Privacy Policy

BeyondSwipe ("we", "us", or "our") is operated by 15748666 Canada Inc., a company incorporated in Canada. Our registered address is on file with Corporations Canada. For privacy inquiries, contact us at privacy@beyondswipe.app.

We are subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector (Law 25 / Bill 64).

2.1 Information you provide directly

• Account information: email address, first name, date of birth, gender, and sexual orientation.
• Profile information: photos, video introduction, biography, height, job title, education level, and pronouns (all optional except photos).
• Interest selections: the interests you choose during onboarding (used for compatibility matching).
• Messages: the content of messages you send to other users.
• Location: the New York City borough you choose during onboarding, which is shown on your profile as your city. Your account also stores the jurisdiction code that borough belongs to, US-NY, which is never shown on your profile and is used to decide where BeyondSwipe is available. Accounts created earlier may hold a state or province that was chosen directly at the time. We do not collect precise GPS coordinates, and we do not confirm where you actually live.

2.2 Identity verification and biometric information

We require all users to verify their real identity through Didit, our identity verification provider. During this process, Didit captures your government-issued photo ID and a live selfie, and processes biometric information (facial geometry) derived from both for the sole purpose of confirming that you are the person shown on the document.

Your identification document and selfie are transmitted directly to Didit. They are never received by, transmitted through, or stored on BeyondSwipe's systems. When we create the verification session, we send Didit the date of birth you entered so it can compare that exact date with the date printed on your document. Didit is capable of returning to us the images themselves and the personal details it reads from your document, such as your legal name, document number and address. Our verification is configured to return none of them. We request exactly one extracted value: the date of birth on your document, which we read transiently to confirm you are 18 or older and that it exactly matches your declared date. The extracted value is immediately discarded. It is not stored, not logged, and not linked to your profile. We retain only the date you entered, or the corrected date you submit after a mismatch. Beyond that check, what we receive is a session reference, warning codes needed to explain a refusal, and the verification result. Warning codes do not contain or retain the expected or extracted dates. If a date of birth cannot be read from your document, verification does not complete and you will need to contact support.

Deletion. Immediately after a verification resolves, whether it passed or failed, our system instructs Didit to delete the verification session and its associated document, selfie, and extracted feature data. Didit has confirmed to us in writing that this call is a permanent erasure carried out immediately, including backup and other residual copies, and that a deleted session is not brought back by a system restore. What remains afterwards is an entry in Didit's audit log recording that the deletion happened, which Didit keeps for 365 days; that entry is a record of the erasure and not a copy of your data. Because no image is ever returned to us in the first place, no BeyondSwipe personnel is able to retrieve or view your identity document at any point, before or after verification completes.

Biometric data. The biometric identifiers used to match your selfie to your document are never disclosed to us; we receive only the outcome of the match. Our Didit account is set to a one month retention period, the shortest the platform offers, and we have deliberately not enabled Didit's optional biometric template retention, which is the setting that would keep a face template for matching against later sign-ups. Didit's published Verification Privacy Notice says a template is kept only if a customer opts in to it, and we have not. Deletion still happens on Didit's systems rather than ours, so what we can tell you is how our account is configured, what Didit publishes and what Didit has told us in writing, not the result of our own audit. Didit's published policy reserves the option to anonymise or de-identify data rather than erase it, so we asked which one applies to our account. Didit has confirmed to us in writing that at the end of our retention period the data is deleted, and that this means deletion rather than anonymisation or de-identification. You may withdraw consent to that retention at any time by writing to privacy@beyondswipe.app, after which we will instruct Didit to delete it.

Consent. We give you written notice of this biometric processing, its specific purpose, and its retention period before any capture takes place, and we proceed only with your consent. You may decline, in which case you will not be able to complete verification. We do not sell, lease, trade, or otherwise profit from biometric information, and we do not disclose it to third parties.

What we retain. The complete record we hold in relation to your verification is: a verification session reference, the declared date used for that session, the verification outcome, non-identifying warning codes needed to explain that outcome, and the date it completed. We do not retain the date extracted from your document. Didit stores verification data in the European Union, described further in Section 9, and its own privacy practices are governed by the Didit Privacy Policy. See also our How Verification Works page.

