BrainMatch — privacy and how your data is used

Run by: Turing Creative LLC Questions: [email protected]

What BrainMatch is

A place to get to know yourself, one ordinary day at a time. If you're with someone, you watch the two of you grow. If you're single, you work out what you actually want. Nothing here gives you a compatibility number or scores your relationship.

How your data is used

• To help you get to know yourself. Everything you answer builds your own record: your brain map, your journal, your monthly recap. It's there so you can see your own journey, and it's yours to export or delete at any time.
• To help you and your partner now. If you're in a couple, the reports, things to say, and songs work from what each of you chooses to share. Your partner never sees anything you haven't shared.
• To match future couples well. Questionnaire and check-in answers are analysed together to learn what good matches look like and to build BrainMatch's matching. We call this **matching data**. It's filed under a random id, never your name or email, alongside your birth year, whether you're single or in a couple, when your relationship started, how you met (if you meet someone here). That makes it pseudonymised, not anonymous: the id links your answers over time and to your partner's, so it's still treated as your personal data. It never includes your writing, your email, or your gender and the gender you're looking for. "Help build matching" controls whether yours is used to build matching features.

Please keep very sensitive things out

Please don't put very sensitive things in BrainMatch, like passwords, account or card numbers, your address, health details, private details about other people, or anything you wouldn't want stored.

The app says this when you join, next to your choices, and again in Privacy. Everything you write is kept for you as described below, and you can delete any of it; this is about what's best never written down in an app at all.

Your words, in your hands

If you need to keep your words for any reason, download a copy regularly. You -> Your data -> Export your words gives you everything, any time; delete your account there too, and every word goes with it.

Every deletion is your choice, named first (owner, 2026-09-30). Nothing you wrote is deleted because you changed where you are (single, seeing someone, together), linked, or unlinked; the app asks in place before anything is removed, and says what goes. Turning Writing off deletes everything you've written: your journal answers, two things, letters for later, the jar and your replies to Megan; the notes, thank-yous and songs you sent a partner, and your copies of them in past chapters; your firsts, surprises and bucket list; free notes and Five senses; the songs you added to a couple's playlist; the events you named and what you filed in them; and your next date, if you set it last.

One entry at a time, too (owner, 2026-10-03). Open any entry in your Journal and tap Delete this entry: a Tonight answer from any day, a line of Two things, a free note, a reflection, an answer to Megan, a Monday Mix, Things to say, Taste or Tonight-together answer, or something a friend sent that you added (its photo goes with it; they aren't told). A letter for later can be deleted from its row, even while it's still sealed, and a day photo from the photo itself. The app says in place what goes before it goes. It's deleted for real, not hidden, together with what was made from it (the "a spot just lit" note that quoted it, a Tonight answer's look-back, a Two-things line's "how it went"); if you'd shared it with a partner, they can't see it any more. A prompt or insight the AI already wrote for you stays, as it does when you turn the AI off; it goes with your account. Our encrypted backups age out within 35 days (see "Security and backups").

What you'll do

• A 15-minute personality questionnaire now, and again every few months. It saves as you go: each answer is kept on your phone as you tap it and, a moment later, as a draft on our server (under the questionnaires permission), so you can stop and pick up at the first question you haven't answered, even after a reinstall or on another phone. A part-done questionnaire is never counted, never in matching data or the research export, and is deleted when you send it, when you turn Questionnaires off, or with your account; it's in your export until then.
• A daily check-in: a few quick taps, about 30 seconds: your mood and, if you're in a couple, how appreciated you felt and your time together. If you're in a couple, it also covers the state of us: three taps once a week on how the two of you are doing (how close you feel, time together, and what would help). Your partner sees yours only once they've given theirs. Both are under the check-in permission, and turning it off deletes both.
• Counted across everyone. Your questionnaire answers and check-ins are also counted with everyone else's: how many people gave each answer, per question and per month. Those counts never carry your id or a day, and a group of fewer than 10 people is left out, so nothing in them is yours on its own. Your answers themselves go into the owner-only research export only if you turn on "Help build matching" (see "The owner-only research export").
• If you choose: open questions, what-would-you-do scenarios, Two things a day, Taste, and the questions the app builds from your own answers.

If you're in a couple, your partner joins separately on their own phone. Neither of you can see the other's answers unless one of you shares something.

Optional: what you're looking for

You can answer eight questions about what you need from a partner (or, if you're in a couple, how your relationship actually runs). You can also say your gender and the gender you're looking for.

Your gender and the gender you're looking for are sensitive information (under GDPR they can reveal sexual orientation). They are stored separately from everything else, never included in matching data, never shown to your partner, and entirely optional. Turning this section off deletes all of it: what you need, who you want, your Taste picks, your gender answers, your green flags and dealbreakers, and your sealed "Before you met".

The archive, the journal, and Two things

One question a day, answered by tapping, writing, or dropping a pin on a grid, kept with its date so you can look back. Two things a day: something you did, an idea, or something to get better at, with an optional mood. All of it collects in your journal, a day at a time. Only today's archive entry can be changed. Each archive entry has its own share switch, off by default, and writing the answer again keeps the choice you made; Two things are never shown to a partner. What only you can read (your journal, free notes, an entry you keep for yourself) is never run through a word filter: it is yours to write in your own words. The fixed word lists check only text that reaches another person.

When you answer the archive question, a look-back is booked for that answer: about six weeks later, the same question is asked again on Today, and only after you've answered it does your earlier answer appear beside the new one. We keep the date it's due and the answer you give when it comes round, under the Writing permission, like the archive itself: only you see it, it's in your data export, and it's deleted if you turn Writing off or delete your account.

Events: your own names for entries that belong together (owner, 2026-10-03). You can name an event in your own words (there are no suggested names) and file any of your journal entries in it: a Tonight answer, two things, a free note, a reply to Megan, a day photo, a letter for later once it's opened, a moment you added, or something a friend sent that you added. An entry can be in more than one event. We keep each event's name, when you made it, and which entries you filed in it. Only you see your events: never a partner, a friend or anyone else; they're never used for matching or in matching data, never read by AI, and, like the rest of your private writing, never run through a word filter. They're under the Writing permission, in your export, and deleted with it or your account. Deleting an event deletes only its name and its filing: every entry in it stays in your journal. Deleting an entry takes it out of every event.

Bucket list

Things you'd like to do one day with a partner, each tagged with the kind of thing it is, and ticked off with the date when you do them. It's covered by the "Writing and scenarios" permission, private to you unless you share it (never in matching data), and it stays with you if you meet someone. Once you're linked, you can put your list on a shared wall with your partner, and each item has its own share choice: only the items you mark shared go on the wall, a new item is kept for you unless you choose to share it, and you can change any item's choice later. Your partner can tick off an item you shared. (Items you added before 3 October 2026 kept the visibility they had: they show on the wall while your list is on it.) Your export says which items are shared.

Things to say, and the answers you write back

The app takes answers you've already given and hands them back as a question. You can write an answer to any of them. They're covered by the "Writing and scenarios" permission, private by default, and your partner sees one only if you turn on its share switch.

Sending a song

If you're in a couple, you can send your partner a song with a reason and a short line. It goes to them and nobody else, is not included in matching data, and the app never counts how many songs go each way.

If you're single and meet someone

• How you met (through friends, online, at work, out somewhere, or elsewhere) is recorded with the date and included in matching data: how people meet, and how it goes from there, is how BrainMatch learns what good matches look like. Nothing else about the person is asked.
• What you had said you were looking for is sealed, dated, and opens on a date you choose. It is yours alone: the person you met can never see it, it is not in matching data, and the app never compares them with it. If you meet someone again later, the first sealed note is kept as it was (the app says so, and from when); a new one never writes over it.

