Privacy Policy

This policy describes what PhotoMatch collects, who can see it, who processes it for us, and how to delete it. It describes the service as it works today. Please read the sections on who sees your photos and, if you use the optional "Meet people" feature, on facial analysis: that processing requires your explicit consent.

How the service works, and what is stored at each step

• 1. You scan a QR code in a place. It opens a web page. The code identifies the place; we do not check that you are physically there. The first screen shows the place, its badge if it has one, this week's numbers (how many photos and how many people), and the latest published photos taken there, with their captions. Anyone who scans the code, or opens the link, can see this without an account.
• 2. You take your photo(s). The page uses your camera (the back camera by default, with a button to switch) for one to three photos, and you can write a caption of up to 140 characters. The photos stay in your browser until you post.
• 3. You give your first name and your age and tick one box: that you are 18 or older and that your photo is public in that place's feed and in the app.
• 4. Optional: "Meet people who were here". It is off by default. If you skip it, nothing below is asked, collected or analyzed.
• 5. You press "Post to this place". Only then are your details saved and your photos uploaded. They are uploaded hidden and are published in one step at the end. If something fails before that, or you go back and edit, the unpublished photos are kept but never shown. If you close the page before pressing Post, nothing has been sent, except a selfie you took for the optional feature (next section).
• 6. In the app, opening the link from the final screen ("Your photo is live") records your visit, unlocks the place's badge if there is one, and brings your photos to your profile. If your account has "Meet people" on, it also puts you in that place's pool: the people who visited it during the same night (bars, until 6 a.m., Austin time) or the same week (Monday to Sunday, Austin time, for other places). You swipe on the cards of people in your pools; two likes make a match. Matches, and people who follow each other, can send private messages.

Facial analysis and biometric information (only with "Meet people")

The photos you post are never analyzed. The analysis below only happens if you turn on "Meet people who were here" on the place page, tick the consent box shown there, and take a selfie. It is performed by an AI model provided by Anthropic on our behalf, in two steps:

• Face detection. As soon as you take the selfie, it is sent to find where the faces are, so the page can crop your face and, if several people are in the picture, let you pick which one is you.
• An internal score. When you press Post, the selfie (or the crop of your face) is sent, and the model returns a number from 1 to 10 for the person closest to the camera. A small bonus based on your height, if you gave it, is added; the height itself is not stored. The score is saved with your session.

The selfie is not posted and is not stored by us. We do not store face templates, face measurements or any other faceprint: the only thing kept from the analysis is that one number. Depending on where you live, this processing may be treated as processing of biometric identifiers or biometric information.

What the score is used for. It is one of three inputs to the compatibility percentage shown on cards and matches, alongside star-sign compatibility and the age gap between the two people, and that percentage orders the cards you are shown. The score itself is never displayed to you or to any other user. We do not sell it, license it or disclose it for profit.

Consent. The place page asks for your explicit consent, by a separate checkbox you must tick before the selfie can be taken, and our servers refuse the analysis without it. If you do not consent you can still post photos: you just cannot use "Meet people". You can withdraw consent by deleting your account. The score is deleted with your account.

Your photos: where they appear

• Photos are uploaded to our image host (Cloudinary) and saved with the name of the place, the date, your caption if you wrote one, and a random session code.
• Once published, your photos and their captions are not private. They appear in that place's photo feed, which anyone can open in the app, and the latest ones are also shown on the place page, with or without an account, together with the place, the date and the like count (the data behind the app's feed also carries your username and profile picture). They appear on your profile, and, only if you use "Meet people", on your card (up to six photos, those from the place first) for people in your pools.
• Your first photo is used as your profile picture: the app has no way to upload a different one.
• Other people can like and comment on your photos, and can save, screenshot or share them. The app has a share button that produces a framed image with the place name.
• Image links are public: anyone who has the link to a photo can open it.
• A photo that two different people report is hidden for everyone while we review it.

Do not post a photo if you do not want it, and its caption, seen by other people.

Information we collect

• On the place page, always: your first name as you typed it, your age, your consent, the place and the time, your photos and your caption.
• On the place page, only with "Meet people": gender (man or woman), who you want to see (men, women or everyone), star sign, the three answers combined into one score, the internal face score described above, and the fact that you turned the option on. Your height, if you give it, is used once for the score and is not stored. Your selfie is analyzed and not kept.
• In your browser: the session code, the place, the time, the links to the photos you posted and your caption, kept for 12 hours so you can come back after installing the app; and your first name and age, kept on that device to fill the form next time, until you clear your browser data.
• Your account: email address, username (also used as your name), an optional bio, a password (stored only as a salted PBKDF2 hash: we cannot see it), the confirmation that you are 18 or older, follower and following counts, and the creation time. If you use "Meet people": that setting, your gender (man, woman or non-binary) and who you want to see. They are copied from the place page when you link a session where you turned the option on, or asked in the app, and you can change them, or turn the option off, in Edit Profile. Turning it off also clears your "show me" answer.
• What you do in the app: the places you visited and when (a visit to a place's pool is only recorded if "Meet people" is on; badges you find and the posts you make are recorded either way); the badges you found and whether you were first; your swipes (who, like or pass, in which place, when); your matches (the other person's name, star sign, compatibility percentage, photo and the place); your messages (sender, recipient, text, time, whether it was read); who you follow; your photo likes and comments; and the reports and blocks you make.
• On your device: a signed session key, the code of your latest session, and any scans waiting to be recorded (place code and time) until they can be sent. The app asks permission to use the camera to scan QR codes, and for notifications. Notifications are generated by the app on your phone while it runs: we have no push-notification server.
• Technical data: to limit abuse we count requests by IP address. Those counters (IP address, the action, the time window) are stored in our database and are not linked to your account. Our hosting provider also keeps ordinary server logs.

