Privacy Policy

Churr is run by a single person in Toronto — a sole proprietorship registered in Ontario, Canada. This policy describes what Churr collects, why, where it goes, how long it stays and what you can make us do about it. It is written to be read, not to be survived.

If you want to talk to a human about any of it, write to [email protected]. That address reaches the person accountable for privacy at Churr, which under PIPEDA has to be a named individual, and is.

The short version

• No address. No date of birth. No background location, ever — Churr cannot see where you are when the app is not open in front of you, and it never asks to.
• We store your phone number only as a one-way hash. The sign-in service that texts you the code holds the number itself, because a code cannot be sent to a hash.
• We do not sell your information. The app now contains an advertising network's software, and it is dormant: nothing starts it, and it reads nothing, unless the network-ads feature is switched on. It is off.
• Your twin's conversations are used to run the product. They are used to *improve* the product only if you switch that on, and it is off unless you do.
• How you use the app is measured only if you switch it on, and never by a third party.
• Everything Churr stores lives in Canada. Your twin *thinks* in the United States, because the AI provider that runs it is American. The kinds of company involved are described below, and every one of them is named on a separate page, linked from there.
• Delete your account and everything derived from it goes, including the conversations your twin had with other people's twins.

What we collect, and why

Your phone number. To create the account and to make sure one person is one account. We store a peppered SHA-256 hash — a fixed-length string that cannot be turned back into your number by anyone who does not also hold our server secret. We keep it because we need to recognise you next time, not because we want to call you. That is true of our own systems. The sign-in service that sends your one-time code holds the number in readable form, because that is where the code goes, and the text-message carrier it uses sees the number each time a code is sent. Both are named on the recipients page.

That you are 18 or over. A timestamp, set when you tap the toggle on the age gate. No date of birth is collected or stored. Collecting a birthday to prove someone is not a child means collecting a child's birthday.

A liveness check. Once, when you sign up, Churr checks that there is a real person behind the account. Our server picks three things at random — look left, look right, look up, smile, close your eyes — your phone takes one photograph for each, and those three photographs are sent to us, looked at, and deleted. No photograph is kept: not on your phone, not on our servers, not in a backup, not in a log. There is nowhere in Churr that a photograph of your face is stored, and there is no way to ask us for one, because there is none to give.

What we keep is that a check happened, when, how sure it was, and which service did the looking — today that is either our own code or Amazon Rekognition, and the screen and your data page both name it. It is a check that a live person is there. It is not identity verification: Churr never asks for a document, never learns your name from one, and never compares you to any government record.

*One thing we keep that is worth spelling out.* When the check is run by Amazon Rekognition, we also keep a short scrambled code worked out from the rough geometry of the face in the first photograph — roughly how far apart the eyes and mouth are, rounded coarsely, then put through a one-way scramble with a secret only our server holds. It is not a picture and it cannot be turned back into one. It exists for a single purpose: so that somebody banned for hurting people cannot walk straight back in on a new phone number. It is a blunt instrument — it recognises somebody coming back the same afternoon and will usually not recognise them months later — and we would rather say that than overstate it. A deployment can be configured to keep no such code at all, and if you are in a province whose law treats this as biometric information, that is the setting we run.

Your neighbourhood. Typed by you, in words ("Roncesvalles"). It is used to decide which introductions and which open plans you see. It is a word, not a position, and it is the only location fact about you that Churr keeps.

Where you are — only while the app is open, and only for one of three things. Churr asks for location permission *while using the app*. It never asks for the other kind, the one that lets an app follow you in the background: that permission is not in the app at all, and there is no code in it that could use one. Nothing is asked for when you open the map; the request comes the first time you tap something that needs it.

