Privacy Policy

In plain words

I’m an AI. When we talk, your voice goes straight from your phone to ElevenLabs, the company that gives me my voice and my ears — it never passes through our own machines. They keep the recording, and their own copy of what was said. For my calls with you that copy deletes itself two years after we hang up. One thing I would rather say than let you assume: the catch-up calls, «Tell me something», only got that clock on 19 September 2026, and the ones taken before that day have none. If you delete your account, we ask them to erase all of it straight away.

From what you say, I write down a lot. Not just your words: what I think you value, roughly what you’re like, and — this is the one people don’t expect — what I think your religion is. If you mention a church wedding or Semana Santa, I may write down “Catholic” even if you never said the word. I might be wrong. You can read the page I keep about you, in the app, and tell me it’s wrong — in writing or out loud — and I rewrite it.

I also work out a rating of your photos that I never show you, and it decides who you can be introduced to.

And after I have introduced two people, if theirs is one of the introductions picked for a person to read, a model may write an imaginary conversation between them — both first names on the lines, sentences lifted word for word from their own calls — to find where they would rub each other up the wrong way. It never happened. Neither of them is ever shown it, and it changes nothing: the introduction has already gone out.

Because I only introduce men to women and women to men, using me says something about who you’re attracted to. European law treats your faith and who you’re attracted to as data that needs your explicit permission. That permission is asked separately from accepting the Terms, on its own screen, with nothing ticked for you. Taking it back has no button in the app yet: today it is an email, and section 6 is honest about what taking it back does and does not undo.

Before I introduce you to somebody, a real person looks at the two of you: your photos, your first names and your ages, and nothing else — no score, nothing either of you told me, nothing I worked out — and says whether, on looks, you are in the same league. If they say no, I don’t introduce you. There is one switch that would let a pair through without that look; it ships switched off, and section 7 says what it would do. Afterwards, some introductions are picked for a second person to read what each of you told me and the note I wrote to each of you; that reading changes nothing about an introduction that has already gone out.

You can delete your account from inside the app. It really deletes it. A handful of things stay behind, and section 13 names every one of them instead of calling them internal counters.

And if all you have done so far is leave your email on this website, that is a separate record with no account attached to it. Write to privacy@withsarah.app and we delete it. Section 17 explains why that has to be an email today.

1. Who we are

Menovite OÜ is the data controller — the company that decides what happens to your data and is legally answerable for it.

Company

Menovite OÜ

Register

Estonian Commercial Register (e-Äriregister), registry code 17486082

Registered address

Tartu mnt 67/1 — 13b, 10115 Tallinn, Estonia

Privacy contact

privacy@withsarah.app

Data Protection Officer

[DPO CONTACT — or the recorded assessment that none is required]

“Sarah” is our product. She is not a company and not a legal person. When this notice says “we”, it means Menovite OÜ.

2. Sarah is an AI system

Sarah is an artificial intelligence system. Her voice is synthetic, generated by software. There is no person on the line and nobody is listening live.

The models that answer you are other companies’ models, not ours, and which one it is depends on the call and the language: Anthropic’s models answer every call in English and the catch-up call in both languages, and Google’s answer the rest of the calls in Spanish. Both are reached through ElevenLabs. The analysis we run afterwards on what you said goes to Anthropic. The only models that run on our own machines are the ones that look at photographs. Section 9 names all of them and says what each one receives.

Article 50 of the EU AI Act requires that anyone interacting with an AI system be told so. Where we say it: here; in the Terms; on the screen of every call with her in the app, for as long as the microphone can be open, where a line says that Sarah is an AI and that the call is recorded; on the screen where you ask her about somebody she introduced you to; on the screen of a group room and of «Sarah, a solas», where a line says that Sarah is an AI, that she reads the thread to help you plan, and that a person only sees it if somebody reports something; and out loud, in her own first sentence, on four of the telephone calls — our support line, our switchboard, the line a restaurant calls back on, and the calls she places to a restaurant to book or cancel a table. On that last one the disclosure is scored against her: a call where it was missing, buried later or hedged is marked a failure.

She also telephones people who never signed up for anything, in the same synthetic voice: restaurants, when she books a table; a member who has not turned up to a date, on the number they verified; and whoever rings our support line. The restaurant calls are recorded and kept by the voice provider for a year, and our own erasure machinery does not reach them — see section 11. On the calls she places to a member, she says what she is in her first sentence. The one to somebody who has not turned up opens “Hi, it’s Sarah — the AI who introduced you two…”, and the one on the day of a table opens the same way about the table she booked. Until 19 September 2026 the first of those two opened with her name and the question and no disclosure of any kind; calls placed before that day were made that way.

What she does if something heavy comes up. If you tell her about self-harm, about violence in a relationship, or about a recent loss, she is instructed to drop the tone, sit with it, and suggest — once, gently, and never twice in the same call — a professional or a helpline. She is instructed not to diagnose and not to brush it off. Two things you should know, because they are not what people assume. On her calls she names three numbers and nothing else: 024, the line for anyone thinking of harming themselves; 016, the line against violence towards women; and 112, the emergency number. No association or service beyond those three is in anything she is given to say. And on the calls you start with her in the app, no human being is alerted to a crisis of your own — nothing in our code raises a flag on it. Three narrower things do reach a person. If she rings you because you have not turned up to a date and you sound unwell or unsafe, the system rings one of us straight away. After each call you have with her about a date you went on, our own model reads the transcript for one question only — whether you told her the person you met made you feel unsafe, harassed, threatened or pressured — and the voice provider’s own “felt unsafe” mark on that call is read too. If either says yes, a safety case opens and the system rings one of us. Neither that reading nor that ring has a switch: the switches only decide whether the other person’s introductions and dates are paused at once. And a second reader, built to notice the same thing in the rest of what you write and say — your written notes, your catch-up calls, the calls she places to you, the group rooms, «Sarah, a solas» and the reason you give when you decline an introduction — can open a case for us too; it sits behind a switch. If you are in danger, please ring the emergency services rather than Sarah.

3. What we collect

3a. What you say out loud, and what you type to her

• Live microphone audio of your calls with Sarah: the first long conversation; «Tell me something», the catch-up call, which you can take again and again, up to a limit each day and each week; the first call about your friends, if you came in through that door; the call after a date; the call where you explain why you passed on somebody; the call she places on the day of a table to remind you of it; and — if you do not turn up to a date — a call she places to the number you verified.
• A word-for-word transcript of every one of those calls, stored by us, including which of her turns you talked over and which of your “ya, ya”s were read as keeping her going rather than as an answer. Whatever you said about your family, your faith, your last relationship, your work or how you are doing is in there verbatim. There is one exception, and it is the odd one: the call she places when you have not turned up is deliberately not written down, so it is the single conversation with her you cannot read back.
• A recording of the call, held by ElevenLabs — together with their own copy of the transcript, their own summary of it, and the envelope of the call: how long it ran, why it ended, which language you spoke, what it cost. See section 11; that is the part of this notice we most want you to read.
• What you type to her. «Tell me something» is also a text box — up to 600 characters, a few a day. What you write is stored as a conversation like any other and is read into everything in 3d.
• Everything you write in «Sarah, a solas», the chat at the top of your friends tab where she is the only other voice. It is stored like a call: word for word, and read into everything in 3d. Two things follow from that and we would rather say both. The page she keeps about you only changes for the things that say who you are — what you are like, what matters to you, the people in your life — and not for the details of your week. And the details themselves are not thrown away either: out of anything you tell her — a call, the text box, this chat — she keeps a short line of her own, in her words, for the ones that are about seeing somebody («wants to see more of Marta»), so that she can suggest that plan later. Those lines are read by nothing but this chat, they never appear on the page you can read, and they are in your copy of your data if you ask for it.
• If you ring our support line: the number you rang from, the name you gave, what you said, a callback number, and the provider’s summary of the call. If that number matches a verified account, the voice that answers has been handed your first name and whether you have a date coming up before you have said a word.