We do not collect GPS or device location. We know a place only from the QR code you scanned, and a QR code proves that you have the code, not where you are.

Who can see what

• Anyone, with or without the app, can see the latest photos of a place, and their captions, on the place page.
• Anyone using the app can see your published photos and their captions, comments and likes, your username and profile picture, and your profile page: name, username, bio, photos, and your follower and following counts and lists.
• People in the same pool as you, only if both of you turned on "Meet people" and your "show me" and theirs fit each other, see your card: photos, username, age (as you typed it on the place page), star sign, bio and the compatibility percentage. If "Meet people" is off, you never appear on a card and you have no deck.
• Members of the weekly crew (everyone who visited, scanned or posted at any place that week, whether or not "Meet people" is on) see your username, profile picture and how many spots you visited that week, but not which ones. They can all read the group chat.
• Your matches and mutual followers can message you privately.
• Nobody else sees your email address, your gender, your "show me" answer, your internal score, the list of places you visited, or your swipes: a pass, or a like that was not returned, is never shown to the other person. When two likes match, both of you see it.

Messages and the group chat

Private messages can only be exchanged between two people who matched, or who follow each other. They are stored on our servers in readable form: they are not end-to-end encrypted, so we can technically access them, and may do so to review a report or to comply with the law. A message shows as "seen" to its sender once you open the conversation. Messages are limited to 500 characters.

The group chat is a shared room, not a private one. Its membership is the weekly crew, and every member can read every message posted in it, including after the week ends. Posting is limited to five messages every 30 seconds per person. People you have blocked, and people who blocked you, do not appear in your view of the group.

Reports, blocks and moderation

• You can report a person, a photo or a comment, and block a person, from the places listed on our support page.
• A report stores who reported, who or what was reported, the reason, where it came from, the time, and its status. We keep reports, including after an account is deleted, so that repeat abusers can be identified.
• Blocking removes the follows between the two of you, ends any match, and hides each of you from the other in the deck, the group and crew lists, the photo feed, comments and search. It also stops messages, follows and comments between you. The other person is not notified. A new block can take up to a minute to reach every part of the service.
• A photo or comment reported by two different people is hidden for everyone while we review it.
• We review reports and act on them, aiming for within 24 hours.

Age requirement

PhotoMatch is for people aged 18 and over. Age is self-declared and we do not verify identity or age documents. The place page asks for your age and for a tick on "I'm 18 or older", and it will not let you continue if the age is under 18; the server also refuses a session with an age under 18. Creating an account in the app requires ticking "I'm 18 or older", which is saved with the account. Swiping and messaging require that confirmation, and the app asks for it once if an older account does not have it. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it. If you believe a minor uses PhotoMatch, contact us.

How we use it

To run the service as described above: to publish your photos, and, for accounts that use "Meet people", to build your card, put people in pools and match them, deliver messages, prevent abuse, and keep the service working. We do not use your data for advertising and we do not sell it.

Who processes data for us

These providers process data on our behalf, under their own terms:

• Vercel hosts the service and its server code, and keeps server logs.
• Airtable hosts our database: accounts, sessions, visits, swipes, matches, messages, reports.
• Cloudinary stores and delivers the photos.
• Anthropic runs the face detection and the internal score, only on the selfie of people who turn on "Meet people" and consent.
• Apple distributes the app through the App Store; Apple's own policies apply to your App Store account and to what Apple collects about downloads and use.
• Expo delivers over-the-air updates to the app.
• The place page loads its fonts (Instrument Serif and Geist) from Google Fonts, which therefore receives your IP address and browser details when the page opens.

When you use the app's share button, the photo goes wherever you choose to send it. We may also disclose information if the law requires it.

How long we keep it

We keep your data while your account exists. There is no automatic expiry of visits, swipes, messages or group messages. If you post photos at a place without ever creating an account, or without linking the session to an account, those photos stay associated with that session and remain published (and the name and age you gave stay with the session); to have them removed, contact us with the place and the date.

Deleting your data

In the app: Me → Edit (top right) → Delete Account. This permanently deletes:

• your account, and the sessions and photos linked to it (with their captions, and the internal score if you had one), with the likes and comments on those photos;
• the image files of your photos and of your profile picture on our image host (Cloudinary). The deletion counts as successful only if these files are removed too;
• your messages, sent and received, including group messages you wrote;
• your matches, your follows in both directions, and the swipes you made and the ones made on you;
• your place visits and badges, your comments and your photo likes.

If any part fails, the account is kept and the app tells you, so you can try again.

What is not deleted by the app:

• reports and blocks that involve you, kept for safety;
• photos from sessions never linked to an account (see above), and the image files of those photos: email us to have them removed;
• the request-count records, and server logs;
• copies other people already saved or shared.

You can also email us to request access to, correction of, or deletion of your information. Depending on your state of residence, you may have additional rights, including the right to know what we have collected and the right to appeal a refused request.

Security

Passwords are stored using salted PBKDF2 hashing. Data travels over encrypted connections and is held with the providers above. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you as required by applicable law.

Meeting people

PhotoMatch is entertainment. We do not conduct background checks on users. We do not verify that anyone is who they claim to be. Use your judgment, meet in public, and tell someone where you are going.

Changes

If we change this policy materially, we will update the date above and, where required, ask for your consent again.

Contact

Questions, requests, or complaints:
Email: support@matchbooth.app
Austin, Texas, USA