Privacy

What we store

Only what the app needs to work. There is no analytics profile of you being built in the background.

• Your phone number, used to sign you in.
• An email address, if you choose to add one as a second way to sign in. It is used to send you a code and nothing else, and it is never shown to other members.
• The name you choose to display. It does not have to be your legal name, and we never ask for one.
• Your date of birth. Other members see an age, never the date.
• Your community and condition type, and the U=U badge if you turn it on.
• What you are looking for, and whether you are in dating or support-only mode.
• An approximate location, rounded to about a kilometre before it is saved. Other members see a distance, never a point on a map.
• Your photos, prompts, bio, and search radius.
• Whether you are verified, and when.
• Your messages, and the connects you send and receive.

What we never store

These are not settings you have to find and switch off. There is no column in our database for any of them.

• Your legal name. Our payment processor holds one if you subscribe; our own database never does.
• Medical records, test results, lab values, diagnosis dates, or any medical history.
• Free text about your condition. The only options are the ones in the list.
• Your exact location.
• Your verification selfie, once the check has finished. See below.
• Advertising or tracking identifiers. There are no third-party ad or analytics pixels in this app.

Health data

Your community, your condition type, and your optional U=U badge are health data, and we treat them that way.

We ask for them on their own screen, with their own checkbox, and we store the date you agreed along with the exact wording you agreed to. If we ever change that wording, we ask again rather than assuming the old answer still stands.

We use this only to run matching and the community rooms. We do not sell it. We do not share it with advertisers, data brokers, or anyone building a profile of you. No third party receives it in exchange for money or anything else of value.

You can change your community or condition type at any time, and you can delete everything permanently at any time.

We apply this standard everywhere, to everyone, rather than only where a particular law requires it. That includes the protections in Washington's My Health My Data Act and Nevada's consumer health data law.

Who can see what

Your profile is visible to verified members in your own community, inside your distance range. Members in support-only mode are not visible to members browsing for dating.

This is enforced in the database itself, not in the app. A bug in a screen cannot show your profile to someone who should not see it, because the rule is applied before the data ever reaches a screen.

If you choose blurred photos, they are blurred before they are sent to anyone you have not connected with — not blurred in the browser afterwards.

Blocking is mutual and immediate: a blocked member cannot see you, and you cannot see them.

Verification

Everyone here verifies a phone number and passes an automated selfie check. That is the whole point of the place: every profile is a real person.

The selfie is sent to an identity verification provider, checked, and then deleted. We keep whether it passed and a confidence score. We do not keep the image, and we never show it to anyone.

If the automated check cannot make a decision, a member of our team reviews it. You can always appeal a decision, and appealing never requires passing the check you are appealing.

Messages

Messages are private between you and the person you are talking to. They are not scanned to target you with anything, and they are not used to train anything.

They are encrypted in transit and encrypted at rest, and the same database rules that protect everything else protect them too.

They are not end-to-end encrypted, and we would rather say so than let you assume otherwise. That means we could read them if we were compelled to, or if we went looking. The reason is moderation: if you report a message, a human has to be able to read it, and that is not possible in a system where we hold no key. We think being able to act on reports matters more here than the stronger guarantee, and you deserve to know which trade we made.

If you report someone, the moderators reviewing the report can see the messages you reported.

Text messages

We text you a one-time code when you sign in. That is the only thing we ever text you — no marketing, no reminders, no announcements.

How often: only when you ask for one. For most people that is once, when they first join, and again if they sign in on a new phone. You can add an email in your settings and get the code there instead.

Message and data rates may apply.

We never sell your mobile number, and we never share it with anyone for their own marketing. It goes to the messaging provider that delivers your code, in order to deliver your code, and nowhere else.

You can reply STOP to any message to stop receiving them. If you have added an email to your account, you can still sign in with a code sent there. If you have not, a text is the only way in — so replying STOP would leave you unable to sign in, which is closer to closing the door than to turning off a notification. Reply START if you change your mind.

Notifications

Every notification we send is deliberately vague. A push notification says someone sent you a message, never who or what. Emails all carry the same subject line and say nothing on the outside.

No notification, email subject, or link we send contains any word about a condition. Someone glancing at your lock screen learns nothing.

Payments

Payments are handled by Stripe. Card details never reach us.

Stripe holds your legal name and billing details because a payment processor has to. Our database never receives them — it stores only that a subscription exists and when it renews.

Who else touches your data

As few companies as we can manage, each doing one job:

• Our hosting and database provider, which stores the data described above.
• A messaging provider, which sends the sign-in code to your phone.
• An identity verification provider, which checks your selfie and then deletes it.
• Stripe, for payments.
• An email provider, for transactional email.

Logs and diagnostics

We keep error logs so the app can be fixed when it breaks. Those logs identify accounts by an opaque id. Message contents and profile fields are stripped before anything is recorded, and no condition information appears in any event we log.

Deleting everything

You can delete your account from Settings. It is permanent and we mean it literally.

Within seven days, your profile, photos, messages, connects, and every other row belonging to you are removed from our database and our file storage, and any subscription is cancelled. This is a deletion, not a flag that hides you while the data stays.

Your verification selfie is already gone by then — it is deleted as soon as the check finishes, whether or not you ever delete your account.

Your choices

You can change or withdraw your health-data consent, switch to support-only mode, turn off optional notifications, or delete everything. Withdrawing health-data consent means we can no longer run matching for you, so it deletes your account.

You do not have to give a reason for any of this, and using any of it will never get you treated differently.

Age

Plus One is for adults. You have to be 18 or over, and the app enforces that at sign-up.

Changes to this policy

If we change how we handle health data, we ask for your consent again rather than quietly updating this page. For other changes, we will tell you in the app before they take effect.