ByChance Privacy Policy

Version 1.2 | Posted: September 1, 2026 | Effective: October 1, 2026

This updated policy takes effect October 1, 2026. Until then, the previous version (1.1, effective July 29, 2026) applies.

What changed in this version: we corrected how long we keep hints and hint safety records, added a named exception explaining what survives when you delete your account, explained what we do with your photos and made the part that describes what you look like something you switch on yourself, explained what we can and cannot tell you when you ask for a copy of your data, and corrected several statements about the App that no longer matched how it works. See Sections 2.5, 5, 7, 8 and 15.

This policy covers both our mobile app and our website at bychanceapp.com.

Quick Summary

This summary provides a brief overview. Please read the full policy below for complete details.

Your Key Rights:

• Access all your data
• Delete your account and data
• Withdraw consent for sensitive data processing
• Unsubscribe from marketing emails at any time
• Export your data
• Object to certain processing

Table of Contents

1. Who We Are and What This Policy Covers
2. Information We Collect
3. How We Use Your Information
4. Legal Basis for Processing
5. How We Share Your Information
6. International Data Transfers
7. Data Retention
8. Your Rights and Choices
9. Security
10. Location Privacy and Safety
11. Lucky AI Assistant
12. Cookies and Similar Technologies
13. Waitlist, Newsletter, and Ambassador Program
14. Children's Privacy
15. California Privacy Rights (CCPA)
16. Changes to This Policy
17. Contact Us

1. Who We Are and What This Policy Covers

ByChance ("we," "us," or "our") operates the ByChance mobile application (the "App"), a dating service that connects people through real-world events and chance encounters, and the website at bychanceapp.com (the "Website").

1.1 Scope

This Privacy Policy applies to both the App and the Website (together, the "Services"). It covers:

Sections 2.1, 2.2, 2.3, 2.5, 10 and 11 describe the App only. If you have never installed the App, none of them applies to you.

You do not need a ByChance account to exercise the rights described in Section 8. If you have only interacted with our Website, we will still honor your access, deletion, and opt-out requests.

Data Controller: Cluster AI LLC (operating ByChance), 2108 N St, Ste N, Sacramento, CA 95816-5712, United States

Data Protection Contact: Email: info@bychanceapp.com

For users in the European Economic Area (EEA), please contact us at: info@bychanceapp.com

2. Information We Collect

We collect information in three ways: directly from you, automatically when you use the Services, and from third parties.

2.1 Information You Provide Directly

Account Information

Profile Information

Important Notice About Sensitive Data:

Your gender and sexual orientation/preference are considered "special category data" under GDPR Article 9. We only process this data with your explicit consent, which you provide during registration. You can withdraw this consent at any time (see Section 8), though this may limit our ability to provide matching services.

Note for Website visitors: We do not ask for or collect gender, sexual orientation, date of birth, or photographs through any Website form. Joining our waitlist reveals nothing about your orientation or dating preferences.

Event Participation

Communications

2.2 Information Collected Automatically

Device Information

Location Information

Your location in ByChance is an approximate location that you select by placing a pin on a map during profile setup. This location:

• Is chosen by you, not automatically tracked via GPS
• Is truncated to approximately 11-meter precision
• Is never shared with other users
• Is never automatically updated — it only changes when you manually move the pin

During active Chance Mode, we perform real-time proximity checks to verify you are near the event venue. These checks are ephemeral — the data is used momentarily for verification and is not stored.

Important: No other user can ever see your location. Your stored location is used only to find nearby events for you. Real-time event verification data is never persisted. See Section 10.

The Website does not request or use your device's precise location, and it does not run analytics that infer your location. The providers that host and secure the site process your IP address only as described in Section 2.4.

Usage Information

2.3 Information from Third Parties

2.4 Information We Collect Through Our Website

Our Website is a marketing and pre-launch site. You can browse it without giving us any personal information. If you choose to submit a form, we collect the following.

2.4.1 Waitlist and Newsletter Signup

Available on our home page, our "App Pre-Release Signup" page, and elsewhere on the site.

When you submit the signup form, it is handled by our website provider and then passed to our own systems, where your signup is stored in our database and used to send you the emails you asked for. Every one of those emails carries an unsubscribe link.

We use this email address only for the communications you signed up for and for related administration. Joining the waitlist does not create a ByChance account and does not reserve or guarantee you a place in the App.

