secret-photo count. Kink Lane rooms and posts are still withheld from members who are on Vanilla. Your date of birth, desire tags, bio, and deck filters stay on your own row.

A verification selfie or identity document is biometric or government-ID information processed by Persona. Vesper’s copy of that event is the result row described above, not the images.

Why it is used

• To create and keep your account and your session.
• To enforce the 18+ rule from the date of birth you enter, and to store a Persona result when you start one.
• To show profiles, run the deck, record likes, passes, and pairs, and apply your filters.
• To host rooms, meetups, portraits, and albums under the access rules above.
• To store sealed notes as ciphertext and to publish only your public key.
• To record house-rules acceptance and lane changes.
• To record reports and to hide an item after the report rule is met.
• To keep the service secure, including encrypted sign-in tokens and access checks on album files.

Who else receives it

Other members see what the product is built to show them: public profile fields, your lane on the public profile slice, public album photos, secret photos only after a pair and your approval, and community material in a lane they can enter. They do not receive your date of birth, your sign-in email, your desire tags, or your album storage keys.

Google receives the sign-in if you use Google. Persona receives the check if you start one. The database is hosted Postgres, set up in this project for Neon. The site is operated as a web application. The confirmed vendor list, and any data-processing terms, are [SUBPROCESSOR LIST]. [COMPANY LEGAL NAME] should publish that list before relying on this notice.

The product does not include an advertising sale of personal information or a “share” for cross-context advertising. Whether a particular disclosure is a “sale” or a “share” under a state law is for counsel to decide. Staff accounts can read reports. [COMPANY LEGAL NAME] may preserve and disclose information if a law, a court, or other valid legal process requires it. Send those requests to [LEGAL CONTACT EMAIL].

How long it is kept

Passes are deleted after 14 days, and likes that never became a pair are deleted after 30 days. That deletion runs the next time you load the deck, not on a separate schedule, so the rows can remain longer if you do not come back.

Pairs stay until you end them or you use wipe. Profile fields, photos, notes, rooms, meetups, the sign-in account, verification results, and reports stay until they are deleted by a feature that covers them or until counsel sets a schedule. There is no fixed retention period in the product for verification results or for reports. Database backups, if any, are kept for [BACKUP RETENTION]. That period is not defined in the software.

Access and deletion

You can see your profile, your filters, and counts of passes, likes, and pairs in the product. There is no “download my data” export.

Wipe deletes your filters, swipes, pairs, album photos and related unlocks, notes, rooms and meetups you created, reports you filed, handle, profile row (including date of birth), portrait file, and seal key. It does not delete the Better Auth user, sessions, or sign-in tokens. It does not delete the Persona result row. It does not delete reports that other members filed. To ask for access to, or deletion of, what wipe leaves behind, write to [PRIVACY CONTACT EMAIL]. Counsel still has to decide what must be kept for safety, fraud, or the law, including any biometric-information duties that apply to the Persona check.

Cookies and sessions

Sign-in on the public site uses cookies. They are Secure, SameSite is Lax, and they are limited to this host (they are not set on a parent domain). The names used by the software are __Host-grok-auth.session_token, __Host-grok-auth.session_data, __Host-grok-auth.account_data, and __Host-grok-auth.dont_remember. The session-data cookie is a cache of about five minutes so ordinary page loads do not have to read the database every time.

The product does not set advertising or analytics cookies. You can clear cookies in the browser. Clearing them signs you out. Clearing site data also removes the local seal key and the browser-only likes and interests, and sealed notes then cannot be opened.

Security

Member reads of private rows go through a restricted database role and row-level security, so one member’s query is limited to the rows the rules allow. Album files are not placed in the public file directory. Sign-in tokens are encrypted at rest. Community note text is encrypted in the browser. These measures reduce risk. They are not a guarantee against unauthorized access, loss, or a bug.

People under 18

Vesper is for adults 18 and older. It is not directed at children. The age check is the date of birth you enter, plus an optional Persona check. Because the date is self-reported, the service can hold an account it should not have. If you believe an account belongs to someone under 18, write to [LEGAL CONTACT EMAIL].

Rights that depend on where you live

Depending on where you live, you may have rights to access, correct, delete, or export personal information, to appeal a denial, to opt out of certain sharing, or to limit use of sensitive information. This product does not yet include a “do not sell or share” link, an authorized-agent flow, or a region picker. This notice does not claim compliance with the GDPR, UK GDPR, CCPA/CPRA, other US state privacy laws, or biometric laws such as BIPA or CUBI.

To make a request, write to [PRIVACY CONTACT EMAIL]. Include the email on the account and what you are asking for. [COMPANY LEGAL NAME] will need a process, and in some cases identity confirmation, before those requests can be honored. Counsel must decide which laws apply, including age-verification laws in the places where Vesper is offered.

Changes and contact

Updates will be posted on this page with a new [EFFECTIVE DATE].

Privacy contact: [PRIVACY CONTACT EMAIL]. Other legal contact: [LEGAL CONTACT EMAIL]. Mailing address: [COMPANY ADDRESS].