2.3 Payment information

We do not store credit card numbers or payment details, and they are never transmitted through or held on our systems. Payment processing is handled entirely by our payment provider. We retain only a transaction reference, the amount, and the date, for billing and fraud prevention purposes.

2.4 Technical data collected automatically

• Log data: IP address, browser type and version, pages visited, timestamps, and referring URLs.
• Device information: operating system, screen resolution, and device type.
• Cookies and similar technologies: session cookies for authentication and analytics cookies (see Section 6).

Video intros and voice recordings are screened before they are published. Still frames sampled from a video are checked by AWS Rekognition, the same service used for photographs. Voice recordings are transcribed by AWS Transcribe and the resulting text is checked for prohibited content by the Anthropic Claude API; this screens what is said and does not analyse non-speech sound. Recordings are held by the screening services only for the duration of the check and are deleted immediately afterwards, and an upload is refused entirely if screening cannot run.

2.5 Content moderation data

Photos you upload are automatically screened before they are published: by AWS Rekognition for prohibited content, and by Microsoft PhotoDNA against industry databases of known child sexual abuse material. Both run on our servers before an image is stored, and an upload is refused entirely if either check cannot run. PhotoDNA receives only a mathematical hash, which cannot be reversed into an image, so no photograph of any member is transmitted to it. The scan produces a classification result; the raw image is not retained by the screening services beyond the duration of the scan. Suspected child sexual abuse material is reported to the Canadian Centre for Child Protection through Cybertip.ca, the agency designated under Canadian law for a service operated from Canada, and to police where we have reasonable grounds to believe our service has been used to commit an offence.

We use your personal information for the following purposes, each grounded in a lawful basis:

• Providing the service (contract): Creating your account, showing your profile to potential matches, enabling messaging, and processing verification and payments.
• Safety and fraud prevention (legitimate interest / legal obligation): Verifying real identity, detecting spam and fake accounts, screening content for abuse, and responding to reports of misconduct.
• Improving the platform (legitimate interest): Analysing aggregate usage patterns to improve features and user experience. We use PostHog for privacy-friendly analytics.
• Legal compliance (legal obligation): Retaining records as required by Canadian law, responding to lawful government requests, and cooperating with law enforcement investigations involving CSAM or other serious harm.
• Communications (consent / contract): Sending emails about your account via Resend: account confirmations, match notifications, and reminders while you finish signing up or finish your profile. We send at most seven reminders of each kind, they stop as soon as you finish or unsubscribe, and every one has an unsubscribe link. We do not send other marketing emails without your explicit opt-in.
• Content screening (contract): We use AWS Transcribe to produce a transcript of a voice recording, and the Anthropic Claude API to check that transcript for prohibited content. This applies to a profile voice prompt before it is published and to a voice note in a chat before it is sent, so the transcript of a voice note you send to a match is checked this way. We send the transcript of that one recording and nothing else: we do not send your typed messages, your profile, or any other recording. The recording itself stays in private storage that only the two people in that conversation can read, and it is served to them through a time-limited link. Neither provider is permitted to use it to train their models. We delete the copy we staged for screening once the check resolves; how long each provider keeps the request on their own systems is governed by their terms rather than ours, and we are documenting those periods.

Electronic messages (CASL). In compliance with Canada's Anti-Spam Legislation, every email we send identifies us, gives our mailing address and contains a working unsubscribe mechanism, and unsubscribe requests take effect within 10 business days. We send reminders to finish signing up or finish your profile because you started an account with us: at most seven of each, and they stop as soon as you finish or unsubscribe. We do not send other marketing emails without your opt-in. Transactional messages about your account, security, or purchases are sent as needed to operate the Service.

