Privacy Policy

About this draft

This is a pre-launch version of QUALIFY's Privacy Policy, published while QUALIFY prepares to open applications. It describes how QUALIFY works today, including safety and security features that may not be turned on yet. It hasn't yet had professional legal review, and we'll update it before applications open.

[Placeholder — attorney-reviewed text required before launch.]

What we collect

Account details (email, password handled by our authentication provider); your application, including your date of birth, sport and athletic background, and the verification evidence you upload; your profile and photos; your discovery preferences; your approximate city-level location; messages and content you share; and billing records from our payment provider (we never see or store full card numbers).

Your location is the city or town you choose (plus any trips or other city you set to explore); we don't collect GPS location.

Technical and security information: when you use QUALIFY, our systems and service providers receive your IP address and basic information about your browser and device, such as the browser type. We use it to run QUALIFY and keep it secure, as described below.

If you only join our early-access waitlist, without an account, we collect just what's described under "Early-access waitlist" below.

[Placeholder — attorney-reviewed text required before launch.]

DATE preferences

DATE uses who you're interested in dating to show you potential matches, which can reveal information about your sexual orientation. We only use it for DATE after you give separate consent, never show it on your profile, and you can withdraw that consent at any time in Settings → Privacy.

[Placeholder — attorney-reviewed text required before launch.]

How we use information

To review applications, run your membership, show you relevant members in DATE, CONNECT and PLAY, deliver messages, keep QUALIFY safe (including reviewing reports and protecting accounts from automated attacks and other abuse), and send you account and application emails.

[Placeholder — attorney-reviewed text required before launch.]

What other members see

Approved members see the profile you publish (name, photos, sport and athletic line, city-level location). They never see your email, exact date of birth, verification evidence, billing details or internal review notes.

[Placeholder — attorney-reviewed text required before launch.]

Security checks and sign-in protection

To protect accounts from automated attacks, we can turn on a short security check provided by Cloudflare, Inc. (Cloudflare Turnstile) on our sign-in, sign-up, password-reset and account-deletion forms. It tells people apart from automated programs. When the check is turned on and runs, Cloudflare receives your IP address, technical information about your browser and connection (such as your browser type), and the website you're using. When we require the check, our authentication provider confirms it by sending Cloudflare the one-time result of the check and an IP address connected with the request. We also use the same check on our early-access waitlist form, which we only offer while the check is on; for that form, our own server confirms the check by sending Cloudflare the one-time result and your IP address. We don't send Cloudflare your email address, password or profile.

Cloudflare uses this information to run the check for us. As described in Cloudflare's Turnstile privacy policy (cloudflare.com/turnstile-privacy-policy), it also uses it to improve its bot detection. When the check is required and can't load (for example, because a browser extension blocks it), you won't be able to complete those forms until it does.

To slow down password guessing and similar abuse, we count recent attempts and actions. These counts are linked either to your account or to a scrambled, one-way code made from your IP address or email address (never the address itself). Counts more than a day old are deleted automatically as the service runs.

Our hosting, database and authentication providers also keep technical records of requests and sign-ins (such as IP addresses, browser type and, for sign-in events, your email address) for a limited time set by those providers, to operate and secure the service.

[Placeholder — attorney-reviewed text required before launch.]

Reports and safety investigations

When a member reports something on QUALIFY, the report keeps a copy of the reported text, such as the message, a photo caption or an event description, so we can review it.

We may also keep a protected copy of reported photos and voice notes as evidence for our safety investigation. This covers photos and voice notes sent in direct messages, photos sent in group chats, and photos in a group's photo gallery. For reports about impersonation, fake identity, sexual content or a suspected minor, it can also include the reported member's profile photos that the person reporting was able to see.

These copies can remain after the original is deleted or the account that shared it is closed. Members can't see them, including the person who made the report. Only authorized QUALIFY moderators can view them, and only after confirming their identity with an additional authentication step (two-step verification). Every view is logged.

We keep these copies while the investigation and any review of it need them, and longer if a safety concern or a legal obligation requires it. We haven't set a fixed period for deleting them and don't currently delete them automatically; if we set one, we'll update this policy.

[Placeholder — attorney-reviewed text required before launch.]

Early-access waitlist

While applications are closed, our sign-up page may offer an early-access waitlist. Joining it isn't an application: it doesn't create a QUALIFY account, doesn't give you access to QUALIFY and doesn't guarantee approval. To become a member, you still need to apply when applications open, like everyone else.

What we collect: your email address, when you joined, and which version of the form's privacy notice you were shown. Only if you tick the separate, optional box, we also record that you'd like occasional QUALIFY news, when you ticked it and the exact wording you agreed to. We don't ask for your name, a password or anything else.

To stop automated and repeated sign-ups, the form uses the Cloudflare security check described above, and we count recent attempts using scrambled, one-way codes made from your IP address and from your email address, never the IP address itself. Like our other attempt counts, those more than a day old are deleted automatically as the service runs. We also keep a one-way code of each completed security check so it can't be used twice; codes more than 15 minutes old are cleared out as new sign-ups arrive.