3b. What you enter

Your name, exact date of birth, sex, height, a short bio, your city, your photos, a verification selfie, your email address (which may be an Apple private relay address) and your phone number. Your Apple account identifier. If you paid, a Stripe customer record.

And, on the friends side of Sarah:

• What you cannot eat — from a fixed list of eight, two of which are religious facts and three of which are health facts. See 20e.
• Your messages in group rooms and the photographs you send there, and the first name you were using when you sent each one, frozen onto the message.
• When you said you were free, plan by plan, and whether you said you were in.
• The first name of a guest you add who is not on Sarah, so that we can count them at the table.

3c. What your device gives us

• Your precise location. GPS coordinates from your phone, to roughly 100 metres, used for the 25 km radius we work in and to pick a venue.
• A second, separate coordinate — a “location proof”: where you actually were, as against the city you told us you live in. The app asks your phone for it once, quietly, at the end of the step where you fill in your basics — and it asks even if you declined to share your location for the city question. If the phone gives it, it is stored.
• If you decline location and type your city instead, we store the coordinates of that city for you, from a list baked into our code. Nothing on the screen says a coordinate was written. It is said here.
• Your push notification token and your notification settings. The token belongs to the handset rather than to you: if somebody else signs in on your phone, it moves to their account.
• Your IP address, used only to rate-limit requests and stop abuse. We do not store it in our database. Your phone number is not written into our own application log either: since the end of September 2026 its lines name you by an identifier, not by your number. See section 16.

3d. What we work out about you

This is the group people don’t expect, so it gets its own list. All of it is derived from one source — what you have said to Sarah, on calls and in writing. None of it comes from anywhere else: there is no third-party data, no enrichment, no looking you up.

• Big Five personality scores (openness, conscientiousness, extraversion, agreeableness, neuroticism), each with a confidence level and written reasoning.
• Your religion and denomination, how devout we think you are, and how much we think you need a partner who shares your faith. See section 4.
• Not your politics. An earlier version of the analysis asked for a political leaning. It no longer does; anything a model says about it anyway is thrown away before anything is stored, and the ones stored before that change were deleted.
• Values scores: how traditional you are, how family-oriented (including whether you want children), how career-driven.
• Your deal-breakers, your core values, your relationship priorities and your idea of a good evening out, in your own words.
• Your interests, hobbies, lifestyle and habits, including sleep schedule, social style and fitness level.
• A physical attractiveness score worked out from your photographs and your selfie, with five diagnostic sub-scores — symmetry, skin, proportions, averageness and photo quality — stored alongside how many photographs it was computed over and how much they disagreed with one another. We never show it to you. It bounds who you can be introduced to. Section 4 says how it is actually computed, because the usual description of it is wrong.
• A single desirability score for you alone, built from three of the personality numbers above — how calm, how agreeable and how conscientious we think you are. It is not a claim about you and any particular person: it is the same number whoever is looking, and it carries as much weight in the ranking as everything we know about your values. Section 7 says where it sits.
• Face recognition templates — mathematical representations of your face, capable of identifying you: two from every photograph you upload (one of your face as it is, one of its mirror image), and from your selfie a template that is kept in two places, plus a mirrored copy of it. Alongside them we keep two further mathematical representations of each photograph as a whole — of the image, not of your face. They play no part in any score today: the score described in section 4 is computed from your face, not from these. They are computed on our own machines and no photograph of yours is ever sent to another company. The one from the selfie is kept so that every photo you add later can be checked against it without asking you for a new selfie.
• The selfie image itself, kept after the check has passed — explicitly so that a later version of the scoring model can be run over it without asking you again.
• Mathematical representations of your interests, values and lifestyle (“embeddings”), used to find people similar to you.
• Sarah’s written assessment of you — a short note and a longer, franker analysis, which prints the numeric score beside each trait. No screen in the app shows either of them, and both are in your data export.
• «What I know about you» — the page she keeps about you. A few paragraphs written to you, in the second person, rewritten in full every time you talk to her, with every previous version kept for a while. You can read it in the app. It holds the people in your life by first name — “your sister”, “Marta” — and what you said about them; surnames are forbidden and stripped out if one gets through, and the removal is written into the version’s list of changes. The whole current text of it is handed to the voice provider at the start of every catch-up call.
• A character brief written to be played as you. A line saying who you are, notes on how you talk, three to five of your own sentences quoted word for word and checked character by character against your recording, and private positions on children, faith, money, ambition and how social you are — the instruction that produces it asks in terms for the parts you would not say out loud on a first date, and for the one thing that would end a relationship for you. It is not rewritten in place: a new one is written and the old one kept — with one exception: taking your faith back strips faith out of every one of them, the old ones included.
• Invented conversations between you and somebody you have been introduced to — written only after the introduction has gone out, only for one picked for a person to read, and only while a switch is on; the character brief above is written after every analysis either way. See section 7.
• A record of every person the system ever scored against you — who they were, the score, the five sub-scores, the weights used, the distance, the age gap, the height gap and the difference between your attractiveness score and theirs — whether or not you were ever told they existed.
• A frozen copy of what the reviewer had in front of them for every pair you were part of — your photographs, in the order and framing they were shown in, your first name and your age — so that changing anything later cannot change the record of what they saw.

3e. What is recorded around an introduction

• Whether you said yes, no or nothing at all, and when.
• If you said no: a reason from a list of four, a comment of up to 500 characters, and — if you took her up on the call about it — the whole transcript of that call, kept on a record of your own, with a copy of the first no given to that introduction also sitting on the introduction itself, a row shared with that other person’s history. The reason is counted, to see which part of the scoring a no points at; the comment can be read by a reader that looks for somebody having made you feel unsafe, and that reader sits behind a switch.
• If you met: what each of you said afterwards, including how attracted you felt and how connected, and the answers to three later check-ins — at around a fortnight, around two months and around six months — asking whether you are still seeing each other and whether you are a couple. A row is written when the question is asked, so not answering is itself recorded.
• If you asked Sarah about the person: your three questions and her answers, stored under your account.
• Your bookings, the €20 or the €2.99 that was charged, the reference of the payment at Stripe, when it landed, and what came back if it was refunded.

If you signed up on withsarah.app before installing the app, we also hold what you gave us there — see section 17.

4. What Sarah infers, and how

Some of what we hold you never told us. We worked it out. European law requires us to say so clearly.

