Privacy Policy — Eventide

Effective date: 2026-09-17 Last updated: 2026-10-21

Version history: 2026-09-17: first version members consented to (the separate religious-data and location consents in §3.4, coarse location, enforced retention; §3.6 in its pre-build form). 2026-09-19: §3.6 rewritten against the built feature and Mistral Medium 3.1, and, after the 100-case evaluation, its privacy promise rewritten to what the feature can hold: answers are never shown or quoted, but the starter is written from them and reflects them; the Mistral location exception in §11; the consent records in the appendix. 2026-09-23: §3.7 added for the waitlist on our website, which concerns website visitors and changes nothing a member consented to; wording edited throughout for plainness, with no change to what any section commits us to; and §3.1 now says that when you crop a photograph we keep the whole photograph, seen only by you; and §7 now gives refused photographs and verification selfies their own, shorter period of 30 days, and keeps a photograph you replace, for our reviewers only, until its replacement is reviewed. 2026-09-24: §3.1 names the reason you give when you end a conversation, which the other person is shown. 2026-09-29: §3.8 added for the liveness check at signup, which measures the shape of your face on your phone with your separate consent and is the first biometric information Eventide handles; every statement in earlier versions that we collect no biometric data is withdrawn, and §7 now carries our retention and destruction schedule for biometric information. The check is asked only of people who sign up after it was added; a member who joined before it is never asked to take it. The verification checkmark now uses three ordinary selfies instead of one (§3.5). 2026-09-30: after a final legal review, nothing from the liveness check is disclosed voluntarily even in an emergency (§3.8, §6); a separate consumer health data privacy policy page for Washington; Connecticut added to the state list in §3.8; the Texas and Illinois paragraphs of §3.8 state our safeguards and disclosures more exactly; §3.8 says what happens to earlier attempts if you send your profile without the check after one; §7 describes more exactly what a backup holds and what Cloudflare's cache keeps after a photograph is deleted. These changes narrow what we may do or describe it more exactly. The consent wording for the check gained one clause, saying how to withdraw it (by writing to support@eventidedating.com); no member had given that consent before the change. 2026-10-01: the liveness check is required to join (§1, §3.1, §3.8, §4, §5, §11): §3.8 says why it is necessary to provide the service, what a person at Eventide does with what it produced (compares its photographs with your profile photographs, and decides the check where three attempts did not pass or the phone has no depth camera), what happens if you do not agree, and what withdrawing after the check does; the path for sending a profile without the check is withdrawn; the review of every profile is described as a review against our standard of modesty and appropriateness, and the checkmark as confirming that a profile's photographs show the member using the account. The consent wording for the check changed to say that the check is required and why, and what a person at Eventide uses it for; and the check no longer counts blinks. A consent record that names any of these versions refers to the text current on that date; the two texts posted on 2026-09-30 differ only in the withdrawal clause of the consent wording. 2026-10-06: §3.9 added for Experience, the feature that lets a member mark and verify that they are going to an event, meet other verified attendees in The Room, say hello, mark a quiet hope to meet, check in at the venue, and take a blind Close by introduction. §6 says who can see that a member is going, including an existing match's "Here now" presence and the "Crossed paths" tag an overlapping check-in produces; §7 gains rows for the proof image, the attendance decision, the same decision kept in the member's account history, the venue check-in, and the Room's hellos, hopes, crossed paths and Close by offers; §11 notes that going to an event can also reveal religious affiliation. Checking in at the venue uses a location reading that is taken and tested on the phone; the reading is never sent to us or stored, and the toggle that turns it on is off by default. Experience asks for two consents of its own, each given by tapping "I'm going" or turning the check-in on, next to a short explanation, and recorded: one the first time you say you are going to an event, and one when you turn on checking in at the venue (§3.4, §3.9, §11). §1 and §3.3 now say that checking in at the venue is the other thing that can make the app ask for location after signup. Experience also lists two more kinds of event beside gatherings: open homes, an evening for a small group in the home of a married couple we have checked, and mission trips run by their own organisers. §3.9 says what each records and who sees it, including an open home's street address, which only its confirmed guests receive and only from 48 hours before the evening until it ends; the no-show rule for open homes; "Who did you notice?" after every kind of event; the events you can suggest to us; and what we keep about hosts and organisers, who may not be members. Saving a seat at an open home and going on a mission trip each have a short explanation of their own next to the button, and tapping it is the consent for that kind of event. §3.1 and §3.4 describe the optional "Been part of" section of a profile, which has a short explanation of its own next to it; saving your first entry there is your consent, and it is recorded. §3.2, §3.6, §4, §5, §6, §7, §8 and §11 follow these changes. 2026-10-11: the Verified badge now comes from the liveness check (§1, §3.1, §3.2, §3.5, §3.8, §4, §5, §6, §7, §11). A member whose check passed shows other members the Verified badge once a person admits their profile. A member admitted without a passed check can take the same check later from Profile, after agreeing to it on a screen of its own, whose words differ from the signup consent only in saying that this check is optional and how it earns the badge, and in deleting what it sends us 30 days after the decision on the badge, and within 90 days of the check at the latest; §7's biometric schedule gains that date. The app no longer takes verification selfies. Members verified with selfies before 2026-10-11 keep their badge, and their selfies are kept and deleted as before. §6 says when we may tell a member's pastor, or a leader of the church on their profile, what our team did after confirmed reports from more than one member. An event can carry a phone number for its organiser, which a member who suggests an event they run gives us, and which only members our team has confirmed are going see (§3.1, §3.9, §6, §7). 2026-10-14: Experience works differently at events (§3.2, §3.4, §3.9, §4, §6, §7, §8). Hellos, quiet hopes to meet, "Who did you notice?", Close by, crossed paths and "Here now" are gone, with everything they recorded. Instead, each event has one list of who's going: from 14 days before it starts, members verified for the event whom you could meet see you in it, at every kind of event, open homes and mission trips included. When the event ends, for 7 days, you can like up to 5 of the members verified for it, with a note, and the person you like sees your like and your note. Two likes make a match, as in your daily introductions. Checking in at the venue is now only a way to show our team you were there when you have nothing to upload: no member sees a check-in, and it no longer lasts 45 minutes or records that two people crossed paths. A listing can show a photograph from the event's organiser. The events badge now means our team verified you for an Eventide event that has ended. The short explanations next to "Save me a seat", next to "I'm going" on a mission trip, next to the venue check-in and next to the events badge's "Show it" changed to say this. If you agreed to an earlier one, we ask again the next time you do that thing, and until then other members see you at an open home or on a trip only after it ends, as the earlier explanation said. Two more changes in this version. You can turn your daily introductions off in Settings, up to 3 times in any 7 days, and back on at any time; while they are off, you are not introduced to anyone and nobody is introduced to you (§3.2, §5). And you can invite a match to an event from your conversation, or share a link to an event with anyone; the link's page shows the event and your first name (§3.2, §3.9, §6, §7, §8). 2026-10-14, second update: host accounts (§1, §3.1, §3.8, §3.9, new §3.10, §4, §5, §6, §7, §8, §11). Some events are now run by hosts, who sign up for a separate host account. A person at Eventide compares a host's face check with a photo of their photo ID and decides whether to approve them; the photo ID is deleted when that decision is made. A host sees the first name and first profile photo of each member going to their event, and nothing else. The captions next to "I'm going" and "Save me a seat" change at an event a host runs to say so, and the face check a host takes has a sentence of its own; if you agreed to an earlier caption, we ask again the next time you sign up for an event a host runs. After an event a host runs, the members who came can tell Eventide privately whether it was good, and the host never sees who said what. Open homes are run by hosts and no longer listed or suggested by us, and the private page through which our team showed hosts their guests' first names is gone. A confirmed guest now receives the street address of every event that shares one from 24 hours before it starts until it ends (it was 48 hours for an open home), and an event a host runs counts toward the events badge like any other (§3.2, §3.9, §7). Reports no longer suspend an account automatically; Eventide reviews them and may hide, suspend or ban the account, and a hidden profile is not shown to other members (§5). A no-show mark no longer stops anyone from saving a seat and is deleted when the event's likes close; each account's record (reports received, no-show marks, warnings and other messages from Eventide, and Eventide's actions) is kept for as long as the account exists; and Eventide can send warnings, updates and announcements in the app (§3.2, §3.9, §4, §5, §7, §8). Each notification is also kept in the app's list of notifications for 90 days (§5, §7). The consent captions, including the three face check agreements quoted in §3.8, are reworded in plainer language with the same facts, and if you agreed to an earlier wording, the app asks you to agree to the new words the next time you do what it covers (§3.3, §3.4, §3.6, §3.8, §3.9). 2026-10-15: a note sent with a like is checked for offensive language before it is delivered. A note that uses a word on our list is not delivered and the like is not sent; where the app offers it, a language model run by Mistral AI through OpenRouter also reads the note, and a note it marks is delivered and a person at Eventide is told. Refused and marked notes are kept with your account's record, their words for 90 days (§3.2, §3.9, §5, §6, §7, §11). 2026-10-20: §3.11 added for signing in on eventidedating.com: the record kept for each browser (its kind, an approximate city, and when it was made and last used), when it is deleted, and the two cookies the website sets (§3.2, §6, §7). It concerns people who sign in on the website and changes nothing a member consented to. 2026-10-21: §3.9, checking in at the venue: check-in opens 30 minutes before an event starts, and you choose how it happens on arrival, manual (a notification your phone shows when you enter the venue's area) or automatic (with location access set to Always, one reading when you enter it, even with the app closed). Both are your choice; the check-in's consent and what it sends are unchanged. Checking in at the venue now verifies you at once, with no review by our team.

