Privacy Policy

• Account: email address, sign-in method (email or Google), and your 21+ confirmation.
• Profile: display name, age range, city or general area, bio, preferred methods, favorite strains, purpose or intent tags, and the photos you upload.
• Social activity: swipes, matches, chat messages, voice-call metadata such as start time and duration (we do not record call audio), sesh RSVPs and strain ratings.
• Chronic AI: the prompts you send and the replies generated for you.
• Store: cart contents, orders, order items, shipping address and fulfillment status.
• Technical: device and browser type, approximate region from IP, timestamps, error logs, and security events such as failed sign-ins.

We do not ask for government ID, precise GPS location, health records or payment card numbers. Card details, when payments are enabled, go straight to the payment processor and never touch our database.

• Run the core features you asked for: matching, chat, calls, seshes, the strain library and your orders.
• Keep the community safe: enforce the 21+ rule, detect spam and bans, investigate reports.
• Support you: answer emails, fix bugs, restore accounts.
• Improve the app: aggregate, de-identified usage patterns to tune recommendations and content.
• Legal: comply with the law, respond to lawful requests and defend our rights.

We do not use your data for third-party advertising, and we do not sell or rent personal information.

• Other members see your display name, photos, area, bio, methods, favorite strains and purpose tags — treat that as public inside the app.
• Chats and calls are visible to you and the member you matched with; our team can access message content only when investigating a report or a legal request.
• Your email, order history and account settings are never shown to other members.
• Nothing is published to the open internet by us — Paper Bag profiles are behind sign-in.

We use a small set of processors to run the app. They act on our instructions and are not allowed to use your data for their own purposes.

• Cloud database, authentication and file storage for accounts, profiles, photos and orders.
• AI model provider to generate Chronic AI replies and marketing imagery.
• Peer-to-peer signaling for voice calls — audio flows directly between devices where possible.
• Email delivery for sign-in links and transactional notices, and a payment processor for store checkout.

• Traffic is encrypted in transit with HTTPS, and data at rest is encrypted by our cloud provider.
• Row-level database rules mean each member's private rows are readable only by that member or an authorized admin path.
• Uploaded photos live in a private bucket served through short-lived signed links, not public URLs.
• Admin capabilities are gated behind a separate server-side role check, never a client-side flag.

No system is perfectly secure. We do not claim end-to-end encryption, and we do not claim any external certification. If a breach affects you, we will notify you as the law requires.

• Account, profile and photos: until you delete them or delete your account.
• Messages and matches: until either member deletes the match or their account.
• Chronic AI conversations: kept for abuse prevention and quality review, then pruned.
• Orders and store records: retained as long as tax and accounting rules require, even after account deletion.
• Security and moderation logs: kept for a limited period, longer where an active investigation or ban is involved.

• Edit or remove your profile details and photos any time from Profile.
• Delete your account from Profile — this removes your profile, photos, swipes, matches and messages.
• Ask for a copy of your data, correction of it, or deletion by emailing support@paperbag.app.
• Opt out of non-essential email by using the unsubscribe link; account and order emails are required to run the service.

Depending on where you live you may have additional rights, such as access, portability, objection or lodging a complaint with your local data protection authority. We will not treat you differently for exercising them.

Paper Bag is 21+. We do not knowingly collect data from anyone under 21. If we learn an account belongs to a minor, we delete it and its data.

If we make a material change we will announce it in-app or by email before it takes effect. Privacy questions and requests: support@paperbag.app.