Draft — pending legal review

This policy has not yet been reviewed by an attorney. Bracketed items are placeholders. It describes what charper does today, and it will change before charper opens to more members.

Privacy Policy

Last updated: 19 October 2026

The short version

charper is an invite-only map of queer life in Portland, Oregon, still at an early stage. We keep as little as we can: the name you choose, your 18+ answer, how you sign in, which devices are signed in, who invited you, and your email setting. We never ask for a phone number or a password. Today the map doesn't read your location, and member-to-member messages don't exist yet. End-to-end encrypted messages and an optional face check for a "Photos verified" badge are planned, and Planned features already says who will be able to see what. We don't sell your data, we don't show ads, and we don't use analytics or trackers. Because being on charper can reveal your sexual orientation or gender identity, we treat everything about you as sensitive. You can delete your account from the map at any time, except in the 24 hours after a backup code is used, and you can ask us for a copy of your data.

Who we are

charper is run by Curiositech LLC, 5441 S MACADAM AVE STE N, PORTLAND, OR 97239, USA ("charper", "we", "us"). We decide what personal data charper collects and how it is used. You can reach us through our private request form.

This policy covers charper.app: the public pages anyone can read, and the members' map with its sign-in and invite pages, which charper.app serves to signed-in members (the old address, map.charper.app, now only forwards to charper.app). It also covers the emails charper sends: charper's own email comes from mail.charper.app, and sign-in codes and discreet security messages come from a neutral sending address that does not name charper (see Email).

What we collect and why

Here is everything charper's servers hold about members today, grouped by what it's for.

Your account

The display name you choose. It doesn't have to be your real name. You can change it.
Your answer to "Are you 18 or older?", kept as a plain yes.
When you joined, and who invited you. The invite is the "vouch": a record that this member brought you in.
Your role and standing (member or admin; active, invites paused, or banned), and if you're banned, when and a one-word reason category.
Your email setting: "Keep me posted" or "Maximal discretion" (see Email), and, while it is Maximal discretion, when you chose it, so your other devices can be asked to clear what they kept. Choosing "Keep me posted" erases that time.
Your map privacy setting: how many people must share your area before the map shows you as yourself: 1 ("Just me is fine") unless you choose 2, 3 or 5. Where people's numbers differ, the biggest one applies to everyone there. It never makes anyone else more visible. It is kept on our servers and never sent to other members, though others may work out which you chose from how and when you're shown.

We use these to run your account, keep charper invite-only and adults-only, and enforce the community rules.

Your separate map and daily-discovery preferences. If you choose to save these optional filters, we keep separate age-range, gender-option and Friends/Dates selections for each surface, their format version and latest save revision/time. Leaving a selection empty means no preference. Only your account can read these choices today. Saving or clearing one set leaves the other unchanged; neither turns participation on or changes profile sharing. Earlier single-set discovery choices remain separate and are not automatically copied into either new set. We do not infer or learn filters from your activity or keep a change history. You can replace or clear each set, and account deletion erases both. These records contain no location or profile-view history, and their values are not added to error logs.

Discovery choices and safety blocks. If you save discovery choices, our servers keep your request to take part or stay off, your chosen non-sexual age range, gender and Friends/Dates filter values, your selected coffee, walk or art activities, and when you last saved them. These are private settings, not a published profile, and are not shown to other members or written to our error logs. Saving a participation request does not make you visible or authorize us to turn discovery on without asking you again. We also keep the account identifiers on each discovery safety block and when you created it, so that future discovery can respect it; another member cannot see whether you blocked them. We keep your current choices until you replace them or delete your account, and a block until you remove it or either account is deleted. Account deletion erases the choices and every block in either direction. These settings do not include location, private passes, profile-view history or a learned preference model.

Your optional profile details. If you choose to enter them, we store your self-reported age (18 to 120), the gender option you choose, and whether you are open to Friends, Dates or both. Every field is optional. We do not collect your birthday or infer these details from your photos, interests or search filters. Self-reported age is not verified-age evidence. Only your account can read these details today. Saving or clearing them requires a new profile-sharing review; it does not publish them or turn discovery on. You can replace or clear them, and account deletion erases them. We keep only the latest values and profile revision, not a change history, and do not add them to error logs.