Religion. We never ask your religion on a form. Sarah listens to everything you have ever said to her and our AI decides. It is specifically instructed to conclude that you are Catholic from behaviour — your own church wedding, baptising your children, keeping Semana Santa, going to Mass — even if you never use the word “Catholic”. That default fills a silence and never overrides an exit: “raised Catholic, but I stopped” is recorded as somebody who stopped, and a relative’s faith is not yours. It also assigns a score for how devout you seem and for how much you appear to want a partner of the same faith.

This matters because faith is the heaviest single thing in how she ranks people, and it works in three modes, read off two numbers taken separately — “how devout you seem” and “how much you seem to want a partner of the same faith”. If either is high — and the second needs less to count as high than the first — faith is about 45% of the score and people of your own faith are preferred. In the middle, about 20%, and it works differently there: a clash counts against a pair, while a shared faith is simply unremarkable and counts for nothing. And if both are low — or if we hold nothing about your faith at all, which we read the same way — the dimension is dropped entirely and the others are rebalanced around it. Silence is not scored as a lukewarm middle, and neither is being secular. Two faiths are not treated as interchangeable either: a Muslim and a Christian, or a Muslim and a Jew, are scored as far apart as a believer and somebody with no faith at all. You are never blocked from meeting somebody of a different faith — the preference shapes the order of the shortlist and the shortlist is topped up across it.

It is a guess, it can be wrong, and it does not entirely agree with itself. Running the same conversation through the same analysis a second time moves the answer: in our own measurements the denomination flipped between “Catholic” and “Christian” in two runs out of six. Treat everything in section 3d as an impression. If something is wrong, open «What I know about you» in the app and tell her — in writing, or out loud on a catch-up — and she rewrites the page; if you told her on a catch-up and what you corrected matters, the whole analysis re-runs over everything you have ever said to her, what you wrote included. What no screen lets you do is edit a score, a denomination or the attractiveness number directly, and we don’t rewrite a personality or values score, or the denomination, by hand either: the way to change them is to tell her, as above.

Sexual orientation. We do not ask and we store no orientation field. But at launch Sarah only introduces men to women and women to men. So using it reveals that you are seeking a different-sex partner. Under European law that is data about your sexual orientation, inferred from the design of our product. We are treating it as such rather than pretending otherwise. This is a current limitation of the product, not a position on who deserves to be introduced to anybody.

Attractiveness. This is not what people assume it is, so here is what it actually does. Every photograph of yours with a usable face in it is turned into a mathematical representation of that face and compared, for similarity, against a curated set of faces of the same sex chosen as attractive Western faces. The five closest comparisons are averaged and pushed through a curve to give a number between 0 and 1. Your score is the plain average of that number across every photograph of yours that could be scored — your selfie counts as one photograph among the others, not more. Separately, an older model with different formulas for men and for women produces the five diagnostic sub-scores; its own documentation says it is calibrated for Western and Caucasian faces, and it no longer drives the number that matters.

The score is internal. It is never shown to you and never shown to the person you are introduced to. What it does is bound who you can meet: the people you can be shown must sit inside a band around your own score — a band that is not centred: the woman’s score may sit further above the man’s than below it — and those who survive it are then ordered by how close the two numbers are.

Personality and values. Inferred by an AI from everything you have ever said to her — every call and every written note, not a single conversation — and only once there are at least six turns of it, so a call you hung up produces nothing. Treat them as an impression, not a diagnosis. Sarah is not a psychologist and nothing here is a clinical assessment.

5. Why we process your data, and on what legal basis

One line about the last row, because it is the one that leaves the building. The training labels are written out of the database to a file by a person running a script, not by the application — and, in our own code’s words, that material leaves the application’s deletion path the moment it is written to a file. Deleting your account does not reach a file that was already written.

6. Special-category data and your explicit consent

Three kinds of thing we hold are “special category” data under Article 9 GDPR: your religious beliefs (inferred — see section 4), your biometric face data (the template computed from your selfie and from your photographs), and, on the friends side, what you cannot eat — halal and kosher are religious facts, and an allergy or coeliac disease is a health fact.

Your sexual orientation is also special-category data, inferred from the fact that you are using something that introduces men to women.

For the first two we rely on your explicit consent, and here is exactly how it is asked and what it does.

• It is asked on its own screen, before your first call, separately from accepting the Terms. Accepting the Terms is not consent to any of this.
• Nothing is pre-ticked. The box starts empty and you have to tick it.
• One tick covers five things at once: recording the call; what she works out from it, including your faith and what you have been through; the face template from your selfie; looking at your photographs; and your precise location. They are written out as five sentences and agreed to with a single box. We are telling you that because it is the first thing a regulator would look at.
• Every yes and every no is written into a ledger: the purpose, whether it was granted, the date, and the version of this notice that was in force. Nothing is ever edited — a withdrawal is a new row — and a row only counts at the current version, so publishing a new notice and moving that stamp asks everybody again. Publishing on its own changes nothing: section 23 says why the two are separate.
• It is enforced, not merely recorded. Without the first two, the server refuses to open any call you start yourself in the app: the first long conversation, a catch-up, the call after a date and the call about why you passed on somebody. The call she places if you do not turn up is not separately checked: it only exists for somebody who already passed that gate. The call that reminds you of a table is different, because it can reach somebody who never passed it: it is checked every time, against the recording consent alone, and without that yes on file she does not ring — the written reminder still arrives. Without the photograph consent, an upload is refused before the image is even decoded. Without the face-template consent, the selfie is refused before its bytes are read.
• Three further purposes live in the same ledger and are not on that screen: your faith, on a line of its own — a yes is written beside the yes to what she works out from the conversation, and a no, once given, stays a no whatever you agree to later on that screen; whether people who have your number may find you (section 19); and, when you pay a group booking fee, your acknowledgement that you are giving up the 14-day right to change your mind.

And now the part that is not built, which changes what the paragraph above is worth.

• There is no in-app control that withdraws. The consent card in Settings → Privacy only ever grants: its two exits are “Continue”, which grants all five, and “Close”, which writes nothing. Write to privacy@withsarah.app and we act on it by hand. For what she works out from the conversation, faith included, the person who acts on it has a tool that does what the next two points describe; faith cannot yet be taken back on its own, so taking it back by email takes back the rest of what she works out too. For the other four there is no such tool yet.
• Withdrawing erases less than you might expect. No code path deletes a recording, a transcript, a face template or the attractiveness score because you withdrew; only deleting your account does that. What she works out from the conversation is the one exception. Withdrawing it deletes what was inferred about your faith (the religion, how devout you seem and how much it seems to matter), takes faith out of her written analysis and out of every character brief, deletes the invented conversations written from those briefs, and deletes every fact she had noted from what you said; the rest of your personality and values scores stay. And because a call needs that yes, she can no longer hold a call with you.
• Withdrawing what she works out also takes faith out of your ranking. What was inferred about your faith is deleted and nothing new is written about it, so the faith dimension drops out and the others are rebalanced around it, exactly as for somebody who never mentioned faith.
• Withdrawing the face-template consent does not unverify you. Nothing clears the template or the flag that says you passed. What is true is the consequence at the other end: verification is required before you can be introduced to anybody, on both sides, and that is enforced.
• Your coordinates are written two screens before you are asked about them, and saying no afterwards does not remove them. And if you never see that screen, setting a location is treated as the answer: the first time coordinates arrive and the ledger has never heard of that purpose for you, a yes is recorded.