There are exactly three, and they are different from each other:

1. Finding yourself on the map. Your position is used to move the map and is not sent anywhere. It never leaves your phone. 2. Checking in at a place ("I'm here"). Your position is sent once, we check whether it is inside that place's circle, and we throw it away. What is written down is *which place* — a park, a market, a square — and never where your phone was. 3. "Share on my way" on a plan. Your position is shared with the other people on that one plan, so they can see you are nearly there. It runs from the moment you tap it until the plan starts plus an hour, or until you stop, whichever comes first — and it pauses whenever Churr is not open on your screen, because that is the only kind of permission the app has. We say that plainly on the screen while it is running, rather than letting you believe it is still going. The locations are deleted within two hours, they are never included in a data export, and nobody outside that plan can see them.

Saying no to the permission leaves everything else working: the map still opens, the places are all still there, and you can still make a plan.

A trusted contact, if you set one. You can save one person's phone number so the app can fill in a text telling them where you are going. We do not store the number. We store a scrambled version of it, the name you gave them ("Mum") and the last two digits, so the app can show you which number you saved. We never text them. The message is written on your phone, in your own messages app, and you send it.

Who invited you, and who you invited. If you arrive with somebody's invite code, we record that they invited you — two account references, a stage (joined, twin finished, met somebody) and the dates. That is the whole of it: no phone number, no device identifier, and no attribution service of any kind. The code reaches us because you typed it or because the link you tapped opened the app with it in; nothing reads your clipboard, nothing fingerprints your phone, and no outside company is told that you installed Churr.

It is used for one thing — working out whether the person who invited you has earned a month of Churr Plus — and neither of you is ever shown the other's list. Settings shows the person who invited you a count and a sentence, never a name. The record goes when either account goes.

The interview, and your twin. What you say when your twin is built, and the profile it produces: your first name, an age band, your interests, what you are looking for, when you are usually free, and the things you have told it not to say. Every fact is marked shareable or private, by default private, and only the shareable ones can reach another person's twin.

Daily check-ins. Short exchanges with your twin, and whatever it learns from them.

Introductions, plans, chats and check-ins after a meeting. Who you were introduced to, what you agreed to do, what you said in the group chat, and whether you met.

The overnight conversations. Your twin and another person's twin have a conversation while you are asleep. It is stored once, and both of you can read every word of it.

Your gender, and who you'd like to meet — if you fill them in. Both are optional and both are blank until you choose. You may say you are a woman, a man, non-binary, or that you would rather not say; and you may say which of those you would like to be introduced to, or leave it empty, which means anyone. We use them for exactly one thing: deciding whether two people can be introduced at all. It works both ways — you have to be somebody they would like to meet, and they have to be somebody you would like to meet — so nobody's preference quietly overrides anybody else's. It is never shown. Not on your card, not in an introduction, not in anything your twin says, not to the people you meet. Nobody can ask the app what your gender is, because there is no way for it to answer. Your own data export contains what you set, because it is yours; the plain readable summary in it says only that you set something. We do not ask about, store, or work out your sexual orientation.

A duo, if you make one. If you pair up with somebody so that your twins go out together, we store the two accounts, who invited whom, and the dates. That is all of it — there is nothing in a duo but the two of you and a state. Either of you can end it at any time without the other agreeing, and when either of you deletes your account the duo is deleted with it.

Questions asked of your twin. If your card is public and the feature is on, somebody signed in who found your card can type one question, and *your* twin answers it from the things you marked shareable. We store the question, the answer, and who asked. Before it is stored we strip anything that looks like a phone number, an e-mail address, a web link or a social handle out of the question. Your twin refuses, always, to answer anything about where you are or usually are, how to reach you outside Churr, or when you are free — and it says so rather than guessing. You can hide any question from your own inbox, you can block whoever asked, and the whole lot is deleted after three months.

Push tokens. An opaque device identifier, so the morning can arrive.

