privacy policy

1. what we collect

data from x (twitter)

when you sign in with your x account via oauth 2.0, we access and store:

• your x profile information (display name, bio, profile image)
• your recent tweets and retweets
• your liked posts
• your follower and following counts

this data is refreshed weekly to keep your personality profile current. we do not post to your x account or follow/unfollow anyone on your behalf.

data from larry (our ai)

larry is your matchmaker. when you chat with larry, we store:

• your chat messages and larry's responses
• preferences and information you share during conversation (e.g., interests, what you're looking for, relationship goals)
• your relationship preferences as determined by larry from your conversation

photos

photos you upload for your profile are stored securely. no explicit or nude content is permitted on profile pictures.

selfie verification (biometric data)

during onboarding, you may be asked to take a selfie to verify your identity. this selfie is compared to your uploaded profile photos using ai to confirm you are the same person.

• what we process: facial geometry from your selfie is compared against your profile photos. this may constitute biometric data under certain state laws (illinois bipa, texas cubi, washington biometric law).
• purpose: to prevent catfishing and verify that your profile photos depict you.
• storage: your selfie image is processed in real-time and is not permanently stored. after comparison, the selfie is discarded. we retain only a cryptographic hash of your verified photos to detect future changes.
• consent: you will be asked for explicit consent before the selfie is captured. selfie verification is optional; you may skip it, though your profile will not display a verified badge.
• re-verification: if you change your profile photos after verification, we automatically compare your new photos against your existing verified photos using the same facial comparison technology. no new selfie is required unless the system cannot confirm you are the same person.
• retention schedule: selfie images are deleted immediately after processing. photo hashes are deleted when you delete your account or remove verification.

date of birth

we collect your date of birth during onboarding to verify you are at least 18 years old and to display your age to potential matches. your full date of birth is stored but only your calculated age is shown to other users.

location

if you choose to share your location, we use it to find matches near you. location sharing is optional. when provided, we use reverse geocoding to confirm your general area (city-level) rather than storing precise coordinates.

email

we collect your email address via clerk (our authentication provider) for account verification and essential communications only.

payment information

subscription payments are processed by stripe. we never see or store your full card number. stripe handles all payment data under their own privacy policy.

2. how we use your data

ai personality analysis

your x activity (tweets, likes, bio) is analyzed by ai to build a personality profile used for matching.

your ai bio is private. it is never shown to other users. it exists only to power matching. other users cannot see your personality analysis, your x activity, or any ai-generated content about you.

larry chat

conversations with larry are powered by ai. larry uses your chat history to understand your preferences and provide personalized matchmaking.

matching

we use ai to generate mathematical representations of your personality and preferences, which are used to find compatible matches.

3. special category data (gdpr article 9)

larry may optionally infer information about your attraction preferences and sexuality based on your conversations and x activity. this is considered special category data under gdpr.

• consent is optional and granular. you are never required to provide or confirm attraction data. larry will ask for explicit consent before processing this information.
• this data is never shown to other users. attraction preferences are used internally for matching only.
• our legal basis for processing this data is explicit consent under gdpr article 9(2)(a). you can withdraw consent at any time.

4. data sharing

we do not sell your personal data. we do not share it with advertisers. we share data only with service providers necessary to run larry match:

• google cloud platform — hosting, database, and ai processing. data processed in the united states.
• ai service providers — personality analysis from x activity.
• clerk — authentication and session management. handles x oauth flow and session cookies.
• stripe — payment processing for subscriptions. stripe stores payment methods under their own privacy policy.
• vercel — frontend hosting and cdn.

5. data retention

• active accounts: your data is kept as long as your account is active. x data is refreshed weekly and previous snapshots are replaced, not accumulated.
• x oauth revocation:if you revoke larry match's access in your x settings, we delete all x-sourced data within 24 hours per x platform policy.
• account deletion: when you delete your account, all personal data (profile, chat history, ai data, photos, ai bio) is permanently deleted.
• backups: data may persist in encrypted backups for up to 30 days after deletion, after which it is purged.

6. cookies

we use only essential cookies required for authentication (clerk session cookies). we do not use tracking cookies, analytics cookies, or advertising cookies.

7. your rights

you have the right to:

• access — request a copy of all personal data we hold about you
• rectification — correct inaccurate data (talk to larry to update your profile, or contact us)
• deletion — delete your account and all associated data
• data portability — receive your data in a machine-readable format
• withdraw consent — withdraw consent for special category data processing at any time without affecting your account
• object — object to processing based on legitimate interest
• lodge a complaint — file a complaint with your local data protection authority

to exercise any of these rights, contact us at privacy@larrymatch.com. we will respond within 30 days.

8. automated decision-making

larry match uses ai to make automated decisions that affect your experience, including:

• generating your personality profile from x activity
• calculating compatibility scores between users
• selecting which potential matches to present to you

under gdpr article 22, you have the right to:

• request information about the logic involved in automated decisions
• request human review of any matching decision
• express your point of view and contest decisions

to exercise these rights, contact us at privacy@larrymatch.com.

9. age restriction

larry match is for adults only. you must be at least 18 years old to create an account. we verify your age through date of birth collection during onboarding. we do not knowingly collect data from anyone under 18. if we discover an underage user, their account and data will be deleted immediately.

in compliance with the children's online privacy protection act (coppa), we do not knowingly collect, use, or disclose personal information from children under 13. if a parent or guardian becomes aware that their child has provided us with personal information, please contact us at privacy@larrymatch.com and we will delete such information promptly.

10. geographic restrictions

larry match is not available in countries where lgbtq+ individuals face criminal penalties, including imprisonment or death. we maintain a list of restricted countries and block account creation from these jurisdictions to protect user safety. this list is reviewed periodically based on reports from ilga world and similar organizations.

11. security

all data is encrypted in transit (tls) and at rest. ai processing happens server-side only. your x handle is hidden from other users until you mutually match. we use google cloud's security infrastructure including iam, secret manager, and encryption at rest.

12. data breach notification

in the event of a data breach affecting your personal information, we will:

• notify affected users via email within 72 hours of becoming aware of the breach, as required by gdpr article 33
• notify relevant supervisory authorities as required by applicable law
• comply with state-specific breach notification requirements, including those in california, illinois, new york, and all other applicable jurisdictions
• provide information about what data was affected, what steps we are taking, and what you can do to protect yourself

13. changes to this policy

we may update this policy as larry match evolves. significant changes will be communicated through the app. continued use after changes constitutes acceptance.

contact

questions about this policy? reach us at privacy@larrymatch.com.