Privacy Policy
Last updated: June 2026
Your data is yours. We do not sell it, share it with advertisers, or use it to build profiles for third parties. This policy explains what we collect, why we collect it, who else touches it, and what control you have over it.
We respect your privacy — and we also have a responsibility to protect our members. That means privacy here isn't absolute: it doesn't extend to someone using unmaskd. to harm others. The exceptions are covered below, and they're narrower than they might sound.
What we collect
We collect only what is needed to run the platform:
- Profile information: display name, age (optional), general location (optional), bio (optional), photos (optional), connection goals, interests, communication styles, support needs, ND identifiers, collaboration roles
- Account credentials: email address and a hashed password (we never store your password in plain text)
- Messages and connection activity: messages you send through the platform, and connection/circle activity, are stored to deliver them and maintain your history
- Safety reports and moderation records: reports you file, reports filed about you, and related moderation actions are kept — even if an account involved is later deleted — to enforce our Acceptable Use Policy and keep the community safe
- Payment information: if you make an optional support contribution, our payment processor (Stripe) handles your card details directly — we receive limited metadata such as the amount and payment status, never your full card number
- Device and security logs: browser type, OS version, IP address, and login/authentication activity, used for compatibility, bug reporting, and detecting fraud or abuse — not for tracking or advertising
- Cookies: a session cookie to keep you logged in. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics on unmaskd today
What you control
Your profile has granular visibility controls:
- ND identifiers: you choose whether these are shown publicly, shown only to connections, or hidden entirely
- Support needs: same controls — you decide who sees them
- Communication styles: shown or hidden at your discretion
- Location: if provided, only a general area (city or region) is ever shown — never an exact address or coordinates
- Photos: all photos you upload can be removed at any time; removal is immediate
What we will never do
- Sell your data to third parties
- Share your data with advertisers
- Use your neurodivergent identifiers or support needs for ad targeting
- Show ads on this platform
- Use your data to train AI models without explicit, separate opt-in consent
- Store support-sensitive information in browser caches accessible offline
- Share your messages with anyone other than the intended recipient — outside of the limited safety and legal situations described below
Service providers
We use a small number of service providers to operate unmaskd, and only share what each one needs to do its job:
- Payment processing: Stripe, for optional support contributions
- Hosting and cloud storage: to run the platform and store photos/media
- Email delivery: to send account, safety, and transactional emails
- Moderation tooling: to help review reports and enforce the Acceptable Use Policy
These providers only receive the data necessary to provide their service to us, and are not permitted to use it for their own advertising or profiling purposes.
Law enforcement and legal requests
We may disclose account information in response to valid legal process, or where we reasonably believe disclosure is necessary to prevent imminent harm. See our Law Enforcement Requests page for details on how these requests are handled.
Data boundaries
Profile data is separated into two layers:
- Public profile data — information visible to other users according to your visibility settings: display name, bio, connection goals, interests, and any profile sections you have set to public
- Private account data — email address, exact age, full message history; never shown to other users
These two data types are stored and returned through separate code paths. A bug that leaks public profile data cannot also leak private account data.
Deleting your account
You can request account deletion at any time from your profile settings. Deletion removes all of your personal data — profile, messages, photos, and account credentials — within 30 days. If something you were involved in is still under active review, like an open safety report, we keep what's needed for that a little longer. Anonymised aggregate data (e.g. "X% of users are interested in music") may be retained but cannot be linked back to you.
Questions
Questions about your data or this policy? Email [email protected] or see our Contact page. We aim to respond within 5 business days.