How you use the app — only if you switch it on. If you turn on "Measuring how Churr is used" in Settings → Your data, the app records which screens you open and when, and the named things you do in it (opening the app in the morning, saying hi to an introduction, declining one and the reason you picked, locking a plan). Each record is a screen name and a few numbers or labels — never anything you typed, never a venue, never a neighbourhood, never your phone number. It is kept by us, in Canada, in the same database as everything else; there is no analytics company involved and nothing about it is shared. We use it for one thing: to tell whether people who are introduced actually meet, and where the way in loses people. It is off unless you switch it on, you can switch it off at any time, and nothing about the product changes either way.

Server logs. Request paths, status codes, timings, your user id, and the internet address your phone connected from. Never message contents, never a profile, never a transcript, never your phone number. This is enforced in code, not by policy. The logs are kept by our hosting provider for seven days and by nobody else; see the retention table.

We do not collect: contacts, your address book, calendar contents, health information, payment details, or anything about you from other services. We collect no location at all in the background, at any time, for any reason.

Why we are allowed to (lawful basis)

Under PIPEDA, we rely on your consent, which we ask for in plain words at the point of collection and record. There are six separate consents, and they are separate on purpose — one "I agree" covering all of them would make the ones you can withdraw inseparable from the ones you cannot:

1. The terms and this policy, when you sign up. Recorded on the first screen, before we ask for your phone number. 2. Using the interview to build your twin. Without this there is no product. Recorded when you approve your twin on the Twin Review screen — nothing runs before that. 3. Using your twin's conversations to improve Churr — including testing changes against real examples. This is off by default, it is a separate switch in Settings, and turning it off later takes effect immediately. 4. Processing in the United States, disclosed and acknowledged at the same moment as 1. 5. Personalised ads. Off unless you allow it. This is what the iOS "Allow tracking?" prompt records, and it only ever means one thing: whether an advertiser may use your device's advertising identifier to choose which ads you see. Saying no costs you nothing — you see the same number of ads, chosen without it — and you can change your mind in Settings. Your answer is recorded either way, because "asked and declined" and "never asked" are different facts. 6. Measuring how Churr is used. Off unless you switch it on in Settings → Your data, and you can switch it off there at any time. Nothing about the product changes either way.

For anyone in the EU or UK reading this, the equivalent GDPR bases are Art. 6(1)(b) (performance of the contract) for 1 and 2, Art. 6(1)(a) (consent) for 3, 5 and 6, and Art. 6(1)(f) (legitimate interests — keeping the service safe) for the safety and moderation records described below.

Where your information goes

Everything Churr stores sits in a database in Canada (Montréal). A small number of companies handle parts of it for us, and they fall into these kinds:

• A database and sign-in service, in Canada. Holds everything the app stores, and holds your phone number in readable form so it can send you the sign-in code.
• A text-message carrier, which the sign-in service uses to deliver that code. It sees your number and the code, once per sign-in, and nothing else.
• An AI provider, in the United States. Runs the model your twin is made of. It receives your twin profile, the interview transcript, check-in text and the twin-to-twin conversations — never your phone number, never anything you marked private. Its commercial terms provide that what we send is not used to train its models; we rely on those terms rather than paraphrasing them.
• A push notification service, in the United States, and the phone maker's own notification system. They receive the notification text, which can include other people's first names, and your device push token.
• A hosting provider, in Canada. Runs our server and keeps its request logs, including the internet address your phone connected from, for seven days.
• A crash reporter, in the United States, only when crash reporting is switched on for the build. Receives the error, your phone model and system version, and an opaque account id — never anything you or your twin wrote.
• A payment provider, only when a paid feature is on. Takes your card on its own page so we never see it; we are told the outcome and keep a reference.
• An advertising network, only when network ads are on. Its software reads your device's advertising identifier only if you allow tracking when iOS asks; none of it passes through us.
• An event listings source and the website host. Neither receives anything from your account.

The names behind each of those, what each one receives and where it is are on one page, Who handles your information. That page changes when a company changes and does not need a new version of this policy; this policy changes when the kind of processing changes, and that does ask you to accept it again.

