HugTone Privacy Policy

Last updated: September 9, 2026

This is HugTone's privacy policy. We wrote it in plain English because we want you to actually read it. No tricks, no buried clauses.

The Short Version

We collect data to match you with compatible people. We will never sell your data, and we never give anyone access to it for their own purposes. The only companies that touch your data are the service providers that run HugTone for us, listed in Section 5, and they may only use it on our instructions. Your data exists to serve you, and only you.

1. Who We Are

If you have questions about this policy, contact us at hugtonesupport@gmail.com.

2. What We Collect and Why

Account Information

Phone number — to verify you're a real person. We store a one-way hash, not your actual number.
Email address — for account recovery and important notifications.
Date of birth — to verify you're 18+ and for age-range matching.
Display name — so your matches can identify you after meeting.
Password — stored as a one-way hash. You sign in with your email and password; your phone number is verified separately by text message.

Personality & Compatibility Data

AI conversation responses — your answers during onboarding about values, emotional style, humor, communication, and life goals. This is used to build your compatibility profile.
Compatibility profile — a numerical vector (30 dimensions) generated from your conversation. This is what we use to calculate match scores.
Physical preferences and dealbreakers — what you're looking for and what's non-negotiable.

Why we collect this: Your conversation and its retry copies are retained with your account to build and update your profile. Your original conversation is not shown to other members. Anonymous matches receive compatibility scores. Revealed connections may also see selected trait and interest labels. Sharing lets both of you read an updated compatibility story and per-dimension alignment for values, emotions, life goals, lifestyle, culture and communication, including sensitive dimensions such as religion, politics, children and substances when supported. Alignment on each dimension can indicate where the other person sits on it. Future profile changes are included. Stop sharing stops future reads of the story and alignment, but cannot recall what someone already saw. Sharing alignment alone does not reveal your name or photo. Approved Specific Signals include your identity, compatibility score, summary and Field. Joining a group shares the selected facts described below.

Photos

Profile photo — visible to your Soul Link, to people you exchange Pings with once a Ping is accepted, to the members of a Friendship Blip once the group is active, to matches after a real-life proximity encounter, and through an approved Specific Signal. Until then, matches see you as an unnamed resonance.
ID photo and selfie — used for identity verification. AI compares the selfie to the ID photo to confirm you are the person on the document, extracts the date of birth and gender to confirm you are 18 or older, validates that the document is genuine, and computes a one-way hash of the document number to prevent banned users from re-registering. The selfie and ID images are deleted from our servers immediately after processing — only the verification result, the document number hash, the document type (e.g., "driver's license"), the extracted date of birth, and the extracted gender are retained. We do not extract or store visual attributes like eye color, hair color, height, or ethnicity from your ID. Those come from what you tell us in your profile.
Private photos (photos of you) — analyzed by AI to understand your physical appearance for compatibility matching. These photos are never shown to any other user, ever. They exist solely for our AI to generate an anonymous appearance vector.
Type photos (people you find attractive) — analyzed by AI to understand your physical type preferences. These are also never shown to any other user.

Why we collect this: Photos of you help our AI match you with people whose type you fit. Type photos help us understand what you're attracted to. Neither set of photos is ever displayed to anyone. We extract numerical data from them and use that data for matching.

Location Data

Your latest location — while your beacon is on, the app sends your current coordinates to our server, and we keep only the most recent one. It is used for two things: limiting matches to people within your chosen radius (about 25 miles), and confirming that two people were genuinely near each other (within about 500 meters) before either phone rings, which stops anyone from faking an encounter. We do not keep a history of where you have been, and your coordinates are never shown to other users.
Bluetooth proximity — when the app detects another HugTone user nearby via Bluetooth Low Energy (BLE), it triggers a compatibility check. Your Bluetooth identity rotates roughly every 15 minutes, which makes following you by your beacon impractical. We store the fact that a proximity event occurred, not where it occurred.
Resonance Map presence (optional, off by default) — if you turn on "Show my presence on the map", we record which public area (a grid cell roughly 555 meters across) you were in during each hour, for 30 days. This only ever appears to your compatible matches as an aggregate, and only when at least five people were in the same area; areas we believe to be homes are excluded, and areas we can't classify as public are never shown. Turning the switch off stops recording. "Delete my map history" erases everything recorded, immediately.