Question of the day, time capsules, nudges and appreciations

A short either/or question each day; in a couple, you also say which one you think your partner would pick, and neither of you sees anything until you've both answered; then you see both picks side by side. Time capsules (a letter for later) stay sealed until the date you choose, at least a week ahead; the server keeps the words and hands them back only on or after that day by its own clock, once, when you open the envelope, and it remembers when you did. After that the letter is a keepsake in your journal. A capsule is one of your written answers (that permission), and is deleted with it. A nudge is a wave with no message, at most once a day, and can be switched off in Reminders. An appreciation is one of our fixed kind lines ("Thank you for today"), one a day, sent to your partner. For nudges and appreciations we keep who sent it, the day, and when it was seen; your "nudges off" choice is kept as a setting.

Playing together in a shared room (on a headset or the web preview, once shared rooms are open): you and your partner each pick on your own device, and the room shows both picks once you have both picked. The room holds the questions, the picks and who is there only while it runs, and deletes them when it ends; a pick on today's question is saved as a pick on your phone would be, and a line you write there is a private line in your journal. In a shared room, where your head and hands are is passed to the other person a few times a second so they see your figure move, along with which made-up setting you're in. It is never stored or logged, and stops when you leave. Nothing of the real room around you, no camera image and nothing from your eyes or face is ever sent: only the position and turn of your head and hands.

Notes to your partner

In a couple, you can leave a short note (up to 140 characters) on your partner's Today. It's your own words, so it's under the writing permission: only your partner can read it, and turning writing off deletes the notes you sent. Notes your partner sent you are theirs, and go if they turn writing off or delete their account.

Optional: Moments (couples)

You can keep photos of moments you want to remember, each with a title, a date and an optional note. Each time you add one, you choose: share it with your partner, or keep it for you. You can change that later on the moment's page, and your export says which you shared. Your partner sees only the ones you shared, and only while you both have Moments on; nobody else ever sees any of them. (Moments added before 3 October 2026, and any added from an older version of the app that doesn't ask, are shared, as they always were; you can keep any of them for yourself on its page.) They are never used for matching, never analysed, never in matching data, and never shared or sold. You can delete any moment you added, and turning Moments off deletes every moment you added, photos included.

Optional: Notifications from your partner

If you turn on "Tell me when my partner sends something" in Reminders, your phone is told when your partner sends a heartbeat, a note, a letter or a song, or answers today's question. The notification only ever says that something is waiting, in fixed words we wrote; nothing anyone wrote is in it. To reach your phone it passes through Expo's push service and Apple or Google. Reminders are different: they're scheduled on your phone and never touch the server.

Couples: thank-yous, your next date, and long distance

Under the writing permission: the thank-yous you write to your partner (they see them; you never see whether they've been read) and the next date you set (both of you see it; it's deleted two days after; calling it off or clearing it is asked first, because it goes for both of you). Turning writing off removes your thank-yous from their jar and the next date only if you were the one who set it last; one your partner set stays. If you switch on long-distance mode, each phone sends its time zone offset (how many hours it is ahead of or behind UTC, like "+1"), so the other can see your local time and a "good night" can arrive in their evening (and a "good morning" in their morning). It's the offset only, never the name of your time zone or anything about where you are. It's only kept while the mode is on: it's deleted when either of you turns long-distance mode off, or when you delete your account. A good night or good morning itself carries no words and is deleted 30 days after it's sent. Whether you are close by or far apart, either of you can also type how far apart you say you are, in your own words (up to 24 characters, like "20 minutes" or "2,140 miles"). It is your shared setting: you both see it, either of you can change or clear it any time, and it is kept with the long-distance setting, on or off. It is only ever shown back as you wrote it: never read as a number, never a location (the app has no location permission), never compared and never used for matching. It is deleted when either of you ends the link or deletes your account, and it is in your export.

Singles: dealbreakers and green flags

Under "What you're looking for": your private list of dealbreakers and green flags. Only you see it. It's never shared or used for matching; if dating ever uses it, that will be a separate choice you make. The profile in your words is stitched only from what you've already given (your trait headlines, Taste picks, a line you wrote, a bucket-list item, your green flags) and is shown only to you.

Couples: firsts, surprises, the Sunday ritual and your shared garden

Under the writing permission: firsts you log (on your partner's timeline only if you switch that on for that one; it starts off) and surprises you plan (your partner never sees any of it until you choose to reveal it, and then only its title). The Sunday ritual stores only a yes for each week each of you did it, nothing about what you said. The shared garden is drawn only from what both of you have already chosen to share on the "two of you" map.

Optional: your birthday

If you add it, we keep only the month and day (your birth year is already known from sign-up), so Today can celebrate with you. Your partner sees only "It's their birthday today", and only if you tick "let my partner know"; never the date. Remove it any time in Settings; it's included in your export and deleted with your account. We also remember which look you chose for your own brain drawing; only you see it.

Rooms and chapter titles

Under the questionnaires permission: your answers in Rooms (question packs). The sensitive rooms (money and security, family and roots, health and energy) are taps only: no free text, and never amounts, accounts, employers, diagnoses, medication, names or places. Those answers are stored encrypted with their own key, never go into matching data, and can each be deleted. Under the writing permission: your monthly chapter titles, made only from your own words and days; words that look like names, numbers or places are never used.

Asking your friends, and BrainMatch on a computer

If you ask your friends about today's this-or-that, we make a link that shows only the question: never your name, your pick or anything about you. Friends' picks come back to you only as counts. We don't keep a visitor's internet address: to allow one pick per visitor, we keep a scrambled code made from their address and the link, with a random key that changes daily, so it can't be turned back into the address. Links close after 7 days and the picks and codes go with them; each day's key is deleted a day after that. The links are under the writing permission. If you sign in on a computer (brainmatch.app/me), we keep a scrambled record of that browser's session for up to 30 days, deleted when you sign out or delete your account. The web shows only your own journal and brain map.

What matters to you

Under the questionnaires permission: a "What matters to you" card sort (16 values, your top three), kept with dates so you can redo it every few months. Your "really matters" values light spots on your own brain map; they're filed with the trait they're closest to, which is a layout choice, not a claim about your personality. Turning the permission off deletes them.

Optional: Faith & spirit

If you practise a religion or a spirituality, you can add a Faith chapter: the tradition you choose, the daily practices you tick, the good deeds you log, the prayers, mantras and readings you keep in your own words, and your reminder times. Only you can see it. It is never shown to a partner, a friend who introduces you, or anyone else; it is never used for matching, never in matching or research data, never read by AI, and never shared or sold. Reminders are scheduled on your own phone; nothing is sent. Turning Faith & spirit off deletes all of it.

Optional: Couples answers with your partner

One question a night for the two of you, answered alone. Your answer is sealed on our server until your partner has answered too; then you both see both, and each of you keeps your own. Only the two of you ever see them: never anyone else, never used for matching, never in matching or research data, never shared or sold. Turning this off deletes your answers; your partner's stay theirs.

Optional: Live calls with your partner

Live voice and video with your partner in a shared room. It goes straight between your two devices when it can, or through Cloudflare's relay when it can't. Nothing is recorded or stored by us. Your microphone is used only while you're in a call you joined, and your camera only if you turn it on (a headset sends voice only). Only you and your partner can be in it: never a first date, a friend or anyone else. No AI listens or watches, and none of it is used for matching. Turning this off ends any call you're in; nothing is stored for calls, so nothing is deleted.