2.4.2 Ambassador Application

Available on our "Become an Ambassador" page.

About free-text fields: Your personal statement is an open text box. Please do not include sensitive information in it — for example, information about your health, religious or political beliefs, racial or ethnic origin, sexual orientation, or precise home address. We do not need it and do not want it. If you include such information voluntarily, you are asking us to process it and we will handle it under this policy and delete it on request.

About social handles: If you give us a public social media handle or link, we may view your publicly available profile and content as part of evaluating your application. We do not request access to your private accounts, we do not log in as you, and we do not use social platform APIs to pull your friend or follower lists.

2.4.3 Contact Form

Available on our "Contact" page.

Submitting the contact form does not subscribe you to marketing emails. We will reply to your inquiry and nothing more, unless you separately sign up for the waitlist or newsletter.

2.4.4 Information Collected Automatically on the Website

Protecting our forms. Our Website forms are protected against automated abuse by the spam and bot controls our hosting, form and content-delivery providers apply. These controls look at technical signals from your browser and your interaction with the page to confirm you are a person. They are strictly necessary to keep our forms usable, they are not used to build an advertising profile of you, and they cannot be switched off while still submitting a form.

We do not use analytics, advertising, or cross-site tracking cookies on our Website. The Website runs no web analytics tools, no retargeting, and no social media advertising pixels. A Google Analytics tag that had been present on the site was removed in August 2026 and is no longer in use. See Section 12 for the full cookie disclosure.

2.5 Photos and What We Derive From Them (App)

This section applies to the App only. The Website never asks you for a photograph.

When you upload a photo, two things happen automatically:

1. Content check. The photo is checked for prohibited content (for example nudity or violence). Photos that fail this check are not shown to anyone.
2. Description — only if you ask for it. If, and only if, you have switched on Photo-Based Matching, we derive a short description of visible physical characteristics — for example hair colour and style, eye colour, skin tone, facial features, facial hair, build, glasses and visible tattoos or piercings. We use this to learn what kinds of people you tend to be drawn to in Gallery Mode, so that we can suggest better matches.

The content check always happens, because it keeps everyone safe. The description does not happen unless you switch it on. We ask you the first time you open the Gallery, we tell you on that screen exactly what we would read from your photos, and if you say no, the Gallery stays closed and everything else in ByChance works normally. You can switch it off again at any time at Settings > Consent Settings > Photo-Based Matching; when you do, we delete the derived description and the preferences we learned from it, and your photos are left alone.

Both steps are performed by an AI service we operate, which uses Google's Gemini model to look at the image. When you have not switched Photo-Based Matching on, that service is only asked to carry out the content check. The description we derive is used internally for matching only. It is never shown to other users, and it is never used to advertise to you or sold to anyone.

If you delete a photo, we delete the stored image, including the copy held in our cloud storage. If you delete your account, both the photos and the derived description are deleted with it, subject only to the safety-records exception in Section 7.3.

3. How We Use Your Information

We use your information for the following purposes:

3.1 Provide and Improve Our Services

• Create and maintain your account
• Enable you to browse and RSVP to events
• Power Chance Mode and the Hints feature
• Enable the Lucky AI assistant to help build your profile
• Process post-event surveys
• Send push notifications about your events

3.2 Matching and Personalization

• Match you with events that fit your preferences
• Filter events based on the location you selected and your availability
• Group users with compatible preferences for events
• Show your photos in Gallery Mode, and — if you have switched on Photo-Based Matching — learn what you find attractive from the descriptions derived from photos (see Section 2.5)
• Improve recommendation algorithms based on feedback

3.3 Safety and Security

• Verify you meet our age requirement (18+)
• Check uploaded photos for prohibited content
• Keep a short-lived record of hints that have been revealed, so that harassment reports can be acted on (see Section 7.1)
• Detect and prevent fraud, abuse, and policy violations
• Investigate reports of harmful behavior, and establish, exercise or defend our decisions about them
• Implement the location protections described in Section 10
• Block automated bot submissions to our Website forms

3.4 Communications

• Send event reminders (24 hours and 1 hour before)
• Send post-event survey requests
• Notify you of important account or policy changes
• Respond to support inquiries

3.5 Legal Compliance

• Comply with applicable laws and regulations
• Respond to lawful requests from authorities
• Establish, exercise, or defend legal claims

3.6 Analytics and Research

• Analyze usage patterns to improve features
• Conduct research on service effectiveness
• Generate aggregate, de-identified statistics

3.7 Website, Waitlist, and Ambassador Program

What we do NOT do with Website information:

• We do not sell your email address or any other personal information
• We do not rent, trade, or share your email address with other companies for their own marketing
• We do not run analytics, advertising, or tracking cookies on the Website at all
• We do not automatically add contact-form senders or ambassador applicants to our marketing list
• We do not merge your waitlist email into a dating profile — if you later create an App account, that account is created from scratch by you

4. Legal Basis for Processing

For users in the EEA and UK, we process your data under the following legal bases.