7. How Sarah decides who to introduce you to

You are entitled to understand the logic. In plain terms, for each person:

1. 01Hard filters. The opposite sex, because she only introduces men to women and women to men. Both of you must have passed the selfie check. Both of you must have a finished analysis and the numbers that come out of it. Anybody either of you has blocked is excluded, in both directions. Anybody you have already been introduced to is excluded.
2. 02Age and height — by a rule, not by a preference you set. The man may be up to 12 years older and up to 4 years younger than the woman, and the man must be the taller one by no more than 30 cm. That is a filter in the query, not a setting. There is no control of any kind over who you are shown: no age range, no distance, no deal-breakers. The only lever you have is to pause.
3. 03Location. Within roughly 25 km, measured between the two of you.
4. 04A shortlist is cut. The other person’s attractiveness score must sit inside a band around your own — a band that is not centred, since the woman’s score may sit further above the man’s than below it — and the survivors are ordered by how close the two scores are, with a shared faith pulling people forward. A smaller age or height gap moves nobody up.
5. 05Scoring on five things: how compatible your faiths are, how close your values are, how similar your interests and lifestyle are, how well two temperaments fit (openness and extraversion), and — the one people do not expect — a single score for you alone, built from three of your personality numbers: how calm, how agreeable and how conscientious we think you are. That last one is not about the two of you. It is the same number whoever is looking, and it means the personality we inferred from your call helps decide how often you are shown to anybody at all. How much faith counts varies from person to person, as section 4 describes, and the other four are rebalanced around it. Nothing you do afterwards changes those weights. There is no feedback loop: what you say after a date and your reasons for passing on somebody are counted, and read by people, and they do not move the scoring. The weights are set by hand.
6. 06A conversation may be invented between the two of you — after you have been introduced. For an introduction picked for a person to read, two models are each given a character brief of one of you and made to talk through three to five specific frictions worked out from where your measured scores diverge, across one of five imagined evenings. It is run several times. A third model then scores the result out of 100, gives it a verdict, and writes findings each of which quotes a line one of you never said. All of it is stored, with both of your real first names on every line. Neither of you is ever shown it and it is not in your data export. Two things to be straight about: it changes nothing about the introduction, which has already gone out; and it runs only while a switch is on. The character brief it would use is written anyway, after every analysis. We describe the rest in the present tense because it is built, turning it on takes one switch, it would spend our money on each introduction it runs on (never yours), and we would rather you read it before it runs than after.
7. 07A person looks at the two of you, before you ever hear that the other person exists: both people’s photographs, first names and ages, and nothing else — no score, no profile, nothing either of you said. A no ends it there, for good.

The human gate, honestly. No pair becomes an introduction until a person has looked at it, as point 7 describes. One switch would change that: it would let a pair that passed every automatic check go out after 48 hours without anybody having looked at it, recorded as having gone out that way. It ships switched off, and turning it on asks for a recorded decision first. Once introductions have gone out, a share of them — how large is a setting — is picked for a second person to read what each of you told Sarah and the note she wrote to each of you; that reading holds nothing back and changes nothing.

What reaches your phone. You are not shown the other person’s scores, their weightings or their ranking, and we do not publish the exact weights or the code. One number does reach your phone with the introduction — the compatibility score for the pair — although no screen in the app shows it; it is in your data export.

Some of the profiles are ours. There are twenty internal accounts in the system carrying photographs of well-known public figures. A database migration marked them verified without anybody ever taking a selfie, and under the configuration running today they count as ordinary supply — which means a real person can be shown one and will read it as an ordinary introduction. [INTERNAL PROFILES — whether they stay in the pools once real people are in them, and what is said to somebody who is shown one]

This is automated profiling, and it decides whether you are introduced to anybody at all, although today no introduction goes out without a person having looked at the pair. One decision is taken with nobody in the loop, and you should know about it: calling off a table less than two hours before it closes your account there and then, unless Sarah had just rung you about that table. Others are built and ship switched off: the switch in the paragraph above, which would let a pair go out after 48 hours without anybody having looked at it; and a hold that pauses the introductions and tables of somebody while a person looks — when they are reported after an introduction for harassment or aggression, or, each behind a further switch of its own, when our reading of the call after a date, the voice provider’s own “felt unsafe” mark on that call, or the reader described in section 2 finds something. No number of reports closes an account on its own: a person always decides that. You can ask a person to look at a decision and contest it — see section 12 — though today that is an email and not a button. What we have not stated anywhere, because we have not been given the answer, is which exception in Article 22(2) lets any of those be taken automatically at all. Section 5 carries that question as an open one rather than printing an article number to fill the space.

And what happens afterwards, which the app deliberately does not explain. Saying no rests you for a fortnight. Not answering rests you for a fortnight. Finishing a date rests both of you for a fortnight, before either has said how it went. After the wait you are still not introduced to anybody until you ask. The screen gives you none of those reasons, and that silence is a decision rather than an omission: the alternative would tell you that the other person said no. The same goes for saying “we’re still seeing each other” — it takes you out of the pool until you say it ended, and the product never tells you so, because somebody who knew would have a reason to lie.

8. Human review

Before a pair becomes an introduction, a person looks at it. What they see, for both people: the photographs as the app would show them, the first name and the age — and nothing else. No score of any kind, no compatibility, no profile text, nothing either person said, nothing we inferred, and no invented conversation.

After introductions have gone out, a share of them is picked for a second person to read. What they read: what each of the two had said to Sarah up to then, on calls and in writing, and the note she wrote to each of them — no photographs, no scores, no analysis, no invented conversation. Whatever they answer, the introduction is not held back or withdrawn because of it.

What they are asked to do, before. Give each of the two people a mark out of ten, and answer the question the screen asks, “Looking only at the photos: are these two on the same playing field, so that both would want to meet?”, with yes, borderline or no — and, for a no, either “No, he is above her” or “No, she is above him”. What is stored for a no is a direction: which of the two is the one above. They can also say that one person’s photographs do not let them judge. A no keeps that pair apart for good. For thirty seconds after answering they can take it back; after that the answer cannot be changed. A reviewer who knows one of the two says so, and is not shown that person again. None of the people a reviewer looks at is ever told.

Each answer is kept with exactly what was shown — the photographs, their order and their framing — and cannot be edited, so that a later photograph cannot change the record of what was in front of the reviewer. Roughly one pair in ten is drawn to be shown to a second reviewer as well, to see whether the two agree, and now and then a reviewer is shown again a pair they judged at least a fortnight earlier, to see whether they agree with themselves.

A pair a reviewer says no to is never mentioned to either person — not in the app, and not in the data export: it never became an introduction. That withholding was deliberate, on the reasoning that exporting it would disclose both the gate and a person who was proposed and vetoed. The gate itself is described here, which is where it belongs.

The private page Sarah keeps about you is not the reviewers’ to read: only a super-administrator can open it.

Who reviews. Today the people who look at an introduction before it goes out are our own team, signed in with a staff login. Nobody outside the company reviews introductions. If that ever changes, this paragraph changes first.

9. Who else gets your data

We do not sell your data and we do not use it for advertising. There is no advertising software, no attribution software and no third-party analytics in the app or on this website: what we count, we count in our own database, and the rule there is identifiers, durations, counts and fixed values — never message bodies, phone numbers, names, email addresses or free text.

