Privacy Policy

Welcome to Unscripted. The Service is operated by Unscripted Technology LLC, an Oregon limited liability company (Oregon Secretary of State Registry Number 258003293) with its principal office at 9233 SE Harney Court, Portland, Oregon 97266 ("we," "our," "us," or the "Company"). We are committed to protecting your privacy and being transparent about how we collect, use, and share your information. This Privacy Policy explains our practices regarding your personal data when you use the Unscripted mobile application and services.

1. Information We Collect

1.1 Information You Provide

• Account Information: Email address, password (encrypted), name, date of birth, and gender identity
• Profile Information: Bio, photos, relationship intentions, and preferences
• Location Data: Your approximate location to show you potential matches nearby. We collect your location based on your device settings
• Communications: Messages you send through our platform to your matches
• User Preferences: Search radius, age range preferences, gender preferences, and notification settings
• Payment Information: If you complete the optional one-time $1.00 account-verification charge, your payment card details are entered into and tokenized by our payment processor, Stripe. We never receive or store your full card number — only Stripe's transaction identifier and the verification outcome.

1.2 Information Collected Automatically

• Usage Information: Your interactions with the app (likes, passes, matches, messages sent/received)
• Device Information: Device type, operating system version, app version, device identifiers
• Log Data: IP address, access times, pages viewed, and actions taken
• Push Notification Tokens: Device tokens for sending you notifications

2. How We Use Your Information

We use your information to:

• Provide Our Service: Create and manage your account, show you potential matches, facilitate connections and messaging
• Improve Our Service: Analyze usage patterns to improve app functionality and user experience
• Safety and Security: Verify accounts (including confirming you are a real person via an optional one-time $1.00 card-verification charge), prevent fraud and abuse, enforce our Terms of Service
• Communications: Send you notifications about matches, messages, and app updates
• Legal Compliance: Comply with legal obligations and respond to lawful requests

3. How We Share Your Information

3.1 With Other Users

• Your profile information (name, age, photos, bio) is visible to other users in your discovery queue
• Your location is shared as an approximate distance (e.g., "5 miles away"), not your exact coordinates
• Messages are visible to your matched users only

3.2 With Service Providers

Each service provider is bound by confidentiality and a written agreement, and may only use your information to provide services to us:

• Heroku (Salesforce): Application hosting and Postgres database
• Cloudflare R2: Profile-image object storage
• Cloudflare: DNS and CDN
• Apple Push Notification Service (APNs): For delivering push notifications to iOS devices
• Google AdMob: Non-personalized in-app advertising (NPA=1; subject to Google's privacy policy)
• Sentry: Crash and error reporting (PII-scrubbed at the SDK boundary)
• OpenAI: Text content moderation for messages and bios
• Stripe: Payment processing for the optional one-time $1.00 account-verification charge. Stripe is a PCI-DSS Level 1 provider; your card is tokenized and we never receive or store your full card number (subject to Stripe's privacy policy)

3.3 For Legal Reasons

We may disclose your information if required by law, court order, or to:

• Comply with legal processes or government requests
• Protect our rights, property, or safety
• Investigate potential violations of our Terms of Service
• Prevent fraud or illegal activities

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

4. Data Storage and Security

• Encryption: Passwords are encrypted using industry-standard bcrypt hashing
• Secure Connections: All data transmission uses HTTPS/TLS encryption
• Data Centers: Your data is stored in secure data centers maintained by our hosting providers
• Access Controls: We implement strict access controls to limit who can access your data
• Regular Security Audits: We regularly review our security practices

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

5. Your Rights and Choices

5.1 Access and Update

• You can access and update your profile information through the app settings
• You can change your preferences, notification settings, and privacy settings at any time

5.2 Data Export

• You can export your data in a machine-readable format (JSON) at any time via Settings → Privacy → Download My Data
• You may also request a copy by contacting us, and we will respond within 30 days

5.3 Account Deletion

• You can delete your account through the app settings
• Deletion begins a 30-day grace period during which you can restore your account; after 30 days, your profile, photos, messages, and personal information are permanently deleted from production
• Some information may be retained for legal or security purposes (e.g., safety reports)
• Backup copies age out within 90 days

5.4 Location Settings

• You can control location access through your device settings
• Disabling location will limit your ability to see nearby matches

5.5 Marketing Communications

• You can opt out of promotional communications through app settings
• You will still receive essential service-related notifications

6. Data Retention

We retain your information for as long as your account is active or as needed to provide our services. Specific retention periods:

• Active Accounts: Data retained while your account is active
• Deleted Accounts: 30-day grace period during which you can restore; after 30 days, data is permanently deleted from production and backups age out within 90 days
• Legal Requirements: Some data may be retained longer to comply with legal obligations
• Safety Data: Reports of abuse or violations may be retained for safety purposes
• Payment-Verification Records: If you complete the $1.00 verification charge, the Stripe transaction identifier and verification outcome (never your card number) are retained for 7 years for tax and accounting compliance

7. Children's Privacy

Unscripted is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under 18. If we discover that we have collected information from a minor, we will delete it immediately. If you believe we have information about someone under 18, please contact us.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using Unscripted, you consent to the transfer of your information to our facilities and service providers wherever located.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about the personal data we collect, use, and share
• Right to Delete: You can request deletion of your personal information
• Right to Opt-Out: You can opt out of the sale of personal information (Note: We do not sell your personal information)
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us using the information below.

10. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request copies of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Request limitation on processing your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent at any time

Legal Basis for Processing: We process your data based on:

• Your consent for profile creation and matching
• Performance of our contract with you (Terms of Service)
• Legitimate interests in providing and improving our service
• Compliance with legal obligations

11. Third-Party Services

11.1 Google AdMob

We use Google AdMob to display advertisements. AdMob may collect device information and usage data. For more information, see Google's Privacy Policy.

11.2 Apple Services

We use Apple Push Notification Service (APNs) to deliver notifications. Apple may collect device tokens and delivery metrics. See Apple's Privacy Policy.

11.3 Stripe

We use Stripe to process the optional one-time $1.00 account-verification charge. Your card details are entered into and tokenized by Stripe (a PCI-DSS Level 1 provider); we never receive or store your full card number. See Stripe's Privacy Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you through:

• In-app notification
• Email notification to your registered email address
• Prominent notice on our website

Your continued use of Unscripted after changes take effect constitutes acceptance of the updated Privacy Policy.

13. Contact Us