Privacy notice
Last updated:
The operator runs Kamano. This notice says what we hold about you, why we hold it, how long we keep it and how to change or remove it. We wrote it to be read, so it is long where the product is long and plain throughout.
In short
- We know the city you choose, never where you are right now. A place you set up is shown only to the connections you pick, and nothing is live.
- You can see what we hold about you in the app or in a download, and delete your account yourself.
- We do not sell personal data, run ads, or load trackers or analytics from other companies.
- Health information is optional, kept apart, and shared only with the people you choose, with a consent you can withdraw.
- Facts and private answers are never used to rank, filter or match anyone. Standing, which sets how much you can send, comes from what you do here and can never be bought.
Who we are
The operator is the controller of your personal data. Write to us through the contact form for anything in this notice.
Drafting note: Add the company's registered address, and the EU and UK representatives and the data protection officer once appointed (docs/launch-gates.md, section C). Counsel to confirm who is controller and who is processor for each use.
What we hold, and why
Everything we hold is in this table. If a row does not say how long we keep something, it is kept while your account is open and erased with it.
| What | Why we hold it | How long | How to remove it |
|---|---|---|---|
| Your account: email address, how you sign in, and each sign-in with its network address and browser | To let you in and to spot someone else getting in | While your account is open | Delete your account in the app |
| Your profile: name, bio, birth date (others see only your age), an optional gender, pronouns, languages, links, interests, relationship style and your theme colours | To show your profile to the people you choose. Gender shows on your profile only if you turn that on. It also splits question results, and is never used in search, matching or standing | While your account is open | Edit it, or delete your account |
| Standing and vouches | To set how many requests and plans you can send, and to let people choose who can write to them. Only you see your standing | While your account is open | Delete your account |
| Events and groups you host or join, plans, and what you post in them | To run them for the people in them | While your account is open. An event you host is cancelled for its guests, with your name removed | Leave or delete them, or delete your account |
| Questions you wrote and guidelines you published | Other people's answers and acceptances depend on them | They stay after you leave, with your name removed | Ask us |
| Messages you send us through the contact form | To answer you | Until we have answered and no longer need them | Ask us |
| Your city: a city from a fixed list, never coordinates | To place you on the globe. Your phone's position is used once, on your device, to find the nearest city, and is then discarded. It is never sent to us | While your account is open | Change it in the app, or delete your account |
| Your previous cities | Only to limit how often a city can be changed. No screen shows them | While your account is open | Delete your account |
| Places you set up, and who you share each with. Trips | To show a configured place to one connection at a time, inside your profile and on their globe, and to show where you will be. A place is never live | A place until you remove it, the connection ends or you delete your account. A trip for 30 days after it ends | Remove it in the app |
| Photos and posts: your Discovery photos, your posts (photos, words and voice notes) with their comments, and prompt answers | To show them to the people you choose. We strip location and camera data on your device and again on our server, store them privately and serve them only through short-lived addresses checked for each viewer | Until you delete them. A photo a moderator removes keeps its pictures 90 days as evidence, then they are deleted, unless an open report still needs them | Delete the photo, or delete your account |
| Which people you hid a photo from | To honour the choice. Never shown to the person it names | Until the photo or either account is deleted | Delete the photo |
| Messages and pictures you send in a thread | To deliver them. A marker for what you have read sits on your side only: no message carries a read flag and nobody is told you read it | While your account is open | Delete your account, or ask us |
| Connections, agreements, notes and the shared log | To run the relationships you name. Private notes are visible only to their author and are never in anyone else's export | Until you delete your account. A record you share with another person stays with them, with you shown as a former connection | Delete your account, or ask us |
| Question answers and comments | To show your take, if you chose to, and to count results. Private answers never leave you. Results are counts per group, with minimum sizes, and cannot be traced to a person | Until you change or delete them. Totals update at the next nightly count | Delete the answer, or delete your account |