One error-tracking company can receive something from us: Sentry, in the table above, and only what its row says. It runs on our servers only when its setting is present there, and when it runs, the three things its row names are switched off by name in our code. The phone app carries no crash reporter at all.

One more call worth naming, because it is the same voice: when something breaks badly, the provider telephones one of us with a sentence made of counts and identifiers. No member’s personal data is in it.

10. Data leaving the EU

Several of the companies in section 9 are established outside the European Union, which means your data — including your call recordings and your transcripts — leaves it.

We are not going to print a country beside each name on the strength of a guess. Our own code names a country for only one of them — Brevo, a French company — and no region for any: what we can tell you truthfully is who receives what, which is section 9, and the rest is a matter of the agreements we hold. Those are being confirmed one processor at a time rather than summarised into a sentence that sounds finished.

Photographs and selfies

[STORAGE REGION — verify in Cloudflare]

The application and the database

[HOSTING REGION — verify in Railway]

The message we send when an account is closed

Brevo is Sendinblue SAS, a company established in France. It hosts its data with OVH in France and Germany, with encrypted backups on Google Cloud in Belgium — all of it inside the EU.

Every other processor in section 9

[ESTABLISHMENT — the country each named processor operates from, confirmed per processor from the agreement in force]

[TRANSFER MECHANISM — per processor, state EU-US Data Privacy Framework certification and/or Standard Contractual Clauses, and the data processing agreement in force. Verify one by one. Do not publish a generic claim here.]

You can ask us for a copy of the safeguards at privacy@withsarah.app.

11. How long we keep things

We will be straight with you, because the honest answer today is not the reassuring one.

What actually runs on a clock. Six things, and this is the whole list:

• Superseded versions of «What I know about you», the page she keeps about you, are deleted after 90 days. The current version is never deleted at any age.
• A friend request to a number that never joined is deleted after 90 days — see section 18.
• A photograph you picked for a group room and never sent is deleted after two hours, the bytes first and then the record of it.
• Expired sign-in tokens you have already revoked.
• The working notes behind the facts she keeps about you (an older reading replaced by a newer one, a disagreement over a fact that has since been settled) are deleted after 90 days, once nothing still in force points at them. A “never” you took back goes after 90 days too, except the latest one on each subject, which is kept so that reading a call again cannot bring it back. What is in force is never deleted at any age.
• The sheets on which we check her reading of a first call against what was actually said — your own words included — are deleted twelve months after the version of the reader they checked is retired, or twelve months after they were opened if never finished; a finished sheet still waiting to be scored is kept.

Everything else is kept for as long as your account exists. We run no automatic deletion and no anonymisation schedule for any of it, and we are not going to phrase that so it sounds like one. That includes: your call transcripts; everything in section 3d — the personality and values scores, the faith inference, the tags, the embeddings, the attractiveness score and its sub-scores; your photographs and every face template computed from them; your verification selfie, and any you replaced before we began erasing replaced ones; the character brief; the invented conversations; the answers reviewers gave on the pairs and introductions you were in, and the frozen copy of what they saw; the record of every person ever scored against you; your introductions, your bookings and everything you said after a date; the rooms you are in, everything you wrote in them, the photographs you sent and every plan; everything in «Sarah, a solas» and the short lines she keeps out of anything you tell her; the first names of the guests you added; what you told us you cannot eat; and every analytics row. If you delete your account, it goes — section 13. If you don’t, it stays.

And four things that sentence does not describe, because they are not tied to an account at all. The record you left on withsarah.app, which has no account behind it and is not reached by deleting one — section 17. A ticket from somebody who rang our support line, including a caller whose number matched nobody; nothing sweeps those, and our own code calls that a real gap rather than a handled one. A report somebody filed, which keeps both first names and outlives the account it was about — section 13. And a friend request that was accepted or declined, which is never swept at all: the 90 days above reach only the ones nobody answered. No period has been decided for any of these four either.

[RETENTION SCHEDULE STILL REQUIRED for every item in the two paragraphs above. Nothing in the code prunes any of them and no period has been decided, so a number printed here would be an invention. This placeholder does not come out until the schedule exists and something enforces it.]

What survives deleting your account is section 13, and it is longer than one line.

12. Your rights

You can:

• See what we hold (access) — there is an export button in the app under Settings → Privacy. It works even if your account has been closed or removed.
• Correct it (rectification) — in words, by telling Sarah. What that reaches, and what it does not, is below.
• Delete it (erasure) — section 13.
• Pause it — you can turn off introductions without deleting your account. That switch is exactly what it says and no more: it takes you out of the pools and out of new introductions, and nothing else we do with your data stops. It is not the right below.
• Restrict processing (Art. 18) — a separate right, and a real one. There is no button for it: it is an email. Tell us what you want held still and we will tell you what we have done about it.
• Object to processing based on our legitimate interests. There is no button for this: it is an email.
• Stop the marketing email, if you signed up on this website. There is no unsubscribe call anywhere in our own code, so this one is an email too — section 17 says so plainly.
• Take it with you (portability) — the export is machine-readable JSON.
• Withdraw consent — section 6, including the part about what withdrawing does not undo.
• Ask a human to look at a decision, tell us why you disagree, and contest it. Also an email, not a button.
• Complain — section 22.

What the in-app export actually contains. More than the previous draft of this notice claimed, and we would rather correct that upward than leave a version that flattered us. It carries your account details and your profile; every conversation with its full transcript; every version of «What I know about you», with the labels saying what changed in each; your five personality scores, your four values scores, your religion and how much we think it matters, the short note and the long, franker analysis; the list of your photographs with the face count and the verdict on each; your introductions with the compatibility score and the note written to you; what you said after a date; your bookings; your friends data; the reports you filed; and every row of your consent ledger.

What it leaves out, which is the longer list. The attractiveness score and its five sub-scores. Every embedding and every face template. The three lists of tags, which no screen in the app shows either. The complete raw output of the models that read you, which is where your deal-breakers and every per-field confidence live. Your coordinates and your location proof. Your Apple identifier and the keyed handle of your phone number. Your device tokens. Every analytics row. The character brief. The invented conversations. The answers reviewers gave on the pairs and introductions you were in, and the frozen copy of what they saw. The record of every person scored against you. Your cached shortlist. Your answers to the three later check-ins. Your decline reason and the transcript of the call about it. The icebreakers. One trap worth naming: the “url” next to each photograph in the export is our internal storage key, not a link anybody can open.

Some of that is withheld for somebody else’s sake and we would defend it: reports filed about you, the other person’s decision, and other people’s messages in a room you share. Some of it is withheld because a decision has not been taken — our own code says exactly that about the attractiveness score and the face templates. [WHETHER THE ATTRACTIVENESS SCORE AND THE FACE TEMPLATES BELONG IN THE EXPORT — a decision the code itself records as not taken]

That is not good enough for a full access request, and we are not going to pretend otherwise. Write to privacy@withsarah.app and we will send you everything we hold on you, including all of the above, within one month. That is your legal right, and email is how we honour it today.