Why we collect this: HugTone's core feature is ringing your phone when a compatible person is physically near you. Verifying that requires knowing where both people are at that moment. We keep the minimum: one current location per person, no history, unless you opt into the map.

Device & Technical Data

Push notification tokens — so we can send you notifications, including the incoming-call alert for an encounter. If you use hugtone.com, a browser push subscription serves the same purpose.
Device type — for app compatibility.

We do not collect browsing history, contacts, call logs, or any data unrelated to the HugTone service.

3. How We Use Your Data

Your data is used for exactly three things:

1. Matching you with compatible people — calculating compatibility scores, evaluating physical preferences, and determining type match. 2. Verifying your identity — confirming you are who you say you are. 3. Operating the service — sending notifications, processing payments, and providing customer support.

That's it. There is no fourth thing.

4. What We Will Never Do With Your Data

We want to be unambiguous about this:

We will never sell your data. Not to advertisers. Not to data brokers. Not to AI companies. Not to anyone. Not ever.
We will never give third parties access to your data for their own purposes. No "partners," no "affiliates," no advertisers. The service providers in Section 5 process data only on our instructions, and we disclose data otherwise only as required by law (see Section 7).
We will never use your data for advertising. There are no ads in HugTone. There never will be.
Your original conversation stays private from other members. You control ongoing compatibility sharing with Stop sharing. Group participation allows the selected facts described under AI Processing. Hide stops new discovery and proximity alerts; existing connections may still see what you already shared. Use Stop sharing, Leave group and Block for those separate restrictions.

This commitment is permanent. It is not subject to change with a quiet policy update. If we ever attempted to reverse these commitments, this original policy stands as evidence of the promise we made to you.

5. AI Processing

HugTone uses artificial intelligence (powered by Anthropic's Claude) for:

Onboarding conversation — an AI conducts your personality assessment.
Profile extraction — AI converts your conversation into a structured compatibility profile.
Photo analysis — AI analyzes your photos to extract physical appearance data and type preferences. The AI sees your photos; no human does.
Identity verification — AI compares your selfie to your ID document.
Group introductions and Fellowship naming — By joining, you agree that Rhiannon may send your first name, interests, humour, activity level and your adventure, creativity, compassion, humour and authenticity values to our AI provider for a named group introduction and Fellowship naming. Private conversation notes and essence summaries are excluded. Your identity opens to members once the group is active and you have joined.
Content moderation — AI screens photos and message text against our community guidelines.

Important: When we send your data to the AI for processing, it is sent via Anthropic's API under their commercial terms, which prohibit using our customers' data to train their models. Anthropic may retain API inputs for a limited period for safety and abuse monitoring under its own policy, after which they are deleted. Group introduction and naming requests include accepted members’ first names and the selected group facts above. We do not attach account email addresses or phone numbers to these requests.

5a. Third-Party Service Providers

To operate HugTone, we share specific data with the following third-party services. Each provider operates under their own privacy policy and is contractually bound to use your data only for the purposes described:

Anthropic (AI processing) — onboarding conversation text, photos for analysis and verification, message text for moderation, and first names with selected group facts for introductions and naming. No training use.
Twilio (SMS) — phone numbers when sending verification codes only.
RevenueCat (payment processing) — subscription and purchase status, anonymized user ID. Actual payment information is handled by Apple App Store / Google Play directly; we never receive your credit card.
Sentry (error monitoring) — crash reports and error context. May include your user ID and the screen you were on, never your conversations or photos.
Cloudflare R2 (photo storage) — your uploaded photos, encrypted at rest. Cloudflare also serves hugtone.com.
Stripe (web payments only) — if you buy credits on hugtone.com, Stripe processes the payment; we never receive your card details.
Twilio (phone verification) — the text message with your verification code.
Railway (server hosting) — the encrypted database that holds all HugTone data; Railway operates the underlying infrastructure but cannot access your data.
Expo / Apple APNs / Google FCM (push notifications) — your device's push token only.

