Privacy Policy

Last updated: October 2026

This policy explains what Dateworthy, operated by Pappas Productions LLC, collects and how we use it. The short version: we collect what we need to run a dating app, we do not sell your data, we do not use it for advertising, and we do not track you across other companies’ apps or websites.

This website collects nothing. These pages are plain HTML and one stylesheet, served as static files. Nothing is loaded from anywhere else, so there is no analytics, tracking pixel, advertising tag or outside font, and no cookie is set. Everything below is about the Dateworthy app, on iPhone and Android.

What we collect, and why

How you sign in: On iPhone, Sign in with Apple. Apple gives us a private id for you that only works with Dateworthy; we don't ask Apple for your name or your email. If you sign in with a phone number instead, we keep the number to create your account and sign you in with a one-time code, and it's how we find your account if you write to us. Neither is ever shown to other users.
Your date of birth: To confirm you are 18 or older and to calculate your age. Only your age is shown to others, never your exact date of birth.
Your profile: The things you type and choose: first name, the prompts you answer, your height, what you’re looking for, lifestyle and background answers, your industry, and the rest of the public profile fields. This is the part other users see.
Your photos: Uploaded by you, part of your profile, and shown to other users. Every photo is screened before it is stored. See Photos and video.
Your verification photos, and a face comparison: Four photos the front camera takes while you get verified, compared with your profile photos. Only with your consent, which the app asks for before the camera opens. Never shown to other users. See Verification photos.
Your location: Required, and foreground only. See Location and Passport for exactly what we do with it.
Your dating preferences: Including who you want to see, so we can show you relevant people. Some of this is sensitive and we treat it that way.
Your private Shadow Search answers: Optional, never displayed on your profile. See Shadow Search answers.
Messages and media in chat: The messages, photos, voice notes, GIFs and video messages you send in a conversation, stored so we can deliver them to the person you sent them to.
Your contacts, only if you turn contact blocking on: Optional. See Phone numbers are stored as hashes.
A push notification token: If you turn notifications on, so we can tell you about new matches and messages. It identifies the device we deliver to, and it is never used for tracking.
Crash reports: When the app hits an error, it sends us the error and where in our code it happened, plus which version of the app is running and your phone’s type and system version. Each time the app starts it also tells us which version started, which screen of our app it was last on and whether it closed normally, with the update system’s own log. A random number the app makes on your phone tells one phone’s reports apart. None of it is tied to your account or phone number, we use it only to fix the app, and it deletes itself after 30 days.
Your IP address, at sign-up and sign-in: Checked against a VPN / proxy / datacenter list, because scam-farm signups come from those addresses. The same check runs once when your phone reports a location far from home, so a faked location can’t earn a free Passport. We don’t use your IP to work out where you are. That comes from your device’s GPS.
Reports and safety records: If you report someone, or someone reports you, we keep the report, what it said, and what we did about it. Catfish reports can include a photo you took when you met; only our safety team can open it, through a short-lived link, and the file is deleted when the report is resolved unless the report ends in a ban.
Messages our filter holds: Before the person you are writing to has replied, a like comment or message that looks like a threat, sexual content, a slur or a degrading insult is held instead of delivered. We keep it, we file a report with its text so a person on our safety team can read it, and we tell you it was held. If the reviewer decides it was fine, it is delivered. If not, it stays held and is kept as part of that report.
Messages that ask for money: Every text message is checked for money: payment apps, gift cards, wires, crypto, and asking for money or a fee. A message that asks for money is still delivered, and we file a report with its text so a person on our safety team can read it. The person it was sent to sees a warning under any message that mentions money.
Date plans: Plan a date keeps where, when and your code word on your phone. They go to the friend you send them to, through your phone’s share sheet. If you also propose the date in a chat, where and when go to your match as a message. The code word never does. The “Home safe?” check-in is set on your phone, not on our servers.
Your eligibility attestation: The fact that you agreed to the eligibility rules in the Terms of Use, and which version of that wording you agreed to.

Phone numbers are stored as hashes

Two features work on phone numbers without our servers keeping the numbers.

Blocking your contacts. If you turn this on, your phone normalises the numbers in your address book and sends them to us. Our server hashes each one with a secret salt, stores only the hashes, and discards the raw numbers. Anyone whose number matches is then hidden from you and you from them, in both directions. Someone who signed in with Apple gave us no number, so contact blocking can’t match them. The salt never leaves our server, so the stored hashes can’t be turned back into phone numbers even if the database leaked. You can switch it off at any time, which deletes the hashes.