What you can correct yourself, and what you cannot. You can read «What I know about you» in full in the app and correct it by telling her — that screen has no form and no Save button on purpose, because the correction is meant to be a sentence rather than a field. What no screen shows you and no screen edits: your personality and values scores, the religion we inferred, how much we think it matters, and the attractiveness score. For those, email us and we will show you what we hold; we don’t rewrite a personality or values score, or the denomination, by hand, so the way to change them is to tell her, as above.

We answer within one month.

13. Deleting your account

In the app: Settings → Privacy → Delete My Account. It asks twice and makes you type the word, and then it deletes.

This is a real deletion, not a deactivation. It removes your account record, your profile, your photographs and your most recent verification selfie from storage, your call transcripts, your personality and values profile, your faith inference, your attractiveness score, your face templates, your embeddings, every version of the page she kept about you, the character brief, the invented conversations, the reviews of your introductions, your location, your device tokens, your preferences, your introductions — on both sides — your bookings, your friendships, your plans, the guests you vouched for, what you told us you cannot eat, and everything you said after a date. It also asks the voice provider to erase your recordings, and keeps asking until they confirm.

What it does not reach:

• Your payment records at Stripe, which we must keep for accounting. More than that: nothing we run ever deletes your Stripe customer record, which carries your email address and your account identifier twice over. Our own records of your payments and refunds stay behind as well, a date’s as much as a group plan’s, with only your identifier removed; a group-plan one keeps the payment reference, the amount, when it was paid and when you waived the 14-day right.
• Your email subscriber record at Kit, and any signup you made on this website (section 17). Nothing in our code removes you from Kit either, so that one is a person doing it by hand.
• If your account was removed before you deleted it: a keyed hash of your Apple identity and a keyed hash of your phone number, with a category saying why. They have no link to your account, which is the point — they are built to outlive it. Nothing ever deletes them. They are what refuses a new signup and a new number, across a new Apple ID and across deleting and reinstalling.
• Reports somebody filed about you, keeping both first names as they were at the time, what was written, and a keyed hash of your Apple identity.
• Your consent ledger, with your identifier removed and a keyed handle of you left in place, so that “was consent held for this, on this date” stays answerable after you are gone.
• Every analytics row, with the subject removed and the contents kept.
• What you wrote in group rooms, attributed to “Deleted account”. The photographs you sent there are destroyed; the words stay, because a room’s history belongs to everybody in it. That is a trade, and we would rather state it than bury it.
• Internal alerts, which have no link to any account and can carry a payment reference.
• A support ticket from a caller we could not match to an account. If you rang us before you signed up, that ticket holds the number you rang from, the name you gave, what you said and a callback number — and nothing about it points at your account, so deleting your account never reaches it. Nothing sweeps it on a clock either. Our own code says so in those terms.
• A verification selfie you replaced before we began erasing replaced ones. A selfie you replace now is erased once the new one is stored, and deleting your account deletes the current one; one replaced before that change still sits in storage with nothing pointing at it.
• Safety cases that involved you — opened from a report or from something somebody told her — and the record of what was done about them, kept with your identifier removed.
• Anything already written out to a file by our training-label export which — in our own code’s words — leaves the application’s deletion path the moment it is written to a file.

None of those is an anonymous counter, and an earlier draft of this notice called them that. Two of them exist precisely so that you can be recognised if you come back.

One thing you should know about the other person. If you were introduced to somebody and went on a date, the record of that date belongs to both of your histories. Deleting your account removes it — which means the other person also loses that part of their own history. We think your right to erasure should win, but you should know that that is the trade.

14. Do you have to give us all this?

To be introduced to anybody at all we need your age, sex, height, location and photographs, a verification selfie, and we need you to talk to Sarah — that conversation is the entire thing. The selfie is not optional in practice: the query that finds people refuses on both sides without it, and refuses anybody whose analysis did not finish. Without them we cannot do this for you.

Your religion is never asked for on a form. On the first call she asks about faith without assuming anything, and if it is not part of your life she moves on after one question. If your conversation gives us nothing about faith, we record nothing, the faith dimension drops out of your ranking and the rest is rebalanced around it. Nothing breaks.

Your bio is optional, with one wrinkle worth knowing: if you leave it empty, Sarah writes one for you, in the third person, and that is what the other person reads on your introduction. Notifications are optional.

15. Under 18s

Sarah is for adults. You must be 18 or over, and that is checked on our own servers when a profile is created and again every time one is changed — the same check on the dating door and on the friends door. If we find an account belonging to somebody under 18, we delete it and everything attached to it. We should be plain that the second sentence is a commitment rather than a mechanism: nothing in the product goes looking for one after signup.

16. Security

Photographs and selfies are stored as private objects, and nothing reaches them directly: every image is fetched through us, with a signed link that lasts an hour. What that link checks is the link, not who is holding it. For that hour, anybody with the address can fetch the photograph. Photographs inside a group room are the other way round — those are tied to one viewer and re-checked on every single request, so a leaked address stops working the moment that person leaves the room. We would rather tell you which of the two your profile photographs are.

No part of the product ever serves your verification selfie back — there is no route that returns it, to you or to anybody on our team. Reading one would mean going into the storage account directly.

Passwords don’t exist for you — you sign in with Apple. Staff sign in with a password and a session that lasts a week, and the review panel is reached by named accounts in three tiers. There is also a shared operator key, treated as the highest tier, which produces no reviewer identity at all, so what is done with it is not attributable to a person. We would rather you knew that than read “restricted to named team members” and take it at face value.

Our own log. Since the end of September 2026 its lines name people by an identifier, not by a phone number or an email address, and a model’s answer that fails to parse is logged by its length, not its words. Before that, it carried your full phone number every time a verification code was sent or checked, an administrator’s email address when they changed their password, and the first 200 characters of such an answer — which, on an analysis, is prose about a person. That log belongs to our hosting company and nothing of ours prunes it, so lines from before that change may still be there for as long as they keep them.

We’re a small team. We are not going to tell you our systems are impenetrable.

17. This website

withsarah.app is a static site with no login and no account.

What the form collects. If you ask us to open in your city, we store your email address, the city you asked for, your age, your gender, the language you were reading in, and the referral code you arrived with (if any). If your city isn’t on our list and you type it in, we store that text too, and nobody sees it but us — it never appears on the public board.

What we do with it. We count the cities to decide where to open next, and we pass your email, language, city and referral source — not your age, not your gender, and not the city you typed in yourself — to Kit, the company that sends our email, so that we can write to you when your city opens. Your age and your gender are kept for one thing and it is not the email: counting the shape of who is asking in a city — how old they are, and how the two sexes balance — because a city where only one sex asks is a city where we cannot introduce anybody. They never reach Kit, they never appear on the public board, and nothing in the product reads them back into an account today.

We would like to say that submitting the form is how you consent to the email, and that is what we are relying on. We are not going to pretend it is settled: the line beside the form says only that we want to know who is asking and to write to you, and it does not name Kit. [THE MARKETING CONSENT — either the sentence beside the form says plainly that we will write to you and that Kit sends it, or this stops resting on consent. Counsel’s answer, before publication.]