Your private activity ideas. Other members cannot retrieve these choices. If you choose to save them to your account, our servers keep up to three activities, whether you already enjoy each one or would like to try it, any optional favorite place you enter, and the latest save time. These are private planning preferences, not a published profile, a statement of where you are now, or permission to reveal a place or send an invitation. We do not infer a routine, collect coordinates, or add these choices to error logs, analytics or AI prompts. You can replace or clear them whenever you like; account deletion erases them. We keep only your latest saved choices until you replace, clear or delete them. Saving these ideas does not make you visible in discovery or authorize a future launch without asking you again.

charper has no passwords and never asks for a phone number. The sign-in page shows the methods that are switched on. For each one you add, we keep:

Passkey: its public key, a use counter, how your device can reach it, whether it syncs, and a short device name such as "Safari on iPhone". Your face, fingerprint or PIN never leaves your device; we never receive it.
Sign in with Google: Google's account number for you and the email address Google shares. We ask Google only for your email, not your name.
Sign in with Apple: Apple's account number for you and the email Apple shares, which may be a private relay address. We ask Apple only for your email, never your name.
Email code: your email address. The six-digit codes themselves are stored only as one-way hashes and expire after 10 minutes.
Continue with Facebook, once it is offered: Facebook's app-specific number for you and the email on your Facebook profile. Facebook also sends your name and profile picture; we don't keep or use them. Facebook learns that you use charper and lists it in your Facebook settings.

For each method we also keep when you added it and when you last used it. A method added to an account that already has a passkey, Apple or Google, or added in the 24 hours after a backup code was used, is provisional for its first 24 hours: it signs you in, but it can't change how your account signs in, your name, your email setting or your invites, its address gets none of our security notices, and Sign out everywhere, done as the owner (see Devices and sessions), removes it. After 24 hours it becomes a full method and we tell you. You can remove your own methods in the map after confirming it's you, but never your last passkey, Apple or Google.

Backup codes, if you make them: ten one-use codes that get you back in if you lose your other ways to sign in. We keep them only as keyed one-way hashes, which can't be read back, and when the set was made. A code is deleted when it is used, and making a new set deletes the old one. For 24 hours after a backup code is first used, nobody can remove your other ways to sign in, make new codes, change your name, email setting or invites, or delete the account.

We keep a record of each change to how your account signs in (a method added, removed or made permanent, a backup code used, backup codes made, and signing out everywhere), with that method's email address where it has a verified one and a short device label such as "Safari on iPhone", so we can show it to you and warn you if it wasn't you.

Google, Apple and Facebook learn that you signed in to charper when you use them. Their own privacy policies cover what they do with that.

Devices and sessions

Each device you sign in on gets a session. For each session we keep a short device label (such as "Safari on iPhone", never the full browser string), when it started and was last used, which method opened it, whether you marked it as a shared device, and, under Maximal discretion, when that browser was last asked to clear its cache. You can see and end these sessions under Your devices in the map. We use them to keep you signed in, to let you sign out remotely, and to email you when your account signs in on a new kind of device. Sign out everywhere ends every session. Within 10 minutes of signing in with a passkey, Apple or Google that wasn’t added in the last 24 hours (or was your first), on a device not marked shared, it also cancels your unused backup codes and removes every way to sign in added in the last 24 hours.

Getting back in, and the 24-hour wait

Who can see this: no other member sees that you made backup codes or used one. Anyone signed in to your account, including someone using a stolen backup code, can see which kinds of sign-in you have, your recent sign-in changes and your signed-in devices. The email addresses and device names on that list are hidden unless you're signed in with your strongest way in: a passkey, Apple or Google that you've had for more than 24 hours, on a device that isn't shared (or email, if that's the only way your account signs in). The record of these changes is in our database, and Cloudflare sends the security emails for us.

A backup code gets you back in if you lose your other ways to sign in. Until that sign-in adds a passkey, Apple or Google, it can only add one, see your ways to sign in (without addresses or device names) and your devices, and sign devices out (including Sign out everywhere).
Using a backup code starts a 24-hour wait. The wait starts at the first code used, and using more codes doesn't restart it. For those 24 hours, nobody can make new backup codes, remove a way to sign in that isn't provisional, change your name, your email setting or your invites, or delete the account. Your other ways to sign in keep working.
New ways to sign in wait too. Any way to sign in added during the wait, or added to an account that already has a passkey, Apple or Google, is provisional for 24 hours. It signs you in, but it can't add or remove other ways to sign in, make backup codes, confirm it's you, change your name, your email setting or your invites, or delete the account. Its address gets none of our security notices and never becomes your contact address. If nobody removes it, it becomes a full method after 24 hours, and we tell you.
Your name, email setting and invites change only when you signed in with a passkey, Apple or Google that isn't provisional, on a device that isn't shared, and never during the wait. An email code or Facebook can't change them on an account that has a passkey, Apple or Google.
We tell you at every step by email. Each backup code used, each set of codes made, and each way to sign in added, removed or made permanent is emailed to every verified address on your account, except one added in the last 24 hours that is still provisional. Each is also shown on your other devices in the map. If your account has no verified email address, a backup code being used is recorded but not announced, so add an email sign-in if you want to hear about it.
If it wasn't you, use Sign out everywhere. It ends every session, cancels your unused backup codes and removes every way to sign in added in the last 24 hours, including any address a stranger added. You can also remove a provisional method yourself, during the wait or after it, once you confirm it's you with a passkey, Apple or Google that isn't provisional.

