Privacy Policy

The Service is operated from the United States at the domain doubletaken.com. For privacy inquiries, the contact is hello@doubletaken.com. This Policy applies to personal information we process when you visit the site, create an account, run a search, purchase credits, or receive a safety-buddy link. It does not apply to third-party sites we link to in search results; those sites are governed by their own policies.

Depending on how you use the Service, we may process:

• Account identifiers. Email address (including a privacy-relay address, if you use a sign in option that offers one), authentication identifiers from the sign in method you choose, and session credentials.
• Commercial and billing data. Credit balance, whether the complimentary first search has been used, refill plan status, and identifiers from our payment processor. We do not store full payment-card numbers on our servers; card data is handled by that processor.
• Case records. Optional labels you type, search status, verdicts and summaries, public source URLs, host names, match scores, and timestamps. We do not operate a long-term photo library of uploads.
• Facial images (transient). When you run a search, the image you submit is transmitted to independent contractors solely to generate similarity leads against publicly available imagery. We then drop the file from our servers. We do not use uploads to train a public model or to build a mugshot-style gallery.
• Share data. If you create a safety-buddy link, we store a token, expiry, and, if you choose email delivery, the recipient address you provide.
• Technical and security data. Cookie values necessary to keep you signed in, and limited request metadata used to enforce rate limits and prevent abuse (for example hashed or short-lived buckets keyed to IP address or email).

We do not require government ID, precise GPS, or a public social profile of the person you are checking, other than what appears in public search results returned by our providers.

We collect information from you (forms, uploads, and the sign in method you choose), from your devices (session cookies), and from independent service providers that host, bill, message, or otherwise help us operate the Service. We do not buy marketing lists of dating prospects.

We process personal information to:

• create and authenticate accounts and keep you signed in;
• perform the search you request and write a private case file;
• meter credits, fulfill purchases, and operate optional refills;
• send magic-link and safety-buddy messages you initiate;
• enforce age, acceptable-use, and anti-abuse rules, including blocking disposable inboxes;
• secure the Service, debug failures, and comply with law;
• respond to deletion and other privacy requests.

We do not sell personal information, do not use it for third-party advertising, and do not publish a public profile or directory of people you looked up.

A search necessarily involves processing a face in a photograph to estimate similarity to other public images. In some jurisdictions, facial geometry extracted from an image may be treated as a biometric identifier. By submitting an image and confirming the in-product consent (including that you are 18 or older and will use the Service only for lawful dating-safety purposes), you instruct us to process that image for the single search you requested, and you represent that you have a lawful right to submit it (for example, a screenshot sent to you in a dating conversation).

We do not retain the upload as a standing biometric database. Provider logs and transient processing are governed by the provider’s terms. You must not submit images of anyone you know or believe to be under 18, and you must not use the Service to identify, locate, or contact a minor.

We disclose information only as needed to operate the Service:

• Search contractors. Independent vendors that compare a submitted image to publicly available imagery (and, if we later enable it, that look for copies of the same file). They receive the image only to fulfill the search you requested. We do not control their indexes. Their processing is subject to their own terms.
• Infrastructure. Cloud hosting, application runtime, and database providers.
• Email. A transactional email vendor. Messages are sent from our domain address (for example hello@doubletaken.com), not from your personal inbox as the From line.
• Payments. An independent payment processor receives the email associated with your account at checkout and processes card data. We do not store full payment-card numbers on our servers.
• Sign in services you choose. If you use a third-party sign in, that provider authenticates you under its terms; we receive an email (or relay) and a stable subject identifier.
• A safety buddy you designate. If you create a share link, the recipient can view that case (verdict and source links) until the link expires, typically about forty-eight (48) hours. We do not attach your email to that message as the sender identity.

We may also disclose information if required by law, legal process, or to protect the rights, safety, or integrity of users, the public, or the Service, and in connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality.

We use an HTTP-only session cookie to maintain authentication after you sign in. It is necessary for the Service and is not used for advertising. Magic-link emails contain a one-time token that typically expires in about twenty (20) minutes. We do not use non-essential tracking pixels for ads.

Account and case records are retained so you can reopen files and so credits remain accurate, until you request deletion or the account is closed, unless a longer period is required or permitted by law (including tax, accounting, dispute, and fraud-prevention records). Transient images are not kept as a photo store after the search is submitted. Share tokens become unusable after expiry. Payment records held by our payment processor are retained under that processor’s policies.

We use industry-standard safeguards appropriate to the nature of the data, including encrypted transport, access-limited production systems, and httpOnly session cookies. No method of transmission or storage is completely secure. You are responsible for keeping your inbox and devices secure and for not forwarding magic-link or share URLs.

The Service is for individuals 18 years of age or older. It is not directed to children under 13, and we do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it. Do not submit photographs of minors.

You may request access to, correction of, or deletion of your account and case records by emailing hello@doubletaken.com. We will verify the request and complete it unless an exception applies (for example, we must keep a billing record). You may close a session by signing out. You may cancel a refill in the Stripe customer portal.

If you are a resident of California or another U.S. state with consumer privacy legislation, we do not “sell” or “share” personal information as those terms are defined for cross-context behavioral advertising, and we do not use sensitive data to infer characteristics for advertising. You may designate an authorized agent to submit a request, subject to verification. We will not discriminate against you for exercising privacy rights.

If you are in the EEA, UK, or Switzerland, we process account and search data as needed to perform the contract you request, to pursue legitimate interests in securing and operating the Service (balanced against your rights), and, where required, based on consent (including for facial-image processing). You may have rights of access, rectification, erasure, restriction, objection, and portability, and the right to lodge a complaint with a supervisory authority. International transfers are made to the United States through our processors, who maintain their own transfer mechanisms (such as contractual clauses) where required.

The Service is hosted in the United States. If you access it from another country, you understand that your information will be processed in the United States, which may have different data-protection rules than your residence.

We may update this Policy. The “Last updated” date will change, and material changes will apply going forward. Continued use after the effective date constitutes acceptance of the revised Policy, except where applicable law requires additional notice or consent.

Privacy requests and questions: hello@doubletaken.com.