Ban records. When an account is banned we keep a hash of its phone number or its Apple sign-in id, and perceptual fingerprints of its photos, never the number, the id or the photos themselves, so the same person can’t sign straight back up. That is the whole point of a ban, and the record survives a deletion.

Denied appeals. If a ban is appealed and the appeal is denied, the profile and photos come off Dateworthy for good, and the private answers, filters and likes are deleted. A locked copy of the profile and photos is kept with the reports and conversations behind the ban, as evidence. Only our safety team can open it, and how long it is kept is being set with our lawyer. If a later appeal is approved, the profile and photos are put back.

Shadow Search answers

Shadow Search answers are optional, and they are private in a specific, enforced way:

They are never displayed on your profile and are never returned to another user. There is no route in our API, anywhere, that gives one person another person’s Shadow answers or Shadow filters.
They are used on our servers only to decide whether you match somebody else’s private filter. The only thing a filter produces is who appears in a deck. It never produces an answer.
Nobody learns what anyone searched, and the person being filtered gets no signal at all. The “matches N of your filters” count shown on a profile is computed only from public profile fields, deliberately, so it can’t be used to read a private answer off the number.
Sensitive answers (the tier-3 intimate questions, and the health questions: mobility aid, HSV status and COVID-19 vaccine status) are encrypted at rest with a key held by the server. They are decrypted when you yourself read them back, and for a moment on the server to check them against a filter. That check only decides who shows up where, and the decrypted answer is never stored or sent anywhere.
The intimate questions are off by default, require you to opt in, and can be turned back off.
You can change or delete any answer at any time.

Photos and video

Profile photos. They are stored for as long as they are on your profile. Before a photo is stored it is screened: a perceptual fingerprint catches duplicates and re-uploads of banned photos, and further checks look for meme captions, for whether a face is present, and for more than one person in the shot. We store a resized copy with the photo’s hidden details removed, such as the date and the place your camera may have recorded in it. Deleting a photo removes it from your profile; deleting your account removes all of them.

Verification photos. Before the camera opens, the app tells you what happens next and asks you to agree. Then the front camera watches while you look straight at it and do three quick things it asks for, such as turning your head, closing your eyes or smiling, and it takes a photo at each one.

The face tracking runs on your phone, using Google’s ML Kit, which sends Google usage statistics about the tool. Apple’s App Attest on an iPhone, or Google’s Play Integrity on Android, then confirms the photos came from the real Dateworthy app on a real phone. Apple or Google gets a code made from the photos, never the photos.

Our servers, not an outside verification company, check each step again, and compare the straight-on photo with your profile photos using measurements of each face. If everything is clear, you are verified on the spot. If anything is unclear, a person on our team looks at it instead. The automatic check can approve you, but it never turns anyone down.

The face measurements are used for each check and are never saved. The other photos are deleted as soon as the check runs. We keep the straight-on photo while your account is open, so our team can look at it if a question about your account ever comes up, along with the check’s scores and result. Each profile photo you add after you are verified is compared with that photo the same way, on our servers, so a verified profile can’t switch to someone else’s photos. The straight-on photo is never shown to other users and never sold, and deleting your account deletes it.

Take-down requests. If you ask us to take down an intimate image, we keep your request: your name, how to reach you, where the image was, and what we did about it, with dates. That record is how we show the image was handled inside the 48 hours the law allows. An image taken down this way is never shown to anyone again except our safety team, and we keep a fingerprint of it so the same image can’t be uploaded again. How to ask.

Video messages. A video message is up to ten seconds, is uploaded straight from your phone to our object storage, and is deleted automatically: one hour after the recipient views it, or thirty days after it was sent if it is never viewed. A background job does the deleting.

Photo evidence on a catfish report. Stored in the same object storage and readable only by our safety team through a short-lived link. It is deleted when the report is resolved, unless the report ends in a ban. Then it is kept as the evidence behind the ban, and how long is being set with our lawyer.

Location, and how Passport works

Location is required to use Dateworthy. A dating app that shows you people near you cannot work without it, so there is no location-off mode. What we ask for is location only while you are using the app, on iPhone and on Android. We never ask for location all the time, and we never track you in the background.