The wait is there so that someone who steals a backup code or a signed-in phone can't lock you out before you notice. To run it, we keep the time the first backup code was used, and clear it when the 24 hours are up or when you delete your account.

Invites and the vouch tree

Invites you make: the link's code, when it was made and expires, any private note you add (such as "for Sam"), and who used it and when. A note is erased within an hour of its link expiring unused, and at once if you take the link back.
Your vouch tree: who invited you, and who you invited. You see their display names; vouch counts are never shown to anyone. Admins can see every invite with the inviter's and invitee's names.
Notices to vouchers: if someone you invited is banned, we keep a notice for you that never names them or says why. A banned member no longer appears in your list of who you invited, but the invite they used still shows their name, so you can work out who it was.

An invite link shows your display name ("Sam is vouching you in") to whoever opens it, and an invite you email carries your display name to your friend's inbox.

The vouch tree is how charper keeps out bots and holds people accountable (see the Terms).

Email

Your address comes from your sign-in methods: the account's contact address is taken from a method only once it is permanent, never in its first 24 hours. We use it for sign-in codes, security notices (sent to every verified address on your account, except one added in the last 24 hours that is still provisional), and, if you chose "Keep me posted", a welcome and a note when someone you invited joins.
"Maximal discretion" is how your email is treated until you choose. With it, you get only security messages, sent from "Account notice" at a neutral sending address that does not name charper, with a neutral subject and no "charper" in the preview. Once opened, the email says it is about your charper account.
Which address our emails come from: sign-in codes come from "Sign-in code" at the same neutral sending address, whatever your setting, with the subject "The code you asked for" and no "charper" in the preview; once opened, a code email says it is for signing in to charper and what to do if you didn't ask for it. The security messages under "Maximal discretion" come from that neutral address too. Everything else comes from "charper" at noreply@mail.charper.app: an invite you email to a friend and, if you chose "Keep me posted", the welcome, the note when someone you invited joins, and your security messages. Nobody reads replies to any of these addresses. If our email provider ever refuses the neutral address, a sign-in code is sent from noreply@mail.charper.app instead, under the same "Sign-in code" name, so you can still sign in; security messages under "Maximal discretion" are never sent from it.
On your devices, once you choose Maximal discretion (leaving the question unanswered isn't choosing it), the map keeps no copies of people's photos in your browser, asks each of your browsers to clear any it kept before (the next time it opens the map, or when it is signed out), keeps your map settings only until the browser closes (never adult content), clears them when you sign out, and keeps adult content off. Most browsers do as asked; a few versions ignore the request, and we can't check that they did. Two cases we can't reach: a device you don't open again before its 7-day sign-in runs out, and, when you delete your account, your other devices (we keep nothing of them to recognise them by). Clear those browsers yourself if you need to. Ticking "This is a shared or public device" when you sign in doesn't turn this on: it only shortens that session and limits what it can change on your account. Without Maximal discretion, your browser may keep people's photos for up to a week, and the files that describe the people on the map for up to a year, to load the map faster.
When you email an invite to a friend, we use their address for that one email and don't store it. We keep only a one-way keyed hash of it for 15 days, to stop the same person being emailed over and over.
"Don't email me again": if someone uses the link in an invite email, we keep a one-way hash of their address so we never send them an invite or sign-in code again.
A log of sends: who triggered each email, what kind, and when, kept 15 days for rate limits. Never the recipient's address or the message.
For sign-in codes, the address and your network address are stored only as hashes salted with the day and cut short, which is enough to count requests today and useless for linking across days. They are deleted within a day.

Our emails carry no tracking pixels and no click tracking.

Location

Today the map does not read your device's location, and charper's servers don't receive or store it. The people you see on the map are made up. The map asks a weather service, Open-Meteo, for the forecast at the city's fixed map centre, not at your position; Open-Meteo sees your network address, as any website you load does.

Showing members on the map is planned. It is described under Planned features, and we will update this policy before it launches.

Profile and sensitive information

Our servers keep the saved profile details, discovery preferences and filters, activity ideas, sharing choices and safety blocks described above. Some display preferences and unsaved map choices stay in your browser (see On your device).

Fuller profiles, which may let you share things like your sexual orientation, gender, and sexual health, are planned. Those fields will be optional, and see Sensitive data for how we will ask.

Messages

Members can't message each other on charper yet, so we hold no member-to-member messages. In the prototype, chats with the made-up demo people are scripted replies that stay in your browser tab, are read by no AI model, and are never sent to us.

Separately from the demo people, a few made-up characters on the map are marked as AI. They are there for testing, and chatting with them is switched off: if you type to one, our server turns the message away without reading or storing it, and no AI model is involved. If that chat is ever switched on, we will update this policy first.