How it works, in more detail. It is only for the two of you in your own couple room (when one of you is in the shared room from a headset or the app): never in a first-date or friends room, never with anyone else. It starts only when you press Join; the microphone (and, on a phone, the front camera if you choose it) is opened then, after these words, and closed when the call ends, when you leave the room, or when the app goes to the background. A headset sends your voice only: what a headset sees is never sent. To set the call up, your device and your partner's exchange a short technical description of the call and the network routes each can be reached on (internet addresses); the shared room passes those to the other device at once and keeps none of it: nothing is stored, logged or recorded, by the room or anywhere else. Then the sound and picture go straight between your two devices, encrypted between them (WebRTC). When a network won't allow that, they go through Cloudflare's relay (Cloudflare Realtime TURN), which passes the encrypted stream on without being able to read it and without keeping it; Cloudflare's free address service (STUN) only tells each device its own public internet address. Your partner's device receives your voice and picture as any call does; BrainMatch has no way to record them. No AI listens or watches, nothing is analysed, and none of it is used for matching. Because nothing is stored, there is nothing to export or delete for a call: your export and your deletion are unchanged by it. Turning this off ends any call you're in and stops new ones.

Optional: Friends as matchmakers

Ask a friend who knows you to be your matchmaker, with one link you send them yourself (BrainMatch never emails your friend and never asks for their name or address). For an ask you make we keep the first name you chose, your one line about yourself, and when you made it; anyone with the link can read those two things. Nothing about your friend is kept until they say yes in the app under this same permission; then their chosen first name and when. A matchmaker can introduce you to someone they trust with an ordinary introduction (above): you see their note in the app and say hello or not now, and nothing opens until both of you have said yes. If you say yes to being someone's matchmaker, we keep the first name you chose and that you said yes. A partner never sees any of it, and none of it is used for matching, never in matching or research data, never shared or sold. Turning this off deletes your asks and your yeses; introductions already open carry on.

Optional: Friends

Friends you both say yes to, for anyone: single, seeing someone or in a couple, with no limit on how many. One of you makes a friend code (nine characters, with the first name you want to be shown by) and gives it to the other yourself, by message or out loud; BrainMatch never contacts anyone for you and never reads your contacts. The other types it into "Enter a code someone gave you", sees only that first name, chooses their own, and says yes. A code works once and closes after 14 days. A friend can send you something for your journal: a few words, a photo with an optional caption, or both. Nothing is added to your journal until you accept it. Accepting copies it into your journal, marked as from them, on the day you pick, and into one of your events if you choose (your events are never shown to them). "Not for my journal" deletes it at once, photo and all. The sender is never told which you chose: it simply stops waiting on their side. Until you answer, they can take it back. Once you add it, it's yours: in your journal and your export, deleted when you delete it, and it stays with you if they stop being your friend or delete their account (like a letter given). They keep no copy on BrainMatch once you've answered (their photo is still on their own phone). What we store, under this permission: who your friends are and the first name each of you chose to show the other, your codes, what's waiting either way (the words, the caption and the photo), what you added from friends, and whom you blocked (when, not who). A friend never sees your journal, your events, your other friends or anything else of yours; only what they sent you, while it waits. Words a friend sends are checked by fixed word lists (no AI) on the phone and on our server before they're saved, like a post: no insults, sexual words, threats, slurs, contact details or private things about other people. A photo is checked to be a real JPEG or PNG, made smaller on your phone, kept on our server like your other photos and never analysed. Report is on everything waiting for you, on everything you added from a friend, and on the friend themselves; Block ends the friendship, deletes what's waiting both ways, and means neither of you can make the other a friend again; Stop being friends does the same without the block. Nobody is told you removed or blocked them. A partner never sees any of it, and none of it is used for matching, never in matching or research data, never shared or sold. Turning this off ends every friendship and deletes your friends, your codes, everything waiting from or for a friend, every entry and photo from a friend you added, and every friend's answers about how they see you. (Version 2026-10-03.1 added this permission; it's asked where it's used, never at sign-up. Version 2026-10-04.1 added "How a friend sees you", below, so anyone who had said yes is shown what's new and asked again.)

How a friend sees you (added 2026-10-04): other people notice things about us that we can't. You answer seven short prompts about yourself first ("What do you light up talking about?", "What's a small thing you always notice?"); those answers are your own writing, kept under Writing and scenarios as journal entries of yours, for you alone, never checked by any filter, replaced when you answer again and deletable one at a time. Then you can ask one friend to answer the same prompts about you, in their own words, on their own phone. They see that you asked, your first name as they know you, and the prompts; never your answers. Each box is optional for them, and they can say not this time: the ask is deleted and you're never told, it simply stops waiting. Until they answer you can take the ask back. Their answers come back to you alone, read beside yours prompt by prompt, as words only: no score, no agreement count, no "they know you well", no ranking of friends. They sit in your journal as "How <name> sees you", are in your export, and are yours to keep or delete; deleting the exchange deletes their answers (your own stay). What a friend writes about you is checked by the same fixed word lists as anything a friend sends (no insults, sexual words, threats, slurs, contact details or private things about other people), and Report is on their answers, Block on the friend. One ask per friend at a time, a few a day. What we store, under the Friends permission: each ask (who, when, when answered, when you first read it) and the friend's answers; the friend's account is noted only so their answers can be reported, and that note is cleared if they delete their account (their answers stay yours). If the friendship ends, anything still waiting between you is deleted; answers already given stay with the person they were written for. A friend's answers about you are never used for matching, never in matching or research data, never read by AI, never shared or sold, and never shown to a partner. The friend keeps no copy on BrainMatch once they've answered.

Optional: Hobby chapter

One hobby, one question a night about it, kept as a chapter of your own. We keep the hobby you picked, or for a hobby of your own, the hobby's name in your own words and a photo you choose as its logo; your buddy sees the name and the logo. We also keep the first name you choose to show a buddy, your answers, and which ones you chose to share. Your one buddy is someone you connected with by code (never anyone's email): they see only the entries you share, and only while you keep them as your buddy. Fixed word lists (no AI) check an entry only when you share it with your buddy; an entry you keep for yourself is never checked, like the rest of your journal. A cheer from a buddy is one tap, kept as the day it came. The logo photo is checked to be a real JPEG or PNG, kept on our server like your other photos, never analysed, and in your export. Nothing here is a score or a streak, a partner never sees it, and none of it is used for matching, never in matching or research data, never shared or sold. Turning this off deletes your chapter, the photo you chose as its logo, and your cheers. (Version 2026-09-30.4 added the hobby of your own and its logo.)

Passkeys

If you add a passkey (sign in with Face ID or your phone's lock), we store only its public key, a label you choose, and when it was added and last used. The private key never leaves your phone. Passkeys are deleted with your account, and you can remove any of them in Settings.

Small things you keep

Under the writing permission: the songs you add to your couple's date playlist (your partner sees the one list while you're linked; each of you takes off only your own; each song belongs to the couple it was added in, so a later partner never sees it, and after an unlink it stays with you in that past chapter); when an answer lights a spot on your map for the first time, the day and up to one line of those words, so the app can tell you which spot and why; a free-write note (a journal entry with no prompt, filed under a chapter, Faith, Hobbies or nothing; only you see it, and it is deleted when the writing permission is turned off); the notes in your gratitude jar, the days you star in your journal, and how you feel about a spot on your own brain map (one tap on the spot's page: "That's me", "It surprised me" or "Still working it out"; never a score, never shown to a partner, never in matching data). Only you see them, and turning the writing permission off deletes them. If you take a break (pause mode), we keep only the dates of the break, so the app knows to stay quiet; reminders pause on your phone and partner notifications pause on the server.