¶1. The short version

• Eventide is offered only in the United States.
• We collect what Eventide needs to introduce you to people: who you are, your home church and conference, how you eat, roughly where you are, your photographs, and your conversations.
• We do not sell your data. We do not share it with advertisers. There is no advertising in Eventide and no tracking of any kind: no analytics SDK, no attribution tool and no advertising identifier. The app links no third-party code.
• Eventide is not part of a family of apps. It has no affiliates, sister services or parent company with which your data is shared.
• We collect information about your religious affiliation, with your separate consent, which we ask for on the screen where you enter it and apart from the Terms of Service. Introducing members of this community to each other is the purpose of the app.
• We ask your phone for your location once, during signup, and the app rounds it to a grid cell of about a kilometre before sending it, so your precise location never leaves your phone. Whatever a phone sends, we keep only a grid cell. You can skip this and type your city instead. We never ask again unless you turn on exact sundown for travel (§3.3) or checking in at an event's venue in Experience (§3.9), which tests a precise reading on your phone and tells us only whether you are at the venue. There is no background location in this app.
• A person reads what you submit. Every profile, edit and photograph is reviewed by a person against our community's standard of modesty and appropriateness before other members see it, which means our reviewers see your profile content.
• Everyone who joins takes a short liveness check, after agreeing to it on its own screen. Eventide is a community of real people, and the check is how we know each new member is a real person in front of the camera and the person in their profile photographs, so it is required to join. Your phone measures the shape of your face, using its Face ID depth camera where it has one; those measurements are biometric information. We receive photographs from the check (and a short video on phones without the depth camera), an image of the depth reading and the measurements, which our storage provider keeps for us. They are used only for this check, never to identify you, never sold, and never shared except where the law requires it, and they are deleted 30 days after the first decision on your profile, and within 90 days of the check at the latest, or sooner if you delete your account or ask us to. See §3.8.
• The Verified badge comes from the liveness check. When a person at Eventide admits a profile whose check passed, other members see the Verified badge on it. The badge tells them that a person confirmed the member is a real person and the person in their profile photographs, and it shows nothing from the check itself. A member admitted without a passed check can take the same check later from Profile, with a consent of its own; what that check sends us is deleted 30 days after the decision on the badge, and within 90 days of the check at the latest. Members verified with selfies before 2026-10-11 keep their badge. Nothing measures your face outside the check, and no faceprint is made from anything you send us. See §3.8.
• Messages cannot contain photographs. Eventide has no image messaging, so no member can send you an image.
• Some events are run by verified hosts, who see the first name and first photo of each member going. A host has a separate host account, with a face check and a photo of their photo ID that a person at Eventide compares; the photo ID is deleted when that person decides. A host never sees anything else about you, and never appears in introductions, likes, matches or chats. See §3.10.
• Where the app offers it, an optional conversation starter uses an outside AI provider, and only after both people in a match turn it on. It is sent a limited part of both approved profiles and the private answers each person gives it, and nothing else. It does not receive your photographs or messages, or the name, age, location, church, conference or diet we hold as separate fields. Anything you wrote in your bio or prompts is sent as written. Your private answers are never shown to the other person. The starter is, however, written from what you both said and will reflect it, so please answer with that in mind. Private answers are encrypted and are deleted when the starter is posted or within 24 hours at the latest. The starter itself stays in the conversation like any other message. See §3.6.
• Deleting your account deletes your data within 24 hours (§8). Our nightly database backups, kept only to recover from a failure, expire 30 days after they are made (§7).
• Questions: support@eventidedating.com.

¶2. Who we are

Yonatan Demian, an individual, operates Eventide from 4891 Taylor Circle, Collegedale, TN 37315.

Eventide is offered only in the United States. It is listed on the US App Store only, and it is not directed to people in the European Economic Area, the United Kingdom, or anywhere else. If you are outside the United States, please do not use Eventide. If we learn that an account belongs to someone outside the United States, we may close it.

¶3. What we collect, and why

¶3.1 Things you give us

We collect the minimum this service needs. Everything in this table is used to provide the service you signed up for and for no other purpose.

¶3.2 Things we generate as you use Eventide

¶3.3 Location: one coarse reading, or a city you type

This section describes in detail how the app handles your location.

You do not have to share your location at all. The default path through signup is a search box: type the first few letters of a town and pick it from a list. That needs no location permission, and if you use it your phone never tells us where you are. (The search itself is answered by Apple Maps, so Apple sees what you type in that box.)

If you choose to tap the button instead, then:

• We ask iOS for one reading, once. The app calls for a single location fix during signup and then stops. It does not watch you, it does not collect in the background, and it does not ask again, unless you turn on exact sundown for travel below, or checking in at an event's venue in Experience (§3.9). The app requests only "while using the app" permission, has no background location capability at all, and contains no continuous-location or significant-change monitoring. Your iOS privacy settings will show this.
• We ask for a coarse reading. The app requests kilometre-level accuracy, which is less precise than the fix your phone can produce.
• The app rounds the reading before sending it. It is cut to two decimal places (a grid cell of roughly one kilometre), so the more precise number never leaves your phone.
• Our servers round it again when it arrives. The rounding on your phone means we never receive a precise reading from an up-to-date app. The rounding on our servers means we store only a grid cell from any version of the app, including an older one installed before we made this change.
• We keep one reading. Updating your location overwrites the previous one, and we keep no location history.
• You can change or remove it later by editing your location in the app. Removing it erases the stored reading.

What we do with it. We store the reading, and from it we work out two things: the city nearest to you, and your time zone. The time zone is used to time your daily introductions and notifications to your local day, so that nothing arrives in the middle of your night.

Working out your city happens entirely on our own servers, against a fixed table of about 270 towns built into the software. We do not send your location to Google, Apple, Mapbox or any other geocoding service. No third party is told where you are.

No other member ever sees your coordinates. Distances are calculated on our servers and only the answer is sent to anyone. Other members see:

• "Nearby" if you are within about 10 miles,
• a mileage rounded up from a floor of ten ("12 mi") out to about 100 miles,
• or the city you are in beyond that.

Coordinates never leave our servers. We designed it this way because the Adventist singles community is small enough that people know each other, and a precise distance could be used to locate a home.

Eventide works without location. If you do not share it, you will see a "Location not shared" label and distance filters will not apply to you.

While you travel. Introductions arrive at local sundown, and Sabbath begins at it, so when your phone's time zone differs from your home one, the app tells us the time zone it is in. By default that is all it sends: we take the sundown of that time zone's main city (for "America/Chicago", Chicago), which is close but can be off by half an hour or so across a wide zone. No location reading is taken.

If you want Sabbath to begin at your real sundown while you travel, you can turn on Exact sundown when traveling in Settings. It is off unless you turn it on. While it is on, and only when your phone's time zone changes, the app takes one coarse reading, rounded on your phone to the same two decimal places as above, and sends it with the time zone. Apart from checking in at an event's venue in Experience (§3.9), which never sends us a reading at all, turning it on is the only thing that can make the app ask iOS for location permission after signup, and you can turn it off at any time; the next time zone change then sends the time zone alone.

We store the time zone and any travel reading apart from your home location and use them for one thing: working out when the sun sets where you are. They are never used for distances, your city, choosing who appears in anyone's introductions, or anything another member can see. They are cleared when your phone is back in your home time zone, and when you remove your location.

¶3.4 Religious affiliation: sensitive data, collected with your consent

Information about religious belief is treated as sensitive personal information under many US state privacy laws, and we treat it that way.

We collect as little of it as we can. The religious details Eventide asks for are your home church and conference. Being a member of an Adventist dating service is also, in itself, information about your beliefs. We also ask how you eat (vegan, vegetarian, non-vegetarian, or something else in your own words), because diet is a practical fact about sharing meals and because people here want to be able to filter for it; in this community it can also carry religious meaning, so we treat it as sensitive too.

Outside Experience and the "Been part of" section of your profile, we ask nothing about your practice, such as baptism status, church attendance or Sabbath observance. Experience (§3.9) asks which events you are going to, and the events there are part of this community's life, so saying you are going to one says something about your faith and how you practice it. It asks for its own consent before you do. You may describe your faith in your own words, in your bio and prompts, if you choose to.

Been part of. Your profile has an optional section where you can list camps, mission trips, a student missionary year, schools and the like, with a place, years and a role if you want. An Adventist camp or a mission trip says something about your faith, and a camp or a school with its years can tell someone who was there who you are. Adding entries is your choice. A short explanation sits next to the section in the editor, and saving your first entry is your consent to our showing what you add there; we record it, with the exact words. A person reviews them like the rest of your profile. They show on your full profile to members you are introduced to and to your matches, and an event's list of who's going leaves them out until you and the other person match (§3.9). They are not used to choose or order who you are introduced to, and they are never sent to the AI provider in §3.6. You can change or remove them at any time, and removing every entry withdraws that consent.

How consent works. Under the law of several states, agreeing to our Terms of Service is not consent to this processing. Consent is collected separately:

• On the church screen, before you enter your church and conference, you are asked separately and specifically to consent to our collecting and using your religious affiliation (church, conference and diet) to run your profile, discovery and matching. The screen does not move on without it.
• On the location screen, tapping "Use my location" after the explanation there is your consent to the coarse location reading §3.3 describes.
• In Experience, the first time you tap "I'm going" on a gathering or a mission trip, or save a seat at an open home, next to a short explanation, is your consent to our using the events of that kind you go to as §3.9 describes; and each time you turn on checking in at the venue, next to a short explanation, is your consent to the check-in §3.9 describes. None of these is asked of a member who does not use Experience.
• In the "Been part of" section of your profile, saving your first entry, next to a short explanation, is your consent to our showing those entries as described above. It is not asked of a member who adds none.
• We record each consent: what you agreed to, when, and which version of this policy was in force. The record lets us show later exactly what you agreed to.
• You can withdraw consent to location as described in §3.3, to the Experience consents as described in §3.9, to "Been part of" by removing every entry, and to religious data by deleting your account (§8). Because this data is your profile, we cannot keep an account running without it.
• We never sell this data, never share it with advertisers, and never use it for any purpose other than operating Eventide. We do not use it to infer anything else about you.

Information you choose to share. Apart from the liveness check in §3.8, Experience in §3.9 and the optional "Been part of" section above, each of which has its own consent, the structured questions above are the only sensitive information we ask for. Your bio, your prompt answers and your messages are free text, and you can include more in them than we ask for, such as health, family circumstances or immigration status. Those words are seen by our reviewers and by the members you are introduced to. If you and a match both turn on the conversation starter in §3.6, your bio and prompt answers are also sent to the AI provider named there. Please share only what you want to share.

¶3.5 What we do not collect

• No face measurement outside the liveness check, and no face recognition anywhere. The only time Eventide measures a face is the liveness check, at signup or later from Profile for the Verified badge, which runs only with your separate consent and is described in §3.8. The Verified badge comes from that check and from a person's decision on it. The verification selfies members took before 2026-10-11 were ordinary photographs: nothing about a face was calculated from them, on the phone or by us, and a person compared them with the profile photographs by eye. We do not create a faceprint or face template from anything you send us, we do not compare faces by software, we never search for your face among other members or anywhere else, and we do not send your face to an identity-verification company. We will not introduce any of these without first changing this policy and asking for your separate consent.
• No photographs or files in conversations. Eventide has no image messaging. A message can only carry text, so no member can send you an image.
• Payment card details. Apple processes every purchase. We receive a product identifier, a status, an expiry date and Apple's transaction id.
• Your contacts, calendar, microphone, camera roll beyond photographs you pick, or any health data.
• Any advertising identifier (IDFA). We do not ask for App Tracking Transparency permission because we do not track.

¶3.6 Optional AI conversation starter

Where the app offers it, after two people have matched either of them can turn on a private conversation-starter exercise from inside the conversation. Nothing is sent to an AI provider unless both people separately turn it on, each after reading the same explanation of what is sent, to whom, and how long it is kept. We record your agreement, including the wording you saw, when you agreed, and which version of this policy was in force, in the same way as the consents in §3.4. Either person can cancel at any point before the starter is posted; cancelling deletes the private session for both of you and withdraws the cancelling person's record.

What is sent. Once both of you have turned it on, and not before, Eventide sends the AI provider only the following information:

• each person's approved bio, exactly as written;
• each person's approved profile-prompt questions and answers, exactly as written; and
• the private answers each person gives inside this exercise; and
• for each of you, a number from 0 to 3 that tells the model how many more private questions it is allowed to ask you. This is a control value set by our server and contains nothing you wrote.