End-to-end encrypted messages between members are planned (see Planned features). Until they exist, nothing on charper is end-to-end encrypted.

On your device

The map uses your browser's storage for display preferences and unsaved map choices. These local choices stay on your device; saved account records described above are stored on our servers. Local choices are kept under your account only: anyone else who signs in on that browser starts without them. Under Maximal discretion we clear them when you sign out of that device, and ask your browser to clear the map's display options too; when you delete your account we clear them and ask the same, whatever your setting. You can clear all of them in your browser.

So the map opens quickly, your browser also keeps a copy of charper's own program files (its code and styles, the same for every member, with nothing about you in them) after you open the map on your own device, both in its ordinary cache and in an offline store that belongs to charper.app. The offline store is removed when you sign out, and is never made when you sign in with "This is a shared or public device" ticked. Under Maximal discretion your browser is told to keep none of these files, we remove the offline store, and we ask your browser to clear any copy it kept before (some browsers ignore that request). Nothing about you, other people, your messages or where you looked is kept this way; when you are offline charper shows a page that says so, and no saved map.

Signed-in pages use a few cookies, all necessary for signing in: a session cookie that holds only a random session id, short-lived cookies that carry a sign-in step, and a two-minute cookie that confirms it's you before you delete your account, add or remove a way to sign in, or make backup codes. charper uses no advertising or analytics cookies.

Abuse prevention

To stop floods of sign-in attempts, we count requests per network for a few seconds to a minute, keyed by a hash of your network address salted with the day; the address itself isn't stored. When a backup code is typed wrong, we keep a hash of your network address, salted with the day and cut short, and the time, for up to a day, to stop anyone guessing codes. The email-code form uses Cloudflare Turnstile, a bot check that loads only when you use that form and that processes signals from your browser and device under Cloudflare's privacy policy.

Logs

We don't run analytics. charper's server writes short error lines (for example, "an email failed to send") without names or email addresses; an error line can include the page address that failed, which for some pages contains an account number or an invite code. We don't keep a stored log of requests or of these lines. Cloudflare, which runs our servers, processes your network address and request details to deliver and protect the service, under its own policies.

This website

charper.app’s public pages use our own scripts for appearance, motion, short product clips and form validation. Your chosen appearance stays in your browser, along with the position of your last navigation tap for a page transition; these are not sent to us. We use no analytics or third-party tracking on the public pages and set no cookies there. Fonts, images and scripts come from charper.app. This policy and the Terms run no scripts. The signed-in map uses the cookies and services described above.

The beta list

If you join the beta list on charper.app, we keep your name, email address, city, optional interests and the day you signed up. We keep no network address, browser details or referrer. We use these details to invite you when beta testing reaches your city and understand what you’d like to find, never for a newsletter or reminders, and we never share or sell it. To slow down automated sign-ups, Cloudflare's rate limiter counts requests by network address for about a minute; we never write that address down. You can take your address off the list at any time at charper.app/leave. Signing up needs no confirmation email, so anyone who types an address can add or remove it.

Community listings and working with charper

When you suggest a Community listing, we receive the public name, resource type, source link, description, access information, your permission confirmation and an optional contact email. We use them to review and manage the listing. The public details may be published after review; your contact email stays private.

When you register interest in working with charper, we receive your name, email, chosen area, optional city and optional introduction. We use them to consider future opportunities and contact you about a possible match. These details are not published or sold.

These submissions are retained for manual review. Closing a review does not automatically delete its record. You can ask us to correct or delete your information through the privacy contact. Please leave out private attendee details, health histories and other people’s personal information.

Sensitive data and your consent

Privacy laws in Oregon, Colorado, Washington, California and other states give extra protection to "sensitive data". That includes information that reveals your sexual orientation, your status as transgender or nonbinary, your sex life, your health (including sexual and reproductive health and gender-affirming care), biometric data, and precise geolocation. Oregon and Washington define precise geolocation as a location within a radius of 1,750 feet, and California within 1,850 feet; Washington's health-data law also protects location that could show you seeking health care.

charper is a community for queer people, so the simple fact that you have an account may reveal your sexual orientation or gender identity. We treat everything we hold about you as sensitive data:

We process it only to run charper for you, keep it safe, and meet our legal duties.
We don't sell it, use it for advertising, or use it to make decisions with legal or similarly significant effects about you.
Joining is your choice: before you join, the invite page summarises what charper keeps, and this policy lists all of it. Today it has no separate consent box for sensitive data; one is planned (see Planned features). You can withdraw at any time by deleting your account.
We don't ask for precise geolocation, biometric data, or health information, and no feature collects them today. Before any feature does, we will update this policy and ask for your separate, specific consent where the law requires it.
Two fields are free text: your display name, and the private note you can add to an invite. They hold whatever is typed, so please keep health and other sensitive details out of them. We use them only for what they are for, and they are erased as described in Deleting your account.

