On Deck Society - Privacy Policy

Plain English Summary

On Deck Society collects the data you give us and the data we need to run our products. For Love On Deck and Friends On Deck, that means your account information, your verification selfie while it is being reviewed, your deck content, your filter settings, your messages, and your visibility settings. Some details, like your age and city, belong to your account and are used in every product you join. Forge On Deck is not currently available for new purchases; if you used it, we hold your account information, goals, habits, coaching conversations, and scores.

We use advertising pixels from Snap, Reddit, Pinterest, and Meta on our marketing, signup, and checkout pages to measure ad performance. These pixels do not run inside our products. They receive hashed identifiers and event data, never your plaintext email or any directly identifying information, and never anything capable of revealing your sexual orientation, your relationship status, your beliefs, or your health.

We use two analytics providers. Fathom measures website traffic without cookies and without identifying anyone. PostHog measures how people move through our products and associates activity with an internal account identifier, so we can see where the product is working and where it is not.

We use a third-party AI provider for coaching on Forge On Deck and for date plan suggestions on Love On Deck. We send it a limited slice of deck information and never anything sensitive. Under our agreement with that provider, nothing we send is used to train AI models.

We do not sell your data. You can delete your account and all your data at any time.

1.1 Account information

When you create an account, we collect your email address, password, and birthdate. If you sign up through a third-party authentication provider, we collect the information that provider shares with us, typically your name and email address.

We also assign you a Citizen number when your account is created, and a product number when you join one of our products: a Lover number on Love On Deck, a Friend number on Friends On Deck. Some Citizens also hold a founding number, which determines founding pricing under our Terms of Service. These numbers are identifiers we generate. They are stored on your account and are deleted with it.

1.2 Love On Deck profile data

If you use Love On Deck, you provide personal information when building your deck. This includes your photos, biographical details, preferences, and responses to profile questions. Your verification selfie is handled separately, as described in Section 1.11. You also set Silter, which are search filters, and Vilter preferences, which are visibility filters, and these may include demographic criteria.

Some of the information you may choose to provide, including your sexual orientation, your relationship style, your spirituality, and your political views, is sensitive. We treat it accordingly. This information is used to operate the product and to apply the filters you set. It is never transmitted to any advertising platform, in any form, hashed or otherwise, and we do not use it to build advertising audiences.

We collect the data you choose to include in your deck. You control what you share. The more complete your deck, the better the platform works, but you are never required to disclose any specific piece of information beyond the minimum required fields.

1.3 Forge On Deck profile and coaching data

If you use Forge On Deck, you provide personal information to your coaches. This includes your personal mission, vision, and values statements, your goals and quests, your habits and habit tracking data, your life area scores, your weekly review responses, and anything else you share during coaching conversations.

We store the full text of every coaching conversation you have with all five coaches, including your messages and the AI-generated responses. We also generate and store rolling summaries of your conversations to maintain coaching context across sessions.

1.4 Image uploads

For Love On Deck and Friends On Deck, we store the photos you upload to your decks. We hold your verification selfie only until verification is decided, as described in Section 1.11. For Forge On Deck, if you upload images to a coaching conversation, such as nutrition tracking screenshots, we process those images to extract relevant data. The extracted data is stored in our database.

1.5 Messages

If you use messaging on Love On Deck or Friends On Deck, we store your messages to facilitate the service. Messages are visible only to the sender and recipient, and each product's messages are kept separate.

If you block someone, every conversation between you, in every product, is removed from both of your inboxes. If either of you unmatches, disconnects, or dismisses, that conversation or first message is deleted for both of you. In each case, we keep a copy that only our moderation team can access, for 30 days, so we can review a report about what happened. If a report between the two of you is open, we keep the copy until the report is resolved. Every moderation access is recorded. The copy is then permanently deleted. Neither of you can see or restore it.

1.6 Purchase and payment data

When you make a purchase, payment processing is handled by our payment provider, currently PayPal. We do not store your full payment card details. We store transaction records including what you purchased, the amount, and the date.

1.7 Usage data, analytics, and advertising tracking

We collect standard usage data including which features you use, how often you visit, basic device and browser information, and pages viewed.

