PRIVACY POLICY

Effective Date: August 19, 2026

Last Updated: October 4, 2026

Privacy Policy: https://bmazed.app/privacy Terms of Use (EULA): https://www.apple.com/legal/internet-services/itunes/dev/stdeula/

INTRODUCTION

bmazed ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service").

Note: Some features described (such as subscription billing via the Apple App Store and Google Play, and biometric login on supported devices) apply specifically to our mobile applications. Web users may have a different experience. This policy covers all platforms to provide comprehensive disclosure.

Please read this policy carefully. We collect only data relevant to core features and functionality.

Your Consent Choices

Essential Data: Required for core functionality (account, matching, security). You consent to essential data collection by creating an account.

Optional Data: Analytics and personalization features require explicit opt-in. You may decline optional data collection without losing access to core features. Manage your preferences in Settings > Privacy at any time.

Withdraw Consent: You may withdraw consent for non-essential data processing at any time through your account settings or by contacting us. Account deletion removes all data.

1. INFORMATION WE COLLECT

How We Collect Data: We collect information through: (1) forms you complete during registration and account updates, (2) automatic server logging when you interact with the Service, (3) cookies and local storage in your browser, (4) SDK integrations for mobile app functionality (e.g., push notifications, crash reporting), and (5) third-party authentication providers when you sign in with external accounts.

1.1 Information You Provide

Account Information: First name, last name, username, email address, password (stored as a one-way salted hash, never in plaintext), and date of birth.
Profile Information: Profile photos, bio, and display preferences.
Location Data: Home state and country that you provide during registration. This is the only location information we collect. bmazed does not collect GPS coordinates, does not perform passive location tracking, and does not determine your location from your device automatically. Your home state/country is used solely to power the region filter in Global Circles.
User Content: Posts, comments, messages, matching text inputs (THRN/Vault Messenger), and any other content you submit.
Business Account Data: For business accounts: legal business name, EIN/Tax ID (stored as a one-way cryptographic hash), business website, and business email.
Subscription Information: Subscription billing is handled by Stripe and app stores (Apple App Store, Google Play), with RevenueCat supporting subscription management. We receive subscription status, tier, expiration, and billing transaction identifiers — we do not receive or store payment card details. When you redeem a promotion, we may process the provider's offer identity, eligible plan, promotional-period dates, and account-linked redemption records to verify eligibility, prevent repeat redemption across codes and platforms, reconcile provider events, and distinguish promotional access from actual payment.

1.2 Information Collected Automatically

Device Information: Device type, operating system, unique device identifiers, mobile network information, and browser type. We may generate a device fingerprint (a unique hash derived from your browser type and language settings) to detect unauthorized access and protect your account security. This fingerprint is stored as a one-way hash and cannot be reversed to recover the original data.
Biometric Authentication (Mobile): On supported mobile devices, bmazed may offer biometric login (Face ID, Touch ID, or equivalent) for convenience. Biometric data is processed entirely on your device by the operating system — bmazed never receives, transmits, or stores your biometric data. We only receive a success/failure signal from your device's biometric system.
Usage Data: Pages visited, features used, interaction timestamps, session duration, tap/click patterns, and navigation paths. This data is used for platform improvement and debugging only — it is never used for personalization, content recommendations, or recommendation algorithm training.
Log Data: IP address, access times, app crashes, system errors, and performance metrics.
Session Data: We use server-side sessions to maintain your logged-in state. Session tokens are stored securely and expire after periods of inactivity.

No Advertising Tracking on iOS

bmazed does not track users for advertising, behavioural profiling, or algorithm-building, and does not share data with advertising networks. Because we do not track, our iOS app does not show Apple's App Tracking Transparency (ATT) prompt — there is no advertising-tracking permission to request. We do not collect your IDFA and do not share device identifiers with third-party analytics or ad networks.

We do retain limited operational data (crash and error logs via Sentry, payment transaction records required by payment processors and law, and content reported by users) — none of which is used to profile you or to target advertising.

1.3 Cookies and Local Storage

Session Cookies: Essential cookies to maintain your login state and preferences across pages.
Preference Storage: Theme preferences (dark/light mode), notification settings, and UI customizations stored in browser local storage.
Cache Data: Temporary storage of feed content, user profiles, and images to improve app performance and reduce loading times.
Authentication Tokens: Secure tokens stored on your device to keep you logged in between sessions.