The two of you are labelled only "A" and "B". We do not send photographs, existing messages, "Been part of" entries, or the name, age or birth date, location, church, conference and diet we hold as separate fields, nor verification information, email address, device identifiers, Eventide account identifiers or subscription information. Because your bio and prompt answers are your own words, anything you chose to put in them, such as your church's name, your town or your line of work, is sent with them. The fields we hold separately are not sent. The provider is not told who you are, and the feature keeps no memory from one match or session to another; each request is handled on its own.

What it does. A language model reads that material and asks each of you up to three short private questions, one at a time, to find a genuine point of common ground. When it has one, or when it runs out of questions, it writes one short conversation starter. Our server checks that the text is well-formed and passes a plain-language safety check, then posts it into your shared conversation, clearly labelled as generated by Eventide's AI. We instruct the model to write about what you share rather than about what either of you said, not to quote your private answers or reuse their distinctive wording, not to attribute a view to one of you, not to say or hint that private questions were asked, not to infer health, sexuality, or anything about either of you that you did not tell it, and not to produce sexual, coercive or therapeutic content; our server then checks the text before posting it.

Some of the questions will be about faith. This is an Adventist dating app, so religious practice is one of the things two members are likely to have in common, and the model is allowed to ask about it. In testing, about one private question in ten was about faith (for example, how you keep Sabbath, whether you sing at church, or whether you volunteer there), and none asked about health, sexuality, money, immigration or family, which the model is forbidden to raise. Faith is one subject among several, with the same weight as work, study, food, music or how you spend a free evening. Answers about faith are information about your religious practice, which we treat as sensitive (§3.4). For that reason, turning this feature on requires its own separate consent, recorded with the exact words you saw; the consent given on the church screen does not cover it. You can answer as much or as little as you like, and nothing you say here changes your profile, your church fields, or who you are introduced to. The model's instructions do not guarantee its output, and the safeguards in the next paragraph are there for that reason. Like any generated text, the starter may be awkward or inaccurate. It is a suggestion, and either of you can ignore it.

What "private" means. The questions and your answers are shown only to you. The other person is never shown them, they are never quoted, and they never become messages. Our server enforces these three rules in addition to instructing the model: before a question is sent to one of you, and before the starter is posted, we check it against everything the other person wrote, and anything that repeats four or more of their words in a row is replaced with a plain, general starter instead. The starter is, however, written from both people's private answers, which is the purpose of the exercise, and a starter that finds common ground will reflect what you both said. If you write that you love the frost on an apple tree, the starter may mention frost, or apple trees. It will not repeat your sentence, but it may reflect the image you described, and the other person may recognise it. We tested this before offering it, on 100 matched pairs: no starter reproduced a private answer word for word, and more than a quarter (27 in 100) recognisably reflected one. You should expect this. In the same test, the checks described above replaced 19 starters and 9 questions that would otherwise have carried one person's own words toward the other. We suggest answering these questions as you would speak to someone you had just matched with, and leaving out anything you would not want hinted at in the chat. While your answers are stored they are encrypted (§9), and no plain-text question, answer, profile excerpt or model output is written to our logs. The advice in §3.4 applies here too: share only what you want to share.

Deletion. The private session (the questions, your answers and the working state) is deleted the moment the starter is posted. It is also deleted if either of you cancels, if you unmatch or block each other, or if either account is deleted. Whatever is left is deleted automatically no later than 24 hours after the first of you turned it on. The posted starter is a message in your conversation. It stays there like any other message and follows the message rules in this policy.

Our providers, and what they may not do. We send these requests to one language model, run by Mistral AI, through OpenRouter, a routing service. Both are named in §6 and on our subprocessors page. Three safeguards support our commitment that they do not keep your words or train on them:

• Every request we send carries instructions that OpenRouter must route it to Mistral alone, only to an endpoint OpenRouter designates as zero-data-retention and non-training, with no fallback to any other provider. If no such endpoint is available the request fails; we never relax those instructions to make it succeed. (A short-lived in-memory prompt cache, which OpenRouter does not count as retention, may be used to answer the request itself.)
• OpenRouter's Privacy Policy states that it does not use inputs or outputs to train models; its Terms say it has opted out of model training with the models it uses where possible, and make keeping prompts and responses something an account has to opt into, in exchange for a discount. We have not opted in, and every data-training option on the account is off. Our key for this feature lives in a dedicated workspace whose settings require zero data retention for every model and turn every data-training option off.
• Mistral's published commercial terms exclude training on customer data unless a customer opts in, and its data-processing terms waive the abuse-monitoring retention it otherwise applies when zero data retention is in force. Our requests reach Mistral as OpenRouter's traffic under OpenRouter's agreement with Mistral; we have no direct contract with Mistral.

For our part, we do not use your answers or the starter to train any model, to score either of you, to choose who you see, to moderate an account, or to make any legal or similarly significant decision.

¶3.7 The waitlist on our website

If you join the waitlist on eventidedating.com, we keep only your email address, the date you joined, and which of the two forms on the page you used. We use the address only to send you a single email the day Eventide opens. We do not add it to anything else, share it, or sell it, and joining the waitlist does not create an Eventide account.

The address is stored on our own servers (§6). When we send the launch email, it goes out through Resend, our email provider.

You can leave the list at any time. Every email we send to the list has a Leave the waitlist button, and one click deletes your address. You can also write to us and we will take it off. Once the launch email has gone out, we delete the whole list.

¶3.8 The liveness check at signup (biometric information)

When you sign up, after you add your photographs and before your profile is sent for review, the app runs a short check that tells a real face in front of the camera from a picture of one, such as a printed photograph, a screen or a generated image. It takes about six seconds: you hold still, turn your head one way, turn it the other way, and look back at the camera. The app tells you which way to turn first; our server chooses the order at random for each attempt.

Why the check is required. What Eventide provides is a community of real people who hope to marry, each of them present when they joined and shown truly in their own photographs. Accounts run by software, profiles built from generated or stolen photographs, and people who are not who their photographs show are what that community exists to keep out. A profile's photographs and words cannot show that a real person made it: a photograph can be generated, copied or shown on a screen, and a person reading a profile cannot tell. Measuring the depth of a face in front of the camera, while it moves as asked, can. That is why the check is a condition of joining for everyone who signs up and never a paid feature, and why a profile is not sent for review without it. A member who joined before the check existed is not asked to take it, and can choose to take it later for the Verified badge, as described below.

The review of your profile is a separate step. A person at Eventide reviews every profile against our standard of modesty and appropriateness (Terms §5 and our Community Rules). That review is about what your profile shows and says. It is not how we check that you are a real person; the check in this section is.

We treat all of it as biometric information. The measurements of your face and the image of the depth reading are a record of the shape of your face, which biometric privacy laws protect. We handle everything the check produces under this section, including its photographs and video, whether or not a particular law would count a given piece as biometric.

What happens on your phone. On an iPhone with Face ID, the app uses Apple's face tracking (ARKit) and the Face ID depth camera, which measures how far each point in front of it is from the phone. The face tracking is used to find where your face is in the picture, which way it is turned, and whether your eyes are open, so that the front photo is taken with them open. Whether your eyes are open is worked out only on your phone and is not sent to us. The app then reads the depth camera's own distances at a few points on your face (the tip of your nose, your cheeks, forehead and chin, and around your eyes) and works out:

• how far your nose stands in front of the rest of your face, while you hold still and at the furthest point of each turn;
• how far your face departs from a flat surface;
• how much of the depth reading was usable;
• how far your face was from the phone;
• how far you turned each way, and how long each part took;
• how long your face was out of view; and
• how many faces were in view, using Apple's face detection on the phone.

These calculations happen on your phone. The depth measurements come from the depth camera itself, not from the three-dimensional face model that Apple's face tracking builds, and that model is not sent to us. On an iPhone without Face ID, such as the iPhone SE, the check looks the same, but the app uses the ordinary front camera and Apple's face detection on the phone to follow your turns, and no depth is measured.

What Eventide receives. For each attempt:

• three photographs from the check: one at each turn and one when you look back at the camera;
• on a phone with a depth camera, a small grey image of the depth reading of your face, lighter where your face is nearer to the phone, which shows at a glance that the face has depth (a flat picture shows as flat grey);
• on a phone without one, a short video of the check, at most 720p, instead of the depth image; and
• the measurements listed above, as numbers, together with the model of the phone, its iOS version and the version of the app.

No faceprint or face template is made, on your phone or by us.

What it is used for. Only for this check: to confirm that a real person was in front of the camera and that it is the person in your profile photographs. Our server compares the measurements with fixed limits (for example, a real nose stands well in front of the cheeks, and a photograph does not) and marks each attempt as passed or not passed, with the reasons. A person at Eventide then uses what the check produced in two ways:

• they compare the check's photographs with your profile photographs by eye, to confirm that your profile photographs show the person who took the check; and
• where the measurements cannot settle the check, because three attempts did not pass or because your phone has no depth camera, they decide it from the check's own photographs and depth image or video.

No profile is refused by the server's mark alone. That purpose includes a second look at the first decision on your profile in the 30 days after it, for example if you ask us to reconsider, and it ends when those 30 days do.

The Verified badge. If your check passed, then once a person at Eventide admits your profile, other members see the Verified badge on it. The badge tells them one thing, which is what the check is for: that a person at Eventide confirmed you are a real person and the person in your profile photographs. It shows no photograph, image or measurement from the check, and nothing else about it. A check that did not pass, or that ran without a depth camera, never gives the badge, even when a person admits your profile. Members verified with selfies before 2026-10-11 keep their badge.

What it is never used for. It is never used to identify you, meaning to find out who you are or to recognise you anywhere else. It is never compared by software with any other face, whether another member's, someone we have removed, or any database of faces. It is never used to train any model, never used for advertising or marketing, never used to build a profile of you, and never used for anything other than this check. Beyond your own profile photographs, the only thing a check is ever compared with is the photo ID of the person who took it, when that person is a host or a host's spouse: a person at Eventide compares that check with the photo ID the person gave us, by eye and one to one, to confirm that they are the person on it. That does not find out who someone is. Nothing is compared by software and nothing is searched.

Who sees it. The person at Eventide who decides the check and reviews new profiles sees the photographs, the depth image or video, the numbers and the result, in our own review app, while we still hold them. No other member ever sees any of it, and none of it becomes part of your profile; other members see only the Verified badge a passed check earns, as described above. The files are kept for us in the same private storage as your photographs, run by Cloudflare (§6), which holds them for us and may not use them for anything of its own. The numbers are kept in our own database on our own hardware. Nothing from the check is sent to an AI provider, an identity-verification company or anyone else, except where the law requires it (below).

Never sold, and shared only where the law requires it. We never sell, lease or trade anything from the check, and never profit from it. We share it with no one, except where the law requires it, as described under "When we are required to" in §6; our law-enforcement guidelines require a search warrant before we produce any of it. The voluntary disclosure that §6 allows in an emergency does not extend to anything from the check: we disclose it only when the law compels us to. Apart from that, Cloudflare's keeping the files for us, as described above, is the only place any of it goes outside Eventide.

How long we keep it. The photographs, the depth image or video and the measurements are deleted 30 days after the first decision on your profile, and within 90 days of the check at the latest, or sooner if you delete your account or ask us to. For a check taken later for the Verified badge, the 30 days run from the decision on your badge instead, with the same 90-day limit. What stays with your account afterwards is the result, the plain reasons, the kind of camera and the dates, with no image and no measurement of your face. The photographs, depth image and video are files in our storage and are gone once deleted. The measurements are kept in a part of our database that is left out of our backups, so nothing from the check is ever in a backup (§7). The full schedule is in §7, under "Biometric information: retention and destruction schedule".