Where our tracking runs. Our advertising pixels run only on our marketing pages, our signup pages, and our checkout pages. They do not run anywhere else in our products: no pixel loads in any Quick Build, the Friends On Deck declaration, verification, your deck, search, messaging, any dashboard, or settings, and nothing about your activity there is transmitted to any advertising platform.

Three situations involve a logged-in account. When you create an account, the signup page sends a sign-up conversion event to each platform. When you subscribe, the checkout pages load pixels so the purchase can be attributed to an ad. If you visit a marketing page while logged in, the pixels on that page receive a hash of your email address. In each case, only the identifiers and event data listed below are sent.

Analytics. We use two analytics providers. Fathom Analytics measures website traffic. It does not use cookies, does not track individual users, and does not collect personally identifiable information. PostHog measures how people move through our products. PostHog receives an internal account identifier that we generate, along with events describing which features were used. That identifier is meaningless outside our systems and is not your email address, your name, or any product number. It is not anonymous, however: because it is stable, activity recorded under it can be connected to your account by us. PostHog runs inside our products.

When PostHog first associates an account identifier with a device, activity previously recorded on that device without an identifier is associated with the account at the same time.

We do not send PostHog any demographic information, any location information, any deck content, any filter settings, any message content, any coaching content, or any product number.

Advertising pixels. We use four third-party advertising tracking pixels: Snap Pixel, Reddit Pixel, Pinterest Tag, and Meta Pixel. On the pages described above, each of these may transmit the following to its respective platform:

• The page you visited
• The action you took, such as a page view, a signup, or a purchase
• A SHA-256 cryptographic hash of your email address, only when you are logged in
• A SHA-256 cryptographic hash of your unique account ID, for cross-event correlation
• Your IP address and basic browser and device information. Browser pixels collect this directly. When we send a conversion event from our server to Reddit, that event includes your IP address and browser information.

We do not transmit your plaintext email address, your name, your deck contents, your filter settings, your messages, your coaching conversations, your product numbers, or any other directly identifying information through these pixels. We do not transmit any information capable of revealing your sexual orientation, your relationship status, your religious or political views, or your health. The hashes we transmit are one-way and cannot be reversed to reveal your underlying information.

If you have Global Privacy Control enabled in your browser, no advertising pixel is loaded on any page.

These pixels enable us to measure the effectiveness of our paid advertising campaigns and attribute conversions to specific ad creative. Section 3 provides more detail on each.

1.8 Deck visibility toggle (Love On Deck)

You can hide your deck at any time. While your deck is hidden, it is not shown in discovery or search, and no Lover can open it. We store whether your deck is currently hidden. We do not store when you hid it or how long it has been hidden.

Hiding is not retroactive to conversations you are already in. Anyone you have an open conversation with continues to see your first name, your Lover number, and your photo in their inbox and in that conversation, although they cannot open your deck. Hidden decks are also counted in the total number of Lovers shown publicly on our site.

Hiding does not restrict anything you can do. You can still search, browse, open other Lovers' decks, and start conversations while your deck is hidden.

We do not notify anyone when you hide or unhide your deck, and a Lover who cannot open your deck is not told why. Our moderation team can view any deck, including a hidden one, when reviewing a report or investigating a possible violation of our Terms or Community Guidelines. Every such access is recorded in an access log.

1.9 Shared account details and hiding

Some details you provide, such as your age, city, and languages, belong to your account rather than to one product. If you join more than one product, those details are used in each one, and editing a detail anywhere changes it everywhere.

You can hide a detail separately in each product. A hidden detail is not shown on your deck, but we still use it to apply filters, both other people's and your own, so it can affect who sees you and whom you see. Someone who adjusts their filters may be able to work out a hidden detail from whether you appear. Your city and state cannot be hidden.

1.10 Friends On Deck data

If you use Friends On Deck, we collect your answers to the five Friends questions, the photos and other content in your Friends deck, your Friends filter settings, your Friends messages, your Friend number, and a record that you agreed to the platonic declaration and when. You can join Friends On Deck without a Love On Deck account.