If you unlink: past chapters, and your own copy

Either of you can unlink at any time, in Privacy ("Unlink from your partner"). When the link ends, whether one of you unlinks or one of you deletes their account:

• **Each of you keeps your own copy of what you shared, and deleting your copy never deletes theirs.** Theirs never deletes yours either. Nobody is asked, and nobody is told who unlinked.
• Your side stays in your Journal, under Past chapters: the day the link began and the day it ended, what you wrote in those days (your Tonight-together answers included), the moments you added, the firsts you logged, the surprises you planned and the songs you put on your couple's playlist. Your writing stays where it already is, under the same permissions.
• You get your own copy of anything that lived in a place the two of you shared: the notes, thank-yous and songs you sent them, and the notes, thank-yous and songs they sent you (given to you, like a posted letter; since 2026-09-30), under the writing permission like the originals, and a letter they gave you, written before you met (already yours once given). So one of you deleting an account, or turning a permission off, never takes the other person's copy with it.
• What else they added stays with them. Their moments and their answers, even ones they shared with you, are not copied to you. Nothing either of you kept private ever is. Once the link ends, what they sent you shows only in your own past chapter (and your export), marked as theirs to you, never anywhere else.
• A letter for later you wrote in those days stays sealed until its own date, by our server's clock. Unlinking never opens anything early.
• You can delete your copy of a chapter at any time, asked in place first. That deletes the chapter, the copies kept in it, and the moments (photos included), firsts, surprises and playlist songs you added while you were linked. What you wrote in your journal stays in your journal. The other person's copy isn't touched, and they aren't told. Or delete only some of it (the moments you added, the firsts you logged, your copies of the notes, thank-yous and songs, or the letter given to you) and keep the rest: the "That's allowed" page offers this after a link ends, before it asks where you are now.
• If a plan-a-date connection ends, the dates you logged stay in your journal like anything else you wrote, and you can delete any one of them on the same page. Two dates logged the same day, from two connections, are two entries.
• Past chapters are in your export (Privacy → "Show everything you store about me") and are deleted with your account.

Things with no switch of their own

A few small records aren't anything you've said; they're how the app keeps track, like settings. They're part of your account (the "Join BrainMatch" permission), you can see them all in your export, and they're deleted with your account:

• Settings and choices: nudges on or off, long-distance mode on or off, how far apart you say you are (in your own words, if you typed it) and the day you'll next be together, whether your bucket list is on your shared wall, the look you chose for your brain drawing, your birthday (month and day, if you added it), and pause dates.
• What's already been shown: which milestones, occasions (anniversaries, months together, seasons) and "waiting for you" cards you've seen, and the pulls you've earned in the gratitude jar, so nothing is shown twice.
• Small wordless signals: evenings you tapped Lights out, Sunday-ritual yeses, heartbeats (deleted once seen, or after 30 days), good nights and good mornings, nudges and appreciations.
• How you met, if you were single and met someone (see above; it's in matching data).
• Tell a friend: your six-character code, if you've opened "Tell a friend", and a count of friends who joined on it. If you joined on a friend's code, we keep that link (their account and yours) so that, after your first day, each of you gets one extra pull from the gratitude jar. Neither of you is ever shown the other: the friend never learns whose code it was, and the referrer sees only a number of friends, never who. A week with at least three active days (any check-in or answer) earns the same kind of extra pull too, whether or not you've ever referred anyone. These are shown together as one plain credit balance - a number of extra gratitude-jar pulls, never money, and never treated as scarce.
• Suggestions and bug reports you send us (see "Bug reports, suggestions, crash reports and our website forms" below).
• Shop quote requests (the Shop isn't open yet): when you ask for a quote on something in the Shop, we keep which product, how many, whether it's to go to someone else (a yes or no, never an address), the quote and its status. Nothing you've made or written is sent anywhere by asking, and nothing is bought. You can withdraw a request; withdrawn ones are deleted a month later. Kept with your account (deleted with it) and in your export. We see only how many requests each product has, never what you asked for.
• A letter you gave your partner. Once given, like a posted letter, it's theirs: turning writing off deletes your own copy and anything not yet given, but not the one you handed over. Deleting their account deletes theirs. Deleting your account deletes your own copy, never theirs: when the link ends that way, the one you handed over stays with them, in their Past chapters (see "If you unlink" above).
• Past chapters: the day a link began and the day it ended, for each of you (see "If you unlink" above). Nothing in it says who unlinked.
• A request to link: linking asks both of you. When you enter someone's invite code, we keep which code, that it was you, and when, until the person who made the code says yes (it then becomes your link) or no, you take it back, or the code runs out after seven days; then it's deleted. The person who made the code is shown only when it was used, never who, and gets one notification saying so if they've turned notifications on. It's in your export and deleted with your account.

Optional: A photo a day

You can keep one photo a day in your journal, in place of writing. Only you can see them, unless you're in a couple and tick "share with my partner" on a particular photo, in which case your partner sees that one. They are never used for matching, never analysed, never in matching data, and never shared or sold. You can delete any photo, and turning this off deletes all of them.

Five senses, and optional: Your avatar

Five senses (on the You tab) keeps a small line of gratitude for any of the senses: something you saw, heard, tasted, touched or smelled today. Those lines are writing, kept under the writing permission like the gratitude jar: only you see them, each one lights a spot on your own map, they're in your export, and turning writing off deletes them.

Your avatar is a little drawing of you that you build yourself from a few choices: the gender you choose, a skin tone, a hairstyle and its colour, a top, and extras like glasses or freckles. We keep only those choices, not a picture; the app draws it. Because a skin tone can say something about you, it has its own permission, off until you turn it on. Only you see it. No AI draws it or reads it, it's never used for matching, and it's never shared. You can delete it at any time, and turning the permission off deletes it. If you choose to, you can use a picture of it as your photo (You -> Your photo, since 2026-10-03): the app draws that picture on your phone and it becomes your profile photo, under that permission below, seen only by the people you connect with. The choices it is built from are never sent with it.

Your avatar in a shared room (since version 2026-10-04.4). In a shared room on a headset or the web preview, you can turn on "Show my avatar to <name> in this room". Then the other person sees your figure wearing your look (skin, hair, top and extras; never your gender) for as long as that room lasts. It starts off every time, it lasts for that one room only, and nothing about it is stored by the room: your look is passed to the other person's device and kept nowhere. Off, they see a plain figure that says nothing about you.

Optional: A photo of you, shown to the people you connect with

One photo of you that you choose (You -> Your photo). It takes the place of the plain silhouette next to your name, on the screens of the people you're connected with: your linked partner; each person you connected with by code, a hobby buddy included; and, in an introduction you said yes to, the other friend, once it has opened (not the friend who introduced you). Nobody else ever sees it: never a stranger, never anyone through matching. It is never in matching data, never used for matching, and no AI looks at it. The app is never told anyone's account to fetch it: each screen asks for "the other person here", and the server answers only if you're connected, the permission is on and the account isn't suspended, and the same "not found" otherwise. We keep the photo itself (checked to be a real JPEG or PNG, at most 5 MB; the app sends a square about 512 pixels across), a fingerprint of it, and when you chose it. It's kept on our server like your other photos, it's in your export, and you can change or remove it at any time. It has its own permission, off until you turn it on, asked on that page the first time. Turning it off deletes the photo, and everyone sees the plain silhouette again; deleting your account deletes it too. (Version 2026-10-01.1 added this permission.) The photo can also be a picture of your avatar (above), drawn on your phone when you choose it. Saving a copy of your own photos to your phone ("Save to Photos") stays on your phone: nothing is sent to us, and the app asks only to add to your photo library, never to read it.