Your consent. Before the camera opens, the app explains the check and asks for your agreement on its own screen, apart from the Terms of Service and from every other consent. The screen shows these words:

Eventide requires this check of everyone who joins to confirm that each member is a real person and matches their profile photos. I agree that Eventide may run a short check using my phone's front camera, and its Face ID depth camera where available, to confirm that I am a real person and the person in my profile photos. The shape of my face is measured on my phone; these measurements are biometric information. Eventide receives photos from the check (and a short video on phones without a depth camera), an image of the depth reading, and the measurements, which are stored by its storage provider. An Eventide reviewer uses them to compare the photos with my profile photos and, where the measurements are inconclusive, to decide the check. They are used only for this check, are never used to identify me, are never sold, and are never shared except where required by law. They are deleted 30 days after the first decision on my profile, and no later than 90 days after the check, or sooner if I delete my account or withdraw this agreement by contacting support@eventidedating.com. By tapping Start, I sign this agreement.

Tapping Start is your agreement, and, as the words above say, your signature of it. We record it before the camera opens, with the exact words you were shown, the time, and the version of this policy in force, in the same way as the consents in §3.4.

If you take the check later for the Verified badge (below), the screen shows these words instead. They differ from the words above only in how they begin and in when what the check sends us is deleted:

This check is optional. It is how a member earns the Verified badge, which shows other members that Eventide has confirmed that the member is a real person and matches their profile photos. I agree that Eventide may run a short check using my phone's front camera, and its Face ID depth camera where available, to confirm that I am a real person and the person in my profile photos. The shape of my face is measured on my phone; these measurements are biometric information. Eventide receives photos from the check (and a short video on phones without a depth camera), an image of the depth reading, and the measurements, which are stored by its storage provider. An Eventide reviewer uses them to compare the photos with my profile photos and, where the measurements are inconclusive, to decide the check. They are used only for this check, are never used to identify me, are never sold, and are never shared except where required by law. They are deleted 30 days after the decision on my Verified badge, and no later than 90 days after the check, or sooner if I delete my account or withdraw this agreement by contacting support@eventidedating.com. By tapping Start, I sign this agreement.

Tapping Start there is your agreement and your signature in the same way, and we record it in the same way.

If you do not agree. The check is required to join, so if you do not tap Start, no check is run, nothing from your camera is collected, and your profile is not sent for review. Nothing you have entered is shared with anyone. You can come back to the check at any time, or delete your account (§8), which erases what you entered. If camera access is turned off for Eventide, the check cannot run until you turn it on in your phone's settings. If you do not agree to the check taken later for the Verified badge, nothing is collected and nothing changes except that you do not have the badge.

Attempts. You have three attempts. If an attempt does not pass, the app tells you in a few words what to change, such as holding the phone a little closer, and you can try again. If the third attempt does not pass, the app does not say so: your profile goes to review marked as not passed, the app shows you that it is being reviewed, and a person decides the check as described above. If your phone has no depth camera, the depth measurement cannot run on it, so the check records a short video instead; this depends only on the phone, not on a choice, and the same check runs in every other way. Your profile then goes to review marked "no depth camera" once you complete the check, and a person decides the check from the video and photographs. Every attempt is kept until the deletion dates above. If a disability makes the check hard to complete as asked, write to support@eventidedating.com and we will work out with you a way to take it; a person can decide the check from what an attempt produced.

Asking us to delete it sooner, withdrawing your consent, and your other rights. You can withdraw your consent, and ask us to delete the photographs, video, depth image and measurements before their dates, by writing to support@eventidedating.com; we will delete them. Withdrawing does not end your membership, and a check that has already passed still counts. If you withdraw before a person has decided a check that did not pass or was taken without a depth camera, we can no longer decide it, so your profile cannot be admitted unless you take the check again, which you can ask us to arrange. You can also ask what we hold from the check and receive a copy. The rights in §11 apply to it in full.

Taking the check later, for the Verified badge. If your profile was admitted without a passed check, because you joined before the check existed or because your check did not pass, you can take the same check later from Profile ▸ Get verified. It is optional: without it you keep every part of Eventide except the badge. It needs an iPhone with the Face ID depth camera, because measuring depth is what confirms a real face, so on any other phone it cannot be taken and no video is ever recorded for it. Everything else in this section applies to it, with these differences:

• its consent screen shows its own words, quoted above under "Your consent";
• if an attempt passes, a person at Eventide compares its photographs with your profile photographs by eye and decides whether to give you the badge. An attempt that does not pass does not give the badge, and nobody decides it; the app tells you what to change, and you can try again;
• you have three attempts. After three that do not pass, write to support@eventidedating.com and someone on our team will help. If we decide not to give you the badge, you can take the check again, with three new attempts;
• what it sends us is deleted 30 days after the decision on your badge, and within 90 days of the check at the latest, or sooner if you delete your account or ask us to (§7). An attempt that no decision on your badge follows is deleted 90 days after it; and
• if you withdraw your consent before a person has decided your badge, we cannot decide it, and the badge is not given.

Hosts, and the spouse of a host. A host takes the same check when they apply, and so does the spouse of a host who wants to run open homes, on the host's phone (§3.10). It is required of every host: the photo ID cannot be sent until the check is done. Everything in this section applies to it, with these differences:

• its consent screen shows its own words, quoted below;
• a person at Eventide compares the check's photographs with the person's photo ID, by eye, instead of with profile photographs, because a host has no profile photographs; that comparison is one to one, to confirm that the host is the person on the photo ID, no software makes it, and nothing is searched, and the server's mark never approves or refuses a host by itself: a person decides each host, and each spouse, from the check and the photo ID, and where the measurements cannot settle the check, from its own photographs and depth image or video;
• the host and the spouse each have three attempts;
• what it sends us is deleted 30 days after the decision on that host verification (the decision on the host for the host's check, on the spouse for the spouse's), and within 90 days of the check at the latest, or sooner if you delete your account or ask us to (§7). An attempt by a host nobody has decided is deleted 90 days after it; and
• if you do not agree, nothing is collected, and the host account is not approved; you can delete it (§8); and
• a spouse has no account, and can withdraw their agreement and ask us to delete what their check produced by writing to support@eventidedating.com.

The screen shows these words:

Eventide requires this check of every host to confirm that each host is a real person and matches their photo ID. I agree that Eventide may run a short check using my phone's front camera, and its Face ID depth camera where available, to confirm that I am a real person and the person on my photo ID. The shape of my face is measured on my phone; these measurements are biometric information. Eventide receives photos from the check (and a short video on phones without a depth camera), an image of the depth reading, and the measurements, which are stored by its storage provider. An Eventide reviewer uses them to compare the photos with my photo ID and, where the measurements are inconclusive, to decide the check. They are used only for this check, are never used to identify me, are never sold, and are never shared except where required by law. They are deleted 30 days after the decision on this host verification, and no later than 90 days after the check, or sooner if I delete my account or withdraw this agreement by contacting support@eventidedating.com. By tapping Start, I sign this agreement.

Tapping Start is the agreement and the signature, and we record it in the same way as the others in this section. The spouse takes the check on the host's phone under the same words, and signs them there; the spouse has no account, so the spouse's agreement is recorded separately from the host's, on the host's account, with the spouse's name. The name is erased within 24 hours of the host's account being deleted; the record of the words and the date stays.

What the law asks of us, and what we do. Several US states have laws about biometric information. We follow each of these for every member and every host, whatever state you live in:

• Illinois, the Biometric Information Privacy Act (740 ILCS 14/15). This section and the schedule in §7 are our written policy, available to the public, setting out how long we keep biometric information and how we destroy it. Before anything is collected we tell you in writing that it is being collected and stored, for what specific purpose, and for how long, and we ask for your written release, which is the agreement described above, which you sign by tapping Start. We never sell, lease, trade or otherwise profit from it; apart from our storage provider keeping the files for us, we disclose it only where the law requires it (14/15(d) allows disclosure required by law or by a valid warrant or subpoena); and we store, transmit and protect it with reasonable care, in the same private storage and database as your account, reached only through short-lived links our server gives to the person reviewing profiles (§9).
• Texas, Business and Commerce Code §503.001. We tell you before the check and receive your consent first; we do not sell or lease what it captures, and apart from our storage provider keeping the files for us, we disclose it only where the law requires it, such as to law enforcement in response to a warrant; we protect it with reasonable care, in the same private storage and database as your account (§9); and we destroy it far sooner than the law's limit of one year after the purpose for collecting it ends.
• Washington, RCW 19.375. That law governs enrolling a biometric identifier in a database for a commercial purpose, which it defines as selling or disclosing it for marketing unrelated to the service. We never do either. Washington's My Health My Data Act (RCW 19.373) counts biometric data as consumer health data; we collect the check's information only with the consent above, share it with no one except where the law requires it, and you can find out what we hold, withdraw your consent, and have it deleted, as described in this section. Our consumer health data privacy policy under that Act is a separate page, at https://eventidedating.com/consumer-health-data.
• Colorado, C.R.S. 6-1-1314 (added by House Bill 24-1130, in force since 1 July 2025). We tell you, clearly and before collection, that the check collects a record of the shape of your face, why, how long we keep it, and that our storage provider holds it for us, and only to store it; we ask for your consent first; we do not sell, lease or trade it, and we disclose it only where state or federal law requires it. The law lets a business refuse a service to someone who does not consent to a biometric identifier only where collecting it is necessary to provide the service (6-1-1314(4)(c)(I)). The check is: what Eventide provides is a community of real people, present when they joined and shown truly in their own photographs, and a profile's photographs and words cannot show that, as explained at the start of this section. The check taken later for the Verified badge is optional, and refusing it costs nothing but the badge, which says only what the check confirms. For a host the check and the photo ID are necessary for the same reason: a host runs an evening in a home, or a gathering, for members who have never met them, and a listing cannot show that the host is a real person and the person they say they are. We collect from the check only what deciding it needs, use it for nothing else, and our schedule in §7 deletes it when the purpose above ends, or within 90 days of the check at the latest, long before the outer limit the law sets of 24 months after you last interacted with us. We review the schedule at least once a year (§7).
• California, the Consumer Privacy Act as amended. It counts "the processing of biometric information for the purpose of uniquely identifying a consumer" as sensitive personal information (Civil Code §1798.140(ae)). We never process the check's information to identify you, meaning to search for or recognise you among other people, and we use it only to provide the service you asked for, of which the check is a required part (for the check taken later, the Verified badge you asked for), which is the use the right to limit sensitive personal information leaves in place (§1798.121). A host's check, compared one to one with the host's own photo ID, is sensitive personal information processed with the host's consent, only to provide the service the host asked for, running events. You can ask us to delete what it produced, as described above.
• States with general privacy laws, such as Virginia (Code §59.1-575 and §59.1-578) and Colorado (C.R.S. 6-1-1303 and 6-1-1308). They treat biometric data as sensitive data when it is processed, or in Colorado's case may be processed, to identify a person, and they require consent before sensitive data is processed. Connecticut, from 1 July 2026, treats biometric data and information derived from it as sensitive data whatever it is used for (Conn. Gen. Stat. §42-515, as amended by Public Act 25-113). We do not use the check to identify anyone from among other people, and we ask for your consent regardless. For a host the check is sensitive data processed with that consent, to provide the service the host asked for.

