Privacy Policy

IntimacyBound is designed to protect private communications through end-to-end encryption. When end-to-end encryption is enabled and operating as described, message content is encrypted on the sender's device and can be decrypted only by authorized recipient devices holding the necessary cryptographic keys.

Our servers may process and retain encrypted message data, delivery information, account identifiers, timestamps and other technical metadata needed to operate the service. End-to-end encryption does not necessarily protect all metadata, account information, or information you voluntarily submit to us.

The protection provided by end-to-end encryption depends on the security of your device, account credentials and cryptographic keys. If a recipient captures or exports content outside IntimacyBound, we cannot remotely erase that copy.

We will describe any feature that does not support end-to-end encryption separately, and we will not represent that feature as end-to-end encrypted.

• Your account: name, email address, sign in method and role.
• That a message exists, who sent it, when, and which Camp Fire it belongs to.
• Public keys for each member's device, and one encrypted copy of each message's content key per member.
• Answer choices in Burning Questions, game turns, flame progress and reminder settings.
• Reports you choose to submit, including any photo you deliberately attach.

What our servers do not hold: the private half of any member's device key, plaintext message text, or a readable copy of a photo unless you personally submit it in a report.

Photos and videos intended for encrypted conversations are encrypted on the sending device before they are uploaded, so the stored object is unreadable without the conversation key.

When a message expires, is deleted, or a burn-on-open message is opened, we remove the associated encrypted content from active storage and revoke access to it. Encrypted copies may remain temporarily in backups or other restricted systems according to our retention schedule.

Deletion from IntimacyBound cannot guarantee deletion of copies a recipient captured or stored outside the app.

End-to-end encryption limits our ability to inspect private message content proactively. A user may choose to submit content or relevant information when reporting abuse or requesting removal of an intimate image. Nothing in your chat is readable to us unless you send it to us yourself.

We use submitted information only as reasonably necessary to assess the report, enforce our policies, meet legal obligations and protect users. Access is limited to the safety review role and retention is limited to what is reasonably necessary.

We may remove reported content from our systems when we can identify and locate it, including encrypted copies associated with the reported content. We will make reasonable efforts to meet applicable legal removal obligations. We will not claim that we can automatically inspect, identify or remove every copy of an encrypted image unless our technical systems support that capability.

Read the Intimate Image Removal Policy for how requests are handled and tracked.

Your private key is created on your device and never leaves it. That is what keeps us out of your conversations, and it has a direct cost:

• If you lose or reset a device, or clear your browser storage, older messages in that Camp Fire can no longer be opened by you. There is no server side recovery of past message content.
• A new message keeps working once you open Fireside on the new device, because a fresh key is published for your partner to encrypt to.
• Your invite password is only used to prove the right person is joining. It is never used as an encryption key and cannot unlock message content.
• When one member is removed from a Camp Fire, their access to the chat ends and any content they sent is removed. They cannot read messages sent after they leave.

How long we keep each type of data, and which periods are still provisional targets rather than verified platform behaviour, is set out in the Data Retention Schedule.

A designated safety contact and business mailing address will be published here before launch. Until then, use the in-app report flow so your request is assigned a reference number and a tracked deadline.