Washington residents: charper doesn't ask for or set out to collect "consumer health data" as Washington's My Health My Data Act defines it. If you type health details into a free-text field, we keep them only as that text and use them only for that field's purpose. Your display name is shown to other members and to the people you invite (on invite pages, in invite emails and in vouch trees); the private note on an invite is shown only to you, and we never share or sell it. We never sell either. If a planned feature would collect consumer health data, we will publish a separate consumer health data policy and ask for your consent first. The planned face check (see Face verification, when it launches) would use data that this law counts as consumer health data, so it will not launch in Washington without that policy and your consent.

What we never do

We never sell your personal data, or trade it for anything of value.
We never show ads, and never share your data for targeted advertising or cross-site tracking.
We never share your location with anyone outside charper. (Today we don't have it.)
We never ask for your phone number, your legal name, your birthday, or a password.
We never merge two accounts because they share an email address.
We never show vouch counts, or who viewed your profile.
We never use analytics, tracking pixels or third-party trackers.

Who processes data for us

These companies process data on our behalf, or receive it because you choose to use them. Each gets only what its job needs.

Service providers and what they receive
Who	What for, and what they receive
Cloudflare, Inc.	Hosts charper's servers, website and database (Workers, D1); sends our email (Email Sending); limits sign-in floods (Rate Limiting); runs the email-form bot check (Turnstile). Cloudflare sees network addresses and the data we store. Cloudflare's AI service (Workers AI) is connected but switched off, and receives nothing today.
Google LLC	Only if you use Sign in with Google: your Google sign-in. Google learns you use charper.
Apple Inc.	Only if you use Sign in with Apple: your Apple sign-in. Apple learns you use charper.
Meta Platforms, Inc.	Only once Continue with Facebook is offered and you use it: your Facebook sign-in. Facebook learns you use charper.
Open-Meteo	The weather on the map. Receives the city centre's coordinates (not yours) and your network address.

If the law requires it, we may also disclose data as described in Law enforcement and legal requests. If charper is ever sold or merged, your data would move to the new owner only under this policy's promises.

How long we keep things

Retention, by kind of data
What	How long
Your account (name, 18+ yes, email, email setting, map privacy setting)	Until you delete your account.
Sign-in methods (passkeys, Google, Apple, email, Facebook)	Until the method is removed or you delete your account.
Sessions	A session lasts up to 7 days (on a shared device, 2 hours idle and 12 hours at most). Ended sessions are removed the next time you sign in, once they have been over for 30 days, and all of them when you delete your account.
Time a backup code started the 24-hour wait	Cleared within an hour after the 24 hours end, and when you delete your account.
Record of sign-in changes	Until you delete your account. In-app warnings about a change show for 30 days, and after 30 days we forget which session made it.
Email sign-in codes (hashed)	Up to 1 day.
Backup codes (keyed hashes) and when the set was made	Each code until it is used; the set until you make a new one, sign out everywhere as the owner (see Devices and sessions), or delete your account.
Failed backup-code tries (day-salted, shortened network hash)	Up to 1 day.
Passkey and confirm-it's-you steps	5 minutes and 2 minutes.
Invites (code, dates, who used it)	Kept, to preserve the vouch tree. A private note on an invite is erased within an hour of its link expiring unused, at once if the link is taken back, and when you or the invitee delete the account.
Notices to vouchers	90 days after you've seen them.
Email send log, and hashes of invitees' addresses	15 days.
"Don't email me again" list (hashed)	Kept, so we keep honouring it.
Beta list (email, city, sign-up day)	Until you leave the list, and the whole list is deleted within 30 days of the beta closing.
Sign-in rate-limit counters	Seconds to a minute; never stored by us.
Database backups	Our database provider keeps a rolling recovery history of up to 30 days, so deleted data can remain there for up to 30 days before it is gone for good.

Deleting your account

In the map: open You, then Delete my account. If your account hasn't added a passkey, Apple or Google yet, the map asks you to add one first; or email us (see How to ask) and we'll delete it for you. To protect you from someone who has taken over a signed-in device, you confirm it's you with a passkey, Apple or Google right before deleting. Deletion happens at once. In the 24 hours after a backup code is used on your account, deletion waits until the 24 hours are up (see Getting back in).

What is erased: your name, your email, your Google account number, your sign-in methods (passkeys, Apple, Google, Facebook, email), your backup codes, your 18+ yes, your signed-in devices, your email setting and the emails charper sent for you. Also erased: your record of sign-in changes, notices to you, and your private notes on invites (and the note your voucher wrote about you). Your unused invites are taken back. We email your addresses one last time to confirm the deletion.