| Facts about how you use conversations: bands and dates, and notes up to 140 characters | To show you your own patterns and, only if you choose and they share theirs, to show others a plain-language band. Never a score, never used in search or matching | Snapshots are overwritten as new ones are made | Turn sharing off, or delete your account |
| Your vault: what you keep there, such as health records, consent notes and documents (it can hold special category data, see below) | To keep it for you, and to let you share an item with the people you choose | While your account is open. Stopping sharing removes it from their screen | Delete the item, or delete your account |
| Reports, blocks and mutes | To keep people safe. A report keeps who reported, why, an optional note, and a copy of the reported message with a few around it, or the comment, and anything the reporter chose to attach | A report is kept as evidence, including after the reported account is deleted. If you delete your account, your name, note and any attachment come off reports you made | Unblock or unmute in the app |
| Moderation record: what a moderator did, under which rule, and why | So our decisions can be checked and appealed. It is append-only | Kept, including after an account is deleted | Not erased with an account. Ask us if you want to know what it says about you |
| Warnings, statements of reasons and appeals sent to you | To tell you what we did and let you ask us to look again | Until you delete your account | Delete your account |
| Scam and threat hints on messages | To warn the reader. We keep which kinds of hint, never the text | With the message | Delete your account, or ask us |
| Law-enforcement requests we receive | To show we answered the law and nothing more. We record who asked, on what basis, the scope in a sentence and the outcome, not the data handed over | For the legal retention period | Not erased with an account |
| Subscription and payment records | To take payment for Looking, handle disputes and meet tax law | 7 years | On deletion they lose their link to you. Amounts, dates and status stay for the tax period, then go |
| Notification address: the push service address, two public keys, your browser and when it was last seen | To send notifications you turned on. The text is generic until you choose to show names. The address is a secret and is never sent to any screen | Until you turn notifications off or the push service says the device is gone | Turn notifications off in Settings |
| Sign-in codes | To confirm it is you. Stored scrambled, valid for five minutes, three tries | Five minutes | They expire on their own |
| Face verification result | To confirm a person is who their photos show. We keep a pass or fail, a reason code, the number of tries and the dates, for 12 months. We keep no selfie and no ID image | While your account is open | Delete your account |
| On your device: your age confirmation, your session, whether someone was signed in here, and a copy of your theme | To make the app work. All strictly necessary, all first-party | Until you clear them | Clear this site's data in your browser |
The waitlist
If you join the waitlist on this site, we keep your email address with our email provider, Resend, and nothing else. We use it only to write to you when you can join, then we delete it. To be taken off sooner, ask through the contact form.
Drafting note: Name the service that stores waitlist addresses and how long they are kept at most, once the waitlist endpoint exists.
Location
We never know where you are right now. We hold the city you chose and any place you set up yourself. Strangers and connections see your city and nothing finer. A connection sees a configured place only if you turned sharing on for that connection, and only while your connection is active. It shows inside your profile and on their globe, and is not live. There is no setting that shares your location with everyone, and no distance or near me number anywhere.
Nobody is told how many people live in or look in a city. Without Looking you can open any city, but you see nobody in it.
Health information
Health information is special category data. Adding it is optional, and we ask for your explicit consent for each purpose separately. We never bundle it with anything else, and you can withdraw it at any time.
- Your vault is encrypted on your device before it leaves it. We store only the encrypted version and cannot read it.
- Only you can see an item until you share it. You choose each person who sees it, and you can stop sharing at any time.
- Stopping sharing removes the item from their screen in the app. It cannot reach a screenshot or a photo they already took, and we cannot prevent that.
- Health information never appears on your profile, in search, in matching, in Facts or in a notification.
- If you lose every passkey, your recovery code and all your recovery contacts, no one can open your vault.
- What you keep is what you say. We do not check it. It is not a medical record.
What we do not do
- We do not sell or rent personal data, and we do not share it with advertisers.