1.11 Verification selfie

You verify once, as a person, by taking a live selfie during the first Quick Build you complete. We compare it against your photos to confirm you are who you say you are, and your verification then applies to every product. We delete the selfie as soon as verification is decided, whether it is approved or not. If it is not approved, you take a new selfie when you resubmit. The fact that you are verified stays on your account.

2.1 To operate our products

Your primary data use is product functionality. For Love On Deck, we use your data to display your deck to eligible Lovers, meaning those who pass your Vilter settings, to apply your Silter and Vilter preferences, to facilitate matches and messaging, and to verify your identity through selfie verification.

For Friends On Deck, we use your data the same way: to show your deck to Friends who pass your Vilter settings, to apply your Silter and Vilter preferences, and to facilitate messaging. We use your platonic declaration record, and any reports made by or about you, to enforce our Terms of Service and Community Guidelines.

For Forge On Deck, we use your data to provide coaching. When you open a conversation with a coach, Forge On Deck assembles a context package that includes the coach's system instructions, your personal mission, vision, and values, your current dashboard data, recent summaries from the other four coaches, a rolling summary of your past conversations with this coach, and your most recent messages. This context package is sent to our AI provider's API to generate the coach's response.

2.2 Cross-coach context sharing (Forge On Deck)

After each Forge On Deck coaching conversation, we generate a brief summary and make it available to the other four coaches. This means information you share with one coach may inform advice from another. This sharing happens only within your account. No other user can see your coaching data.

2.3 To process payments

We use your purchase data to manage your subscriptions on Love On Deck, your coaching credit balance on Forge On Deck, and to maintain transaction records for accounting and tax purposes.

2.4 To communicate with you

We may send you service-related emails, including account verification, security alerts, billing confirmations, and product updates. You can manage notification preferences in your account settings. You may opt out of promotional emails by clicking unsubscribe in any promotional email.

2.5 To improve our products

We use usage data to understand how people interact with our products, identify where the product is working and where it is not, diagnose technical issues, and plan improvements. This includes product analytics through PostHog, which associates activity with an internal account identifier as described in Section 1.7. We do not use individual coaching conversations or personal messages for product development unless they are fully anonymized.

2.6 To measure and optimize advertising

We use the hashed identifiers and event data transmitted through our advertising pixels to measure how well our paid advertising campaigns are performing, which creative is working, and how to reach interested audiences more efficiently. The advertising platforms use this data to attribute conversions to ads and to optimize delivery of our future campaigns.

We do not build custom audiences or lookalike audiences from data collected on our website. We do not use the hashed identifiers transmitted to advertising platforms to make decisions about you on our platform. They flow outbound for advertising attribution only.

No information capable of revealing your sexual orientation, your relationship status, your religious or political views, or your health is used for advertising in any form.

3.1 Database and authentication

Our data is stored using Supabase, a cloud database provider. Your data is stored in a Supabase-hosted PostgreSQL database with row-level security, meaning each user can only access their own data at the database level. Authentication is handled by Supabase Auth.

3.2 AI provider

Some features use a third-party AI provider, currently Anthropic, to generate content. Data sent for this purpose is processed and returned in real time. Under our agreement with the provider, the data we send is not used to train AI models.

Forge On Deck. When you send a message to a coach, your message and the assembled coaching context described in Section 2.1 are sent to the provider's API to generate the coach's response.

Love On Deck. If you are in an active conversation with another Lover, either of you can ask for suggestions for things the two of you might do together. When one of you does, we send a limited set of information from both decks to the provider so it can make a relevant suggestion, and the suggestion is shown to whoever asked for it. That person can then choose to share it with you.

What we send is limited to interests, hobbies, general location, and practical preferences about drinking, smoking, cannabis, and diet. We do not send your photos, your messages, your name, your contact information, your Lover number, your filter settings, or any information about your sexual orientation, your relationship style, your politics, your spirituality, your ethnicity, your body type, or your family plans. If you have hidden a field on your deck, we do not send that field either, even if it is one of the fields listed above.

Because this feature suggests plans for two people, information from your deck may be sent when the other person asks for a suggestion rather than when you do. This is only possible while a conversation is open between you and only after both of you have participated in it. Suggestions are generated by AI and are labeled as such. They may be inaccurate, so check hours, prices, and availability before relying on one.