4.1 App

4.2 Website

Legitimate Interest Assessment: Where we rely on legitimate interests, we assess whether our interests are overridden by your fundamental rights and freedoms. You can ask us about the assessment for a particular activity by contacting us.

Withdrawing consent is easy. For marketing emails, click "unsubscribe" in any email or write to info@bychanceapp.com. For sensitive data processing and Photo-Based Matching in the App, see Section 8.3. For cookies, see Section 12. Withdrawal takes effect promptly and does not affect the lawfulness of processing carried out before you withdrew.

5. How We Share Your Information

5.1 With Other Users

We Never Share:

• Your exact location with other users
• Your name, contact details or profile details — other users never see these before you meet in person
• The description derived from your photos (see Section 2.5)
• Your conversations with Lucky AI
• Your waitlist email address, ambassador application, or contact form message with other users

5.2 With Service Providers

We share data with third parties who help us operate the App:

And with third parties who help us operate the Website:

All service providers are bound by data processing agreements requiring them to protect your data and use it only for specified purposes. They act as processors on our behalf and are not permitted to use your information for their own purposes.

5.3 For Legal Reasons

We may disclose your information when required to:

• Comply with a legal obligation (court order, subpoena)
• Protect the safety of any person
• Investigate potential violations of our Terms of Service
• Protect against legal liability

5.4 Business Transfers

If ByChance is involved in a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

5.5 With Your Consent

We will share your information for other purposes only with your explicit consent.

We Do Not Sell Your Personal Information. We have not sold personal information in the past 12 months and do not intend to sell personal information. This includes waitlist and newsletter email addresses, which we never sell, rent, or trade, and the descriptions derived from your photos, which are used internally for matching and nothing else.

6. International Data Transfers

ByChance is based in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States.

6.1 Transfer Mechanisms

For transfers from the EEA, UK, or Switzerland to the United States, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where our provider offers them
• Data Processing Agreements with our service providers
• The EU-U.S. Data Privacy Framework, where the receiving provider is certified under it
• Additional technical and organizational measures as appropriate

This applies equally to Website data, including waitlist emails, ambassador applications, and contact form messages, all of which are processed by U.S.-based providers.

6.2 Transfer Safeguards

Before relying on a transfer to the United States, we consider:

• The nature of the data transferred
• The legal framework in the destination country
• The additional safeguards in place

You can ask us which safeguards apply to a particular transfer by contacting us.

7. Data Retention

We retain your data only as long as necessary for the purposes described in this policy.

We run an automated job every day that applies the App periods below by deleting or anonymising data that has passed them. One exception: the limit on safety records runs from the day a report is closed, and our Trust & Safety team applies it rather than that job.

7.1 Retention Periods — App

Safety records

When you reveal someone's hint, we keep a copy of the hint text you saw and an internal reference to the person who wrote it. We keep it so that if you report that hint for harassment, the person you are reporting cannot destroy the evidence by editing it, deleting it, or deleting their account. It is never shown to you, to them, or to any other user. We delete it 30 days after you view the hint, unless a report has been filed — in which case our Trust & Safety team keeps it while the case is handled.

Two narrow situations extend that 30 days:

• A report has been filed about that hint. We keep the record until 90 days after the report is closed. By then the evidence already sits with the report itself.
• The person who wrote the hint is under investigation because of other reports. We keep the record while that case is open, and in no event longer than 180 days from the day you revealed the hint.

If you delete your own account, the records of hints you revealed are deleted with it. You own the decision to keep or abandon your own evidence.

We rely on our legitimate interests (GDPR Article 6(1)(f)) to keep these records: the interest of people who are harassed on our platform in being able to report it and be believed, the interest of other users in abusive accounts being removed, and our own interest in being able to defend the decisions we take. You can object to this at any time by writing to info@bychanceapp.com. We will consider every objection individually, but we will normally refuse while the hint is still inside the 30-day reporting window, because another person's safety is at stake. After that window the record is deleted automatically, so the objection falls away.