We do not sell your personal information. We share data only in these circumstances:

• Other users: Your profile (name, age, photos, bio, interests, city) is visible to other BeyondSwipe members in your area, whether or not they have verified their identity, together with a label saying whether you have. Members who have not verified see a limited number of profiles a day. Messages can be exchanged only once both people have verified. Your email address and date of birth are never shown publicly.
• Service providers (processors): We share data with trusted vendors who process it on our behalf under contractual data processing agreements: Supabase (database, authentication and media storage), Didit (identity and age verification), AWS (image and video-frame moderation, and speech transcription), Microsoft (PhotoDNA hash matching, which receives a mathematical hash and never an image), Anthropic (checking the text of a transcribed voice recording), Resend (email delivery), PostHog (product analytics), Google (website analytics on our public pages, and measuring which Google ads lead to an install of the iOS app, both described in Section 6), Meta (advertising measurement and remarketing on our public pages, and measuring which Facebook and Instagram ads lead to an install of the app, also described in Section 6), and RevenueCat with Apple and Google (purchases and subscriptions). Each provider processes only the data necessary for their function.
• Legal requirements: We may disclose information when required by law, court order, or to protect the safety of users or the public.
• Business transfers: If BeyondSwipe is acquired or merged, your data may be transferred to the successor entity. We will notify you 30 days before any such transfer takes effect.

We retain your personal information for as long as your account is active. If you delete your account:

• Your profile, photos, and messages are permanently deleted within 30 days.
• When you unsend a message, the copy shown to both people is emptied straight away. We keep a copy that neither of you can read for 30 days so that a report made about it has something to point to, and then we delete that too. We keep it longer only while a report about that message is open, or where the law requires it.
• As soon as a verification resolves, pass or fail, we ask Didit to delete the session, and Didit states that this erases it permanently and immediately, including backups. If that request does not succeed, the outstanding deletion is recorded and retried automatically until Didit confirms the session is gone, and if it still cannot be confirmed we are alerted to chase it. The session also falls under the one month retention set on our account.
• Didit also creates a separate account record for you, keyed on the reference we send with each check. Didit has told us it keeps that reference along with profile details such as a name and date of birth read from your document, and that deleting a session does not remove it. We never receive those details. When you delete your BeyondSwipe account we ask Didit to delete your sessions first and then to delete that record, and the same retry and alerting applies to it. Unlike a session it is not covered by the one month retention, so we do not treat the passage of time as evidence that it is gone.
• Payment records are retained for 7 years. Canadian tax rules generally require business records to be kept for six years from the end of the last tax year they relate to; we keep them a year longer as a matter of policy.
• Moderation records about your own account are deleted with your account. Records that form part of a safety report about you are kept under the safety exception below, and child-protection material is handled under the separate rules in our Child Safety Policy.

Backups containing your data are purged on a rolling 90-day cycle.

We use the following types of cookies:

• Strictly necessary cookies: Authentication session cookies that keep you logged in. These cannot be disabled.
• Product analytics, no cookie: PostHog, to understand how the app is used. PostHog runs in cookieless mode: no analytics cookie is set, nothing is persisted in your browser between visits, automatic click and input capture is disabled, and session recording is off.
• Your activity in the app, on our own systems, no cookie: while you are signed in, we record when you open the app, which screens you visit and which buttons you tap, linked to your account and stored by us rather than by an analytics company. We use it to see where people get stuck, for example during sign-up and verification, and whether the emails and notifications we send are useful. We never record what you type: not your messages, your profile text or anything you enter in a form. Identifiers such as a conversation or match number are removed before anything is stored. We keep this for 180 days.
• Our emails: the main button in our account emails carries a random code, so that we can tell whether that email was tapped. The code identifies the email, not you, and is not shared with anyone. We do not use a third party to track the links in our emails. Our account emails also contain a tiny invisible image, through which our email provider, Resend, tells us whether an email was delivered and opened. Many email apps load it automatically and some block it, so it is only a rough guide. If you mark one of our emails as spam, we stop emailing you.
• Website analytics cookies: Google Analytics, to measure how people find our website. It sets cookies in your browser that can last up to two years.
• Advertising cookies: The Meta Pixel, so that we can show ads on Facebook and Instagram to people who have visited our website and have not joined, and measure which of our ads lead people to download the app. It sets cookies in your browser and tells Meta which of our public pages you viewed and which of our buttons you tapped, as described below. This is the only advertising or remarketing technology on our website.
• Install measurement in the apps: Meta’s app SDK in the iOS and Android apps, and Google Analytics for Firebase in the iOS app, so that we can tell which of our ads lead people to install BeyondSwipe. Described below.