If we change AI providers in the future, this policy will be updated, and the commitment that your data will not be used to train AI models will remain.

3.3 Payment processing

Payment processing is handled by PayPal. PayPal's privacy policy governs how they handle your payment information. We do not have access to your full payment card details.

3.4 Hosting

Our products are hosted on Vercel.

3.5 Email

Transactional emails are sent through Resend.

3.6 Analytics

Fathom Analytics. We use Fathom for website analytics. Fathom does not use cookies, does not track individual users, and does not collect personally identifiable information.

PostHog. We use PostHog for product analytics. PostHog receives an internal account identifier that we generate and events describing which features were used and when. This lets us understand how people move through our products. The identifier is pseudonymous rather than anonymous: it does not contain your name, email, or any product number, and it is meaningless to anyone outside our systems, but it is stable, so activity recorded under it can be connected to your account by us.

We do not send PostHog any demographic information, location information, deck content, filter settings, message content, coaching content, or product numbers. PostHog processes this data on our behalf as a service provider and does not use it for its own purposes. When you delete your account, we instruct PostHog to delete the events associated with your identifier, as described in Section 5.

3.7 Snap Pixel (advertising attribution)

We use the Snap Pixel from Snap Inc. to measure the performance of our paid advertising on Snapchat. On the pages described in Section 1.7, the Snap Pixel transmits to Snap a page view event with the URL you visited, conversion events when you sign up or make a purchase, a SHA-256 hash of your email address when you are logged in, and a SHA-256 hash of your account ID for event correlation.

Snap may set cookies on your device for the purpose of attributing conversions to ads. We do not transmit your plaintext email, name, or any other directly identifying information through this pixel. Snap's privacy practices are governed by Snap's Privacy Policy at https://snap.com/en-US/privacy/privacy-policy.

3.8 Reddit Pixel and Reddit Conversions API (advertising attribution)

We use the Reddit Pixel from Reddit, Inc. to measure the performance of our paid advertising on Reddit. We use a hybrid implementation: a browser-side pixel and a server-side Reddit Conversions API integration.

The browser-side pixel transmits to Reddit a page view event with the URL you visited, a SHA-256 hash of your email address when you are logged in, and a SHA-256 hash of your account ID for event correlation. The server-side Conversions API transmits conversion events directly from our server to Reddit with the same hashed identifiers, along with your IP address and browser user agent, and does not rely on browser cookies. Email addresses are hashed in our own code before transmission.

Reddit may set cookies on your device through the browser-side pixel. We do not transmit your plaintext email, name, or any other directly identifying information through either route. Reddit's privacy practices are governed by Reddit's Privacy Policy at https://www.reddit.com/policies/privacy-policy.

3.9 Pinterest Tag (advertising attribution)

We use the Pinterest Tag from Pinterest, Inc. to measure the performance of our paid advertising on Pinterest. On the pages described in Section 1.7, the Pinterest Tag transmits to Pinterest a page view event with the URL you visited, conversion events when you sign up or make a purchase, a SHA-256 hash of your email address when you are logged in, and a SHA-256 hash of your account ID for event correlation.

Pinterest may set cookies on your device. We do not transmit your plaintext email, name, or any other directly identifying information through this tag. Pinterest's privacy practices are governed by Pinterest's Privacy Policy at https://policy.pinterest.com/en/privacy-policy.

3.10 Meta Pixel (advertising attribution)

We use the Meta Pixel from Meta Platforms, Inc. to measure the performance of our paid advertising on Facebook and Instagram. On the pages described in Section 1.7, the Meta Pixel transmits to Meta a page view event with the URL you visited, conversion events when you sign up or make a purchase, a SHA-256 hash of your email address when you are logged in, and a SHA-256 hash of your account ID for event correlation.

Meta may set cookies on your device. We do not transmit your plaintext email, name, deck contents, filter settings, or any other directly identifying information through this pixel, and we do not transmit anything capable of revealing your sexual orientation, relationship status, beliefs, or health. Meta's privacy practices are governed by Meta's Privacy Policy at https://www.facebook.com/privacy/policy.

