Privacy policy

What this policy covers

This policy describes the information When We Match collects, how we use it, and the choices you have. It applies to the website at whenwematch.co and the matching service it provides.

Information we collect

Your account information. When you sign up, we collect your email address, a hashed password, your full name, city, date of birth, and any social identifiers you provide (phone number, Instagram handle, or Facebook profile URL). Your date of birth is used only to confirm you are 18 or older; it is not displayed to other users or used for matching.

Your search. When you open a search, you provide identifying details about the person you hope to reconnect with: their name, city, and up to three social identifiers (phone, Instagram, Facebook). This is the core of the service. You never provide free-form descriptions, photos, or subjective characterizations — only objective identifiers.

Payment information. Signup is currently free, so no payment is collected.

Technical data. Our servers collect standard request logs (IP address, browser type, pages visited, timestamps) for security, debugging, and performance. This data is retained for 90 days and is not linked to your profile for any other purpose.

How we use your information

We use your information for one purpose: to find and verify a possible bilateral match. Specifically:

• Your identifiers are compared against the searches of others to look for a match — a case where two people have each independently named the other.
• If a potential match is found, our team reviews it by hand before anyone is notified.
• If the review is approved, we send a notification email to each matched person.
• We use your email address to send transactional messages directly related to your account (match notifications, security alerts, account deletion confirmations). We do not send marketing email without your separate consent.

We do not use your information to advertise to you. We do not sell your information to any third party, ever.

The person you named

The person you described in your search is never contacted by us, never shown your search, and never informed that you were looking for them — unless a bilateral match is confirmed. A match can only exist if they signed up themselves and named you independently. We do not approach, look up, or communicate with anyone you name based solely on your search.

Because we never contact the person you named on your behalf, there is nothing for them to opt out of. You cannot be added to someone else’s search without their knowledge; you can only ever be part of a match if you created your own account and named that person yourself.

What we share, and with whom

We share limited information with the following service providers, solely to operate the service:

• Resend — transactional email delivery. Resend receives the recipient address and email content for messages we send on your behalf (match notifications, account alerts).
• Supabase — database and authentication infrastructure, hosted on AWS. Your account data and search data are stored here.

We do not share your information with any other party unless required by law (for example, in response to a valid legal process), or to protect the safety of users or others.

When a match is confirmed and the chat opens, each matched person sees the other’s first name only. No other personal information is shared between matched users by the platform.

Data retention

We retain your account and search data for as long as your account is active. If you delete your account, your profile and search are removed from active systems.

Server logs are retained for 90 days. Audit records (internal logs of match-status transitions, for safety and accountability) may be retained for up to two years.

Your rights

You may, at any time: access the information we hold about you, correct inaccurate details from within your account settings, export your data, or delete your account and your search. Deletion is immediate and permanent — the person you named is never informed.

California residents have additional rights under the California Consumer Privacy Act (CCPA) and its amendments, including the right to know what categories of personal information we collect and the right to request deletion. We do not sell personal information, so there is no opt-out to provide. To exercise your rights, contact us at privacy@whenwematch.co. We will respond within 45 days.

Security

Access to your data is restricted by row-level security policies; no part of the application can read another user’s search details. Passwords are hashed by Supabase and never stored in plaintext. Payment data never touches our servers. We use HTTPS everywhere.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at privacy@whenwematch.co.

Children

When We Match is available only to adults 18 and older. We do not knowingly collect information from anyone under 18. If we learn that we have done so, we will delete that information promptly.

Changes to this policy

If we make material changes to this policy, we will notify you by email at least 14 days before the changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

Contact

Questions, requests, or concerns about this policy can be sent to privacy@whenwematch.co.