Google Analytics runs only in a web browser, and only on our public pages. Those are the home page, the blog, and pages such as Get Started, FAQ, Verification, Dating Safety and our policies. It does not run inside the iOS or Android app at all. It does not run on Discover, Matches, Messages, your profile, sign-in or sign-up, and it does not run on the unsubscribe, appeal, account restricted, delete account, password change or verification and purchase completion pages.

On the pages where it does run, Google Analytics receives the web address of the page and the address you arrived from. We filter both before they are sent. Campaign tags are kept; every other value in the web address is removed. If you arrive at a public page from somewhere inside the app, the address you came from is dropped rather than shortened, so no conversation or match identifier is ever sent.

On those same pages, when you tap one of our App Store or Google Play buttons, our Get the app button or our Sign in link, Google Analytics also receives which one it was and which part of the page it sits on, such as the top of the home page. Nothing you type is sent.

Google Signals and advertising personalisation are switched off for this property, so your activity on this site is not added to an advertising profile and is not linked across your devices by Google.

You can block these cookies with your browser settings or with Google’s own opt-out browser add-on. Blocking them does not affect your account or any feature of the service.

The Meta Pixel runs only in a web browser, and only on the same public pages as Google Analytics. It does not run inside the iOS or Android app at all. It does not run on Discover, Matches, Messages, your profile, sign-in or sign-up, and it does not run on the unsubscribe, appeal, account restricted, delete account, password change or verification and purchase completion pages.

Where it does run, the pixel tells Meta which page you viewed and which address you arrived from, and, when you tap one of the buttons described above, which one it was and which part of the page it sits on. Meta uses the App Store and Google Play taps to measure our ads and to decide who to show them to. Meta reads the address you arrived from itself, and we cannot filter it. So if you reach one of our public pages directly from somewhere inside the app, we do not load the pixel on that page view at all. No conversation or match identifier is ever sent to Meta.

We have switched off Meta’s automatic collection, so the pixel does not read your name, email address, or anything else you type into a form on this site. We do not send Meta any information about your account, your matches, your messages, or whether you are verified.

Meta may link what the pixel reports to a Facebook or Instagram account. You can review and disconnect that in Meta’s own settings under Off-Facebook Activity, and most browsers and tracking-protection tools block the pixel outright. Blocking it does not affect your account or any feature of the service.

You can switch this off at any time. Use the Do Not Sell or Share My Personal Information link in the footer of any page. We remember that choice in the browser you used, so if you visit from another device or clear your site data you will need to set it again. Choosing it stops the pixel immediately and does not affect your account or any feature of the service.

Install measurement in the iOS and Android apps. When someone installs BeyondSwipe after seeing one of our ads on Facebook, Instagram or Google, we want to know which ad it was, so that we stop paying for ads that do not work. For that, the Android app includes Meta’s app SDK, and the iOS app includes Meta’s app SDK and Google Analytics for Firebase. On Android, Google Play reports installs from Google’s own ads to Google itself, so no Google measurement tool runs inside the Android app.

These tools report that the app was installed and opened, with technical details such as your device model, operating system version, app version and an identifier for that installation of the app, and, where you have allowed it, your device’s advertising identifier. Meta and Google compare this with their own records of the ads that were shown, which is how an install is credited to an ad, and they may also use it to improve how our ads are delivered, for example by showing them to people more likely to install. On iPhone, Google Analytics for Firebase is set so that this information is not used to personalise the ads you see. They are not told your name, email address, profile, photos, matches or messages, or whether you are verified, and we have switched off Meta’s automatic reporting of purchases. Two further things are collected automatically and we cannot switch them off: on iPhone, Google Analytics for Firebase can record purchases made through the App Store, meaning the product and its price, and derives an approximate location from your IP address; and Meta’s SDK sends Meta reports of its own errors.

On iPhone, you decide. The first time you open the app, iOS asks whether BeyondSwipe may track you. If you choose Allow, these tools may use your device’s advertising identifier to connect your install with the ad you saw. If you choose Ask App Not to Track, they cannot: your advertising identifier is not shared, iOS blocks the connections these tools use for tracking, and your install is counted toward an ad only in aggregate, without identifying you. You can change your answer at any time in Settings, then Privacy & Security, then Tracking. Your answer has no effect on your account or any feature.

