Privacy Statement

How And-U collects, uses, and protects your information. MVP draft — full statement to be published before public launch.

1. Who we are

And-U is operated by And-U Inc. ("And-U", "we", "us", "our"). For privacy questions, email privacy@and-u.org.

2. Information we collect

  • Account information: email address, password (hashed), date of birth, city.
  • Profile information: photos, bio, intent, preferences, lifestyle answers you choose to provide.
  • Trust information: photo verification results, optional ID-document verification results (we store the verification status only, not the document).
  • Communications: messages, likes, and dismissals between you and other members.
  • Usage data: log-in times, device type, browser, IP address, and pages visited.
  • Payment data: handled by our payment processor (Stripe). We store the last four digits and expiry of your card only.

3. How we use information

  • To operate the And-U service: showing you matches, delivering messages, processing payments.
  • To verify identity and detect fraud, scams, and abuse.
  • To send you transactional emails (sign-in links, match notifications, billing receipts).
  • To improve the service through aggregated, de-identified analytics.
  • To comply with legal obligations and respond to lawful requests.

4. Sharing

We share information with:

  • Other members — only the profile content you choose to make visible.
  • Service providers (Supabase, Stripe, Resend, OpenAI, Sentry, Axiom) under contract that limit them to processing data on our behalf.
  • Law enforcement when required by valid legal process or to prevent imminent harm.

We do not sell your personal information.

5. Your choices

  • Edit or delete your profile content at any time.
  • Pause or delete your account from the Settings page.
  • Request a copy of your data by emailing privacy@and-u.org.
  • Opt out of non-essential email by following the unsubscribe link.

6. Retention

We retain account data while your account is active. After account deletion we retain minimal data for fraud-prevention and legal-compliance purposes for up to 24 months, then purge it.

7. Security

We protect your information with industry-standard practices: TLS in transit, encryption at rest, access controls, and regular security review. No system is perfectly secure; report suspected vulnerabilities to security@and-u.org.

8. Children

And-U is for adults 18 and older only. We do not knowingly collect data from anyone under 18. If we discover an underage account, we terminate it and purge associated data.

9. International transfers

And-U operates globally. Data may be processed in jurisdictions different from yours, always under contract requiring equivalent protection.

10. Changes

We may update this Privacy Statement. Material changes will be communicated via email and in-app notice at least 14 days before they take effect.

11. Contact

Questions about your privacy? Email privacy@and-u.org.

Last updated: April 30, 2026 — MVP draft. Full statement under legal review.