Your exact position is never shown to anyone. Other users only ever see a rounded label like “3 mi away.”
Your first fix decides home. We store the middle of the census tract it lands in, a neighborhood the Census Bureau draws around 1,200 to 8,000 people, and throw the fix away. Your card shows your city. That point is what distances and the distance filter measure from.
Every later fix is used the moment it arrives and thrown away the same way. What we keep is the tract it landed in (outside North Texas, the position rounded to about a kilometre) and which city that is.
When the app is in the foreground it sends a fresh fix at most once every ten minutes.
If that fix is 50 or more miles from your home location, Dateworthy browses from where you actually are, automatically and free, for as long as you are there. That is the whole contextual Passport: you are really there, so you get it. A VPN, proxy or datacenter IP never earns it.
Setting a Passport by hand, to browse a city before you get there, is a separate premium feature. The free one above is not.

Companies that handle your data for us

We do not sell your data and we do not share it with anyone for their advertising. We do, however, run on other people’s infrastructure, and the honest version of “we protect your privacy” is telling you exactly who else touches what:

MongoDB Atlas: The managed database where your account, profile, matches and messages are stored.
Render: Hosts the Dateworthy API. All traffic between the app and the API goes through it.
Cloudflare R2: Object storage for video messages and for photo evidence attached to a report.
Sightengine: Photo screening. Not in use since 3 October 2026; no photo is sent to it. When it is turned on, an uploaded profile photo is sent to Sightengine to check whether it is AI-generated or manipulated, whether a face is present, whether a face filter is on it, and whether a face appears to belong to a minor.
proxycheck.io: Receives the IP address you connect from, at sign-up and sign-in and on a far-from-home location update, and tells us whether it is a VPN, proxy or datacenter address.
Giphy: Powers the GIF picker in chat. When you open it, your phone queries Giphy directly, so Giphy sees your search terms and your IP address. It does not see your profile, your messages or who you are talking to.
Expo push notification service: Delivers push notifications to your device, and passes them on to Apple on an iPhone and to Google on an Android phone. A notification is kept only as long as it takes to hand it over.
Apple: Distributes the iPhone app and delivers push notifications to iPhones. Sign in with Apple signs you in and gives us only a private id for you. App Attest confirms a verification check came from the real app on a real iPhone; Apple gets a code made from the photos, never the photos.
Google: Distributes the Android app through Google Play and delivers push notifications to Android phones through Firebase Cloud Messaging, which also receives the app’s version and an installation ID that identifies the app install, not you. During verification, ML Kit tracks your face on the phone itself and sends Google usage statistics about the tool, and on Android, Play Integrity confirms the check came from the real app on a real phone; Google gets a code made from the photos, never the photos.

If we add another processor, for example an SMS provider to deliver sign-in codes, we will add it to this list and update the date at the top of this page.

What we do not do

We do not sell your personal data.
We do not share it with third parties for their advertising.
There are no third-party advertising or cross-app tracking SDKs in the app, and no analytics SDK collecting your behavior for anyone.
We do not rate your attractiveness, and there is no desirability score anywhere in the ranking.
We do not show your exact location to anyone.

How your data is protected

Data is sent over encrypted connections (HTTPS). Sensitive Shadow answers are also encrypted at rest. Access to personal data is limited to operating the service and responding to safety reports, and every moderation action is recorded with the reason and who took it. No system is perfectly secure, but we work to protect your information.

Your choices, your export, your deletion

Edit or remove. You can change or delete your photos, prompts, preferences and private answers at any time, from inside the app.

Export. Settings › Export my data returns everything we hold on you, including your own Shadow answers and filters. That is the only place Shadow answers are ever handed out, and only to you.

Delete. Profile › Delete account is permanent. It deletes your profile and every answer on it, every photo and voice prompt you uploaded, your matches and the messages in them, your likes, your Worthys, your filters and your private answers. Your phone number or Apple sign-in is released, so it can be used for a fresh signup. The people you matched with lose the thread too. What we keep afterwards is the bare minimum the law requires and any safety report you filed or that was filed against you, together with the conversation and photos it is about, and anything under a take-down request. Deleting an account has never been a way to wipe one.

If you can’t get into the app, or you want this done for you, the delete your account page says how to ask by email. To find out what we hold, email dev@pappasproductions.com and tell us the number on the account, so we can find you.

Children

Dateworthy is for adults 18 and older. We do not knowingly collect data from anyone under 18, and we remove accounts we believe belong to minors. Any attempt to involve or contact a minor is reported to the appropriate authorities.

Changes to this policy

If we change this policy we will update the date at the top of this page and, where appropriate, tell you in the app.

Contact

Questions or requests about your data? Email dev@pappasproductions.com. Dateworthy is operated by Pappas Productions LLC.