1.4 Information from Third Parties

Social Login: If you sign in with Replit or Apple, we receive basic profile information (name, email) from those services.
Subscription Status: Subscription tier verification from Stripe and app stores to confirm your active subscription level.

2. HOW WE USE YOUR INFORMATION

Service Delivery: To operate the THRN and Vault Messenger matching features, display content, and enable social interactions.
Account Management: To create and manage your account, process subscriptions, and provide customer support.
Personalization: To customize your experience, show relevant content in Global Circles based on your location preferences.
Platform Improvement: We improve our platform by analyzing how you use features, and what happens on your device when our app crashes. We use this information to fix bugs, improve performance, and develop better features. Usage data is never used to build recommendation algorithms, personalize content, or make algorithmic recommendations to users.
Safety & Harmful Behavior Prevention: We work to prevent harmful behavior and keep people safe on bmazed. This includes detecting spam, fraud, abuse, and violations of our Terms of Service.
Research for Social Good: We may conduct research to advance technology, improve user safety, or contribute to social understanding — always using de-identified or aggregated data.
Communication: We use contact information you've provided (like your email) to send service notifications, match alerts, security alerts, and important account updates. We do not send marketing emails without your consent.
De-identification & Aggregation: To protect your privacy, we de-identify or aggregate information whenever possible so it no longer identifies you personally. We use this anonymized data for the same improvement and safety purposes described above.
Legal Compliance: To comply with applicable laws, regulations, and legal processes.

We do not sell your personal data. We do not use your data for AI/ML model training.

3. YOUR ACTIVITY AND INFORMATION YOU PROVIDE

When you use bmazed, we collect information about your activity and the content you create. This section describes what activity data we collect and how it is used within our platform.

Content You Create: Posts, comments, and text inputs for THRN and Close Match.
Messages: Messages you send and receive in Vault Messenger and Root Root, including their content.
Global Circles Interactions: Interactions with Global Circles including topics viewed and conversations joined.
Content Engagement: Types of content you view or interact with, and how you interact with it.
Feature Usage: Features you use and actions you take (matching, rooting).
Activity Metrics: The time, frequency, and duration of your activities on our platform.
Subscription Tier: Your subscription tier and status (we do NOT store payment card details — billing is handled entirely by Stripe and app stores).

No Cross-Platform Tracking

Unlike other platforms, bmazed does not track your activity across other apps or websites. We only collect activity within our own platform.

Close Match — Data Handling

When your THRN window expires without an exact match, the system checks whether another user submitted text with greater than 75% similarity to yours. If a candidate pair is found, both users are offered a 12-second mutual-consent window to connect.

What we hold: Your normalized text and user ID are held in ephemeral server-side processing (in-memory and Redis cache) for up to 15 seconds while the candidate pool is being checked — never written to the primary database.

Automatic purge: Candidate data is automatically purged when the consent window closes (whether you accept, decline, or let it expire). No Close Match candidate data persists beyond the 12-second window.

3.1 DIRECT MESSAGING PRIVACY

bmazed is committed to the privacy of your direct messages. Message content is never proactively read, analyzed, or monitored — and is never used for analytics, advertising, or algorithm training. The only exception is when a user submits a report: in that case, a human moderator may access a limited conversation preview solely to evaluate the reported content. This section describes how we handle content sent through our private messaging features.

Account Notices

Official account notifications from bmazed — including identity verification decisions, moderation outcomes, and security alerts — are delivered by email and through the in-app Help Center. bmazed does not send official account notices via direct message.

No Proactive Monitoring: bmazed does not proactively read, analyze, or monitor the content of your direct messages. Message content is never scanned automatically or reviewed without cause.
No Sale: Message content is never sold or shared with third parties for any purpose.
No Analytics: Message content is never used for analytics, advertising, or algorithm training of any kind.
Review Only Upon Report: Message content may be accessed solely when a user submits a report about that content. Reviews are conducted by a human moderator only — never by automated systems. The moderator reviews a limited conversation preview to evaluate the report and determine the appropriate response.

Vault Messenger — Enhanced Privacy

Vault Messenger provides a stronger privacy guarantee than standard direct messages. Matched participants' devices use application-layer end-to-end encryption: they derive AES-256-GCM message keys with P-256 ECDH and HKDF-SHA-256 before message content is transmitted. Vault ciphertext is also encrypted at rest on our servers and is ephemeral — messages are purged after the session ends and are not retained long-term. Even in the event of a user-submitted report, Vault content cannot be recovered after it has expired.