What stays, and why: that you were vouched in, by whom, and when, stays so the vouch tree keeps its shape and nobody else's standing changes. You show there as "Deleted member". If you were banned, that fact, its date and its one-word reason category stay so the rules for vouchers keep working. Hashes on the "Don't email me again" list stay so we keep honouring them. Backups clear within 30 days (see How long we keep things). The beta list is separate from your account: if you joined it, take your address off at charper.app/leave.

Through Facebook, once Continue with Facebook is offered: if you remove charper from your Facebook settings, Facebook tells us, and we remove your Facebook sign-in and sign out the devices it opened. If Facebook was your only way to sign in, we delete your whole account as above. Facebook gives you a link where you can check the request's status.

If you can’t sign in: use our private request form and we will help you prove the account is yours and delete it.

Your rights

Depending on where you live, including Oregon, Colorado, Washington, California and other states with privacy laws, you have the right to:

Know and access: confirm whether we process your data, and get a copy of it.
Get a list of third parties: Oregon residents can ask for the specific third parties we have disclosed their data to. The list in Who processes data for us is complete today.
Correct data that's wrong. You can change your display name in the map yourself.
Delete your data. You can do this yourself in the map (see Deleting your account).
Portability: get your data in a portable, machine-readable form.
Opt out of the sale of your data, targeted advertising, and profiling that has legal or similarly significant effects. We do none of these, so there is nothing to opt out of, and an opt-out signal such as Global Privacy Control has nothing to switch off.
Withdraw consent to processing sensitive data, by deleting your account.
Not be discriminated against for using any of these rights.
Appeal if we refuse a request.

We give these rights to every member, wherever you live.

How to ask

Use our private request form with an email address on your account, or tell us which sign-in method you use. We'll confirm it's you, usually by asking you to sign in, before we act. Someone you authorise can ask for you if they show us your permission. We answer within 45 days. If we need more time, up to 45 more days, we'll tell you why. Requests are free.

To appeal a refusal, reply to our answer with "Appeal". We review it again and answer within 45 days, or tell you why we need longer where the law allows. If you're still not satisfied, you can contact your state's attorney general: in Oregon, the Oregon Department of Justice (doj.state.or.us); in Colorado, the Colorado Attorney General (coag.gov); in Washington, the Washington Attorney General (atg.wa.gov); in California, the California Privacy Protection Agency (cppa.ca.gov).

Children

charper is for adults only. You must be 18 or older to join. Today the invite page asks you to confirm that you are 18 or older; a stronger age check is planned (see Planned features). We don't knowingly collect data from anyone under 18. If we learn that a member is under 18, we close the account. If you believe a child is on charper, tell us at our private request form.

Security

No passwords to steal: you sign in with a passkey, Apple, Google or an email code, and an account must add a passkey, Apple or Google before it can use the map.
Session cookies hold only a signed random id and can't be read by scripts on the page. All traffic is encrypted (HTTPS, with HSTS).
Sign-in codes, backup codes, invite recipients and opt-outs are stored as one-way keyed hashes, not as text.
Deleting your account, adding a sign-in method to an account that already has a strong one (except that a backup-code sign-in may add a passkey, Apple or Google, which starts provisional), removing a sign-in method, and making backup codes each need a fresh confirmation with a passkey, Apple or Google.
We tell you about new sign-ins and changes to how you sign in, and you can sign out everywhere at once.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Law enforcement and legal requests

We disclose member data to police or other government bodies only when the law requires it, such as under a valid subpoena, court order or warrant, and we disclose only what that request covers. Everything we could disclose is listed in this policy; for example, we have no location history and no member-to-member messages to give.

Federal law requires us to report apparent child sexual exploitation to the National Center for Missing & Exploited Children (NCMEC), and we do. We don't call police for welfare checks on members, except where a person at charper, following a protocol reviewed by our attorney, judges that the law requires it to prevent imminent harm.

Where your data is stored

charper is run from the United States and offered to people in the United States, starting with Portland, Oregon. Our data is held by Cloudflare, whose network has servers in many countries; our members' database is stored in Cloudflare's western North America region, and the beta list's database in a region Cloudflare chooses. If you use charper from outside the United States, your data is transferred to and processed in the United States, where privacy laws may differ from yours.

Planned features

None of these is available yet, and none of them collects anything today. Before any of them launches, we will update this policy, and where the law requires it, ask for your consent first.