• We do not sell your personal data to anyone, ever.
• We do not share your coaching conversations or your messages with other users, beyond the intended recipient for messages.
• We do not use your coaching conversations to train AI models.
• We do not share your plaintext email address, name, deck contents, filter settings, messages, coaching conversations, product numbers, or any other directly identifying personal information with advertisers or advertising platforms. We do share SHA-256 hashed identifiers and event data with our advertising platforms for the limited purpose of conversion attribution, as described in Sections 1.7, 2.6, and 3.7 through 3.10.
• We do not transmit any information capable of revealing your sexual orientation, your relationship status, your religious or political views, or your health to any advertising platform, in any form.
• We do not build custom audiences or lookalike audiences from data collected on our website.
• We do not run advertising pixels inside any of our products.
• We do not send your deck photos, your messages, your name, your contact information, your filter settings, or any sensitive information about you to our AI provider, and nothing we send to that provider is used to train AI models.
• We do not use your data for purposes other than those described in this policy.
• We do not build profiles of you for advertising, and we do not infer characteristics about you that you have not told us. We do measure how people use our products, including through PostHog as described in Section 1.7, and that measurement is associated with an internal account identifier.

Your account data, deck content, messages, coaching conversations, and Forge On Deck dashboard data are retained for as long as your account is active.

Deletion. When you delete your account, all associated data is cascade-deleted from our active systems, including your deck, your Silter and Vilter settings, your messages, your matches, your coaching conversations, your goals, habits, and scores, your Citizen and product numbers, and your profile information. This happens at the time of deletion, not on a delay. There are two exceptions. First, if you blocked someone, or someone blocked you, or a conversation between you was unmatched, disconnected, or dismissed, within the last 30 days, the moderation copy described in Section 1.5 is kept for the rest of its 30-day period even if either of you deletes your account. Second, a report made by you or about you is kept until it is resolved, even if either of you deletes your account, and while it is open the related moderation copy is kept too. We keep these so that deleting an account cannot be used to erase evidence of harassment.

Backups. Where we maintain routine backups of our systems, a copy of your data may persist in those backups for a limited period, currently no more than seven days, until the backup is overwritten in the ordinary course. Backups are not used to restore individual accounts, and deleted data is not returned to our active systems. We do not currently maintain scheduled backups of our production database. If that changes, the limited retention described here applies.

Analytics. When you delete your account, we instruct PostHog to delete both the person record and the events associated with your internal account identifier. If that instruction does not complete on the first attempt, we retain your account identifier alone, with no other information, solely to retry the deletion, and we delete that record as soon as the deletion is confirmed and in any event within thirty days.

Date plan suggestions. A suggestion generated for a conversation is stored with that conversation. If either of you deletes the conversation, the suggestion is deleted with it. If you delete your account, every suggestion generated in any of your conversations is deleted.

Record of deletions. We keep an anonymous record that a number was retired. This record contains only the number, whether it was a Citizen number or a product number, a category describing the type of deletion, and the date. It contains no email address, no name, no account identifier, and no link to any person or to any other record. We maintain it in this deidentified form, we do not attempt to reidentify it, and we use it only to understand in aggregate how people move through our platform.

Transaction records. Transaction records may be retained for up to seven years after account deletion for tax and legal compliance purposes. These records contain purchase amounts and dates but do not contain coaching conversations, messages, or personal profile data.

Advertising platforms. Data transmitted to advertising platforms is retained by those platforms according to their own retention policies, not ours. We do not control how long Snap, Reddit, Pinterest, or Meta retain the hashed identifiers and event data we transmit. You can review their retention policies via the privacy policy links in Sections 3.7 through 3.10.

Authentication and session cookies (first-party, required). We set first-party cookies on the OnDeckSociety.com domain for authentication and session management. These cookies are necessary for the site to function and cannot be disabled without breaking core functionality.

Analytics. Fathom does not use cookies and does not track individual users. PostHog may set a first-party cookie on your device to recognize the same browser across visits.