Your Messages Are Private

bmazed's business model is subscription-based — we have no incentive to mine your private communications. Your direct messages remain between you and your conversation partner unless you choose to report content.

4. INFORMATION WITH SPECIAL PROTECTIONS

Through your use of bmazed, you may choose to share information that could be considered sensitive — such as religious views, political opinions, health information, or other personal beliefs — in posts, messages, or profile content.

No Active Collection: We do not actively collect or categorize sensitive personal information. We do not scan your content to identify or classify sensitive data.
Equal Protection: Any sensitive content shared in posts or messages is treated with the same protections as all user content on our platform.
No Profiling or Advertising: We never use sensitive information for profiling, targeting, or advertising. bmazed does not advertise at all — we are a subscription-only platform with no ads.
Public Sharing Awareness: Users should be mindful about sharing sensitive personal information in public posts, as this content may be visible to other users.
No Third-Party Sharing: Special category data is never shared with third parties.
Enhanced Controls: If we become aware of sensitive data, it receives enhanced access controls to provide additional protection.

Important: bmazed is a privacy-first platform with no advertising. Sensitive information you share is never used for any commercial purpose.

5. DATA SHARING AND DISCLOSURE

With Other Users: Your username, profile, and public posts are visible to other users. Matched users see limited information during THRN/Vault matches.
Service Providers: We share data with trusted third parties who assist in operating our Service:
- Cloud hosting and storage (Neon Database, Replit infrastructure, Replit Object Storage)
- Payment processing (Stripe, Apple App Store, Google Play)
- Authentication providers (Replit, Apple) when you choose to sign in with them
- Crash & error monitoring (Sentry) — diagnostic data only, stripped of sensitive content
- Security & bot protection (Cloudflare Turnstile and Cloudflare edge)
- News content (World News API) for the News Hub feed
- Geocoding (Photon API) to resolve user-provided home state/country names
- Subscription management (RevenueCat) for mobile app-store subscriptions
- Transactional email delivery (Resend) for account, support, and security notifications
Legal Requirements: We may disclose information if required by law, court order, or government request.
Business Transfers: In the event of a merger, acquisition, or sale, your data may be transferred to the new entity.
With Your Consent: We may share information for other purposes with your explicit consent.

Third-Party Compliance: All service providers are contractually required to maintain equivalent privacy and security standards. We conduct periodic reviews to monitor third-party compliance with our data protection requirements. We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

DMCA Copyright — Designated Agent

To submit a copyright infringement notice under the Digital Millennium Copyright Act (17 U.S.C. § 512), contact our designated agent:

Email: dmca@bmazed.app
Mail: bmazed LLC, DMCA Designated Agent, c/o Northwest Registered Agent, Inc., 2108 N St STE N, Sacramento, CA 95816, USA

Counter-notifications may also be submitted to the same address. See Terms Section 16.5 for full DMCA procedures.