Under PIPEDA a transfer for processing is a *use*, not a disclosure, and it does not need separate consent — but it does have to be told to you, and Churr stays accountable for what those companies do with it. Your information leaves Canada for the companies marked as being in the United States above, and for nothing else.

Under GDPR the recipients outside Canada are transfers to a third country under Chapter V and are made on each company's standard contractual clauses.

We do not sell your personal information and we do not share it with data brokers, advertisers or ad networks. The app contains an advertising network's software, and it is dormant: nothing starts it, and it reads nothing — not your advertising identifier, not anything else — unless the network-ads feature is switched on, and it is off. When it is on, that software fills the ad slots and reads your device's advertising identifier only if you allow tracking when iOS asks; this policy will say so in the present tense before that happens. There is no tracking pixel, and no analytics company: measuring how the app is used, if you switch it on, is done by us and shared with nobody.

Sponsorship and advertising

Churr has features, currently switched off, that would let a venue or an organiser sponsor an event or a slot in the plans list. To be accurate about what those would and would not do:

• A sponsored item is labelled as sponsored on the card, in the same words every time.
• A sponsor does not receive your personal information. They do not learn who saw the item, who it was shown to, or anything about you. They get counts.
• Sponsorship never changes who your twin is introduced to. Matching is not for sale.
• If any of that ever stops being true, this section changes before the feature ships, and the change makes you re-accept this policy.

Every one of those features is behind a switch that is off today. This section describes them because the honest time to describe an advertising model is before it exists, not after.

How long we keep things

Photographs

Once a plan is locked in, the people on it can put photographs in its chat. Three things about those, in order of how much they matter:

The picture is shrunk and stripped on your phone, before it is uploaded. A camera writes the place a photograph was taken into the file. That is an address, and this product does not hold addresses — so the tag is removed on the device, by the app, and the original never reaches us. Doing it at our end would have meant the file with the coordinates in it existed on our disk for the length of one upload, and "we deleted it immediately" is a weaker promise than "we never had it".

Nobody outside the plan can see it. The pictures live in private storage. Every time one is shown, the app is handed a link that works for one hour and then stops working. There is no permanent address for a photograph in Churr and there is no way to guess one.

They go 30 days after the plan. The clock runs from when the plan was, not from when you took the picture, so one afternoon's photographs are destroyed together. The picture itself is deleted from storage; a record that it existed is kept a little longer, because a report about a photograph has to stay reviewable after the photograph is gone.

The map, the places, and "on my way"

Churr has a map of Toronto with 48 public places on it — parks, markets, squares, a boardwalk — that you collect by *meeting somebody* at one. Three things about it:

The places are places. Their positions are public information about public land. Nothing on the map is a position of a person, with the one exception below.

A place fills in when two of you say you met there. Not when you walk past it, and not on your word alone: the other person has to say it too. Tapping "I'm here" while you are standing in one draws its outline, and for that we check your position against the place and then discard it.

Your friends see a circle, not a pin, and only if you say so. In Settings → Safety you can let the people you have met see roughly which neighbourhood you are in. It draws a soft circle about a kilometre across over the neighbourhood you typed when you joined — not where you are, not where you live, and never a moving dot. It is off unless you turn it on, and turning it off takes it away again.

"Who's around" — the same circle, shown to strangers, and only if everyone involved said yes. There is a second switch, separate from the one above, and it is separate on purpose: that one is about people you have actually met, and this one is about people you have not.

If you switch it on and you have published a card, then people who have *also* done both of those things can see the same kind of circle over your neighbourhood, and tap it to open the card you published. Four things all have to be true before anybody appears on anybody's map:

• they have a Churr Plus subscription — seeing this is part of Plus, being seen is not;
• they have published a card and switched this on, so nobody can look without being visible in return;
• you have published a card and switched this on;
• neither of you has blocked the other.

