Law enforcement and safety requests
This page is for police services, courts, regulators and legal counsel who need information from Churr, or need us not to delete it. If you are a member of the public, the section you want is "Law enforcement and safety requests" in our Privacy Policy.
Churr is a Toronto product operated in Canada. Our records are stored in Canada (ca-central-1, Montréal).
Where to send a request
[email protected] — for preservation demands, production orders, warrants, emergency disclosure requests and questions about any of the above.
Please include:
- the legal instrument itself, as a PDF, signed and dated;
- the issuing authority, the file or court number, and the date you need a response by;
- the account identifier you have. A phone number in E.164 form is the most useful. We store phone numbers only as one-way hashes, so we can tell you whether a number matches an account, but we cannot give you a number we were not given;
- the date range you need, which is almost always narrower than "everything".
We acknowledge within 5 business days and respond to a valid order within 30 days, or sooner if the order requires it.
What we require
We disclose records to law enforcement when we are compelled by valid legal process, or in the emergency circumstances below.
For content and subscriber records, that normally means a production order under section 487.014 of the Criminal Code, or a warrant or order of equivalent force. We ask for one because *R. v. Spencer*, 2014 SCC 43, holds that there is a reasonable expectation of privacy in information that identifies an internet user, and that a request made without lawful authority does not create the authority to answer it. We do not treat a letter or an email from an officer as an order, and we will say so and ask for the order.
Requests from outside Canada should come through a Mutual Legal Assistance Treaty request or an order recognised by a Canadian court.
Preservation demands
A preservation demand under section 487.013 obliges us to stop deleting specified records. It does not entitle anyone to read them, and we do not disclose anything on a preservation demand alone.
On receipt we place an internal legal hold on the account. A hold pauses our deletion schedule for that account's records and does nothing else: no one outside Churr sees anything, and the person is not restricted in any way because of it. Holds have an end date — 12 months by default — and we release them when they are no longer needed. If you need a longer period, say so and we will extend it on the record.
What we hold, and what we do not
What exists:
| Category | What it is |
|---|---|
| Account | Creation date, city and neighbourhood (never an address), settings, account status. |
| Identity | A peppered one-way hash of the phone number. We cannot reverse it. The number itself is held by our sign-in provider, not by us. |
| Profile | The "twin" profile the person built: interests, availability, facts they told it. |
| Written by the person | Interview transcript, daily check-ins, messages in a plan's group chat, meet check-ins, reports they filed. |
| Written by the system | The AI-to-AI conversations between two twins, the notes a twin wrote about a plan, and moderation records. |
| Activity | Introductions, plans, who was on them, when and where they were meant to meet (a public place, by design). |
| Logs | Server request logs, held by our hosting provider for 7 days and by us for no longer. |
What does not exist, in any form:
- photographs, video, or any face image — the liveness check retains no image;
- contacts, address books, calendars;
- precise location or GPS history — we store a neighbourhood, never coordinates;
- payment card details — payments go through Apple and Stripe on their own systems;
- any ability to intercept, wiretap, or read a message before it is sent;
- any ability to recover content that our retention schedule has already destroyed.
Our published retention schedule is in the Privacy Policy and it runs automatically. The only thing that pauses it is a legal hold, which is why a preservation demand matters and why sending one early is worth doing.
Emergency disclosure
Where there is an imminent risk of death or serious bodily harm, we may disclose the minimum information necessary to prevent it, without waiting for an order. PIPEDA section 7(3)(e) permits disclosure required by law, and section 7(3)(c.1) permits disclosure to a government institution with lawful authority in specified circumstances.
Send an emergency request to [email protected] with EMERGENCY in the subject line, the nature of the risk, and the identifier. A named person at Churr decides, the decision and its reasons are logged, and we disclose the minimum that could help rather than an account.
Notice to the person
We will make reasonable efforts to notify a person before we produce information about them, so that they have an opportunity to object.
We will not do that where an order or the law prohibits notice, or where we believe notice would create a risk to someone's safety. If you need a non-disclosure provision, ask the court for one and include it — we will honour it.
Safety reports and our own holds
When somebody reports a serious safety problem through the app — a threat, violence, sexual misconduct, or a person under 18 — we automatically preserve the records of that interaction on both accounts for up to 12 months. Half a conversation is not a record of what happened, which is why it is both.
This means that if an incident is reported to us at the time, the records are likely to still exist months later even though our ordinary schedule would have destroyed them. It also means that an account deleted during that period has left the product entirely while the underlying records remain until the hold ends. The person is told that at the time.
Transparency
We intend to publish a transparency report annually: how many requests we received, of what kind, from which jurisdictions, and in how many we produced information. The first covers our first full year of operation.
Contact
Churr is an early-stage product operated by a very small team. We will answer every valid request, and we will tell you honestly when the thing you have asked for does not exist.