6. DATA RETENTION

Account Data: Retained while your account is active. When you delete your account, your profile, posts, comments, messages (including vault messages), sessions, and account record are permanently deleted immediately — there is no recovery grace period. Associated files (profile/banner images, post media, and any identity-verification photos) are deleted as part of that same immediate process; on the rare occasion a file cannot be removed on the first attempt, deletion is automatically retried and any file that still fails is flagged internally for manual remediation by our team, so nothing is left to silently linger. A small set of records (for example, support-ticket history, audit logs, and payment records required for tax, fraud-prevention, dispute handling, or legal-compliance purposes) may be retained separately as required by law, disassociated from your identifying information where possible.
Unresolved Recurring Payments: If a monthly renewal payment fails, we record the failure and provide 14 days of normal access while payment is recovered. If payment remains unresolved, access is limited to billing, support, data export, and account-deletion tools until payment resumes. Established accounts, usernames, content, and privacy settings are not automatically deleted solely because of nonpayment, inactivity, cancellation, or promotional-period expiry. Ordinary ephemeral-content lifetimes, incomplete-signup cleanup, voluntary deletion, moderation, and applicable legal-retention requirements still apply. Billing provider records, invoices, payment-failure notices, dispute records, and the minimum audit data required by law may be retained separately after voluntary account deletion.
Content: Posts and comments are retained until you delete them or delete your account.
Match History: THRN random-chat sessions are fully ephemeral. Match pairings and chat messages are never written to our database — they exist only in memory/cache for the duration of the session and are discarded when it ends. There is no match history to retain or anonymize.
Server Logs: Operational logs used for security and debugging are not stored in our application database and are not kept on a fixed retention schedule beyond what our infrastructure providers apply by default.
Cache Data: Automatically cleared periodically or when you log out.
Vault Messenger Sessions: Vaults and their messages persist while the vault is active. Once a vault ends — whether you leave it, the other participant leaves, or it reaches its expiry time — the vault and all of its messages are permanently deleted at vault expiry via cascade deletion (triggered on access) and completed by automated background cleanup. Exception: If a vault has been reported to our moderation team before or at the time it ends, its content may be retained until the report is reviewed and resolved by an authorized moderator. Once the review is complete, the vault data is permanently deleted.
Identity Verification Data: When you submit an ID photo, legal name, and ID number for individual identity verification (triggered by safety reports), the photo is stored in access-controlled private object storage and is viewable only by authorized moderators. We retain only the last 4 digits of the ID number — the full number is never stored. The ID photo is retained until your verification is approved or, if rejected, for up to 90 days after the rejection decision (whichever comes first), and is then deleted. Once approved, the photo itself is removed and only the audit record (decision, decision date, last 4 digits) is kept for safety and compliance purposes.

7. DATA SECURITY

We implement industry-standard security measures to protect your data:

Encryption in Transit: All data transmitted between your device and our servers uses TLS/HTTPS encryption.
Message Encryption: Vault Messenger uses application-layer end-to-end encryption: matched devices derive AES-256-GCM message keys using P-256 ECDH and HKDF-SHA-256 before content is transmitted. Vault ciphertext and direct-message content are also encrypted with AES-256-GCM at the application layer before storage in our database, so message content is not stored in plaintext.
Password Security: Passwords are hashed using scrypt with per-user salts. We never store plaintext passwords.
Sensitive Data Protection: Business Tax IDs and government ID numbers are stored as one-way cryptographic hashes (or, for ID numbers, only the last 4 digits are retained). Identity-verification photos are stored in access-controlled private object storage, viewable only by authorized moderators.
Access Controls: Employee access to user data is restricted, logged, and subject to regular audits.
Rate Limiting: Protection against brute-force attacks and abuse.
Security Monitoring: Continuous monitoring for suspicious activity and potential vulnerabilities.

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7.1 DATA BREACH NOTIFICATION

In the event of a data breach that affects your personal information:

Notification Timeline: We will notify affected users promptly upon discovering a breach, as required by applicable US law.
Notification Methods: We will contact you via email at your registered address and/or through in-app notification.
Information Provided: Notifications will include the nature of the breach, types of data affected, steps we are taking, and recommended actions for you.
Regulatory Reporting: We will report breaches to relevant supervisory authorities as required by law.

7.2 KEEPING YOUR APP UP TO DATE

We recommend keeping bmazed updated to the latest version. Each release includes the most recent security patches, new features, and performance and reliability improvements that help protect your data and your account.

Older versions may have reduced functionality, missing features, or known issues that have already been resolved in current releases. We encourage leaving automatic updates enabled in your browser or app store so you always have the latest, most secure version of bmazed.

8. YOUR RIGHTS AND CHOICES

8.1 Access and Portability

You can request a copy of your personal data at any time through Settings > Account > Export Data, or by emailing us.

8.2 Correction

You can update your profile information directly in the app at any time.

8.3 Deletion

You can delete your account through Settings > Account > Delete Account. Upon deletion:

Your profile, posts, comments, and messages are permanently deleted immediately — not within 30 days
Associated media and identity-verification files are deleted as part of that same process, with automatic retry and staff follow-up in the rare case a file isn't removed on the first attempt (see Section 6)
Some data may be retained for legal compliance or fraud prevention (see Section 6)

8.4 Opt-Out Options

Push Notifications: Manage through your device settings or in-app preferences.
Marketing Emails: Unsubscribe link provided in all marketing communications.

9. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

9.1 Your Rights

Right to Know: Request disclosure of personal information collected, used, and shared in the preceding 12 months.
Right to Delete: Request deletion of your personal information, subject to certain exceptions.
Right to Correct: Request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. This right does not apply to our practices.
Right to Limit Use of Sensitive Personal Information: Request limitation on the use of sensitive personal information (if applicable).
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

9.2 Categories of Personal Information

Per CCPA requirements, we collect the following categories:

Identifiers: Email, username, device IDs
Internet Activity: Usage data, interaction timestamps, navigation paths
Geolocation: State/country location (user-provided)
Inferences: Matching activity records retained for 90 days for dispute resolution; we do not build user profiles, preferences, or behavioral predictions

9.3 Exercising Your Rights

How to Submit: Email privacy@bmazedllc.zendesk.com or use in-app Settings > Privacy > Data Rights.
Response Timeline: We will respond to verifiable requests within 45 days. Complex requests may require an additional 45 days with notice.
Verification: We may need to verify your identity before processing requests.
Authorized Agent: You may designate an authorized agent to submit requests on your behalf with proper documentation.

Do Not Sell or Share My Personal Information

bmazed does not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes. Therefore, there is no need to opt out of such practices.

In-App Access: You can verify your privacy settings and data rights at any time via Settings > Privacy > Data Rights. A "Do Not Sell My Personal Information" link is also available at the bottom of the app's main settings page for easy access.

9B. CANADIAN PRIVACY RIGHTS (PIPEDA)

If you are a Canadian resident, your personal information is protected under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

Consent: We collect, use, and disclose your personal information only with your knowledge and consent, except where required or permitted by law.
Access: You have the right to access your personal information and challenge its accuracy.
Correction: You may request correction of inaccurate personal information.
Withdrawal: You may withdraw consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions.
Contact: Direct privacy inquiries to privacy@bmazedllc.zendesk.com.

10. JURISDICTIONAL SCOPE

bmazed is available to users worldwide. This Privacy Policy is written to comply with applicable privacy laws across the jurisdictions we serve, including CCPA/CPRA for California residents, GDPR for users in the European Economic Area and United Kingdom, PIPEDA for Canadian residents, and other applicable national and regional privacy laws.

If you are located in a jurisdiction with specific privacy rights, you may exercise those rights as described in Section 9 of this policy or by contacting us at privacy@bmazedllc.zendesk.com.

11. INTERNATIONAL DATA TRANSFERS

Our servers are located in the United States. If you access bmazed from outside the United States, your data will be transferred to, stored, and processed in the US. By creating an account or using the Service, you explicitly consent to the transfer of your personal data to the United States and to its processing under US law.

For users in the European Economic Area, United Kingdom, or Switzerland, such transfers are made pursuant to appropriate safeguards, including Standard Contractual Clauses (SCCs) adopted by the European Commission or other transfer mechanisms recognized under applicable law. You may request a copy of applicable SCCs by contacting us at privacy@bmazedllc.zendesk.com.

For Canadian residents, transfers are made in compliance with PIPEDA and applicable provincial privacy laws. For users in other jurisdictions, we take appropriate contractual or other measures to protect your data in accordance with applicable law.

All data is encrypted in transit (TLS); Vault Messenger and direct message content is additionally encrypted with AES-256-GCM at the application layer, as described in Section 7. All service providers are contractually required to maintain equivalent security standards. You may withdraw consent to data processing at any time by closing your account; however, this will not affect the lawfulness of processing that occurred prior to withdrawal.

12. CHILDREN'S PRIVACY

The Service is not intended for users younger than the minimum age of digital consent that applies in their country, as declared at sign-up (for example, 13 in the United States and United Kingdom, 15 in France, 16 as the general EU/EEA default, with a default minimum age of 16 for countries not explicitly listed). We do not knowingly collect personal information from users under their applicable minimum age. If we discover that a user under that age has provided us with personal information, we will delete it promptly.

If you believe a child has provided us with personal information, please contact us at privacy@bmazedllc.zendesk.com.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we make material changes:

We will update the "Last Updated" date at the top of this policy
We will notify you via in-app notification or email at least 30 days before changes take effect
Your continued use after the effective date constitutes acceptance of the updated policy

14. CONTACT US

If you have questions about this Privacy Policy or our data practices, please contact us:

Privacy Contact: privacy@bmazedllc.zendesk.com

We aim to respond to all privacy-related inquiries within 30 days.