End-to-end encrypted messages between members, which charper couldn't read. See Encrypted messages, when they launch.
Being on the map: an approximate area, rounded on your device before it is sent, never a point, blurred differently for each person looking, with distances shown only in bands, faces shown only where enough people share an area, and a setting to show yourself less precisely or not at all.
A consent step on the invite page for sensitive data, alongside links to this policy and the Terms.
Fuller profiles: photos and optional fields such as pronouns, gender, interests and sexual health.
A stronger age check by facial age estimation, keeping only a yes and deleting the image.
"Photos verified", an optional badge that uses a face check (biometric data). See Face verification, when it launches.
A demo chat answered by an AI model, for testing the prototype only: it is not a feature members will get, and it is switched off once real members use charper. While it is on, the made-up demo people on the map would reply through Cloudflare's AI service (Workers AI), and the thread would be labelled "AI demo". What you type to them would be stored by charper and read by the model to reply, and each message would first be checked by a model for signs of a crisis, someone under 18, or a no, and each reply checked before you see it. If a message read as a crisis or as someone under 18, we would keep a note of when and with which demo person, which a person at charper reads; it names your account only by a coded key, and it is deleted after 30 days. Your messages, and the short note the character keeps about what you told it, would be kept 30 days, and you could make a character forget you at any time; that also deletes a crisis note, but not an under-18 note, which waits for a person's review. If you said no to a character, or a chat was closed because it read as someone under 18, that is kept even after you make the character forget you and after 30 days, under a code that no longer names you, until you delete your account. It would never apply to chats between members.
Group and event chats, which will be visible to charper and labelled so; an event's chat is deleted 48 hours after the event ends.
Paid hosting features through a payment processor. Safety features will stay free.

Encrypted messages, when they launch

Not available yet. This is how messages between two members will work. We won't switch them on until this section matches what the app does, in the present tense.

Who will be able to read your messages: only you and the person you're writing to, on your own devices. Messages will be end-to-end encrypted with keys made on each device, which never leave it. charper, Cloudflare, and anyone who asks us for them won't be able to read what a message says: its words, the event invites and locations you share in it, or its photos.

Because charper runs in your browser, this rests on the app's code, which charper.app sends to your device. Someone who could change that code could read messages. Before messages launch, we'll say here how we protect against that.

What charper's servers will be able to see:

That two members have a conversation, who started it, and when. When your device asks for someone's keys to start a chat with them, we see that too.
Which of you sent each message, and which device it came from.
When each encrypted message reached our servers. That time is deleted with the message. We don't record when your device collects it.
Roughly how long each message is. Every message is padded to at least 512 bytes, so short messages look alike; longer ones show their length.
How many devices you've set up for messages, when each was added or removed, and their public keys, which let others encrypt to you and can't unlock anything. Other members will be able to see your devices' public keys too, because that's how their app encrypts to you. Before messages launch, we'll limit that to people who can message you.
The network address each request comes from, as with everything on charper. We don't store it.
Each device's push address, which your browser makes so we can tell it a message is waiting, until that device is removed or you delete your account.

What our servers will keep, and for how long: an encrypted message waits on our servers only until your device collects it, and is deleted then. If it is never collected, it is deleted after 30 days. Photos will be encrypted on your phone before they're uploaded, and their keys travel inside the encrypted message.

The record that a conversation exists (the two of you, which of you started it, and when) is kept until one of you deletes your account. If no message is ever sent, it is deleted after a day. Our database backups keep deleted records for up to 30 more days, then they're gone.

Private albums, if you share one, work differently: the photos in it are stored by charper, not end-to-end encrypted, and shown only to the people you give access to, until you take it back. charper can see them.

Notifications: a notification will say only "New message", with no name and no words from the message. Your phone fetches the message and unlocks it itself. If you turn on previews, the name and words are unlocked on your phone, never sent to us or the push service in the clear. The push service (Apple, Google or Mozilla) learns that your device gets notifications from charper, and when, but not who they're from or what they say. Knowing you use charper can itself say something about you.

We'll never scan your messages, and nothing in them will set off an automatic action.

Reporting: if you report a message, your device sends that message and the four messages before it to our safety team, with your consent. You can't add or leave out messages. A tag sent with each message proves the report wasn't edited and nothing in it is missing. Nothing else is ever unlocked. This is the only way anyone at charper will see the words of a message. We keep a reported message as long as the safety review needs it, and where the law makes us report it to the National Center for Missing & Exploited Children, for the year the law requires.

Checking who you're talking to: each chat will show a safety number you can compare with the other person's phone. If their keys change, for example because they lost every device, the chat tells you and waits for you to tap to continue. It never changes silently.

A new or lost phone: your messages live on your devices, not with us, and we never hold a readable copy. Whether a new phone can bring your old messages across depends on a choice we haven't made yet: start fresh, copy them from your old phone, or restore them with a passphrase only you know. We'll say which here before messages launch. If you lose every device and can't do any of those, your old messages can't be read again, the people you talk to see that your safety number changed, and messages still waiting for your lost devices are deleted. Getting back into your account doesn't bring back old messages.

If your phone is stolen: remove it from your devices on any other device you're signed in on. It stops getting new messages at once. Sign out everywhere also stops it fetching or sending messages, but doesn't remove it from your devices, so remove it too. Messages already on it are protected by the phone's own lock, so keep a screen lock on.