¶3.9 Experience: events you go to

Experience lists three kinds of event: gatherings of this community, such as camp meetings and conferences; open homes, an evening for a small group of members in the home of a married couple; and mission trips, run by their own organisers. A gathering can also be run by a host, a person with a host account (§3.10), and every open home is. From "What you tell us" to "Inviting someone", this section describes gatherings that Eventide lists. The paragraphs after it say what is different at a gathering a host runs, at an open home and on a mission trip.

What you tell us. When you mark an event in Experience, we record that you are going. To be verified, you either upload one image showing you are going (a registration confirmation, ticket, housing or campground booking, staff or volunteer badge, or a church group's trip list), or, if you have nothing to upload, you ask to be checked in at the venue instead. Once you are verified, you can see who else is going, and when the event ends you can like the members who were verified for it.

Your consent. The events in Experience are part of this community's life, so the events you go to can say something about your faith and how you practice it, which is sensitive information (§3.4). The first time you tap "I'm going" on a gathering, a short explanation sits next to the button, and tapping it is your consent to our using the gatherings you go to as this section describes; we record it, with the exact words. An open home, a mission trip and a gathering a host runs each have an explanation of their own, described below, and the first time you sign up for each kind is your consent for that kind. You can withdraw a consent at any time by leaving the events of that kind you marked, or all of them by writing to support@eventidedating.com, and we then remove you from every event as leaving does. A seat at an open home can be given up in the app only until the evening starts, and a no-show mark cannot be left in the app at all; after that, write to us and we remove you the same way. Checking in at the venue has a consent of its own, described below.

Your proof. Only our team sees it. It often shows your full name and sometimes an address. Each image you upload is stored as a file of its own, and when you upload a new one we delete the one before it. If that deletion fails, the earlier image is removed by the 30-day limit below. We delete it as soon as a decision is made, and in any case within 30 days of when you upload it, decided or not, including an upload you started and did not finish. It is not kept in any cache: the service that delivers images to our team keeps no copy, and neither do our reviewers' devices.

The decision, and what leaving changes. We keep a record that you were verified or not for an event, by whom and when, and, if you were refused, the reviewer's note saying why; a check-in at the venue is recorded as verified by no one. If you checked in at the venue and were verified, we keep the time of that check-in with the decision for 30 days after the decision, or until the event's Experience closes if that comes first; if you were refused, we clear it. While you stay marked as going to an event, this record is part of your attendance for it, and it is deleted when the event's Experience closes, 7 days after the event ends. You can leave an event in the app until it ends. If you leave, we delete that attendance and everything at the event that names you: your check-in, and every like you sent or received there, so a like you sent there is no longer shown and cannot make a match. Once the event has ended, the app no longer offers leaving; to be removed after that, write to us as "Your consent" says. The decision is also kept in your account's own history, the way our other moderation decisions are, until you delete your account (§7).

Who sees that you are going. From 14 days before an event starts until 7 days after it ends, other members who are verified for the same event see you in the event's list of who's going, if they are members you could meet. That means members of the gender you seek who seek yours, where neither of you has blocked the other, whatever age either of you prefers; the list leaves out someone whose match with you has ended. The list shows everyone this fits, and a member can narrow their own view to the people who fit their age preferences and whose preferences they fit. One exception to that: someone you have an open match with stays in the list, marked as a match. The list shows your profile without your home church or your "Been part of" entries, which a member sees only once you match. Before and during the event it is a list to look at, with no way to like anyone. After the event, it shows only the members our team verified for it who have not been marked as absent: at a gathering or a mission trip, a member whose proof our team accepted (at a gathering a host runs, a member who signed up and was not marked as a no-show); at an open home, a guest whose seat has not been marked as a no-show. Being verified shows that a member planned to be there, not that they were. Nobody sees the list without being verified for the event themselves, and nobody you have blocked, or who has blocked you, ever sees you in it.

Likes after an event. When an event ends, likes open for 7 days. While they are open, you can like up to 5 people from the event's list, on their whole profile or on one answer, with a short note, the same way you like someone in your daily introductions; a like cannot be taken back. A like in your daily introductions is shown to the person you liked only if they have Eventide Premium or like you too. A like you send at an event is shown to them at once: they see that you liked them, with your note, at the top of their list for that event, and can like you back without a note. If you both like each other, a match is made, with the event's name on it, and it stays like any other match. If you had already liked or passed on that person in your daily introductions, liking them at the event replaces that choice. When the event's Experience closes, its list closes too. A like that was not returned is no longer shown at the event; it is kept like a like in your daily introductions, and if that person later likes you there, a match is made.

A check on every like note. Before a note sent with a like is delivered, in your daily introductions or at an event, it is checked for offensive language: swearing, slurs, sexual language, harassment and threats. It is checked first against a list of words. A note that uses one of them is not delivered, and the like is not sent; you can rewrite the note and send the like again. Where the app offers it, a note that passes the list is then read by a language model run by Mistral AI through OpenRouter, which keep nothing (§6); its key is its own, in a workspace that requires zero data retention. A note the model marks is delivered as you wrote it, and a person at Eventide is told, so that they can decide whether anything should follow. We keep each refused or marked note with your account's record, so that we can see it, and its words are deleted after 90 days (§7). Mild words, quotations from the Bible and ordinary words that merely contain a bad one are not refused.

Checking in at the venue. If you have nothing to upload, you can ask to be checked in at the venue instead, and checking in there verifies you for the event at once, with no review by our team. It is off until you turn it on. A short explanation next to the switch says what the check-in records and who sees it; turning it on is your consent, and we record it. Being checked in at a venue places you at a known place at a known time, and the law of several states treats that as precise geolocation, which is sensitive information, even though your location itself never reaches us. Turning the check-in off withdraws that consent, no further reading is taken, and turning it on again asks again. From 30 minutes before the event starts until it ends, while you are waiting to be checked in, your phone takes one location reading when you open that event's page, when you turn the check-in on there, and when you come back to the app with that page on screen, and checks it against the venue's boundary, on your phone. When you choose to check in at the venue, you also choose how it happens when you arrive, and you can change it later in Settings. Manual: your phone's operating system watches for you entering the venue's area and shows a notification; Eventide takes no reading until you tap it and the event's page opens. Automatic: if you also set Eventide's location access to Always, your phone's operating system wakes Eventide when you enter the venue's area, even with the app closed, and Eventide takes one reading and checks it against the venue's boundary, on your phone, as above; if you arrive more than 30 minutes early, it reminds you with a notification when check-in opens instead. Without Always, automatic works as manual does. Either way, the watching stops once you are checked in there, when you turn the check-in off or sign out, and the first time Eventide is opened after the event ends. Apart from these, no reading is taken on any other screen, or for an event you are already verified for, and stepping away briefly, to Control Center, a notification or a prompt from your phone, does not count as coming back. The check needs your exact location: your phone does not check you in on an approximate reading, or on any reading less precise than the venue is large. If you have only given Eventide approximate location, your phone may ask you once for your exact location for this check, and does not ask again until the app has been closed and opened again. Answering "Allow Once" only lasts while you are using the app that time. To stop it asking, turn on Precise Location for Eventide in your phone's Settings, turn off location for Eventide altogether, or turn the check-in off. Either way, the reading itself is not sent to us and is not stored. If you are inside the venue, your phone tells us only that you are at that event at that moment. We keep the time of that check-in with our decision on your attendance, as "The decision" above says, and nothing else, and no member, not even someone you have matched with, can see that you checked in. The request that creates a check-in is recorded like any other, in our server logs (§7).

Event photos. A listing can show a photograph from the event's organiser or hosts. For an event Eventide lists, our team chooses and publishes it, and only when the organiser has the right to share it. A host who runs an event can add a photograph to it: before the event is published a person at Eventide looks at it with the rest of the event, and once the event is published a new photograph shows at once and a person at Eventide looks at it afterwards and can take it down. We never use a member's photographs for an event. A photograph of an event can show people, some of whom may not be members. Anyone shown in one can ask us to take it down by writing to support@eventidedating.com, and we remove it. We keep it with our record of the event until our team or the host replaces or removes it, and we then delete it from our storage; §7 says what a cache can keep for a short while after that, as for any photograph, and when the photograph of an event a host created but that was declined, cancelled or never decided is deleted.

Inviting someone. You can invite a match to an event you are going to from your conversation, and you can share a link to any event that has not ended, with anyone, member or not. The link opens a page on our website that shows the event (its name, picture, dates and town; for an open home, its area, never its address, its hosts or how to reach them) and your first name, as "{your first name} invited you". The page does not name a host; the app is told only whether a host runs the event, so that it shows the right explanation next to "Accept". Anyone who has the link can see that page, and an app that previews links, such as Messages, shows the same, so share it with the people you mean to invite. Search engines are asked not to list it. You have one link per event, and several people can use it. If you open someone's link on your phone before your profile is approved, Eventide keeps that link on your phone, not on our servers, and opens the event once you are in; signing out forgets it. If someone who is not your match signs up for the event through your link, the event's page shows you their first name ("Accepted your invite"), and you may get a notification that names the event and not them, at most once a day for each event; neither happens if either of you has blocked the other. If you and a match are both going to an event and one of you signed up through the other's invitation, the event's page says "You're going with" and the other's first name, to the two of you and to nobody else; it goes if either of you leaves the event, ends the conversation or blocks the other. When you choose an event to invite a match to, the list shows which of your events they are already going to. Nobody is told how many people you invited, and nothing counts or rewards it. An invitation is deleted when the event's Experience closes, 7 days after it ends, and with your account (§7, §8).

Gatherings a host runs. A host can run a gathering of their own. Signing up counts at once: there is no proof to upload and no venue check-in, and from the moment you tap "I'm going" you are one of the members verified for the event, so other members you could meet see you in its list of who's going from 14 days before it starts, as at any gathering. The short explanation under "I'm going" says that the host sees your first name and photo, and tapping it is your consent for gatherings a host runs; we record it with the exact words, apart from your consent for other gatherings. The host sees the first name and first approved profile photograph of each member who is going (§3.10), and can mark a member who did not come as a no-show, from the start of the evening until the event's likes close, 7 days after it ends. A member marked as a no-show did not attend, so they are left out of the list and cannot like anyone from it; the event does not count toward the events badge (§3.2) for that member, although it does for the members who came; and the member is not asked to review the host. The mark is not a penalty and bars nothing else, and it is kept as "No-shows" under "Open homes" below says. The address. The listing shows the venue's name and the city, and the place it gives for "near me" and the map is rounded to about a kilometre. The street address is sent to the app only for a member with a confirmed sign-up, from 24 hours before the event starts until it ends, and never to anyone else.

Open homes. A married couple opens their home for an evening to a small group of members. Every open home is run by a host with a host account, and the host's spouse takes the same checks (§3.10): before an open home can be created, a person at Eventide has compared the face check and photo ID of both of them, and a person reads each open home before it is published. We no longer list open homes ourselves, and members no longer suggest them. An open home has no proof and no check-in, and the app takes no location reading for it.

