Privacy Policy

Effective Date: May 1, 2026 · Last Updated: May 2026

Your privacy — especially your health information — is our highest priority. This policy explains exactly what we collect, how we use it, and the rights you have over your data.

We Never Sell Your Data

Your personal and health information is never sold, rented, or traded to third parties, advertisers, or data brokers — ever.

1. Who We Are

PositivesConnect™ ('we', 'our', 'us') is a dating and social connection platform designed exclusively for adults living with STIs/STDs. We are committed to your privacy, especially given the sensitive nature of the health information shared on our platform. Contact: support@positivesconnect.app Privacy inquiries: privacy@positivesconnect.app

2. Information We Collect

We collect information you provide directly when registering or using the app: • Account data: name, email address, password (securely hashed with bcrypt — never stored in plain text) • Profile data: age, bio, pronouns, gender identity, ethnicity, photos, videos • Sensitive health data: self-reported STI/STD conditions and sexual health preferences (provided voluntarily) • Discovery preferences: distance radius, age range, relationship goals • Location data: approximate location for match discovery (if you enable it — never precise GPS) • Payment data: processed by Stripe or PayPal — we never see or store your card numbers • Device data: push notification tokens, device model, OS version • Usage data: swipes, matches, messages, and feature interactions (used for safety and improvement)

3. Sensitive Health Information

PositivesConnect™ handles health-related disclosures with the highest level of care. Your health data is: • Provided entirely voluntarily by you — we never require specific diagnoses • Used solely to match you with compatible users based on your own preferences • Never sold to third parties under any circumstances • Never shared with healthcare providers, insurers, employers, or government agencies except as required by law • Protected with AES-256 encryption at rest and TLS 1.3 in transit • Under your complete control — update or delete it at any time By voluntarily providing this information, you consent to its use as described in this policy. You may remove or update your health information at any time through your profile settings.

4. How We Use Your Information

We use your information to: • Create and maintain your account • Display your profile to compatible users based on mutual preferences • Enable messaging between matched users • Process premium subscription payments • Send notifications about new matches and messages • Investigate reports of abuse, harassment, or policy violations • Detect and prevent fraud, fake accounts, and safety threats • Improve platform performance and develop new features • Fulfill legal obligations and respond to lawful requests We do not use your data for: • Targeted advertising to third parties • Sale to data brokers or marketing companies • Automated decision-making that has legal effects without human review

5. Information Sharing

We share your information only with: • Other users: your visible profile (name, age, bio, photos, and health details you choose to display) • Stripe / PayPal: payment processing only — they have their own privacy policies • Google Cloud Storage: encrypted media file hosting • Expo / FCM / APNs: push notification delivery infrastructure • Law enforcement: when required by valid legal process (subpoena, court order) • Business successors: in the event of a merger or acquisition, subject to the same privacy commitments We never sell, rent, or trade your personal data to advertisers or data brokers.

6. Cookies & Tracking

PositivesConnect™ uses limited tracking technologies: • Session tokens: to keep you logged in securely • Analytics (anonymous): to understand how features are used and improve the experience — no personal identifiers are attached • Crash reporting: to identify and fix technical problems We do not use advertising cookies, cross-site tracking pixels, or third-party behavioral profiling. You can clear session data by logging out of the app. Mobile devices may offer additional tracking controls through iOS Settings → Privacy → Tracking or Android Settings → Privacy.

7. Data Retention

We retain your data only as long as needed: • Active account data: retained for as long as your account exists • Profile and health data: permanently deleted within 30 days of account deletion • Messages: deleted within 30 days of account deletion • Transaction records: retained for 7 years as required by U.S. financial regulations • Safety and abuse logs: retained for up to 3 years for platform safety purposes • Anonymized aggregate analytics: may be retained indefinitely (no personal identifiers) You may request deletion of your account and data at any time through Account Settings.

8. Your Privacy Rights

Depending on your location, you have the following rights regarding your personal data: All Users: • Access: request a copy of the personal data we hold about you • Correction: update inaccurate or incomplete data • Deletion: delete your account and associated data • Portability: receive your data in a portable format • Withdraw consent: remove sensitive health information at any time California Residents (CCPA/CPRA): • Right to know what personal information is collected, used, shared, or sold • Right to delete personal information • Right to opt out of the sale of personal information (we do not sell data) • Right to non-discrimination for exercising your privacy rights • Right to correct inaccurate personal information • Right to limit use of sensitive personal information EU/UK Residents (GDPR): • Right to access, rectify, and erase personal data • Right to restrict or object to processing • Right to data portability • Right to lodge a complaint with your local supervisory authority • Right not to be subject to solely automated decisions • Legal basis for processing: consent (health data), contract performance (account), legitimate interests (safety/fraud) To exercise any of these rights, email: privacy@positivesconnect.app We will respond within 30 days (45 days for complex requests).

9. Children's Privacy (COPPA)

PositivesConnect™ is strictly for users aged 18 and over. We comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect, use, or disclose personal information from anyone under 18. If we discover or are notified that a user is under 18, we will immediately: • Terminate their account • Delete all associated personal data • Block re-registration from the same device or email If you believe a minor has created an account, contact us immediately at support@positivesconnect.app.

10. Data Security

We implement industry-standard and beyond-standard security measures: • TLS 1.3 encryption for all data in transit • AES-256 encryption for sensitive data at rest (including health disclosures) • bcrypt password hashing with high cost factor • JWT-based authentication with secure token expiry • Google Cloud Storage with strict access controls for media files • Regular security audits and vulnerability assessments • Incident response plan for potential data breaches Data Breach Notification: If a breach occurs that is likely to result in harm to your rights or freedoms, we will notify affected users within 72 hours of becoming aware, as required by applicable law, and will cooperate with relevant regulatory authorities.

11. International Data Transfers

PositivesConnect™ operates from the United States. If you are located outside the U.S., your data will be transferred to and processed in the U.S. For EU/UK users: we rely on Standard Contractual Clauses (SCCs) approved by the European Commission for international data transfers. By using PositivesConnect™, you acknowledge that your data may be transferred to countries that may have different data protection laws than your home country.

12. Third-Party Services

PositivesConnect™ integrates with the following third-party services, each governed by their own privacy policies: • Stripe (payments): stripe.com/privacy • PayPal (payments): paypal.com/privacy • Google Cloud (infrastructure): cloud.google.com/privacy • OpenAI (AI health coach): openai.com/privacy • Expo/React Native (mobile framework): expo.dev/privacy • Resend (transactional email): resend.com/privacy We recommend reviewing these policies. We are not responsible for the privacy practices of third-party services.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by: • Sending an email to your registered address (for significant changes) • Displaying a prominent notice in the app • Updating the 'Last Updated' date at the bottom of this policy Continued use of PositivesConnect™ after changes take effect constitutes acceptance of the updated policy.

14. Contact & Privacy Requests

For all privacy-related questions, data requests, or concerns: Privacy Officer: privacy@positivesconnect.app General Support: support@positivesconnect.app Security Issues: security@positivesconnect.app Mailing address: Available upon request to verified users. Last Updated: May 2026 Effective Date: May 1, 2026

Exercise Your Privacy Rights

To access, correct, delete, or export your data — or to make any privacy request — email our Privacy Officer. We respond within 30 days.

Email Privacy Officer