On Android, you can delete your device’s advertising identifier in your phone’s settings, usually under Privacy, then Ads, or Google, then Ads. Once it is deleted, these tools cannot read it. The Do Not Sell or Share link on our website controls the pixel in that browser only and does not reach the apps, so use your device’s settings for the apps.

Under PIPEDA and Quebec Law 25, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Rectification: Correct inaccurate or incomplete information.
• Deletion: Request deletion of your account and personal data, subject to legal retention obligations.
• Portability (Quebec Law 25): Receive a copy of your data in a structured, commonly used, machine-readable format.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Object to automated decisions: Our matching algorithm uses your interests to suggest potential matches. You may request human review of any significant automated decision.

To exercise any of these rights, email privacy@beyondswipe.app. We will respond within 30 days. Quebec residents may also file a complaint with the Commission d'accès à l'information (CAI) at cai.gouv.qc.ca. Federal complaints may be directed to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

International users: If you are located in the European Economic Area or the United Kingdom, you have equivalent rights under the General Data Protection Regulation (GDPR / UK GDPR), including the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to lodge a complaint with your local supervisory authority. If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know, delete, and correct your personal information, and the right to opt out of the sale or sharing of personal information. BeyondSwipe does not sell your personal information. To exercise any of these rights, contact privacy@beyondswipe.app.

In accordance with Quebec Law 25's privacy by default requirements:

• We conduct Privacy Impact Assessments (PIAs) before deploying new features that process personal data.
• We apply data minimisation principles and collect only what is necessary for a specific, stated purpose.
• We designate a Privacy Officer responsible for ensuring compliance. Contact: privacy@beyondswipe.app.
• Any third-party technology that presents a material privacy risk is evaluated through a PIA before adoption.

Your account data is stored on servers located in North America (Supabase, AWS). Identity verification is handled differently. Didit has confirmed to us in writing that verification data, meaning your identity document, selfie and liveness video, is processed and stored in the European Union, in Amazon Web Services' Ireland region, and that this holds for every Didit customer whichever Didit company holds the contract. Our contract is with Didit's American company, Didit Identity, Inc., because Didit allocates customers in Canada and the United States to it. So the data sits in the European Union while the provider holding it is incorporated in the United States, and a provider incorporated there may still be subject to legal process there wherever it stores data. Didit names two sub-processors and no others: Amazon Web Services for cloud infrastructure, in Ireland, and Google Cloud for geolocation through the Maps API, processed within the European Economic Area. Didit has since confirmed that this geolocation lookup resolves a location only and receives no document images, selfies, face data or identity fields read from a document, and that the check which would produce an address to resolve is one we do not use. Those are Didit's representations about its own infrastructure; we rely on them and have not independently audited them. When data is processed by service providers outside Canada, we ensure appropriate contractual safeguards are in place, including standard contractual clauses or equivalent protections as required by PIPEDA and Quebec Law 25.

BeyondSwipe is strictly for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. Identity verification is mandatory and is performed by Didit, which reads the date of birth printed on your government-issued document. BeyondSwipe checks that date and refuses any account where it shows the holder is under 18. If we discover that a user is under 18, we will immediately terminate their account and delete all associated data.

We implement technical and organisational measures to protect your data, including:

• Encryption in transit over HTTPS, and encryption at rest as provided by our hosting and database platforms.
• Row-level security on all database tables.
• Access controls limiting data access to staff with a need to know.
• Regular security reviews and dependency audits.

No method of transmission over the internet is 100% secure. If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected people as soon as feasible after we conclude that the breach has occurred, and we keep records of breaches as required. Where another regulator also applies to you, we follow whichever deadline is shorter.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and display a prominent notice in the app at least 30 days before the changes take effect. Your continued use of BeyondSwipe after that date constitutes acceptance of the updated policy. The date at the top of this page always reflects when the policy was last revised.

For privacy questions, requests, or complaints:

Privacy Officer
BeyondSwipe / 15748666 Canada Inc.
Email: privacy@beyondswipe.app