Saving a seat. The seats are shared equally between men and women, so to seat you we use the gender on your profile. Only members who have passed the liveness check in §3.8, or who joined before it existed, can save a seat. When your side is full, you join that side's waitlist instead, in the order people joined it, and if someone on your side gives up a seat before the evening, the first person waiting gets it and is told. We record your seat or your place in line and when you took it. Saving a seat (or joining the waitlist) is also your agreement to the Community Rules, so we record which version of them you agreed to and when. The short explanation under the button says what saving a seat shares, including that the hosts see your first name and photo, and tapping it is your consent for open homes; we record it with the exact words.

Who sees it. The hosts see the guest list in their host account: the first name and first approved profile photograph of each guest with a confirmed seat, and nothing else about them (§3.10). Our team sees the guest list too. From 14 days before the evening, other guests with a confirmed seat whom you could meet (as "Who sees that you are going" describes) see you in the evening's list of who's going, and after it, the guests who held a seat and were not marked as a no-show can like you for 7 days. Other members see only how many seats are left on their own side and, when enough people are going, how many. A member still on the waitlist is not in the list, and the hosts do not see them. A member marked as a no-show is not in the list; the hosts still see them in their own guest list, marked, until the event's likes close.

The address. The listing shows the city and the area, never the house, and "Hosted by" with the hosts' first names (§3.10). The place it gives for "near me" is the area, not the house. The street address is sent to the app only for a guest with a confirmed seat, and only from 24 hours before the evening starts until it ends; after that it is no longer sent. Members on the waitlist, and every other member, never receive it. Everything Experience sends the app is marked not to be stored, so the phone does not keep a copy of it. If you tap the address, Apple Maps opens to find it, so Apple sees it, as with the city search in §3.3. Please keep it to yourself. The address stays on our record of the event, which only our team and the hosts see, for 90 days after the evening; see "Hosts and organisers" below.

No-shows. If you hold a seat and do not come, the hosts or our team can mark you as a no-show from the start of the evening until the event's likes close, 7 days after it ends. A no-show mark is not a penalty: it does not stop you from saving a seat at any later event. A member marked as a no-show did not attend, so they are left out of that evening's list and cannot like anyone from it. The mark is deleted with the event's other attendance records when its likes close, and leaving the event does not remove it sooner. A note that the mark was made, or taken back, is kept in your account's history, which only Eventide sees, for as long as your account exists, and it is deleted with your account. If you think we marked you by mistake, write to us, and if we did, we take it back.

Mission trips. A mission trip is run by its own organiser. Unless a listing says otherwise, the organiser does not work with Eventide, and neither of us endorses the other. You sign up, pay and make your arrangements with the organiser on its own site; Eventide takes no booking and no money, and sends the organiser nothing about you. In Eventide you tap "I'm going", next to a short explanation that is your consent for mission trips, and upload the organiser's confirmation of your place as your proof, which is handled exactly as "Your proof" above describes. A trip has no check-in, and the app takes no location reading for it. Members verified for the same trip whom you could meet see you in the trip's list of who's going from 14 days before it starts, and when it ends they can like you for 7 days, as at a gathering. Other members see only how many are going, when enough are.

Suggesting an event. You can suggest a gathering or a mission trip, up to three a week; an open home is created by a host, not suggested. We keep what you send: its kind, name, dates, city and state, who runs it, a link, a way for us to reach them, and your note. If you run a gathering or a mission trip you suggest, you also give us a phone number to reach you on. Only our team reads what you send, and apart from that phone number nothing you send is shown to another member; an event we list from it is written up by our team. The phone number is shown only to members our team has confirmed are going, on the event's page, once we list the event. We use the way to reach them to contact the organiser. If we list the event, the way to reach them moves to our record of the event (see "Hosts and organisers" below), or is deleted if that record already has one; your phone number moves or is deleted the same way; your note is deleted then too, and the rest of your suggestion is kept with your account so you can see what became of it. If we decline it, we tell you why in a line; 90 days later we delete the way to reach them, your phone number, your note and the names you gave, and the rest, including our reason, is kept with your account. A suggestion we have not decided is kept until we decide it. Please give us someone's contact details only if they are happy for us to use them. Anyone can also suggest a gathering or a mission trip on our website, without an account. We do not ask who is suggesting it and keep nothing about them; we keep only what the form sends about the event and its organiser, only our team reads it, and we tell nobody what we decided. It is kept and deleted on the same clocks as a member's suggestion; the website does not ask for a phone number.

Hosts and organisers. Some of what Experience keeps is about people who may not be members. For an event a host runs we keep what the host gave us (§3.10) and the event's street address; for an open home Eventide listed before hosts had accounts, the street address and a way to reach its hosts; for any event, a way to reach its organiser if we have one. They are kept on our record of the event, which only our team (and, for their own event, the host) sees, apart from the address shown to confirmed guests as described above and an organiser's name shown in a listing. We use them to check the hosts or the organiser, to arrange the event and, for the address, to tell guests where to go. We delete the street address of an event a host runs, a gathering's as well as an open home's, and any older open home's way to reach its hosts, 90 days after the event ends, and a way to reach an organiser that came from a suggestion 90 days after the event ends. A way to reach an organiser that our team found itself is kept with the event's record until the organiser asks us to delete it. An event can also have a phone number for its organiser, given in their suggestion or added by our team. We show it only to members our team has confirmed are going, on the event's page, so they can call or text the organiser; the call or text happens in the phone's own apps and we see nothing of it. We delete it 90 days after the event ends, and at once if the member whose suggestion it came from deletes their account. Hosts and organisers can ask sooner, by writing to support@eventidedating.com, and we then delete their details once the event is over.

Notifications about events. A notification about an event you are verified for may name the event on your lock screen, so anyone holding your phone could see it; you can turn notifications off in the app's settings. At an event a host runs, a notification that the host changed the time or the place, cancelled the event, or posted an announcement names the event, and an announcement's also shows the first 120 characters of what the host wrote; the request to review the host the morning after names the event and never the host. A notification about a like you received at an event names the event and never the person who sent it. A notification about proof we could not verify does not name the event. A notification about a suggestion you sent shows our reason in our own words.

¶3.10 Hosts

Some events are run by hosts. A host has a separate host account, used only to run events: it never appears in introductions, likes, matches, chats or the list of who's going, and a host cannot see or contact members outside the events they run. The kind of account is fixed when it is created: an email address or an Apple ID that already belongs to a member signs in to that member's account, and a host account cannot be used as a member account.

What a host gives us. First and last name, date of birth, city, the version of the Host Agreement they accepted (https://eventidedating.com/host-agreement) and when, and a photo of the front of a photo ID (a driver's license, state ID or passport). A host also takes the face check in §3.8. To host open homes, a host adds their spouse's first and last name, and the spouse takes the same face check and adds a photo of their own photo ID. A person at Eventide compares the face check's photographs with the photo ID, by eye, and decides whether to approve the host, and separately the spouse. Hosts must be 25 or older. We record in the account's history that the details were added, that a photo ID was submitted and what was decided.

The photo ID is used only for that decision. It is deleted when the decision is made, whether the host or the spouse is approved or not: the file is removed from our storage first, and if that fails the decision is not recorded. It is deleted at once if the host deletes their account (if our storage cannot be reached at that moment, a daily job keeps trying until it is gone), and a daily job deletes an upload that was never submitted once it is more than 24 hours old. Only the person at Eventide who decides sees it, through a short-lived link in our review app; it is never shown to members or to other hosts, and the service that delivers images to our team never keeps a copy of it.

What a host gives us about an event. For each event: its name, description, date and start and end time, venue or area, street address, how many places there are (for an open home), and an optional photograph. A person at Eventide reads every event before it is published, and may decline it with a reason, which the host reads.

What a host sees of guests. For each member going to their event: the member's first name and first profile photograph, and nothing else: not your age, your profile, your other photographs or anything you wrote. A member who is waitlisted, who left or who was refused is not in the host's list, and neither is anyone whose account is no longer in good standing. A host sees the list from the moment a member signs up until the event's likes close, 7 days after it ends, when it empties. A host also sees how many people are going (for an open home, how many on each side), and can mark a member who did not come as a no-show (§3.9). You agree to all of this with the line under "I'm going" or "Save me a seat" at an event a host runs (§3.9).

What members see of a host. "Hosted by" with the host's first name on the event, and for an open home the spouse's first name too, once the spouse is approved. A member can report a host from the event's page, and a report is handled like any other (§4). A host's announcements are shown on the event's page only to members with a confirmed sign-up, and are sent to them as notifications; the host cannot receive replies. Eventide can read and remove any announcement.

Changes to an event. A published event can be changed by its host within fixed limits: its kind and its day cannot change, the start can move by up to 2 hours on the same day, from the time that was approved (a change of time zone counts as a change of time), the place can move by up to 10 miles from the place that was approved, and an open home's places cannot go below the number going on the fuller side. A new name, description or photograph goes live at once. Everyone with a confirmed sign-up is told when the time or the place changes, and everyone with a sign-up or a place in line is told if the host cancels. Each change is recorded with what it was before, and a person at Eventide looks at changes after they go live and may take down a new name, description or photograph.

Reviews of hosts. From 9:00 on the morning after an event a host ran, each member who came (a confirmed sign-up, not marked as a no-show) is asked whether it was good, and may add a comment. They can answer until the event's likes close, about six and a half days. Only a person at Eventide sees the answers, with a count of good and not good answers for each host and without the member's name. The host never sees who said what, or whether anyone did, and nothing is published. The Good or Not good answer is kept with the event's record; the comment is deleted when the member deletes their account.

What we never do with it. A host's details and photo ID are used only to check and run the host's events. They are never sold, never shared except where the law requires it, and never used to find or contact members.

¶3.11 Signing in on our website

Members and hosts can sign in on eventidedating.com. A member sees events there, and a host manages their events. The website keeps one record for each browser you sign in on: the kind of browser and computer it is (for example, Safari on a Mac), an approximate city, which Cloudflare works out from the connection and passes to us (we do not keep the address itself), and when the sign-in was made and when it was last used. A host sees these records for their own signed-in browsers, so they can tell which is which and end one.

When a host signs in on a new browser, they must approve it from the Eventide app or with a code we email them. We also email you each time a new browser signs in to your account, naming the browser and city and offering a link to sign it out. The notification that asks a host to approve a sign-in is not kept in the app's list of notifications.

A sign-in ends when you sign out; when you sign in again on the same browser, which replaces it; when a host ends one of their own browsers from their settings; when Eventide ends it, by signing the account out everywhere or by suspending or banning the account; when you pause your account in the app, or it is closed after a long time unused; or when a password reset ends every sign-in. Its record is then deleted: a job that runs every hour deletes the records of sign-ins that have ended, and deletes a host's sign-in that was never approved once its 10 minutes have passed. When you delete your account, your sign-in records are deleted at once. People at Eventide who review an account can see that account's current website sign-ins (the browser, the city, and when each was last used) as part of the account's record.