Optional: Pictures from BrainMatch spaces

Inside a BrainMatch space (the made-up settings you can visit on a Meta Quest headset or in a web browser on a computer, such as a corner cafe or a rooftop at dusk) you can take a picture and keep it in your journal. A picture is the made-up setting and your own avatar, drawn by the app: never the real room around you and never a camera image. We keep the picture itself (checked to be a real JPEG or PNG, at most 2 MB and 1600 pixels on its longest side), a fingerprint of it, which setting it was taken in, the day, a caption if you add one (at most 140 characters), when it was saved, and whether you shared it. It shows in your journal on your phone too, with no headset needed, and you can save a copy to your phone, file it in one of your events, or delete it. Only you see your pictures, unless you're linked with a partner and share a particular one (off for each picture until you turn it on, and you can turn it off again); then your partner sees that one in their journal, marked as from you, and can report it. Nobody else ever sees them. They are never used for matching, never in matching data or the research export, never analysed, and no AI looks at them. They're kept on our server like your other photos, are in your backups and your export, and go when you delete your account. It has its own permission, off until you turn it on, asked the first time you save a picture. Turning it off deletes every picture you took in a space, files included, and any you shared stop showing to your partner. (Version 2026-10-04.3 added this permission.) A line you write in your journal while inside a space is ordinary writing, under the writing permission, with the setting's name kept beside it so the journal can say where it was written.

Optional: Connecting by code

You can have a code of your own (a QR on the You tab, separate from your Tell-a-friend code) to show someone in person. Only the BrainMatch app can read it, and you can replace it with a new one at any time. When someone scans it, each of you says why, on your own phone: plan a date, share a hobby, or you're in a relationship. Nothing is set up until you both picked the same thing; until then you both see only "You've connected. Nothing's set up yet.", and neither of you is ever told what the other picked. What we store, under this permission:

• Your code, and each connection: the two accounts, what each of you picked, when it was made and last used.
• Share a hobby ("Alongside"): one short hobby tag each, and the small posts you each add about it. The two of you see one list; there is no chat and no reply thread. No AI reads these posts. Before a tag, a post or a playlist song is saved, fixed word lists (no AI) check it on your phone and on our server: insults, sexual words, threats, slurs, contact details and private things like health or religion can't go on it. Report is beside each of the other person's posts, their tag and their songs, and on the person (see "Reports" below).
• Plan a date: which of your Taste picks you chose to show that one person. Each pick has its own switch, off until you turn it on, and they see only what you switch on. From those, the app shows one thing you both picked (never how many, never a score), a kind of place from the bucket-list kinds, and one fixed question for the walk home. It predicts nothing. While a plan-a-date connection is open, the app asks you once a day "Still good?" (yes, not sure, or end this); your answer is yours and is never shown to them. A short first-date note (meet somewhere public, tell a friend, keep your own way home) is shown once. A date playlist: a song each of you adds (title and artist, typed in), on one list you both see while the date is set up. Nobody is told when one is added, you can take off only your own, and it's deleted with the connection (your own songs are kept for you; see "Ending and blocking").
• "You're in a relationship" hands you to the ordinary partner link, described above.
• Ending and blocking: either of you can end a connection at any time, with no reason asked; the app names what goes before you confirm. It ends for both of you at once, the shared list under it is deleted, and the other person sees only "This connection has ended." Blocking does the same and also keeps that person's account id so their code can never connect to yours again, in either direction. A scan nobody set anything up on (no reason picked, or the two never matched) closes itself after 14 days untouched; **a date or hobby that's set up never closes on its own.**
• Your own words are kept when a connection ends, however it ends (you end it, they end or block it, they turn this permission off or delete their account): the songs you added, your date idea, your hobby tag and your posts are copied for you alone, shown in your Journal under Past chapters as "From a connection that ended", in your export (connections.kept), and deleted when you turn this permission off or delete your account. Never their words, never who they were. (Version 2026-09-30.5 added these kept words.)
• Logging a date puts a private note in your own journal (under the writing permission), and a photo if you add one (that day's photo, under "A photo a day"; if that day already has one, the app asks before replacing it). Nobody else sees it: not them, and not a partner.

A partner never sees any of this, none of it is used for matching or in matching data, and turning this off ends every connection you're in and deletes all of it.

Optional: Introductions

You can introduce two friends you think should know each other, with one link you send them yourself, from your phone's own share sheet. BrainMatch never sees who you sent it to, never reads your contacts, and never asks for, or keeps, either friend's name, email or number. What we store, under this permission:

• An introduction you make: the first name you chose for them to see you by, your reason in your own words, when you made it, and when it closes. **Anyone with the link can read your first name and your reason**, so send it only to the two of them, and write only what you'd say with both of them in the room. Your reason is checked by fixed rules (no AI) on your phone and on our server before it's saved: it can't hold insults, sexual words, threats or slurs, mention money, arguing, anyone's looks or past, anything private about them (their health, sexuality, religion, a pregnancy or a loss), or carry a phone number, email, link or handle. The first names you and your friends choose get the same check for insults, sexual words, threats and slurs, and a swapped contact line has to be a number, an email address or an @handle.
• Nothing about either friend is stored until that friend says yes, in the app. Opening the link on the web or in the app stores nothing: no visit, no count, no address. The page's "Become a beta tester" button never carries the link's code, so the beta list is never tied to you.
• If a friend sends you one and you say yes: the first name you choose to show, and when you said yes. Until both friends have said yes, nobody is told anything: the one who made it sees only "Sent. Waiting on them.", whatever either of you did.
• The room for three, once both friends have said yes: each person's own pick in one this or that (nobody's shows until all three have answered); for the two friends only, **a first coffee**: when you're free (a few fixed choices; you see only whether a time suits you both), and a way to reach you only if you choose to swap it, shown to the other friend only while you both have. The one who made the introduction never sees the coffee plan or a swapped contact. "Stay connected" hands the two of you to Connecting by code, under that permission and its rules, only if you both tap it and both have it on.
• No thanks is one tap, on the web page (no account needed) or in the app, and deletes the introduction. Leaving, blocking and reporting: either friend can leave or block at any time, which ends the room; the one who made it can leave (the room carries on for the two of you) or say "That's not who I sent it to", which ends it for everyone. A block keeps the two of you apart from then on. Report, in the room, on the coffee page and before you answer, covers the reason, a name, a swapped contact line or a person (see "Reports" below). Anyone who had said yes is told only "This introduction has closed." or "This introduction has ended.", never who or why.
• It lasts 14 days: a link closes 14 days after it was made unless both friends said yes; a room closes 14 days after anyone last used it.

A partner never sees any of it, none of it is used for matching or in matching data, and nobody earns anything or is counted for making one. Turning this off closes every introduction you made or said yes to, and deletes all of it: a room you made carries on for the two friends, without your words.