Advertising attribution cookies (third-party). Our advertising tracking pixels, Snap Pixel, Reddit Pixel, Pinterest Tag, and Meta Pixel, may set third-party cookies on your device to enable conversion attribution. These cookies are set by the advertising platforms directly through their pixel scripts, which we embed only on the pages described in Section 1.7. You can opt out through:

• Your browser settings, by blocking third-party cookies
• Global Privacy Control, which we honor. When it is enabled, no advertising pixel loads at all
• Each platform's own opt-out tools
• Industry opt-out tools at https://optout.networkadvertising.org/ and https://optout.aboutads.info/

Blocking third-party advertising cookies will not prevent you from using On Deck Society. It will only affect the relevance of advertising you see on those platforms. Core functionality is unaffected by advertising cookie choices.

We do not use cookies for any purpose other than what is described in this section. We do not use cookies to track you across other websites for our own purposes.

7.1 Access

You can access your personal data through your account dashboard at any time. Your deck, filter settings, messages, and visibility settings in each product you use, along with any Forge On Deck coaching history, goals, habits, and scores, are visible to you in the product.

7.2 Deletion

You can delete your account and all associated data at any time through your account settings, or by contacting support@OnDeckSociety.com. Deletion through your account settings takes effect immediately. Requests sent by email are processed within thirty days.

7.3 Portability

You can request a copy of your personal data in a machine-readable format by emailing support@OnDeckSociety.com. We will provide your data within thirty days.

7.4 California residents (CCPA and CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion of your personal information, to correct inaccurate personal information, to limit the use of sensitive personal information, to opt out of the sale of your personal information (we do not sell your data, so this right is already satisfied), to opt out of the sharing of your personal information for cross-context behavioral advertising as described in Section 7.6, and to not be discriminated against for exercising your rights.

To exercise these rights, email support@OnDeckSociety.com with the subject line CCPA Request, or use the Your Privacy Choices link in our site footer.

7.5 EU and EEA residents (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights including the right to access, rectification, erasure, restriction of processing, data portability, and the right to object to processing.

Our legal bases for processing your data are: contract performance, for providing the service you signed up for or purchased; consent, for advertising and analytics tracking; and legitimate interest, for maintaining the security and integrity of our products and understanding how they are used. Where we rely on consent, you may withdraw it at any time, and withdrawing consent does not affect processing carried out before withdrawal.

To exercise these rights, email support@OnDeckSociety.com with the subject line GDPR Request.

7.6 Opting out of advertising tracking

We use third-party advertising pixels that may constitute sharing of personal information for cross-context behavioral advertising under the California Privacy Rights Act and similar laws. We do not receive payment for this sharing. The data shared is limited to hashed identifiers and event data, never plaintext personal information, and never sensitive information.

To opt out, you can:

• Use the Your Privacy Choices link in our site footer
• Enable Global Privacy Control in your browser, which we honor automatically
• Email support@OnDeckSociety.com with the subject line Do Not Sell or Share My Personal Information
• Use the opt-out controls provided by each advertising platform
• Block third-party cookies in your browser settings
• Use industry opt-out tools at https://optout.networkadvertising.org/ and https://optout.aboutads.info/

If you are an EU or EEA resident, advertising and analytics tracking is governed by your jurisdiction's consent requirements, and we rely on consent as described in Section 7.5.

We implement reasonable security measures to protect your data, including row-level security at the database level, encrypted data transmission over HTTPS and TLS, secure authentication through Supabase Auth, access controls limiting which team members can access production data, and server-side storage of all API keys so they are never exposed to the client.

Hashed identifiers transmitted through advertising pixels are SHA-256 hashes generated before transmission. The advertising platforms receive only the hash, not the underlying email or account ID. We do not retain those hashes ourselves; they are generated at transmission time.

No system is perfectly secure. We cannot guarantee absolute security, but we take reasonable precautions to protect your information.

On Deck Society products are not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a user under 18, we will delete that data promptly.

We may update this policy from time to time. If we make a material change, we will tell you by email or in the product before it takes effect. If a change would let us use information you have already given us in a materially different way, we will ask for your consent before applying it to that information. Your continued use after an update takes effect means you accept it.

For privacy questions, data requests, or concerns:

On Deck Society is a Delaware public benefit corporation.