The website uses one cookie to keep you signed in, called ev_web. It is strictly necessary to the service you asked for, and it is only ever sent to our own address, api.eventidedating.com. It stays on your browser until you sign out, and stops working 400 days after you last used it; each use renews it. While you use Sign in with Apple on the website we also set a second cookie, ev_apple_state, which protects that sign-in from being forged. It lasts 10 minutes and is not used for anything else. We set no other cookies. The website loads no advertising, analytics, third-party scripts or fonts.

¶4. How we use it

• To run the service: your profile, your daily introductions, matches and conversations.
• To review content. Every profile, every profile edit and every photograph is read by a person before it becomes visible to other members, against our standard of modesty and appropriateness (Terms §5). Our reviewers see the profile content you submit; messages and like comments are not read before delivery, but are stored and are reviewed by a person when a report names them.
• To investigate reports and enforce our Terms.
• To send notifications you have not turned off: new matches, new messages, your daily introductions, and the outcome of a review. We never put message content in a notification. A notification shows who sent a message, and not what it says. Each notification is also kept in the app's list of notifications, whether or not it reached your phone, so you can read it there.
• To send you messages from Eventide: a warning, an update or an announcement, sent to you alone, to several members, or to all members and hosts. Each one appears as a notice in the app, with a push notification if notifications are on. A warning always names its reason and is part of your account's record (§3.2).
• To verify subscriptions and grant entitlements.
• To run Experience (§3.9): listing events with their organisers' photographs, showing members verified for an event who else is going and the likes sent there, seating open homes, showing the host of an event the first name and first photo of each guest, and checking the events members suggest.
• To run host accounts (§3.10): to check each host and spouse before approval, to read each event a host creates and the changes they make later, to tell guests about a change, an announcement or a cancellation, and to read the reviews guests give a host. For nothing else.
• If both people in a match ask us to, to ask private follow-up questions and produce the single conversation starter described in §3.6.
• To run the liveness check in §3.8, which is required to join, and the same check taken later for the Verified badge; to show what it produced to the person at Eventide who decides it; and to show other members the Verified badge a passed check earns. For nothing else.
• To keep Eventide secure: rate limiting, abuse detection, and diagnosing faults.
• To meet legal obligations.

We do not use your data to train machine-learning models, and we do not profile you for advertising. The order of your daily introductions is computed from your stated preferences, the profile fields above, and activity signals, as listed in §5.

¶5. Automated decisions

Five things happen without a person:

• Your daily introductions are chosen and ordered by our compatibility scoring. Its complete list of inputs is: how your stated intentions compare, distance (or a shared conference, when you have set no distance limit), how recently each of you was active, and how complete each profile is. Members who have been inactive for 30 days are left out of the day's candidates until they return. There are no other inputs: no attractiveness score and no behavioural profile. It has no legal or similarly significant effect on you, and you can change your inputs at any time in preferences. You can also turn your daily introductions off in Settings: while they are off, you are not introduced to anyone and nobody is introduced to you, and events, likes and conversations work as before. You can turn them off 3 times in any 7 days, and back on at any time.
• An optional AI conversation starter. Only after both people turn it on, a language model chooses private follow-up questions and drafts one shared starter from the limited inputs in §3.6. It does not decide who you see, whether you match, whether content is allowed, or anything about your account. Its output can be imperfect, and either person can ignore it.
• The liveness check's mark. Our server compares the check's measurements (§3.8) with fixed limits and marks each attempt as passed or not passed. No profile is refused by the mark alone: where three attempts do not pass, or the phone has no depth camera, a person decides the check from its own photographs and depth image or video, and a person decides whether every profile is admitted. For the check taken later for the Verified badge, only an attempt the server marks as passed goes to a person, who decides the badge; an attempt marked as not passed does not give the badge, and after three of them you can write to us and someone on our team will help (§3.8). A host's check works the same way: the mark never approves or refuses a host, and a person decides each one (§3.8, §3.10).
• The language check on like notes. A note sent with a like that uses a word on our list of offensive words is refused automatically and not delivered; you can rewrite the note and send your like again. Where the app offers it, a language model also reads the note (§3.9); a note it marks is still delivered, and nothing is decided by the model. Nothing else happens to your account automatically: no warning, hold, suspension or ban follows from a refusal or a mark. A person at Eventide, the owner, sees every refused or marked note in your account's record and decides whether anything more is done.
• Seats at an open home. Seats go to members in the order they save them, side by side, and a waitlist moves up the same way (§3.9). Only a person marks a no-show, the host or Eventide, and a no-show mark does not stop you from saving a seat (§3.9). You can ask Eventide to look at a mark again.

None of these has a legal or similarly significant effect on you on its own. Reports never hide, suspend or ban an account automatically: a person at Eventide reviews every report and decides whether to hide, suspend or ban the account. A hidden profile is not shown to other members, and the member keeps their existing matches and conversations.

¶6. Who else sees your data

¶Other members

Your approved profile (first name, age, photographs, bio, prompt answers, "Been part of" entries, church, conference, intent, diet, badges, and a coarse distance label) is visible to members you are introduced to. The Verified badge among them tells other members that a person at Eventide confirmed you are the person in your photographs; a badge given since 2026-10-11 comes from the liveness check (§3.8) and shows nothing from the check itself. Your messages are visible to the person you sent them to. Your last name, email address, date of birth and coordinates are never shown to another member. If you are verified for an event in Experience, other members verified for that same event whom you could meet (as §3.9 describes: the gender you seek, who seek yours, never someone who has blocked you or whom you have blocked) can see that you are going, from 14 days before it starts, and after it ends, members verified for it who have not been marked as absent can still see you in its list. A match of yours who is verified for the event sees you there too. If you like someone at an event, they see your like and its note at once. No member sees that you checked in at a venue. If you save a seat at an open home, the hosts see your first name and first profile photo, and other guests you could meet can see that you have a seat. If you sign up for a gathering a host runs, the host sees them too. If you go on a mission trip, members verified for the same trip whom you could meet can see that you are going.

If you share an invitation link, anyone who has it sees the event and your first name. If someone signs up through your link, you see their first name on the event's page, unless either of you has blocked the other. Two matched members going to an event together through an invitation see each other's first name there as "You're going with". While your daily introductions are off, nobody is shown you in their daily introductions; members still see you wherever else this section says they do.

If you organise an event and gave us a phone number, members our team has confirmed are going see it on the event's page.

If you ask for the church badge, the pastor or church leader you name learns that you use Eventide and sees your first name, a photograph of you (your first profile photograph or, if you were verified with selfies before 2026-10-11 and we still keep your front-facing selfie, that selfie; never anything from the liveness check) and the church you named. Only our team sees their email address, their answers and any concern they share; you see only whether the badge was added. The badge says a pastor or church leader has confirmed they know you, and nothing about your character. A church leader we contact can ask us to see or delete what we hold about them by writing to support@eventidedating.com. A copy of your own data that you ask us for leaves out a leader's answers and any concern they shared, which are theirs as much as yours.

While your account and theirs are both open, a member who asks us for a copy of their own data may receive the messages you sent them, because those messages are as much theirs as yours.

¶Hosts

The host of an event you sign up for sees your first name and first profile photo (§3.10), and nothing else about you. If you review a host, only our team sees it, without your name, and the host never does.

¶Service providers

We use a small number of processors, each bound to use the data only to provide the service to us. The current list, kept up to date at https://eventidedating.com/subprocessors:

¶No sale or sharing

We do not sell personal information, and we do not share it for cross-context behavioural advertising, under the CCPA/CPRA definitions of those terms or any other. We have no advertising business, no advertising partners, and no advertising code in the app.

We have not sold or shared personal information in the last twelve months.

We have no affiliates. Eventide is not part of a group of apps. We do not share information about you with a sister service, a parent company, or another dating app.

¶A member's pastor, after confirmed reports

If more than one member reports the same person, and our team confirms what happened and acts on the account, we may tell that person's pastor, or a leader of the church named on their profile. We do this only for harassment, threats, sexual misconduct, deceiving or defrauding other members, or other conduct that puts someone's safety at risk, and a person on our team decides each case. A report is confirmed when a person on our team has reviewed it, upheld it and warned, suspended or banned the account.

We tell the pastor that Eventide acted on the account, the kind of conduct in general terms, and when. We never name or describe the people who reported, and we never send messages, photographs or the reports themselves. We find the pastor's contact details ourselves, as for the church badge. Before we contact them we tell the member and give them 7 days to answer us; we may skip that step when waiting would put someone at risk. What we sent and when is kept with the account's history of our decisions for as long as that decision is (§7).

¶When we are required to

We may disclose information to law enforcement or others where we are legally required to, or where we believe in good faith that it is necessary to prevent serious harm to someone. Our law-enforcement guidelines at https://eventidedating.com/law-enforcement set out what we produce in response to each type of legal process. We will tell you when we are able to. Nothing from the liveness check in §3.8 is ever disclosed voluntarily, even in an emergency: it is produced only when the law requires it, and then only on a search warrant.

¶If the business changes hands

If Eventide is acquired or merged, member data may transfer as part of it. You will be told before your data becomes subject to a different privacy policy, and you will have the chance to delete your account first. Nothing from the liveness check in §3.8 is transferred: it is deleted instead.

¶7. How long we keep it

Each retention period in the table below is enforced by software. Data we keep with no end date is listed separately, after the table.

¶Periods we enforce

Backups. Our database is copied every night so that the service can be restored after a failure. Each copy is kept for 14 days on our own hardware and, as an offsite copy, for 30 days in private storage at Cloudflare (§6), and is then deleted automatically. So anything deleted from our database, including under the periods above and when you delete your account, can remain in a backup for up to 30 days after it was deleted, and no longer. Backups are used only to restore the service after a failure, never to look anything up. Photographs and the other files we store are not in these backups. Once a photograph is deleted from storage, our server no longer makes links to it; a copy held in the cache of our photo server at Cloudflare stays reachable only through a link made before the deletion, which stops working within two hours, and Cloudflare discards the cached copy in time. Nothing from the liveness check in §3.8 is ever in a backup, and its files are never cached: its files are not backed up, and its measurements and attempts are kept where the backups leave them out. A backup holds only the result of each attempt and of the check, its plain reasons, the kind of camera, the dates and your consent record, none of which is biometric information.

Why bans are kept for seven years, and dismissed reports with the account. A dismissed report is an accusation we decided was not true. It stays in the account's record, which only Eventide sees, while the account exists, so that a pattern, such as one person repeatedly reporting another, can be noticed when a later report is reviewed. After the account is deleted, it is kept for one year and then deleted. A ban is the decision most likely to be disputed later, and its record is how we recognise someone who has been removed and returns under a new name. Deleting it would make the ban ineffective.

Open cases. A report nobody has resolved, and a profile edit or verification request still waiting for a reviewer, are never deleted on a timer. They are deleted only once they are finished, with the period counted from the date they were finished.

¶Biometric information: retention and destruction schedule

This is our written policy for keeping and destroying biometric information. It covers everything the liveness check in §3.8 sends us: the photographs, the depth image, the video and the measurements. Eventide holds no other biometric information. A host's photo ID is a photograph, deleted at the decision (§3.10).