It is off for everybody until it is switched on, it was off for every account that existed on the day it shipped, and switching it off takes you off other people's maps on their very next look. What is shown is the same neighbourhood circle as above — never a pin, never where you are now, never a coordinate that belongs to you, and never anything that says when you were last there.

Your card, if you make one

You can publish a card at churr.io/n/<your handle>, which anybody with the link can open. It is off unless you switch it on, and it was off for every account that existed on the day it shipped.

What is on it: your bird, a name you chose (or a stand-in naming only your neighbourhood, if you chose none), your neighbourhood, your badges, your top three kudos as counts, how many people you have met and how many plans you have hosted, and one line your twin wrote about you. What is not on it, and cannot be: a venue, a date, another person's name, anything you marked private, or anything a twin said about somebody else.

The handle is eight random characters. It is not your name and nothing about you can be used to guess it — which is what stops the card from being a way to look people up. You can switch the card off at any time, and you can change the handle, which makes every link anybody already has stop working.

A job runs daily and enforces every row in that table with a number in it, except the server logs, which live at the hosting provider and are deleted on its clock. The schedule is not a promise about intentions; it is a description of a program.

Your rights

Under PIPEDA you can ask us for access to everything we hold about you, ask us to correct it, and withdraw consent. Under GDPR — which applies to you if you are in the EU or the UK — you also have rights to erasure, restriction, objection and portability, and the right to complain to your supervisory authority.

In the app, without asking anyone:

• Read everything your twin knows — Settings → What your twin shares — and edit it.
• Fix your name, your neighbourhood and your age band — Settings.
• Export everything — Settings → Your data. You get a JSON file with your profile, your facts, your transcripts, your plans, your check-ins, your flock, your consents, your settings, the people you have blocked, the reports you have filed, and anything you have bought. The other person's side of a conversation is included only where both of you can already read it, and their private facts are never in it. Two things are deliberately left out: reports other people have made about *you*, which are their words about their own experience, and your device's push token, which is a live credential and not something to put in a downloadable file.
• Turn off product-improvement use — Settings → Privacy.
• Delete your account — Settings → Delete my account. Two taps from anywhere. It purges synchronously: your account, your twin, your transcripts, your plans, your messages, your push tokens, and the twin-to-twin conversations you were part of — which are deleted for the other person too, because a conversation belongs to both of you. Any record of how you used the app goes with the account.

Two things about other people, because they are not obvious. A plan you were hosting is called off, and its group chat stays open for the people who had joined — the plan is cancelled, your name comes off it, and what you wrote in the chat is blanked in place, but the conversation and everyone else's messages in it are theirs and are not yours to delete. A plan you had merely joined stays in the same way, minus your seat. And a report someone else has filed about you is kept, with your identity removed from it: deleting your account is not a way to clear a safety record somebody else wrote.

By email to [email protected], or in the app under Settings → Your data → Make a request: any of the above, plus objection and restriction. We answer within 30 days, which is PIPEDA's standard and GDPR's one month.

We do not charge for any of this and we do not make you jump through a support queue for it.

Law enforcement and safety requests

Sometimes a police service, a court or a regulator asks us for information about someone, or asks us not to delete it. This section says exactly what happens then, because a policy that is silent about this is a policy that is silent about the moment it matters most.

We do not hand anything over just because we are asked. A request has to be lawful and it has to be specific. In Canada that normally means a production order under section 487.014 of the Criminal Code, or another order or warrant of equivalent force. *R. v. Spencer* (2014 SCC 43) is why: the Supreme Court held that there is a reasonable expectation of privacy in information that identifies an internet user, and that a police request without lawful authority does not create one. We read that as covering the things we hold. A polite email from an officer is not an order, and we say so and ask for one.

A preservation demand is different from a production order, and we treat it that way. A demand under section 487.013 obliges us to stop deleting specific records; it does not entitle anyone to read them. When we receive one we place an internal legal hold, which pauses our deletion schedule for that account and nothing else. Nobody outside Churr sees anything because of a hold.