Optional: monthly Complementary Report

This switch turns on what you and your partner see about each other, and only this:

• A monthly PDF comparing your personality results with your partner's: your **five trait levels**, in words.
• Your scenario picks, side by side with theirs, and whether each of you guessed the other's. A note you wrote beside a scenario shows only if you shared that note.
• The Taste picks you marked shared, one at a time (each answer's own "Share this one" switch, off unless you turn it on), with the guess each of you made about them. A Taste pick you didn't share never shows, and neither does their guess about it. (Until 3 October 2026 every quick-fire pick showed; now only the ones you share.)
• Date ideas made only from Taste picks you've both shared.
• The "two of you" map and your shared garden, drawn only from answers you each chose to share, and shown as counts of who added to it, never what was said.

And:

• It only works if both of you turn it on.
• Your partner will see your five trait levels in their copy, written as words (for example "Planning ahead" or "Going with the flow"). There are no numbers, scores or percentages in it, and it never ranks one of you against the other.
• It never includes your check-ins or anything you wrote and didn't share.
• It describes your answers. It does not predict whether your relationship will last.
• Nothing is stored for it: it's made when you open it, from answers kept under your other switches. Turning it off stops it for both of you, with the date ideas and garden made with it, and deletes nothing; your answers stay yours.

Megan, and how AI is used

Megan is not an AI. She's a set of written replies picked by simple rules that look at the shape of what you wrote. Nothing you write is sent anywhere to produce them. She can be turned off anywhere.

• Her voice is AI-generated: a text-to-speech voice, recorded in advance from lines the BrainMatch team wrote. It never hears or reads anything you write.
• An AI writes your prompts and insights (since 30 September 2026; the permission "An AI reads your answers to write your prompts and insights", version 2026-09-30.3). To write tonight's question and what each spot on your map means, BrainMatch sends your own written answers to an AI model run by Anthropic (the Claude API). What is sent: your written answers to the daily question and the Monday Mix questions, with the question each one answered: at most eight excerpts of up to 280 characters for one spot's insight, and your last five answers for tonight's question. Only yours: never a partner's, a buddy's or a friend's, and never your name, email or account id. Anthropic processes them under a data-processing agreement and doesn't use them to train its models. What comes back is a short text in plain words: kept with your account, shown to you and no one else, in your export (aiTexts) and deleted with your account. It is written once per spot (again when a new answer lights it) and once per night, at most twenty a day. Whenever no key is set on our server, the model is slow, or its text would break our rules (no numbers about people, no money or conflict, no diagnosis, no brain regions), the human-written version is used and the app says so. This is your choice (since 30 September 2026, later the same day): the switch starts off everywhere, and you turn it on at Join or later in Privacy, or never. Off, nothing of yours is sent to any AI, and tonight's question and what each spot means are written from your own words by fixed rules; on, they're a little more on the money. Turning it off deletes nothing: what the AI already wrote stays in your account and your export, shows again if you turn it back on, and is deleted only with your account. Nothing else you write goes to any AI: not photos, not letters, not notes to a partner, not what the two of you share.
• Matching models: only if you turn on "Help build matching", your pseudonymised answers (under a random id, never your name or email) may be used to train the models behind future matching. Today that means the owner-only research export, analysed on BrainMatch's own computer after the owner downloads it; no outside AI or model service receives it.
• Keep out of AI: a list of whole sections (your journal, day notes, photo captions, Taste, brain answers, letters, things you wrote for the two of you) or single things (one journal day) that the AI above never reads. The server honours it before reading anything; the list is kept with your account, included in your export and deleted with it. (The screen to edit it was taken out of this build's Settings; email us to change yours until it returns.)
• Megan follows up: if something you write in Two things names a day ahead ("interview Thursday", "big day tomorrow"), Megan asks how it went on that day. It's a simple rule that looks only for "tomorrow" or a day's name. Your answer is kept in your journal, under the writing permission, and deleted with it.

Bug reports, suggestions, crash reports and our website forms

• Bug reports you send from the app: what you wrote, which screen you were on, the app's build and your phone type, and, only if you tick "you can reply", your email address. We keep it with your account (deleted with it), and email a copy to our inbox so we can fix it.
• Suggestions you send from "Suggest something": what you wrote, the app's build and your phone type, and, only if you tick "you can email me about it", your email address. Kept with your account (deleted with it, and in your export, with the status we gave it: new, planned, done or no), and emailed to our inbox the same way as a bug report.
• "Something my partner sent": if your partner sends you something that isn't ok, you can tell us from the report screen or from Settings. It's kept and emailed exactly like a suggestion, marked so we read it first. A person reads it, never a machine, and nothing you write there is ever used for anything else. **Your partner is never told you wrote it and never sees it.** If you'd like the link with them ended, say so and we'll end it; you can also end it yourself at any time (see "Your choices").
• Reports (Apple asks every app where people's words reach each other for this). Wherever someone else's words reach you (an introduction, a list you share with someone you connected with by code, something a partner sent, something a friend sent for your journal), Report is there, beside Block, for the words or for the person. A report keeps: who reported, **whose words they were** (worked out by our server from what was reported, never typed by you), what kind of thing it was and where (the introduction's code, the connection or the friendship), the words as you saw them, anything you add, when, and what we did about it. The words are copied into the report so that a block, a leave or a deleted post afterwards doesn't erase what we need to read; a photo a friend sent is copied the same way, kept only for the person who reads the report, and deleted with it. It's emailed to our inbox, and it's on the owner's own list of reports even when email isn't working. **A person reads every report within 24 hours, never a machine.** When something breaks the Terms, we remove it, and we can suspend or close the account that sent it: a suspended account can still export or delete its data, and what it wrote is hidden from everyone else until the suspension is lifted. The person you report is never told who reported them, and never sees your report. Reporting doesn't end anything by itself; Block, on the same screen, does.
• Reports about you: if someone reports your words, the report keeps them, and your account id, as above. Your export shows reports about you (what, the words, when, what we did), never who made them or what they said. Reports are kept on our legitimate interest in keeping BrainMatch safe, not under a permission of their own, so switching a permission off doesn't delete a report made under it. If you delete your account, reports you made keep the words that were reported but lose anything you added, and reports about you lose your account id.
• Counting, not tracking: brainmatch.app uses no analytics service, no pixels and no advertising cookies. We count, on our own server, how many times each page of our site was opened each day and which site the browser said it came from (its domain only, such as a search engine, never the full address), and how many different visitors there were that day: for that, each visit is turned into a code made from the day, the connection and the browser with a secret; the connection and browser are never kept, and the code can't be turned back into either or matched across days. We also count how many times a shared this-or-that link was opened each day, how many times a page of our site was opened from each printed QR code (a poster, a card), how many times the public question of the day (brainmatch.app/q/today) was opened and how many taps each of its two sides got, and how many beta sign-ups came through which page of our site or which friend's code. These are daily totals with nobody in them: no address, no name, no id is kept with a count.
• Crash reports: if the app crashes, it sends what went wrong (with anything that looks like an email, a code, a number or a sentence removed), the screen, the app version, your phone type and a random id made only for crash reports. They're not linked to your account and are deleted after 90 days. The first report of each crash each day is emailed to us.
• The beta and investor forms on brainmatch.app: what you type in (name, email, and your answers or message). It's emailed to us, we send you one welcome email, and the form entry is deleted automatically after 12 months, or sooner if you ask. On the beta form you can also tick "I have a Meta Quest and I'd like to try the headset version too" and, if you like, say which headset; we keep that with your sign-up only to invite you to the headset version's early preview, and it's deleted with the rest of the entry (email us any time).
• Our inbox (currently Gmail, run by Google) is where these copies arrive, along with alerts about the service. Emails there aren't deleted automatically; ask and we'll delete yours.

