What we know about you, and who can see it.

To create an account: your mobile number, which we verify by sending you a code. Your first and last name, your date of birth, and optionally an email address.

The profile you fill in: where you live, what you do, your height and appearance, your religious background and practice, your family — parents, siblings, and where they live and pray — your schooling, and, if you have been married before, whether you have children. Two or three people who know you well, and their phone numbers.

What you are looking for: the ages, backgrounds and circumstances you would consider, and anyone you would rather never be shown to. Names you give us there are stored as you typed them; phone numbers are stored only as an irreversible fingerprint, never as numbers.

Photographs and video: a photograph of your face and an upper-body photograph, both taken inside the app rather than chosen from your camera roll; up to four more photographs you upload if you want them; and, if you choose, a thirty-second profile video. The two taken in the app are what lets a person here confirm the rest are of you.

Your conversation: the full transcript of the conversation described below.

A few short questionnaires about money and home life, and your answers to them.

What our system works out about you: from your conversation and what you have written, an automated analysis of your values, what matters to you, and how you describe your own life. You can read this about yourself. It is never shown to anyone you are matched with.

Ordinary technical records: when you signed in, which steps of your profile you completed and when, and what messages we sent you.

At one step, an automated assistant telephones you and talks with you about your life for around fifteen minutes. It is software, not a person, and it says so in its first sentence. It only ever calls when you press the button asking it to, and only on the number you verified when you signed up. We never telephone you out of the blue.

The conversation is transcribed, and we keep the transcript. It is the single most useful thing we hold for finding you a good match, and it is also among the most private. Nobody you are matched with ever sees it, in whole or in part.

The company that places the call also keeps an audio copy for a short period before deleting it. We do not copy that audio into our own storage. We would rather tell you it exists than let you find out later.

This is a different thing from the fifteen minutes you may later spend meeting someone. Meetings are never recorded. There is no transcript of a meeting and no copy of it anywhere.

Nobody can browse this platform. There is no search, no directory, and no way to look someone up. You are introduced to one person at a time, or you are not seen at all. What that person can see grows in three steps, and each step needs both of you to agree to it.

We run this platform, so we can reach the information in it — including your conversation transcript and your photographs. That is how a profile gets checked, how a problem someone reports gets diagnosed, and how a complaint about behaviour gets looked into.

We are telling you this because the alternative is a claim that would not be true. Any service that can fix your account can read your account.

What we do not do: read for interest, share what we read, or use it for anything other than running the platform and keeping people safe. Staff access to a profile is recorded.

One exception, on purpose. While you are part-way through a step, what you have typed is saved so that closing the tab does not cost you your work. That unsubmitted draft is readable by you and by nobody else — not by us. It is deleted the moment you finish the step. Operating a platform does not require reading what somebody typed and chose not to send.

Signing up lets us text you a sign-in code, and text you when there is a suggestion for you — that is what an account is for, and for most people it is the only way we can get in touch. We record the exact wording you agreed to, and when.

We never sell your mobile information, and we never share it with anyone for their own marketing. Your number is used to sign you in and to tell you when there is a suggestion for you — nothing else. We share it with the company that delivers our messages only so that a message can reach you, and with nobody else.

Reply STOP to any message and we stop sending them — all of them, not only the kind that prompted it. Reply HELP for who we are and how to reach us. Message and data rates may apply.

We never place a call you did not ask for. The conversation happens only when you press the button, and if it reaches a voicemail it leaves nothing that says what it was about.

We use a small number of suppliers, each for one job, each under a contract that limits them to that job. By category:

• —Hosting and database. Runs the site and stores everything described here, including photographs and video.
• —Text messaging and telephony. Delivers sign-in codes and notifications, and places your conversation call.
• —Automated language processing. Conducts the conversation and produces the analysis of what you have shared.
• —Site measurement. Counts page views so we can see where people arrive and where they stop. It sets no cookie, stores nothing in your browser, and does not identify you.

We do not sell your information, and we do not share it for advertising. No supplier is permitted to use what they process for their own purposes.

We keep your profile while your account exists. The audio copy of your conversation is deleted by the company that placed the call within a short period; the transcript stays with your profile.

To have your account removed, write to us at the address below and we will do it. There is no button for this yet, and we would rather say so than describe one that does not exist.

When we remove an account, this is what happens:

• —Your photographs and your video are deleted from storage.
• —Your profile, family details, education, references, preferences, questionnaire answers, conversation transcript and the analysis derived from it are deleted.
• —Records that describe you and somebody else are kept, with everything personal about you removed from them. A match involves two people, and one of them is entitled to an accurate record of what happened. What remains after that carries nothing that identifies you.
• —A small number of records are kept because we are obliged to keep them: what messaging permission you gave and when, and the log of staff or shadchan access to your profile. Those exist to prove what was done, and deleting them would defeat the purpose of having them.

If you become engaged and want to leave, tell us — we would like to know, and it is a better ending than an account quietly going away.

The database refuses cross-account access at its own level, not in the application. Every table denies everything by default and then permits only what is explicitly allowed — so a mistake in our code produces an error rather than somebody else’s information. We test that by attempting the reads that should fail and checking that they do.

• —Photographs and video live in private storage. They are never served from a public address. When you or somebody entitled to see them needs one, we issue a link that works for a few minutes and then stops.
• —Your phone number is verified by a code before an account exists, so an account is tied to a phone somebody actually holds.
• —Numbers you ask never to be shown to are stored only as an irreversible fingerprint.
• —Traffic is encrypted in transit, and stored data is encrypted at rest.

We will not tell you this is impossible to breach. No one can honestly say that. What we can say is that the design assumes a breach would be catastrophic for the people here, and is built accordingly.

This service is for adults aged eighteen and over. We check your date of birth when you sign up and refuse an account to anyone younger. We do not knowingly collect anything from a child. If you believe a child has given us information, write to us and we will remove it.