How to stop the email. There is no unsubscribe call anywhere in our own code, so the route that works today is the one in the box above: write to us and a person takes you out of Kit by hand. We are not going to promise you a one-click link in every message when nothing we control puts it there. [THE UNSUBSCRIBE — a working one-click opt-out in every marketing message, which Spanish law (LSSI arts. 21–22) wants beside the consent. Until it exists, the email address is the route and this paragraph says so.]

The public city board shows ranks always, and numbers only for cities that reach 1,000 requests. It is built from counts. It never shows an email address, an age or a gender, and it never shows an individual.

Cookies and third parties. We set no advertising cookies, we run no analytics that profile you, and nothing third-party is fetched when the page loads. One thing is stored on your device and it is ours: when you switch this page between English and Spanish, that choice is written into your browser’s own storage under the name sarah_lang, so the site opens next time in the language you picked. It holds two letters. It carries no identifier and nothing that says who you are, and it sits outside a consent choice because it is the preference you just expressed. There is one exception and it is under your finger: if you tap the sound control, the page loads a music player from Spotify, and from that moment Spotify can see your browser and set its own storage. Nothing loads it unless you tap. [COOKIE CHOICE — whether that tap is enough, or the player goes behind a consent choice or is replaced with audio we host ourselves]

18. Adding a friend by their number

The friends side of Sarah works on phone numbers. This section is about what that means for the number you type in — including when it turns out to belong to nobody.

18a. We never see your address book

There is no contacts permission and no contact upload. The app does not contain the code to read your address book at all. You type one number at a time, or pick one from a picker that runs outside our app and hands back only what you tapped, and that is the only number we receive.

18b. What we store, and what we don’t

We do not store the number. What we store is a keyed hash of it — a fixed-length string produced by running the number through a one-way function together with a secret only we hold — and a masked version for your own list, so you can tell which of your contacts a pending request was for. That looks like «+34•••••78».

18c. When the number belongs to somebody who is not on Sarah

A row is still written. That is not an accident — see 19a for why the alternative would tell you whether they have an account.

We never contact them. No text message, no email, no call. There is no route in our code that sends anything to a number that has no account. The invite link is handed back to you, in the app, and if they hear about Sarah at all it is because you sent it to them yourself.

Our lawful basis is legitimate interests (Art. 6(1)(f) GDPR), and here is the balancing we did rather than a citation on its own. On our side: you asked for this, it is one number, it is used for one purpose, and a product where you add a friend by their number cannot work without it. On theirs: they did not ask, and that matters. So the processing is kept as small as it can be — the number is hashed on arrival and never stored, it is never used for marketing, never enriched, never sold, never used to build a picture of them, and never used to work out who else might know them. If they never join, it is deleted after 90 days.

Two honest edges on that 90 days. The sweep counts from when the number was first added rather than from whether the invite you sent is still live, so a contact you added again later can be swept while a working invite is still out in a message thread. And a request that was accepted, or declined, is never swept at all: the refusal is what stops somebody adding you again to get a second chance, and it is worth more kept than deleted.

Because we hold no way to reach them, we cannot send them the notice Art. 14 would otherwise require, and we rely on Art. 14(5)(b) — this section is that notice. If you believe your number is in here and you want it out, write to privacy@withsarah.app and we will remove it. You do not need an account to ask, and we will not ask you to make one.

18d. Three other people are in the same position

A number that belongs to nobody is not the only person here who never signed up for anything, so this notice is theirs too. A guest somebody added to a table, whose first name every member of that plan can see (section 20d). Somebody you told Sarah about — your sister, a friend, whoever you were with last year — whose first name and what you said about them sit inside the page she keeps about you, and whose name is read out to the voice provider at the start of every catch-up call (section 3d). And whoever answers the telephone at a restaurant she rings, whose voice is recorded and kept for a year by the voice provider, and which nothing in our erasure machinery reaches (sections 9 and 20c). We hold no way to reach any of the three, so Art. 14(5)(b) is what we rely on for them as well. The lawful basis for each of the three is open in section 5 and we have not filled it in with something that reads well. If you are one of them, write to privacy@withsarah.app and we will tell you what we hold and take it out. You do not need an account to ask.

19. Requests, and what we refuse to tell people

19a. We never say whether you are on Sarah

Somebody who has your number can send you a friend request. Whatever happens next, the screen they see is the same: “Request sent”, with the option to send you an invite link.

It is the same screen whether you have an account, whether you have never heard of Sarah, whether you have hidden yourself, whether you blocked them, and whether you already said no. It is the same words, the same buttons, and it takes the same amount of time — because a screen that appeared faster for one of those would answer the question just as well as saying it out loud.

This is a deliberate limit on a product we could have made more convenient. Being able to type a number into an app and learn whether that person is on a dating service is a thing we are not willing to build, for people who never agreed to be looked up.

It also means we cannot tell you whether your request reached a real person. Your list says “sent” and keeps saying it. That is not us being coy with you; it is the only way the guarantee holds for you as well.

19b. Saying no is silent

If you decline a request, the person who sent it is not told. Their list still reads “sent”. They cannot get a second chance by adding you again — we remember the refusal, and that is the one thing about the pair we keep after the request itself is gone.

19c. Hiding yourself

In Privacy there is a switch: Hide me from contact search. Turn it on and somebody who has your number can no longer send you a request. They are not told that either — their screen is the same one everybody gets.

Two honest details. Invite links still work: if you follow a link somebody sent you, that is you choosing, and hiding your number does not undo it. And turning the switch back off does not deliver requests that arrived while it was on — they were never delivered, and handing them over later with old timestamps would leak exactly what the switch is for.

The switch is off by default, which is a choice we are telling you about rather than burying: the friends side is built around being findable by people who already have your number. Every change to it is recorded as a consent row, in both directions.

19d. The invite link, and the clipboard

The invite link you send is a page on this website, and anybody holding that link is told your first name, with no account and no sign-in, until the link expires. After that the page stops giving the name.

And when somebody who received one taps “Get the app”, this website copies the link into their clipboard, so that the app can pick the invitation up on first launch: the app reads the clipboard once, recognises a withsarah.app address, takes the token and clears it. Their phone shows its own paste banner when that happens. The alternative for joining an invitation to an install is a fingerprinting service, and we were not going to add one.

20. Rooms, plans and what Sarah does in them

20a. What is stored

• Your messages, as you wrote them, and who is in each room — with the first name you were using frozen onto each message, so it stays on that line whatever changes later.
• Photos you send, stored with our storage provider. They are checked automatically for explicit content before they reach anybody, and re-encoded on the way in — which is what strips the location and everything else out of the file.
• Plans: the meal, the part of town, the times you said you were free, whether you said you were in, and the first name of anybody you added who is not on Sarah.
• What you cannot eat — see 20e.
• Who paid the booking fee, and the Stripe record of that payment.
• How far each of you has read. Every member’s read position is shown to every other member.

The people in the room can see all of it. That is what a room is. Two consequences worth stating rather than discovering: adding somebody to a group hands them the whole history by default, back to before they arrived; and a room can hold people who are strangers to each other, because the only rule is that whoever added them is friends with each of them. A group also outlives any one member: if you leave, the conversation carries on without you and what you already said stays where you said it.

20b. Sarah reads your rooms

So: what you write in a room is read by a model; it leaves for another company every time she takes a turn, including turns nobody asked for; and there is no switch that turns her off in one room. Leaving the room is the way out of it. The room’s own screen says as much — Sarah is an AI. She reads this thread to help you plan — and this notice should have said the same from the start.