The newsletter

If you give us your email for the newsletter on brainmatch.app, we send one confirmation email, and you're on the list only once you tap the link in it. An address that's never confirmed is deleted after 7 days. Every issue carries a one-click unsubscribe link and our postal address; an unsubscribed address is deleted within 30 days. The list is its own thing: email only, kept apart from the app and never linked to an app account, even if you added the same address in the app, and never used for sign-in or matching. Issues are sent through Resend. We never sell or share the list.

Where your data is

BrainMatch's server is moving to Cloudflare, in the United States, in October 2026. Until the day of the move, which we announce in the app, everything below is held on one computer that Turing Creative LLC controls, in the United States, exactly as before; from that day, this is where it is. In plain terms:

• Your account, answers, journal and everything else you write are in one database held by Cloudflare in a "Durable Object", a kind of storage Cloudflare lets us restrict to the United States. We chose that restriction when we set it up; it can't be changed later.
• The photos you add (Moments, your photo a day) and the files of each encrypted backup are in Cloudflare's R2 storage, which isn't open to the public: photos are served only through the app, after sign-in.
• Cloudflare is our processor. It handles this data only to run BrainMatch for us, under the data-processing addendum named in "Who it's shared with". Like any company that hosts data for someone else, its systems and staff can technically reach what is stored on them. The few especially personal Rooms answers (money and security, family and roots, health and energy) are also stored encrypted with their own key, but the app needs that key to show them to you, so it is kept with the server's secret settings on Cloudflare too.
• A copy comes home. Every few hours an encrypted copy of the database and your photos is taken on Cloudflare, sealed with a public key so that Cloudflare cannot open it, and brought to BrainMatch's own computer, where it is checked, locked again with a key only the owner holds and kept (see "Backups" below). That way a billing problem or a locked account at a provider can cost us availability but never your data.
• Where it ran before: until the move to Cloudflare the server ran on BrainMatch's own computer. For up to 30 days after the move that computer keeps its old copy as a way back; then the old copy is wiped, and the computer keeps only the encrypted backups.

Security and backups

• Signing in: we store only a scrambled form (a hash) of each phone's sign-in, never the sign-in itself. A phone that hasn't used BrainMatch for 180 days is signed out and has to sign in again; phones in use are never affected. Signing in on a computer lasts up to 30 days.
• Limits on repeated tries use your internet address, held in memory only and forgotten within a day. The one exception is the lock after twenty wrong sign-in attempts in a row from one address: that is kept as a scrambled code in place of the address, with the time, for fifteen minutes at most, so a restart of our server can't lift the lock early.
• A security log records when the owner-only tools were used (pulling matching data, the sign-up list, the owner's dashboard), with a scrambled code in place of the internet address, and a few internal events. It holds no answers. One kind of entry, that we emailed you your own personality PDF, carries your random account id so the app can show it was sent. The log is built so that nobody, including us, can edit or delete an entry for 12 months; after that it's deleted automatically. Once your account is deleted, that random id links to nothing.
• Backups: the database and photos are copied every 6 hours into encrypted backups (AES-256), each kept for 35 days: first on Cloudflare in a private store, then brought to BrainMatch's own computer (and an encrypted copy in the owner's cloud drive), as set out in "Where your data is". If we ever restore one, accounts deleted since it was made are deleted again before it's used. Data removed by switching a permission off, or a single entry you deleted, isn't yet re-applied automatically after a restore.
• Cloudflare's own history: besides our backups, Cloudflare keeps a change history of the database that lets us rewind it to any moment in the last 30 days. If you delete your account, what you deleted can therefore still sit in that history for up to 30 days, and in our encrypted backups for up to 35, after which it's gone. A list of accounts deleted is kept so that if we ever rewind or restore, you're deleted again before anything is used.

How long we keep things

• Your account and everything in it: until you delete it. We don't delete accounts for being inactive, so if you stop using BrainMatch, delete your account (or email us) to have it removed.
• Anything under a permission: until you switch that permission off or delete your account.
• Past chapters: until you delete your copy of a chapter, or your account.
• Sign-in codes: 15 minutes. Couple invite codes: 7 days, or until used.
• Heartbeats: until seen, or 30 days. Good nights: 30 days. Your next date: until the day after it. Ask-your-friends links: 7 days.
• Time zone offset: only while long-distance mode is on.
• Connections by code: until either of you ends it; a scan nothing was set up on, 14 days after both of you last touched it. Your own words from one that ended: until you turn Connecting by code off or delete your account. The "this connection has ended" line: until you tap it away.
• Introductions: a link, until someone says no thanks, it's closed, or 14 days after it was made; a room for three, until someone leaves or 14 days after anyone last touched it. The 'this introduction has closed' line: until you tap it away.
• Friends: a friend code, until someone says yes or no to it, you close it, or 14 days after it was made; a friendship, and anything waiting in it, until one of you ends it, blocks or turns Friends off; what you added from a friend, until you delete it, turn Friends off or delete your account.
• Computer sign-ins: 30 days. Phone sign-ins: 180 days without use.
• Crash reports: 90 days. Beta and investor form entries: 12 months.
• Reports: until a person has dealt with it, then 12 months from when it was closed.
• Newsletter: an address never confirmed, 7 days; an unsubscribed one, 30 days; otherwise until you unsubscribe. Daily counts of link opens and sign-ups (nobody in them): 24 months.
• Backups: 35 days. The security log: 12 months (see above).
• Matching and research exports: you're left out of every export made after you turn "Help build matching" off or delete your account; a file made before stays as it was.

Risks

• Some questions about your relationship may feel personal. Every question can be skipped.
• As with any stored data, there's a risk of a breach. We limit it by collecting as little as possible: no names in matching data, no messages, no location, no contacts.

What we collect and what we don't

We collect: your birth year, whether you're single or in a couple, the month your relationship started, your email address, your questionnaire answers, your daily check-ins and state-of-us taps, anything you write in the app (including notes to your partner), and, if you turn them on, the photos you add to Moments, your photo a day, and the pictures you take inside a BrainMatch space. In long-distance mode, your phone's time zone offset (not your location). And the small records described under "Things with no switch of their own", bug reports and suggestions you send, and crash reports.

Your email address is needed to make an account: there's no password, so it's how you get back in on a new phone. When you join we send a six-digit code to it, and the account is made only once you type that code in, so every account has an address that's really yours. If you change it later, the old address keeps signing you in until you confirm the new one with its code; until then we keep the new one alongside it (it's in your export). It is used for signing in, sending you your own PDFs, and replying if you contact us. If you turn on Follow-up, we may also email you about new features and occasional follow-up questions; turning it off stops that. It is never part of matching data, never shared, and never used for advertising. Signing in uses a six-digit code; there's no password to steal.

We never collect: your messages, contacts, location, or what you do in other apps; nothing from your microphone or camera (a live call with your partner, if you join one, goes straight between your two devices or through Cloudflare's relay and is never recorded or kept; see "Live calls with your partner"); and no photos except the ones you choose to add (to Moments, as your photo a day, as your photo, or from a friend), and the pictures you choose to take inside a BrainMatch space, which show only the made-up setting and your avatar, never a camera image. We read nothing from Apple Health, Health Connect, a watch or any other health app or device: no sleep, no steps, no readings of any kind.