How we use it: only to contact you about QUALIFY early access and, if you ticked the box, for occasional QUALIFY news. Your waitlist entry is stored with our database provider, Supabase. We don't sell it, use it for advertising or share it with advertisers, and it isn't connected to any QUALIFY account.

How long we keep it: we keep each waitlist entry for 12 months from the day you join, then delete it automatically. If you ask us to remove it sooner, we do that as described below.

Removing your email: you can ask us at any time to remove your email from the waitlist, including if you no longer want news, by writing to privacy@thequalify.club. We may also remove entries ourselves. When an entry is removed, we erase the email address and your news choice straight away and keep only a record without them (the dates, which form and notice were used, and the reason for removal) until the entry's 12 months are up, when it is deleted too. Because the waitlist is separate from QUALIFY accounts, deleting an account or downloading your data from Your data & account doesn't include it.

The waitlist is only for people aged 18 or older. Please don't join if you're under 18; if we learn that an entry belongs to someone under 18, we'll remove it.

[Placeholder — attorney-reviewed text required before launch.]

Where QUALIFY is available

QUALIFY is currently offered only to people in the United States. Our database is hosted in the United States, and some of our service providers, such as Cloudflare and our hosting provider, run global networks that may process information in other countries to deliver their services.

If you visit QUALIFY or join the waitlist from outside the United States, your information will be processed in the United States, where privacy laws may differ from those where you live.

[Placeholder — attorney-reviewed text required before launch.]

Cookies

We only use cookies that are needed to run QUALIFY and keep your account secure. We don't use advertising or analytics cookies.

Sign-in cookies, set through our authentication provider (Supabase), keep you signed in. They hold a short-lived access token and a refresh token that renews it automatically while you use QUALIFY. You stay signed in on a device until you sign out or delete your account; we don't currently end sign-ins automatically after a set time. Your browser deletes these cookies if you don't use QUALIFY on that device for about 400 days.

When you sign out, we remove the sign-in cookies from that browser and also end your sign-ins on your other devices. An access token already issued to another device can keep working for the short time until it expires.

A known-device cookie is set when you sign in from a browser that doesn't already have one. It holds a random code and a check value our server can verify, linking this browser to your account without containing your email address, so someone repeatedly trying your email address can't lock you out of a device you've used before. It expires 180 days after it's set and isn't removed when you sign out.

If you open a link to a group before your membership is active, a cookie remembers that link so we can take you there afterwards. It expires after 60 days.

When Cloudflare's security check is turned on, it may use its own technical storage in your browser to work; see Cloudflare's Turnstile privacy policy.

[Placeholder — attorney-reviewed text required before launch.]

Service providers

We use service providers that process information on our behalf: Vercel (website hosting), Supabase (database and the early-access waitlist, file storage including protected copies of reported content, sign-in, and sign-in emails such as password resets), Resend (account and application emails), Stripe (payments; you enter card details on Stripe's own checkout page) and Cloudflare (the security check on our account forms and our waitlist form, when it's turned on). Each one receives the information it needs for that job. Cloudflare also uses security-check information to improve its bot detection, as described above.

[Placeholder — attorney-reviewed text required before launch.]

Retention and your choices

You can download a copy of your information, or delete your account, at any time from Your data & account.

When you delete your account, you're signed out everywhere and we remove your profile, photos, preferences, location and athletic details, and your verification evidence unless we need to keep it for a safety or legal reason. Your matches end: direct messages you sent are no longer shown to the other person, but their text stays in our records. Messages you sent in groups stay visible to the group under "Deleted member". Photos and voice notes you sent are deleted, except protected copies of reported ones (see "Reports and safety investigations"). We keep some records for safety, legal and billing reasons, such as reports, protected copies of reported content, blocks, the versions of our terms you accepted, and payment records.

How long we keep information: while your account is open, we keep your information so QUALIFY can work for you, and you can delete your account at any time. Download links for your data expire after 30 minutes and work only once; we don't store the file. Sign-in limit counts are deleted after about a day, as described above.

Verification evidence is reviewed by hand and is currently kept until you delete your account. We're working toward deleting it a fixed time after your application is decided, except where an open request for reconsideration, a safety concern or a legal obligation requires us to keep it longer.

After you delete your account, we keep the records described above only for safety, legal, accounting and dispute purposes. We haven't set exact periods for them yet; when we do, we'll update this policy.

[Placeholder — attorney-reviewed text required before launch.]

Age

QUALIFY is only for people aged 18 or older.

[Placeholder — attorney-reviewed text required before launch.]

Changes and contact

When this policy changes in a material way, you'll be asked to review the new version. Privacy questions and requests about your data: privacy@thequalify.club. Help with your account: support@thequalify.club.

[Placeholder — attorney-reviewed text required before launch.]