legal
privacy policy.
last updated november 3, 2026 · unmasque, a california company
the short version.
Your romantic life is private unless you choose to share it. We do not sell your data, and we do not use it for advertising. A small number of people on our team can see some of your answers in order to introduce you to someone, and this page says exactly which.
what we collect.
Your phone number, first name, date of birth (only your age is ever shown), city, three photos, and what you tell us in the onboarding conversation. Depending on whether you join single or as a couple, that conversation covers what you wanted to be as a kid, what you are hoping to find, what you want love to feel like, how you show love and what makes you feel loved, what draws you to someone physically, how quickly you tend to fall for someone, your attitude toward money, your gender and who you want to meet, the age range you are open to, whether you want kids someday, and how much faith shapes your life and your tradition if you choose to share it. Couples also tell us how long they have been together, an anniversary if they have one, and their memory of their first date. After that: messages, date plans, reflections, verification results, payment status, and your push notification token. Voice notes you send in a connection and the voice intro you can record on your profile are saved as audio files in private storage, your connection can play them (a voice intro only after you both reveal), and they are removed from storage when your account data is purged. When you open the Unmasque web app, it saves one small flag in your browser's local storage, named unmasque.installMarker, with the value 1. It is a flag, not a cookie, and on the web it sits in the same local storage as your sign-in, so clearing your site data removes both. On the web the app uses it to tell whether this browser has opened the app before: if it finds no flag, it clears any stored sign-in and your saved place in onboarding, once, and then writes the flag. In the iOS app the same flag is kept in the app's own storage, which is deleted when you uninstall, while the sign-in is kept in the iPhone Keychain, which can survive an uninstall, so a sign-in left over from before a reinstall is not reused. It holds no personal information and it is not sent to us or to anyone else. While you are signed in, the web app also keeps your sign-in tokens, your user id and your onboarding step in your browser's local storage, so a page refresh does not sign you out, and signing out removes them. The web app keeps a few more settings and flags in your browser's local storage or session storage: an invitation you opened before signing in, where you got to in onboarding, notices and choices you have already seen or dismissed, the support contact details we show you, and a flag that says you have already passed the access screen. Some of these are labelled with your user id or an id for a connection. Signing out removes your sign-in tokens, user id and onboarding step. It does not remove the flag described above, and it does not clear all of the rest, so some of it can stay in your browser until you clear your site data. The access screen flag is in session storage and ends when you close the tab.
joining the waitlist.
If you join the waitlist on unmasque.co, we collect your first name, your last name if you choose to give it, your email address, your city, your current context (single, seeing someone, or in a relationship), and how you found us, including an invite code or referral link if you arrived with one. We use it to open early access and to email you about it, including early access invitations, product updates, and research. When you join we try to send you a welcome email, and it may not arrive if our email service is down. We use Resend, our email provider, to send you that welcome email, and to email a copy of your signup to one of our team inboxes as an alert: your name, your email address, your city, your current context, how you found us, and any invite code or referral link. We keep waitlist records until you ask us to remove yours. Email privacy@unmasque.co and we delete your signup record and our signup alert email within 30 days.
what we do not collect.
a stored location (if you tap use my location, the fix is turned into a city by Apple's location service and only the city is kept), contacts, social media accounts, browsing history, your income or any money figures, your race or ethnicity, or your ID image or ID number. We never ask about race or ethnicity, and if it comes up when you describe who you are drawn to, it is screened out before anything is saved.
how your answers are read.
Code checks your answers first. For free-text answers, a language model reads what you wrote and turns it into a short list of values, like "quality time". You see what we understood and can correct it before anything is saved. The original text of those answers is then deleted.
the mirror.
At the end of onboarding we show you the mirror: a short description of how you like to be loved, built from your answers. You see it and can edit it before anyone else does. It is shown only to your current connection, or to your partner if you joined as a couple. It never includes your faith, family plans, money, attraction answers, or any other matching requirement.
people who read your answers.
While Unmasque is small, every introduction is approved by a member of our team before it is made. That person can see your onboarding answers, including what draws you to someone and your attitude toward money, to judge whether two people fit. Those answers never appear on your profile and are never shown to other members. Access is limited to the people who approve introductions.
how matching works.
Some answers are requirements, like age range, location, who you want to meet, whether you want kids, faith, and what you are looking for. If two people do not meet each other's requirements, they are not introduced. Everything else helps us suggest who might fit. Nobody is ever shown a compatibility score, including you.
who sees your data.
Before a reveal, your connection sees your first name, age, and city. After you both choose to reveal, they see your photos. Your connection or partner sees your mirror. Couples each answer some questions privately, and those answers open to both partners only once both have answered. Your reflections are never shown to your connection, and this is enforced in our database, not only in the app.
verification.
When you join you enter your birthday, and our server only accepts a birthday that makes you 21 or older. Your selfie and your face photo are compared by AWS Rekognition to confirm the selfie is you. That comparison does not read an ID and does not check your age. Your selfie is not stored by Unmasque after the comparison, no facial geometry is retained, and only the result is saved. Verification is required for singles before a connection opens.
payments.
Payments are processed by Stripe. We receive whether you paid, when, and for which season. We never receive or store your card number.
third parties we use.
Supabase (database and photo storage), Railway (hosting our servers), Vercel (hosting unmasque.co, including the waitlist form), RunPod (servers that run the language model; your answers pass through them while they are read), Twilio (text messages: sign-in codes), Apple (push notifications, and the city lookup when you tap use my location), AWS Rekognition (selfie comparison, temporary), Stripe (payments), Resend (email: the waitlist welcome email and signup alerts), Expo and Google (push notifications), and Sentry (crash reports, with identifying details removed). We do not use any advertising or analytics third parties.
we do not sell your data. ever.
Your data is used to run Unmasque and nothing else. We do not sell it, share it for advertising, or use it to train AI models. Mobile numbers are never shared with third parties for marketing purposes.
sms.
We send one kind of SMS: a one-time passcode for each sign-in attempt. We do not text people you invite; an invitation is a message you send from your own phone. We send no other SMS and no marketing SMS. Message and data rates may apply. Reply STOP to opt out, HELP for help.
deleting your account.
Delete your account anytime from your profile. When you do, you are signed out, any open connection closes, and you are no longer introduced to anyone. Within 30 days of your request, we permanently delete your profile, photos, voice recordings, onboarding answers, reflections, the memories you added, and the text of the messages you sent. Some records are kept after that, listed below. What we keep after deletion: a record that your account existed, with your phone number replaced by a placeholder, and how you joined; the dates and states of your past connections, the messages other people sent you, date plans made in those connections including their place and notes, memories and the shared photo the other person keeps in a chapter; safety reports, blocks and moderation records that involve you; payment records; your invites, notification settings and choices about sharing glimpses; and a record of when our team opened your answers. Copies held in our providers' backups and logs, such as email and crash reports, are not removed by this deletion and last as long as those providers keep them.
your rights.
You may request a copy of your data, correct what we understood about you (at the reflection, or by editing your mirror), or delete your account at any time. Your faith answer and who you want to meet are sensitive personal information, and California residents may limit their use to what is needed to run the service. California residents have additional rights under CCPA/CPRA. Contact us at privacy@unmasque.co.
age requirement.
Unmasque is for adults 21 and over, checked on our servers when you sign up. We do not knowingly collect personal information from anyone under 21. We may close an account and delete its data if we learn the person is under 21.
questions? privacy@unmasque.co