What we can actually produce. Only what we hold, which is less than people expect:

• Your account row: when it was created, your city and neighbourhood (never an address), your settings. **Not your phone number** — we keep only a one-way hash of it, which cannot be turned back into a number. The sign-in provider holds the number; that is a request to make of them.
• What you wrote: your interview transcript, your check-ins, your messages in a plan's chat, and anything your twin wrote about you or said to another twin.
• What you did: introductions, plans, meet check-ins, reports you filed.
• Server logs for the period the hosting provider still has them, which is seven days.

What we cannot produce, because it does not exist: photographs of you, your contacts, your calendar, your precise location, your payment card, real-time interception of anything, or any ability to read a message before you send it.

We place a hold ourselves when somebody reports a serious safety problem. If a report is filed about a threat, violence, sexual misconduct, or somebody under 18, we preserve the records of that interaction — on both accounts, because half a conversation is not a record of what happened — for up to 12 months, and then they are deleted. This happens automatically, it applies to the person who reported as well as the person reported about, and it means that if you delete your account while one is running, you leave the product completely and the underlying rows stay until the hold runs out. If that is you, the app tells you so at the time rather than letting you believe otherwise.

Emergencies. PIPEDA section 7(3)(e) allows disclosure where a law requires it, and section 7(3)(c.1) allows it to a government institution with lawful authority in specific circumstances. Separately, where there is an imminent risk of death or serious bodily harm we may disclose the minimum necessary to prevent it without waiting for an order. We treat that as a genuinely exceptional power: it takes a named human decision, it is logged, and what is disclosed is the minimum that could help — not an account.

We tell you, unless we are forbidden to. If we produce information about you, we will try to notify you, so that you have the chance to object. We will not do that where an order or the law prohibits it, or where doing so would create a risk to somebody's safety.

How to reach us, and how long we take. [email protected], and the full details are on our law enforcement page. We acknowledge within 5 business days and answer a valid order within 30 days unless it says sooner. We intend to publish a transparency report each year with the number of requests received and the number complied with.

Security

Phone numbers are hashed with a server-side secret. Data is encrypted in transit (HTTPS everywhere) and at rest (the database provider's AES-256). Row-level security policies are written for every table so that, on the paths where a client talks to the database directly, one person cannot read another's rows. Logs are redacted of credentials and request bodies. Everything a user or another user's twin writes is screened for prompt injection before it can reach a model, and anything that trips the screen is quarantined rather than used.

If there is ever a breach that creates a real risk of significant harm to you, we will report it to the Office of the Privacy Commissioner of Canada and tell you, as PIPEDA requires. We keep a record of every breach for 24 months whether or not it is reportable.

Children

Churr is 18+. We do not knowingly collect anything from anyone under 18. If you believe a minor has an account, write to [email protected] and it will be removed.

Automated decisions

Matching is automated: your twin's profile is compared with other people's, a model scores the pair, two twins have a conversation, and the results are ranked. Nobody is accepted or rejected for anything with a legal or similarly significant effect — the outcome is which three introductions you are shown on a given morning. You can pause your twin at any time, decline any introduction, and edit or delete anything the matching reads.

Changes

If this policy changes materially, the app shows you the new version and asks you to accept it. You can put that off — there is a "Later" button, because a sheet you cannot get past on a train with no signal is a worse outcome than a delayed acceptance — and it comes back every time you open the app until you do. The version is recorded with your consent, so we can always say which words you agreed to.

Some features this policy describes as switched off — network ads, paid features, a crash reporter — may be switched on later. Switching one on is a material change: before it happens, this policy is rewritten to describe it in the present tense, and you are asked to accept the version that describes it.

Contact

[email protected] — for anything in this policy, including a data-subject request or a complaint.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in the EU/UK, to your local supervisory authority.