What she cannot do is read across. The part of the system that answers in a room cannot reach the page she keeps about you: what you told her privately never arrives in your friends’ group. The reverse is true of the rooms and not true of the friends call — what you say on a call becomes evidence like anything else, and can move the numbers that decide who you are introduced to.

Staff cannot read a room. The only way in is a window of at most twenty-five messages either side of a message somebody has actually reported, only while that report is open, and every such look is recorded with the name of whoever made it. Taking a message down removes that message and nothing else.

20c. What the restaurant is told

When Sarah rings a restaurant for your group, what she gives them is: how many people, what day and time, a callback number of ours, one surname to put the booking under, and — if anybody at the table told us — what the table needs to eat safely, said as a count and a need ('one coeliac'), never as a name (section 20e). The surname is ours, not yours — it comes from a small fixed list we keep, and the app tells you which one to give at the door. No member’s name is spoken on that call, and the restaurant is never told who is in your group.

The call is placed through ElevenLabs, who supply the voice. It is recorded and kept there for a year, and nothing in our code erases it — our erasure machinery only reaches calls that belong to a member’s account, and this one does not. The voice on it is the restaurant’s staff, who never agreed to anything. Section 9 lists them and everybody else who receives something.

20d. Somebody you added who is not on Sarah

If you add a friend to a plan by typing their name — somebody without an account, so we can count them at the table — we store that name and nothing else. No number, no email, no note. It is attached to that one plan and it goes when you go.

Two details about who sees it. Every member of the plan sees that name on the plan sheet. The room itself is only told that the number at the table went up by one — Sarah saying “Ana is bringing Marta” would put a person’s name into a room they are not in and cannot leave. And the number the restaurant is given includes them.

20e. What you cannot eat, and where it goes

On a plan, Sarah asks whether anybody has something they don’t eat. The list is fixed at eight — vegetarian, vegan, gluten-free, no pork, halal, kosher, nut allergy, shellfish allergy — and there is no free-text box, for anybody. Halal and kosher are religious facts; an allergy and coeliac disease are health facts. Article 9 covers both, and there is no separate consent for either today: section 5 carries that as an open question rather than as a claim. “I eat everything” is a real answer and is stored as one; saying nothing stores nothing, and a plan is never blocked by an unanswered question.

What she does with it is say it out loud to the room, as one warm clause per person naming what the place has to offer them — “somewhere with a proper vegetarian option for Ana” — never what they cannot have. Halal and kosher are the exception: they are said once, as a fact about the place, with nobody’s name attached. The name is withheld; the fact still reaches everybody in the group, and that sentence is returned to every member of the plan.

And the part that has to be told in full: when she books, Sarah tells the restaurant on the phone — how many of you and what is needed, 'one coeliac and one who doesn't eat pork', never whose. Only on that call and only out loud: it goes nowhere in writing, no message to the restaurant carries it, and it does not decide which restaurant is chosen. Whatever the restaurant answers is stored with the booking. If you would rather tell them yourself when you arrive, don't tell us here: with no answer there is nothing to pass on.

21. If you only came for your friends

You can use Sarah for your friends without using her for dating. It is a real choice, not a trial: at that door you are asked for a first name, a date of birth and a phone number. What an earlier draft of this notice said next — that the questions stop there — was not true, so here is what actually happens.

21a. What is different, and what is not

• You are not asked to take the long first call — but there is a call for you. Once the two call consents are on file, Sarah offers you a first conversation about your friends: who you go out with and how many, which parts of Madrid, whether anybody in your group doesn’t eat something — allergies, coeliac, vegetarian, vegan, halal, kosher, which nights you are free, roughly what you want to spend, and what kind of place suits you. It is recorded and transcribed like any other call, and it is kept at the provider for two years like her other calls — with the exception section 11 describes for calls taken before 19 September 2026. It also means you may be saying other people’s religious and health facts out loud, on a recorded call.
• We do not ask you for photographs or a verification selfie, so in the ordinary course there is no face template and no attractiveness score for you. That is a description of what we ask for, not a wall: if you open Settings → Privacy and give the photograph consent, the server will accept photographs from you like anybody else’s.
• No location. We do not ask for it and we do not have it. Plans work on parts of Madrid, not on where you are.
• Everything in section 3d happens to you once you have had that call. The analysis does not care which door you came in by — it reads every call and every written note you have given her. So the personality scores, the values scores, the faith inference and the embeddings exist for you too, from the moment you take the friends call and not before.
• There is a written page about you. «What I know about you» is written from that call, readable by you in the app and readable by a super-administrator, exactly as for anybody else.

The date of birth is used for one thing: checking you are 18. It is the same check the dating side uses, in the same code.

21b. You are not in the pool

Not “excluded by a setting” — you cannot be selected. The query that finds people to introduce requires three things at once: an account flagged as having finished the full sign-up, a verification selfie that passed, and a finished analysis with the numbers that come out of it. A friends-only account has the first two switched off by design, and the flag is never set until you choose to finish. So there is no state in which you are considered and rejected. You are not in the room where that happens — and taking the friends call does not put you in it.

You will also not be nagged about it. We do not send you reminders to finish signing up for something you did not sign up for. The offer sits in three places in the app — your home screen, your dates tab and your profile — and nowhere else.

21c. If you change your mind

Finishing the full flow turns your account into an ordinary one, and from that point everything in section 3 applies to you like anybody else. Nothing in this section is a limit we impose — it is a description of what we have not asked you for yet.

22. Complaints

Talk to us first: privacy@withsarah.app. If we don’t fix it:

• Andmekaitse Inspektsioon — the Estonian Data Protection Inspectorate, our lead supervisory authority. [ANDMEKAITSE INSPEKTSIOON — POSTAL ADDRESS] · www.aki.ee
• Agencia Española de Protección de Datos (AEPD) — if you live in Spain you can complain here instead. C/ Jorge Juan 6, 28001 Madrid · www.aepd.es

You can also go to court.

[DPIA — Article 35 requires a Data Protection Impact Assessment for this processing. Given inferred religion, a face template, an attractiveness band and invented conversations in people’s names, this is the placeholder least safe to remove without the work behind it. State its status here once it has been carried out. Do not publish a claim that one exists until it does.]

23. Changes

If we change something that matters, we will tell you in the app or by email before it takes effect, and you will be asked to agree again where the law requires it. Old versions stay available at [ARCHIVE URL].

There is a mechanism behind that sentence, and it has teeth. Every consent you have given is stamped with the version of this notice that was in force when you gave it, and a consent only counts at the current version. So publishing a new notice and moving that stamp asks everybody again, and closes every gate — no call, no photograph, no selfie — until they answer. That is a real cost, which is why the version is moved deliberately rather than with every edit.

One practical thing, because section 12 promises you every row of your consent ledger. The stamp the code writes is not the version identifier printed below: it is a short string of its own, and the two schemes have never been reconciled. So a row in your export can carry something that matches nothing you can find on this page. [THE CONSENT STAMP — one identifier for both, or a printed key here saying which stamp corresponds to which published version. Settled before the stamp is next moved, not after.]

This version: 0.1, in force from [EFFECTIVE DATE].