Privacy Policy

This policy explains what Threesum collects when you use Threesum, why, who processes it, and how to get rid of it. Threesum handles sensitive information - government IDs, face images, location, and details about your relationships - so this page is specific rather than generic.

What we collect

• Account: email address and a password (stored hashed by our authentication provider, never in plain text).
• Profile: name, age, gender, who you are seeking, whether you are a single or a couple, partner details if applicable, your bio, and your interests.
• Photos: the profile photos you upload.
• Location: a town or city you type, and - only if you enable it - approximate GPS coordinates used to calculate distance. We show distance, never your exact coordinates.
• Identity verification: a photo of your government ID and a selfie.
• Activity: likes, matches, messages, blocks, reports, and any messages you send to support.
• Billing: if you take a paid subscription, a customer reference and subscription status. We never see or store your card number - Stripe handles payment details directly.

Your ID and selfie - the important part

When you verify, your ID photo and selfie are sent from your device to our server and passed directly to Amazon Web Services, which performs two checks: a face comparison between the selfie and the ID photo, and a reading of the date of birth printed on the ID.

We do not store either image. They exist only in memory for the seconds the check takes and are never written to our database or file storage. What we keep is the outcome: whether you passed, and the age we read from the document. We keep the age rather than your full date of birth so we hold the minimum needed to justify your verified badge.

The face comparison involves biometric processing. We use it solely to confirm the ID belongs to you, and for no other purpose - we do not use your face to identify you elsewhere, build a face database, or sell or share biometric data with anyone.

Photo moderation

Photos you upload are automatically screened for explicit, violent, and hateful content before being stored. Photos that fail are rejected and never saved. Photos that pass are stored and are publicly reachable by their link, so treat anything you upload as visible to others.

Who processes your data

We use a small number of providers, each for a specific job:

• Supabase - database, authentication, and photo storage.
• Amazon Web Services - face comparison and date-of-birth reading during verification, and photo moderation.
• Stripe - subscription payments.
• Resend - transactional email, such as verification results.

These providers process data on our instructions. We do not sell your personal information, and we do not share it with advertisers.

What other members can see

Your profile - photos, name, age, gender, bio, interests, and approximate distance - is visible to other verified members. Your email address, exact location, and verification details are never shown. Messages are visible to you and the person you matched with.

How long we keep things

Account and profile data is kept while your account exists. ID and selfie images are never retained.

Messages auto-delete after 30 days. Each message is permanently deleted from our database 30 days after it was sent - per message, not per conversation, so an active conversation continuously sheds its oldest messages. This is a real deletion by a scheduled job, not a display filter.

One exception: reports. If either of you reports the other, a copy of the messages between the two of you is attached to the report at that moment, so our moderators can see what actually happened even after the originals expire. That copy is readable only by us, never by other members, and is permanently deleted at most 90 days after the report was filed - sooner if either account is deleted.

When you delete your account from Settings we permanently remove your profile, photos, messages, matches, likes, notifications, blocks, reports and their attached message copies, and your login itself. Deletion is immediate and cannot be undone. Backups and provider logs may retain residual copies briefly before expiring on their normal cycle.

Your choices

• Delete everything - Settings → Delete account.
• Edit or remove any profile detail or photo at any time.
• Turn location off - GPS is opt-in and you can leave it off.
• Manage blocks - see the members you have blocked, and unblock them, from Settings.
• Access or correct your data, or ask questions - contact us through the support option in your account settings.

Depending on where you live you may have additional rights over your personal and biometric information, including the right to request a copy or to withdraw consent. Contact us and we will honour them.

Security

Access to your data is restricted at the database level so that members can only reach their own records and what they are meant to see. Photo uploads are only possible through our moderated pathway. No system is perfectly secure, but we hold the minimum data we can and avoid retaining the most sensitive parts at all.

Children

Threesum is strictly for adults 18 and over. We verify age from government ID and remove accounts we believe belong to minors. We do not knowingly collect information from anyone under 18; if you believe we have, contact us through the support option in your account settings and we will delete it.

Changes

We will post updates here and change the date above. Material changes to how we handle verification or biometric data will be communicated directly.