We do not sell, rent, or trade your data with any of these providers. They process your data only on our instructions and only for the operational purposes listed above.

6. Data Security

All data is transmitted over HTTPS (encrypted in transit).
Photos are stored on secured servers, not in publicly accessible locations.
ID document numbers are stored as one-way hashes — we cannot reverse them.
Phone numbers are stored as one-way hashes.
Passwords are stored as one-way hashes; phone numbers are verified by text message.
We conduct regular security reviews of our infrastructure.

No system is 100% secure. If we ever experience a data breach, we will notify affected users within 72 hours and provide full transparency about what was accessed.

7. When We May Disclose Data

We will only disclose your data if:

Required by law — a valid court order, subpoena, or legal process compels us.
Preventing harm — we have a good-faith belief that disclosure is necessary to prevent imminent physical harm to a person.
With your explicit consent — you specifically ask us to share something.

Apart from the harm-prevention case above, we will not voluntarily provide data to law enforcement or government agencies without a valid legal order. Where the law permits an emergency disclosure to prevent death or serious physical injury, we may act on it, and we assess each such request ourselves rather than accepting the label. We will notify you when we are legally permitted to do so. How agencies must contact us, and what we require of them, is set out in our [Law Enforcement Guidelines](/law-enforcement).

8. Your Rights

You have the right to:

Delete your data — delete your account from Settings. Account access is removed and live database records are deleted, including profiles, conversations and retry copies, matches, messages, analytics, proximity records and map history. Generated group introductions and starters are cleared and Fellowship names are reset when needed. Photo and service-cache cleanup jobs persist until deletion succeeds; the service reports access removal separately from completion of live-data cleanup. Information another person already copied cannot be recalled.
Modify your data — update your profile, photos, and preferences at any time.
Opt out of proximity matching — go invisible at any time so no tones trigger.

You can delete your account and modify your data directly in the app's Settings. For other requests, contact hugtonesupport@gmail.com.

9. Data Retention

Active accounts — data is retained as long as your account is active.
Deleted accounts — access removal and live database deletion happen during the request. Storage and service-cache cleanup may remain pending during outages and is retried; completed jobs erase their object keys. Ban hashes are retained for preventing banned members from re-registering while the ban remains in force; they are not matching profiles. Provider-retained copies and backups follow their separate retention lifecycle, whose exact deletion timing is not verified here. We do not claim deletion from backups is immediate.
ID verification images — deleted from our servers immediately after verification (see Photos above). Only the verification result, document type, extracted date of birth and gender, and an irreversible hash of the document number are retained, so that a banned person cannot re-register.
Resonance Map presence — 30 days, or until you delete it.

10. Children

HugTone is for users 18 and older. We do not knowingly collect data from anyone under 18. If we discover that a user is under 18, we remove account access and begin deletion using the lifecycle described above.

11. International Users

HugTone data is stored and processed in the United States. By using HugTone, you consent to your data being transferred to and processed in the United States. We comply with applicable data protection laws including GDPR for European users and CCPA for California residents.

12. Changes to This Policy

If we change this policy, we will notify you via the app and email before any changes take effect. We will never reduce your privacy protections without your explicit consent. The commitments in Section 4 ("What We Will Never Do") are permanent and will never be modified.

13. Contact

Questions, concerns, or data requests:

Email: hugtonesupport@gmail.com

This privacy policy is a promise, not a formality. We built HugTone because we believe people deserve better than what the dating industry gives them. That includes how their data is treated.