Privacy Policy

Last updated: June 2026

Your data is yours. We do not sell it, share it with advertisers, or use it to build profiles for third parties. This policy explains what we collect, why we collect it, who else touches it, and what control you have over it.

We respect your privacy — and we also have a responsibility to protect our members. That means privacy here isn't absolute: it doesn't extend to someone using unmaskd. to harm others. The exceptions are covered below, and they're narrower than they might sound.

What we collect

We collect only what is needed to run the platform:

Profile information: display name, age (optional), general location (optional), bio (optional), photos (optional), optional profile signals (e.g. open to collaborating), interests, communication styles, support needs, ND identifiers, collaboration roles
Account credentials: email address and a hashed password (we never store your password in plain text)
Messages and connection activity: messages you send through the platform, and connection/circle activity, are stored to deliver them and maintain your history
Safety reports and moderation records: reports you file, reports filed about you, and related moderation actions are kept — even if an account involved is later deleted — to enforce our Acceptable Use Policy and keep the community safe
Payment information: if you make an optional support contribution, our payment processor (Stripe) handles your card details directly — we receive limited metadata such as the amount and payment status, never your full card number
Device and security logs: browser type, OS version, IP address, and login/authentication activity, used for compatibility, bug reporting, and detecting fraud or abuse — not for tracking or advertising
Cookies: a session cookie to keep you logged in. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics on unmaskd today

What you control

Your profile has granular visibility controls:

ND identifiers: you choose whether these are shown publicly, shown only to connections, or hidden entirely
Support needs: same controls — you decide who sees them
Communication styles: shown or hidden at your discretion
Location: if provided, only a general area (city or region) is ever shown — never an exact address or coordinates
Photos: all photos you upload can be removed at any time; removal is immediate

What we will never do

Sell your data to third parties
Share your data with advertisers
Use your neurodivergent identifiers or support needs for ad targeting
Show ads on this platform
Use your data to train AI models without explicit, separate opt-in consent
Store support-sensitive information in browser caches accessible offline
Share your messages with anyone other than the intended recipient — outside of the limited safety and legal situations described below

Service providers

We use a small number of service providers to operate unmaskd, and only share what each one needs to do its job:

Payment processing: Stripe, for optional support contributions
Hosting and cloud storage: to run the platform and store photos/media
Email delivery: to send account, safety, and transactional emails
Moderation tooling: to help review reports and enforce the Acceptable Use Policy

These providers only receive the data necessary to provide their service to us, and are not permitted to use it for their own advertising or profiling purposes.

Law enforcement and legal requests

We may disclose account information in response to valid legal process, or where we reasonably believe disclosure is necessary to prevent imminent harm. See our Law Enforcement Requests page for details on how these requests are handled.

Data boundaries

Profile data is separated into two layers:

Public profile data — information visible to other users according to your visibility settings: display name, bio, interests, and any profile sections you have set to public
Private account data — email address, exact age, full message history; never shown to other users

These two data types are stored and returned through separate code paths. A bug that leaks public profile data cannot also leak private account data.

Deactivating your account

Deactivating is reversible and separate from deletion. From Account Settings, you can deactivate your account to hide your profile from Discover and pause new connection requests and messages, without deleting anything. Your data — profile, messages, connections — is kept for 30 days so you can pick up where you left off. Signing back in during that window shows you a reactivation prompt; nothing is restored automatically without you confirming it. If you do not reactivate within 30 days, your account proceeds through the same permanent deletion described below.

Deleting your account

You can request account deletion at any time from your profile settings, and it happens immediately — not a delayed or queued process. Deletion removes all of your personal data: profile, messages, photos, and account credentials. If something you were involved in is still under active review, like an open safety report, we keep what's needed for that a little longer. Anonymised aggregate data (e.g. "X% of users are interested in music") may be retained but cannot be linked back to you. See Delete Your Account for the full walkthrough.

Questions

Questions about your data or this policy? Email [email protected] or see our Contact page. We aim to respond within 5 business days.