Privacy & your choices

Policy version 2026-11-07-v3. Operator: Lucas Zarzeczny. Contact: Lucas.Zarzeczny@gmail.com.

What this beta stores

Your account name and handle, password hash and session records; accepted friends and couple relationships; groups, invitations, plans, attendance, chat messages, original writing, shared drawings, reports, library entries and playback state. The server does not need an email address, contacts upload, advertising ID, GPS coordinates. Together Rooms optionally use camera, microphone and screen capture only after explicit action. Befrendle does not record these streams. Other participants may record independently. In peer-to-peer mode, participants can learn each other’s network addresses; an operator can configure relay-only mode. LiveKit is server-mediated and is not end-to-end encrypted by this implementation.

Phone verification

Verifying a phone is optional, and needed only to meet new people (Discover, Events, Clubs) or to receive host payouts. We keep a keyed hash of the number (so one number verifies one account, and numbers of suspended accounts can be blocked) and its last two digits for display. The full number is kept only until the code is checked, then deleted. When the operator configures Twilio Verify, Twilio receives the number to send and check the code. Other members see only a verified badge, never your number. You can remove your number in You at any time; Discover then turns off.

Events and clubs

A public event or club is visible to signed-in members, with its title, description, host name, time and, for in-person events, an approximate area. The exact meeting place and links are shown only to people who are going. Club members can see the club's member list and chat. Joining makes you a participant like any plan: the host and other people going can see your name.

Payments and payouts

Memberships and tickets, when the operator enables them, are processed by Stripe. Befrendle stores the plan, ticket and payment references, not card details. Hosts who sell tickets set up payouts with Stripe Connect; Stripe collects their identity and bank details, and Befrendle stores only the account reference, its status and an earnings record for each ticket (price, fee, what the host keeps, refunds). Buyers' names are visible to the host of an event they bought a ticket for.

Moderation

Staff named by the operator can review reports, approve profile photos, suspend accounts, and pause or remove clubs and events. They see the reported content and the accounts involved. Every decision is logged with the staff member's handle.

Optional recommendations

You may choose interest tags, your city or town, approximate travel range, time zone and broad availability, languages you wish to socialize in, activity mode, cost and group-size preferences. We use the centre of the city you pick, not your device location. City search runs on this server, so what you type isn't sent to a map company. City names come from GeoNames (geonames.org), licensed under Creative Commons Attribution 4.0. Discovery is off until you turn it on. Other opted-in people can see your name, handle, bio, area label and interests. Availability details and Social Style answers/scores are private.

The original optional Social Style questionnaire is not scientifically validated and makes no diagnosis. Using its scores for suggestions is a separate opt-in. Learning from Helpful/Not for me feedback is a separate opt-in too, and requires both people’s consent. It does not read your conversations, infer health or protected traits, or sell your data. Couple ranking is rules-based and respects all four people’s choices.

Chats

Messages, photos, voice notes, reactions and replies are stored on this server and shown only to the people in the conversation. “Typing…” is passed along live and never stored. Read receipts (“Seen”) are on by default; you can turn them off on your profile page, and then you don't see other people's either. Pins and archived chats are only for you.

After a hangout

After a plan, you can answer privately whether you'd hang out with each person again, or say they didn't come. Nobody else ever sees your answers, including the person you answered about. They shape your own suggestions. Taken together over 90 days, they can lower how often someone who keeps not coming is suggested, and show the safety team a count when several people wouldn't meet someone again. The count never says who answered.

Signing in with a passkey, Apple or Google

A passkey uses your phone's or computer's own lock: Face ID, a fingerprint or its PIN. We keep only its public key, a name for it (like "iPhone") and when it was added and last used; your face and fingerprint never leave your device. If you sign in with Apple or Google, we keep the ID they give us for you and the email address they share (Apple may share a private relay address instead), never their password or tokens, and nothing else from your Apple or Google account. You can unlink them, or remove a passkey, from your profile.

Sharing a plan with someone you trust

If you're going to an in-person plan, you can make a private link for someone you trust. Whoever has the link sees the plan's title, time, place, the host's first name, the first names of the people going, and whether you've said you're home safe. It needs no account, stops working 12 hours after the plan ends, and you can turn it off any time. We don't record who opens it.

Optional music and browser connections

Spotify authorization tokens are encrypted in this server’s database with an operator-managed key. They are not used for friend recommendations. Disconnecting removes local credentials; revoke the app in provider settings as well. Apple Music authorization is handled by MusicKit on your device. A remote-browser server processes the browser session and can access its cookies and credentials. Host setup is private from guests until broadcast, not private from the server operator. Browser rooms are disposable, expire after four hours, and require healthy lease enforcement and verified container deletion. The application does not promise that protected subscription media can be captured.

Who receives information

The operator hosts this server. Twilio receives your phone number to send and check a verification code when the operator configures it. Stripe processes payments and host payouts when the operator enables them. Authorized participants receive their shared content. Third-party catalogues receive only user-initiated searches. External media hosts can receive IP addresses and request metadata when your device plays their media. External watch-party and streaming links open those services under their own terms. Their availability, privacy and subscription requirements are not controlled by Befrendle.

Retention and deletion

Your account content remains until you delete it. Discovery preferences and the questionnaire can be erased independently. Recommendation examples expire after 90 days and are deleted when either person withdraws consent or deletes their account; an affected trained model is disabled pending retraining. Recovery codes are stored only as hashes. Sessions expire within seven days or when revoked. Reports involving a deleted account are removed from the live database. Operational moderation logs expire after 90 days. Local migration backups are NOT encrypted automatically. Before a public launch, the operator must configure encrypted backups with a rolling maximum 30-day retention and must not restore erased personal data to an active service.

Self-hosted installations must run the documented maintenance task daily, define access-log retention and configure their actual hosting-provider disclosures before launch. This page describes the shipped code; operator-specific hosting arrangements must be added.

Your controls

Export your account from You → Privacy & safety. Delete it there or through the website deletion page. Turning off discovery does not remove your established friendships. Removing a shared couple profile does not delete your partner’s personal account. Contact Lucas.Zarzeczny@gmail.com for access or deletion questions; support does not need your password.