- We do not show ads or load third-party analytics, ad or social trackers.
- We do not use your facts or private answers to rank, filter, price or match anyone, and standing can never be bought.
- We do not keep selfies or ID images after a verification check.
- We do not make decisions about you by automated means that have legal or similar effects. Automated checks can hold a photo, hide reported content, or hide a profile reported as under 18, until a person looks. They never suspend or close an account.
Companies that help us run it
These companies handle personal data on our behalf, under written agreements that limit what they can do with it. Nobody else receives it unless the law requires.
| Company | What they do | What of yours they handle | Where |
|---|---|---|---|
| Convex (to confirm) | Database, server functions and file storage | Everything in your account, including photos and messages | Region to be confirmed |
| Polar (to confirm) | Takes payment for Looking and acts as merchant of record | Your email address, payment details (we never see card numbers), subscription and transaction records | Region to be confirmed |
| Resend (to confirm) | Sends sign-in codes, keeps the waitlist and delivers contact-form messages | Your email address, each sign-in code, and anything you write in the contact form | Region to be confirmed |
| Browser push services (Apple, Google, Mozilla, Microsoft) (to confirm) | Deliver notifications to a device you turned them on for | A notification, generic by default, addressed to your device | Region to be confirmed |
| Face verification provider (to be named) (to confirm) | Checks that a selfie matches your photos and returns pass or fail | A selfie, deleted after the check | Region to be confirmed |
| Error tracking provider (to be named) (to confirm) | Tells us when something breaks | Technical details of an error, with personal fields removed | Region to be confirmed |
| Mapbox (to confirm) | Draws the maps in the app (the globe, a shared place, the pin) | Your device's network address and the app's public map key while a map loads. No place, name or account details | Region to be confirmed |
| Content delivery provider (to be named) (to confirm) | Speeds up photos | Your device's network address while it loads photos | Region to be confirmed |
Drafting note: Confirm every row, sign the processor agreements, and add the region of each. Add the legal mechanism for transfers outside the UK and the EEA (docs/launch-gates.md, section B).
Your rights and how to use them
Depending on where you live you can see, correct, export and delete your data, object to or restrict how we use it, withdraw consent, and complain to your data protection authority. We give these rights to everyone, wherever you live.
- See it: every figure we work out about you opens the records behind it, in the app. The download holds the rest.
- Export it: ask for a download in the app. It holds your profile, photos, messages you sent, connections, plans, places, answers, vault items (still encrypted), sign-ins, billing and safety records, plus the shared records you are a party to, with other people's personal data replaced by an alias. It never holds private notes someone else wrote about you.
- Delete it: ask in the app. Your account disappears for everyone else at once and a paid subscription stops renewing at the end of its period. Sign in within 30 days to cancel. After that a daily job erases your data, then your sign-in records and your account. Billing records stay for the tax period, shared logs stay with the other person with your identity removed, and signed agreements stay with everyone on them, your signature included.
- Anything else, or anything you cannot do in the app: write to us through the contact form. We answer within 30 days.
Age
You must be 18 or over to use Kamano. We do not knowingly hold data about anyone younger. If you think someone under 18 is using it, report them and we will remove their account.
Requests from the authorities
We answer a legal request only as far as the law requires, we log each one, and we tell the person concerned when we are allowed to. Where reporting is a legal duty, for example child safety, we make the report.
Keeping it safe
Connections use HTTPS. Sign-in codes are stored scrambled and expire in five minutes. Profile and post photos are reached only through short-lived addresses made for each viewer. Pictures in messages are stored privately and only the people in the thread get their addresses. Every limit on who can see what is enforced on our server, not only in the app, and our logs strip codes, tokens, addresses and message text. No system is perfectly safe. If something goes wrong that affects you, we will tell you and the authorities as the law requires.
Changes to this notice
We change the date at the top when this notice changes, and tell you in the app when a change matters to you.
Contact
- Privacy and anything else
- Contact form