Who it's shared with

• We don't sell your data or share it with advertisers or data brokers.
• Service providers process data only on our instructions and only to run BrainMatch: Cloudflare (it runs our server and holds your data, in the United States: Workers run the app's code, a Durable Object holds the database, and R2 storage holds your photos and the encrypted backup files, as set out in "Where your data is"; it also provides the secure connection to our server and serves the pages of this website, and, through Cloudflare Realtime, the relay that carries a live call between two partners when their networks can't connect directly, passing it on encrypted and keeping none of it), Resend (email, like sign-in codes, and the copies of bug reports, crash alerts and form entries sent to us), Expo and Apple or Google (push notifications, if you turn them on; fixed words only), Expo's update service (the app checks it for updates, which shares your phone's internet address and app version with Expo), Apple, Google or, for the Meta Quest app, Meta (app delivery), Google (Gmail, our inbox, where those copies arrive), and Anthropic (the Claude API: your own written answers, to write your nightly question and your spot insights; see "Megan, and how AI is used"). Each of them may use what passes through it only to provide its service to us, under its own data-processing terms, and we'll name the formal agreements here as they're signed. **With Cloudflare** that is its customer data-processing addendum (version 6.4), which its standard terms bring into our agreement and which includes the EU standard contractual clauses and the UK addendum for transfers out of the EU, the EEA and the UK. **Each of these providers is bound to protect your data at least as well as this policy does**: the same or equal protection this policy promises and the app stores require. Our server, your data and these providers are in the United States; if you're outside the US, your data is transferred there, with safeguards we'll name here as they're put in place (for Cloudflare, the clauses above).
• Meta, if you use BrainMatch on a Meta Quest headset. The Quest app runs on Meta's headset and its operating system, comes from Meta's store, and its "Step inside" space is built with Meta's own software (Meta Spatial SDK). **Meta may collect or receive information from the Quest app** under its own terms and its own privacy policy (the Supplemental Meta Platforms Technologies Privacy Policy, meta.com/legal/privacy-policy), not this one: for example that you installed and use the app, how long and how well it runs (performance and crash reports), and what the headset itself senses to work, such as where your head, hands and controllers are. Meta is not one of our service providers and we don't instruct it. The Quest app itself sends what you write, pick or make only to our own server, never to Meta; but if you type with the headset's own keyboard (or speak to it), that keyboard is Meta's and works under Meta's terms.
• Anything reported outside BrainMatch is group-level only, never about an individual.

The owner-only research export

This is how "to match future couples well" happens today. Only the owner can make it, it's logged each time. It's made from the database on Cloudflare, downloaded by the owner and kept on BrainMatch's own computer: it isn't shared with anyone. It never includes test accounts, your email, anything you wrote, your Rooms answers, or your gender and the gender you're looking for. It has two parts:

• Your answers, under your random id, only if "Help build matching" is on: your birth year, whether you're single or in a couple, how you met (if you meet someone here), your questionnaire answers (only questionnaires you sent, never a part-done draft) and your check-ins. Your couple link and when your relationship started are included only when both of you have it on, so nobody is ever joined to a partner who said no.
• Counts across everyone: how many people gave each answer, per question and per month. No ids, no days, and any group of fewer than 10 people is left out.

Turning "Help build matching" off, or deleting your account, leaves you out of every export made after that. An export made before isn't changed.

Help build matching: the trade-off

BrainMatch learns what makes a good match from couples who are already together. Your questionnaire and check-in answers, under a random id rather than your name or email, are the only way it can learn, and it's how the app stays free, with no ads.

• Where the law and the app stores allow it, this is part of using BrainMatch: the switch is on and can't be turned off; if you'd rather not, you can delete your account at any time. We tell you this before you join.
• Where consent must be freely given (the EU/EEA, the UK and Switzerland), it's a plain choice, off until you turn it on, and nothing else in the app depends on it.
• Everywhere else, until that's settled, it's on by default with the reason shown, and the join screen says so, and you can turn it off, there or later in Privacy. Turning it off stops your answers being used to build matching from then on: you're left out of every matching export made after that. Nothing is deleted, because the same answers are your own record; an export made before stays as it was.

Which of these applies is decided once, by the country your internet connection comes from when you join (we don't collect your location, and we keep only which of the three applies, not the country), and the app tells you which. It stays with your account: travelling or using a VPN later never changes it, and a later change to where it applies only affects people who join after. If the country can't be told, it's the plain choice, off until you turn it on.

Your choices

• Every kind of data is its own switch under Privacy. Turning one off stops collection and deletes what we already have of that kind, after the app has named what goes (a "no" to a switch that was already off deletes nothing more). Three switches store nothing of their own, so turning them off stops something and deletes nothing, and the app says so: the **Monthly Complementary Report (it stops for both of you), Help build matching** (you're left out of matching exports from then on) and Follow-up (we won't email you about new features or follow-up questions), and An AI reads your answers (nothing more of yours is sent; what the AI already wrote stays, and goes only with your account). One switch is part of using BrainMatch and can't be turned off on its own: Join BrainMatch; the way off it is deleting your account.
• Unlink from your partner (Privacy) ends the link between your two accounts. It ends it for both of you, straight away: everything that took the two of you (notes, thinking of you, the state of us, the Complementary Report, Moments and the shared list) stops for both. It deletes nothing either of you wrote: your check-ins, journal, questionnaires and photos stay with you, and theirs stay with them. **Each of you keeps your own copy of what you shared, and deleting your copy never deletes theirs** (see "If you unlink"). Your partner sees that the link has ended, and nothing else; nobody is told who unlinked. Either of you can link with someone new afterwards.
• Delete my account and data removes your account and everything in it at once, and the encrypted backups that still hold it age out within 35 days. Your partner's data stays unless they delete theirs too, including their own copy of what the two of you shared.
• Show everything you store about me shows your full record at any time: your email and whether it's confirmed, your couple link and relationship start, your settings, what you've written and tapped, nudges and appreciations, where you're signed in, and a list of your photos (each photo can be downloaded in the app, or email us for a copy of them all). It never includes anything your partner hasn't shared with you.
• You can also email [email protected] to have everything deleted.

Your rights

Wherever you live, you can:

• see everything we keep about you (Privacy → Export), and get it in a portable format;
• correct anything that's wrong: most things you can edit yourself, and for anything else, email us;
• delete any kind of data (turn its switch off) or everything (Delete my account);
• withdraw consent at any time, for any switch, without affecting anything done before;
• object to or ask us to restrict any use of your data, by emailing us.

We answer requests within one month. If you're in the EU, the UK or elsewhere with a data protection authority, you can also complain to it. We don't make decisions about you by automated means that have legal or similarly significant effects. The rights Washington, Nevada and Connecticut give you over health-related data (your mood check-in and the like) are the same ones listed above; brainmatch.app/health-privacy says what changed on 24 September 2026.

Contact: Turing Creative LLC, [email protected]. BrainMatch is not offered in the EU or the UK yet; before it is, our EU and UK representative will be named here. More help: brainmatch.app/support · Terms: brainmatch.app/terms.

Agreeing

By tapping Join BrainMatch, you confirm that you're 18 or older, have read this, and agree to BrainMatch using your data as described above. Join also asks you to tick that you agree to the Terms of Use and this privacy policy; we keep which version of the Terms you agreed to, and when, with your account (in your export). If the Terms change in a way that matters, the app asks you once before the change applies.

If you sign up as a beta tester

The form on the beta testers page collects your first name, email, whether you're single or in a relationship, your phone type, whether a partner would join, whether you have a Meta Quest and would like to try the headset version (and, if you pick one, which headset), and anything you choose to tell us. Turing Creative LLC uses it only to invite you to the beta and to tell you when BrainMatch launches; the Meta Quest answer is used only to invite you to the headset version's early preview. It is kept apart from the app's data and never shared. Email [email protected] and we'll delete it.