Why these dates. We collect this information for one purpose, the check in §3.8, which is decided with the first decision on your profile and includes a second look at that decision in the 30 days after it. That purpose is satisfied when those 30 days end, and that is when we destroy it. A check taken later for the Verified badge serves one decision too, the decision on your badge, so its 30 days run from that decision. The 90-day limit means nothing waits longer than that for a review, and deleting your account ends the purpose at once. None of these dates is later than the state laws in §3.8 allow, and each is far inside the outer limits they set: in Illinois, three years after your last interaction with us; in Colorado, 24 months after it; in Texas, one year after the purpose ends.

Keeping to it. We follow this schedule for every member. We review it at least once a year, and if we find that any of this information is no longer needed for the purpose above, we delete it within 45 days. If we ever learn that this information has been accessed without our authority, we will tell you as the law requires (§9).

¶Data kept with no end date

• The empty record of a deleted account: a row with no personal information in it, which exists so that other members' conversations remain intact. §8 explains this.
• Your consent records (§3.4, §3.6, §3.8, §3.9): the proof that the processing was lawful while your account existed. They hold dates, version numbers and the words you agreed to, not profile content, and nothing from the liveness check itself.
• The events badge's evidence (§3.2): for each event that has ended, that you were verified for it. It is the badge's proof, so it stays after the event's Experience closes. It is deleted for every event if you ask us by email to withdraw your Experience consent (§3.9), and with everything else when you delete your account. Hiding the badge withdraws your consent to show it but keeps the evidence, so you can show it again.
• The record of a host's event (§3.10): the event itself, the changes a host made to it (what each was before and after, except the street address in a change of place, which goes 90 days after the event, as the table says), and the Good or Not good answers its guests gave. They are kept with the event's record. Our review app shows a guest's answer without the guest's name, and the host never sees it; a guest's comment goes with their account. A host who deletes their account leaves the event's record in place, and the event no longer shows who hosted it.
• An organiser's photograph of an event (§3.9): kept with our record of the event, which only our team edits, for as long as it is on the listing. We delete the file from our storage when our team replaces or removes it, and at once when someone shown in it asks us to take it down, by writing to support@eventidedating.com.
• A way to reach an event's organiser that our team found itself (§3.9). It is kept with our record of the event, which only our team sees, until the organiser asks us to delete it; we then delete it once the event is over. (An open home's address and hosts' details, and an organiser's contact from a suggestion, are deleted 90 days after the event; see the table above.)
• Server logs. We keep them for security, debugging and abuse investigation, and we do not currently delete them on a fixed schedule. If we adopt a retention period for server logs, we will state it here.

While your account is open, we keep your data. When you close it, §8 applies.

¶8. Deleting your account

Profile ▸ settings ▸ Delete account, from inside the app. It takes two taps from your profile and a typed confirmation.

Immediately: your account is marked deleted and disappears from Eventide entirely. Your email address, your Apple identifier and your stored password are erased and every session is signed out. Other members can no longer see or contact you. If you are a host, your upcoming events are cancelled in the same step, each guest is told once, and the photo ID you gave is deleted from our storage (if the storage cannot be reached at that moment, the daily job below keeps trying until it is gone).

Within 24 hours, an automated job erases:

• every photograph, from the database and from storage;
• your profile, including all religious-affiliation, diet and location fields, your "Been part of" entries, and your city and time zone;
• your prompt answers, preferences, settings (including whether your daily introductions are off and when you turned them off) and any pending profile edits;
• your notification device tokens and every sign-in session;
• everything from the liveness check (§3.8): its photographs, depth images, videos, measurements and results, and for a host the same from their own and their spouse's face checks;
• if you were a host, your host details (§3.10): your name, date of birth and city, the Host Agreement you accepted, your spouse's names (and the name on the consent record of your spouse's face check), and the rows that recorded your photo ID;
• any outstanding email verification codes;
• everything from Experience (§3.9): the events you marked, your seats and places on a waitlist at open homes and any no-show mark, any proof image, the time of any check-in, your invitation links, your suggestions (with the draft of an event from one we had not yet decided), and the record of each attendance decision in your account's history;
• your account's history of our decisions, including any no-show mark, and the messages Eventide sent you in the app (warnings, updates and announcements);
• the content of every message you sent, every comment you attached to a like, and any words you wrote when ending a conversation.

What remains, and why:

• An anonymous placeholder row with no personal information in it. Your matches, likes and any moderation record point at it. Deleting it outright would also delete the other member's side of those conversations.
• Message and like rows without their content, so that a conversation you were part of keeps its structure for the other person, without any of your words in it.
• Our moderation record, including reports about you and any warning, hiding, suspension or ban, for the periods stated in §7.
• Reports you filed about other people, as evidence in a case about them.
• An event we listed from your suggestion, as our own listing. It does not name you. The way to reach its organiser or hosts that you gave us stays with our record of it until 90 days after the event (§3.9); if that was your own, ask us and we will delete it sooner.
• An event you hosted that has ended, and the Good or Not good answers its guests gave. They stay as the event's record without your name (§7).
• What you wrote for an event you hosted: its description and its photograph stay with the event's record, and the text of your announcements stays until 90 days after the event ends (§7).
• Your consent records (§3.4, §3.8, §3.9, §7).

Limits of deletion. Deletion removes your data from our systems. What was in our database can remain in our nightly backups for up to 30 days after deletion, until they expire (§7); photographs, and everything from the liveness check in §3.8, are never in those backups. Deletion does not affect copies other members may have made, such as screenshots, notes, or photographs saved to their own devices, or the first name and photograph a host saw of a guest.

The same erasure, with the same retained records, applies whether you use the in-app button or send a deletion request to support@eventidedating.com (§11).

Deleting your account does not cancel an Eventide Premium subscription. Cancel it in your Apple Account settings first, or Apple will keep charging you.

¶9. Security

• Passwords are stored as Argon2id hashes. We never store or see your password in readable form.
• All traffic is over HTTPS.
• Sessions use short-lived access tokens with rotating refresh tokens, and every session is revoked when you delete your account, change status, or sign out.
• Photograph uploads use short-lived signed URLs and object keys that cannot be guessed, into a private bucket that is not readable from the open internet.
• The photographs, depth images and videos from the liveness check (§3.8) are kept in the same private bucket as photographs and reached the same way, through short-lived signed links that our server gives only to the person reviewing profiles. Its measurements are kept in our own database with your account details.
• Private AI conversation-starter questions and answers are encrypted at rest (AES-256-GCM) with a fresh key generated for every write; each of those keys is itself encrypted with a master key held in the server's configuration, outside the database. A copy of the database alone cannot read them.
• Access to member data by our own team is limited to what moderation requires.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and the relevant regulators as the law requires.

¶10. Children

Eventide is for adults. We do not knowingly collect information from anyone under 18. We ask for a date of birth at signup, refuse anyone under 18, and the date of birth cannot be changed afterwards. If you believe a minor has an account, report it in the app or write to support@eventidedating.com and we will delete it immediately.

¶11. Your rights

These rights are offered to everyone who uses Eventide, in every state. Some states give their residents these rights by law and some do not, and the thresholds in those laws mean several of them may not yet apply to a company our size. We offer the same rights to every member, whatever their state. If you can use Eventide, you have the rights below.

• Know and access: what we hold about you. Most of it is visible in the app; write to support@eventidedating.com for the rest, and we will send you a copy.
• Correct it: edit your profile in the app (moderated fields go through review).
• Delete it: Profile ▸ settings ▸ Delete account. §8 describes what that does.
• Portability: ask us for your data in a portable form and we will send it.
• Withdraw a consent: §3.3, §3.4, §3.8 and §3.9.
• Object to notifications: the toggle in settings, or your device's system settings.
• Limit the use of sensitive information: see below.
• Complain to us at support@eventidedating.com, and to your state attorney general.

We answer within 45 days. If a request is unusually complex we may take one 45-day extension, and we will tell you before we do. Requests are free.

We will never treat you differently for exercising any of these. We will not reduce your service, charge you a different price, or remove you from other members' introductions.

¶Appealing a decision

If we refuse a request, we will tell you why, and you can appeal. Reply to our refusal with the words "Privacy Request Appeal", or write to support@eventidedating.com with them. We will review the request again in full, taking your reasons into account, and tell you the outcome and our reasons. If you are still unhappy, you can contact your state attorney general.

¶Someone acting for you

You can authorise someone else, such as a family member, a lawyer or an agent, to make any of these requests for you. We will ask them for proof that you authorised them, and we may check with you directly, so that your data is not released to someone you did not authorise.

¶Verifying it is you

We will ask for enough information to be confident that the account is yours, and no more than that. We will not ask you to create an account, to send identity documents, or to provide anything we do not already hold.

¶Selling, sharing, and opt-out signals

We do not sell personal information and we do not share it for cross-context behavioural advertising, so Eventide has no "Do Not Sell or Share My Personal Information" setting.

If your browser or device sends a Global Privacy Control signal, we will honour it. Because we do not sell or share personal information, the signal currently has no further effect.

¶Sensitive information

We collect sensitive personal information (religious affiliation and a coarse location), and we use it only to provide the service you asked for. We do not use it to infer characteristics about you, we do not disclose it for any purpose beyond running Eventide, and we do not sell or share it. If you want us to stop using it, that means deleting your account, because it is your profile (§3.4).

The liveness check in §3.8 produces biometric information, which we treat as sensitive whether or not a particular law does. It is collected only with its own recorded consent, used only for the check, never used to identify you (a host's is compared one to one with the host's own photo ID, §3.8) or to infer anything about you, never sold, shared only where the law requires it, and deleted on the schedule in §7. The check is required to join, for the reasons in §3.8; taken later for the Verified badge, it is optional. Other members see only the Verified badge a passed check earns, and nothing else from it.

The private answers in §3.6 are free text, and its questions will often be about your faith and practice, which is sensitive information. Nothing is sent unless you and your match have both turned the feature on, that tap is a separate recorded consent that says so, the answers are encrypted and deleted within 24 hours, and you choose what to type.

Marking that you are going to an event in Experience, saving a seat at an open home, or going on a mission trip can also reveal something about your religious affiliation and practice, since Eventide's events are part of this community's life, and checking in at an event's venue is precise geolocation under the law of several states, though your location itself never reaches us. Each is used only with its own recorded consent (§3.9), only to run Experience, and never sold or shared; the host of an event sees only your first name and first profile photograph (§3.10). The "Been part of" entries you choose to add to your profile can reveal it too. They are optional, shown only with their own recorded consent, reviewed like the rest of your profile, and used only to show on it (§3.4).

¶Why we are allowed to hold each thing

The table below sets out, for each purpose, why we are allowed to hold the data. No US law requires us to publish it.

Your data is stored and processed in the United States, with one exception: a request in the optional §3.6 feature, and, where the app offers the language check, the check of a like note (§3.9), reaches Mistral AI, a French company, and may be processed outside the United States for the seconds it takes to answer. Nothing is stored there.

¶12. Changes

We will update this policy as Eventide changes. If a change is material we will tell you in the app or by email before it takes effect, and if it touches the consents in §3.4, §3.8 or §3.9 we will ask for your consent again. The "Last updated" date above always reflects the current version.

¶13. Contact

support@eventidedating.com Yonatan Demian, 4891 Taylor Circle, Collegedale, TN 37315