Privacy,
before product.

1. What the service processes

When you request registration, we store your email address and a hash of a one-time verification token. After you confirm your email and complete signup, we store your username, display name, email, password hash, verification time and the accepted terms version. A basic profile is private; it is not listed publicly. Signup does not opt you into marketing, intimate questions or a subscription. New basic users cannot access the quiz unless an administrator separately grants access.

Optional profile details, devices and access

You may choose a gender when completing signup or editing your profile, including a self-description or “prefer not to say”. This is optional and never inferred from your name, partner or answers. Your profile also has an optional phone-model field for account support. These details can be changed or cleared at any time and are visible only to you and authorised administrators, not automatically shared with a partner.

From this update onward, a successful sign-in stores the latest approximate platform and browser family with a timestamp for account support and troubleshooting. It replaces the previous observation, not a device or movement history. Browser-provided data may be inaccurate or intentionally reduced; it is not proof of device ownership or an exact model. The application does not retain the full User-Agent or collect OS/browser version numbers, high-entropy client hints, a device fingerprint, IMEI or serial number. Native-app device reporting is not connected. The latest observation remains until replaced or account deletion; contact support for removal requests.

Authorised administrators can view account contact details, the optional profile/device fields, actual partner-account connections and access periods. No connection means no partner is linked, not that someone is single. A complimentary feature grant stores the feature, start/end, issuing administrator, administrative reason and any revocation. It creates no payment. Grant history and corresponding admin audit events remain for support/accountability until reviewed as part of an account deletion request. Administrators cannot view personal quiz answers or passwords through the dashboard.

Private preferences and partner invitations

You may save a language preference, time zone and a short city or region description in Preferences & setup. These are voluntary, self-reported, visible only to you and authorised administrators, and can be cleared without paid access. The current member website remains in English. The place description is separate from the registration IP estimate and is never treated as a verified home address. We also record whether you finished or skipped the guided setup.

A signed-in user can send a personal partner invitation to a chosen email. We store the sender, recipient email, a hash of the random one-time token, expiry, sharing-notice version and invitation/response/mail status. Links expire after 72 hours. Only a signed-in, activated account with the invited email can accept or decline; opening an email link does not connect accounts. Invites from a blocked sender or a sender whose account-security version changed cannot be accepted. Sending again cancels the sender’s previous pending link. Sending is limited to three per sender per hour, three per recipient per day and 100 per hour overall.

Accepting connects two separate accounts and makes each person’s profile name and username visible to the other. Administrators can see the connection and contact details for account support. A connection does not share email, gender, phone, IP estimates, private preferences or any quiz answers with a partner. It grants no paid access. Both existing 18+ choices are reset so the new relationship cannot inherit an earlier choice. Either person can disconnect; each keeps their own account, answers and individual access.

Invitation rows are removed from the active database 30 days after their expiry during later invitation sends; old hosting logs and protected backups have separate retention. Couple membership history, including inactive memberships, is retained for account support and reviewed with account-deletion requests. The invitation URL can initially appear in hosting access logs; the app removes it from the address bar and suppresses referrer information. No invitation token or email content is shown in the admin dashboard. Unwanted invitations can be ignored or declined; contact support if they continue.

Registration IP and approximate location

For registrations completed after this update (network notice version 2026-09-09-network-v1), we record the public IP observed by our server at the moment you create your profile. We encrypt that IP and use a locally stored DB-IP City Lite database to estimate country, region and city. No visitor IP is sent to DB-IP or another lookup service. We store the capture time, database version and whether an estimate was available. We do not store GPS coordinates, a street address or a movement history.

The registration IP supports account-security review. The approximate registration area provides a starting point for future app location settings, not automatic partner sharing or proof of residence. Mobile networks, VPNs and database errors can make it inaccurate. No country-based blocking, pricing or eligibility decision is made from this estimate. A missing lookup does not block signup. We do not fill in historical locations for existing accounts.

The full IP can be viewed only by the account owner and authorised administrators for 30 days. After that it is no longer returned by the application and its encrypted value is cleared on the next application request. The location estimate stays in the private account until the user removes it in Profile & consent or requests account deletion. Removing the estimate does not regenerate it on a later login. Protected recovery backups and hosting logs may still contain older data; contact us for deletion requests affecting those copies. Data source: IP Geolocation by DB-IP, licensed under CC BY 4.0.

When you visit the website, the hosting server may process standard technical information such as your IP address, browser type, requested page, date and time, response status and referrer. This is used to deliver the site, detect abuse and keep it secure.

For invited alpha accounts, the service stores a username, email address, display name, account role, a one-way password hash, sign-in security records, session data, quiz answers, answer-visibility choices and any recorded choice to open the optional 18+ question category. It does not currently collect payments, photos, precise location data or mobile-device identifiers.

2. Sensitive quiz answers

Some optional questions concern beliefs, sexuality, fantasies, desires, kink, fetishes and personal boundaries. Answers about a person’s sex life or sexual orientation may be specially protected personal data. The 18+ category is off by default and requires a separate, explicit choice by each adult. A user can skip every question, keep an answer private, delete an answer and withdraw access to the 18+ category.

An answer marked “after both partners answer” is intended to become visible only after both partners have answered that question. In this release, even connected partners cannot view each other’s answers. Answer sharing has not been implemented. Any future reveal feature must be tied to the specific relationship and separately explained before use.

3. Cookies and analytics

The member area sets the essential fna_session cookie. It expires when the browser session ends, is not used for tracking and is protected with Secure, HttpOnly and SameSite settings. No analytics or advertising cookies are currently set.

4. Purpose and legal basis

Account data is used to provide the free profile you request, send verification and recovery emails and maintain your account. Quiz data is processed only for users with access to the restricted quiz. Technical and sign-in security data protects the service from misuse. The separate 18+ choice is optional; withdrawing it prevents further access but does not silently delete answers you may still want to review or remove.

5. Storage, retention and sharing

Account and quiz data is stored in a protected database outside the public website directory. Passwords are stored only as secure hashes. Server logs are rotated under the hosting configuration and are not used for profiling. Data may be accessible to the hosting operator and infrastructure providers only where needed to run, secure or troubleshoot the service, or when required by law. It is not sold or used for targeted advertising.

Profiles are kept until deletion is requested. Verification links expire after 30 minutes. Expired registration tokens and signup-throttling records older than seven days are removed during subsequent signup requests. Throttling records contain keyed IP/email hashes; the separate completed-registration record contains the encrypted IP and estimate described above. Mail-processing status records contain no recipients or message contents and are pruned after 90 days during mail processing. The hosting mail service may separately retain delivery logs. Protected recovery backups may contain older data; deletion requests include reviewing those copies. Automated backup retention and mobile self-service deletion are not yet available.

6. Your choices and rights

You can edit your display name, change or clear optional gender and phone-model details, review and delete your own saved quiz answers and withdraw the optional 18+ choice inside your account, without paid access. For a copy of your data, an email or username correction, or full account deletion, email info@nvrgrp.com from your registered address. We verify requests before changing or disclosing account data. Never send your password. See account deletion for the current process.

7. The future apps

Before iOS or Android accounts or shared location features become available, this policy will be expanded with verified business and privacy contacts, complete retention periods, mobile-platform disclosures, data export and the exact self-service deletion process.

8. Changes

This notice will change as the service develops. The updated date at the top will always show the current version. Material changes will be explained before they take effect for registered users.