Deleting: deleting a message removes it from your devices; the other person's copy stays on theirs. Deleting your account deletes your keys, your devices' records and anything waiting for you on our servers. It also deletes the record of your conversations and any message you sent that the other person hasn't collected yet. Copies other members already have stay on their devices; we can't reach them.

Group and event chats won't be end-to-end encrypted at first. charper will be able to read them, and they'll be labelled so (see the list above). An event invite you send inside a private chat is encrypted, but the event itself (its title, place, time and guest list) lives on our servers, because the map has to show it.

Legal requests: if the law requires us to hand something over, all we will have is the facts listed above, the photos in private albums, reported messages, group and event chats, and encrypted messages we can't read.

Face verification, when it launches

Not available yet. It won't launch until our attorney has reviewed it, and we won't switch it on until this section matches what the app does. Before it does, we'll publish a face data retention and destruction policy, which also says what we'd do if face data were ever exposed, and ask for your written consent before your first check.

Who will be able to see what: at first, only you will see that your photos are verified. Before other members can see it, we'll add a way to prove the check really ran, and update this section. Even then, they'll see only a tick on your profile, never a date, a count or a failed try. Nobody, including charper, will see your scan or anything measured from your face.

It's optional. You can use all of charper without it, and we're adding a way to verify for people who can't use a camera or turn their head.

How it works: your camera films your face while you turn your head the way the screen asks. Your phone turns your face, and the face in each photo you choose, into numbers (a "face template", which the law calls biometric data), compares them, and then deletes the video and the numbers. All of this happens on your phone, with no outside company involved. Photos with more than one person in them can't be used, and nothing is compared or kept about anyone else.

What leaves your phone: only the result. That's a yes, the date, which version of the check ran, and a fingerprint of each photo file (a SHA-256 hash, which can't be turned back into the photo). Never the video, a picture, a face template or a score. A failed check leaves no result; we only count that a check was started (see below).

When your photos change: the badge will cover only the photos that were checked. If you add or replace a profile photo, the badge will come off until you check again.

What we'll never do: sell, rent, trade or profit from face data or the result; use it to identify or search for anyone; use it to train models; or share it with anyone.

Your consent: before the camera opens or a photo is read, the app will tell you what happens, what leaves your phone and how long we keep it, link the retention policy, and ask you to agree with a box you tick. We keep which version of those words you agreed to, a fingerprint of them, and when.

Changing your mind: on the Photos verified page, Remove it deletes the result at once and withdraws your agreement. It works even if the feature has been switched off. You can verify again later, after agreeing again.

Retention schedule:

The video and face templates: on your phone only while the check runs, and deleted when it ends. They never reach our servers.
The result (yes, date, version of the check and photo fingerprints): until you remove it, withdraw your agreement, or delete your account, and then deleted at once.
The record that you agreed (version, fingerprint of the words, time): until you delete your account, as proof that we asked.
During a check, its single-use head-turn order: it works for 10 minutes and is deleted within the hour after that. The number of checks you started each day, so we can limit them to five: 2 days.
Database backups holding any of these: gone within 30 days.

The laws we follow: Illinois (the Biometric Information Privacy Act), Texas (its biometric identifier law), Washington (its biometric identifier law and the My Health My Data Act), Colorado, Oregon and California all protect face data. We'll follow the strictest of them for every member, wherever you live: written notice and your signed consent before any scan, a public retention schedule, deletion as soon as the check is done, no selling or sharing, and protection at least as strong as for anything else we hold. In Washington, face data counts as consumer health data, so the consumer health data policy described above applies.

If you're in Europe or the UK: the face check won't be offered there. It will be closed to requests from the EU and its overseas territories, the rest of the European Economic Area, the UK with Gibraltar and the Crown Dependencies, Switzerland, Andorra, Monaco, San Marino, Vatican City, Svalbard and the Faroe Islands, and to any request whose country we can't tell (through Tor, for example). We tell where a request comes from by the country our network provider reports for it, so this is a best effort, not a guarantee. If you checked before, you can still see and remove your result from anywhere. If we ever offer the face check there, we'll ask for explicit consent and assess the risks before we do.

The age check in the list above won't reuse this scan. It's a separate check that keeps only a yes, and because it also looks at your face, it will get its own notice and consent first.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change affects how we use data we already have, or adds a new kind of sensitive data, we'll tell members in the map or by email before it takes effect, and ask for consent where the law requires it.

Contact us

Curiositech LLC
5441 S MACADAM AVE STE N, PORTLAND, OR 97239, USA
Send a private request

Send a private request

Ask for access, a correction or deletion, or tell us about another privacy concern. A person will review your request. Sending this form does not automatically change or delete an account, and no confirmation email is sent.