7.2 Retention Periods — Website

7.3 Account Deletion

When you delete your account:

1. Immediate: Your profile is no longer visible; you cannot log in
2. 30-day soft delete: Account recoverable if you change your mind
3. After 30 days: Your account and your personal data are permanently deleted, except for the narrow safety records described below

Exception: safety records

If a harassment report has been filed about you, or by you, a minimal record of it survives the deletion of your account. Specifically:

• an internal reference linking your account to the hint that was reported;
• the text of that hint as the person who reported it saw it; and
• an internal reference identifying who filed the report.

Why we keep it. Otherwise the way to erase a harassment complaint would be to delete the account that caused it — which would take away the evidence from the person who was harmed, and would leave us unable to defend or explain the decision we took. We keep it to establish, exercise or defend legal claims and to protect other users. Our legal grounds are GDPR Article 6(1)(f) (legitimate interests) and Article 17(3)(e) (establishment, exercise or defence of legal claims); for California residents, Cal. Civ. Code § 1798.105(d)(2) (helping to ensure security and integrity).

What it is not. It is internal only. It is never shown to any user — not to you, not to the person who reported you, not to anyone else. It is not used for matching, for analytics, for advertising, or to train any AI model. It is not sold or shared with anyone outside our Trust & Safety team, except where we are legally required to produce it.

How long. We keep it while the report is open and for no longer than 2 years after the report is closed. Then it is deleted.

Everything else goes. This exception is limited to what is listed above. Your profile, your photos and the copies of them held in our cloud storage, the description derived from them, your messages with Lucky, your RSVPs and your other data are deleted on the normal schedule.

If we apply this exception to a deletion request you have made, we will tell you that we have done so and why, and you may complain to your data protection supervisory authority (or, in California, to the California Privacy Protection Agency or the Attorney General).

Note: Deleting your App account does not automatically remove you from our waitlist or newsletter if you signed up separately on the Website, because those are separate systems. Use the unsubscribe link in any email, or email info@bychanceapp.com and we will remove you from both.

7.4 Anonymization

Some data is anonymized rather than deleted. For example, 48 hours after you check in to an event we remove your exact check-in time and keep only the fact that you checked in. Data that has been fully anonymized cannot be used to identify you and is not subject to deletion requests.

8. Your Rights and Choices

8.1 Your Privacy Rights

Depending on your location, you may have the following rights. These rights apply whether you are an App user or only ever visited our Website.

8.2 How to Exercise Your Rights

In the App:

• Settings > Privacy & Data > Manage My Data
• Settings > Privacy & Data > Delete Account
• Settings > Privacy & Data > Export My Data

The in-app export covers your profile, consents, availability, RSVPs, surveys, hints and Lucky conversations. For anything not included in it — for example your photos and the description derived from them, Gallery Mode sessions, blocks or subscription records — email us and we will provide it.

For Website data (no account required):

• Email info@bychanceapp.com with the subject "Privacy Request"
• Tell us which form you submitted (waitlist, ambassador application, or contact form) and the email address you used
• We will verify your request by replying to the email address in our records — we will not ask you for extra identifying documents unless the request is high-risk or the identity is genuinely unclear

By Email: info@bychanceapp.com — for anything not included in the in-app export, and for rectification, restriction, objection or complaints.

Response Time:

• We will respond within 30 days (EEA/UK)
• We will respond within 45 days (California)
• Complex requests may require an extension, and we will tell you why

8.3 Withdrawing Consent

You can withdraw consent for:

• Gender and sexual orientation processing: This will disable matching features
• Photo-Based Matching: Settings > Consent Settings > Photo-Based Matching. Switching it off stops the derivation described in Section 2.5, deletes the derived description and the preferences we learned from it, and closes the Gallery. Your photos are left alone
• Device location permission for check-in: Revoke in device settings; this disables check-in and Chance Mode. It does not change the approximate location pin you set on your profile, which you can move at any time
• Marketing communications: Unsubscribe link in emails or App settings
• Analytics: Use the opt-out toggle in App settings (the Website does not set analytics cookies — see Section 12)

Withdrawing consent does not affect the lawfulness of processing before withdrawal.

8.4 Right to Lodge a Complaint

If you believe we have violated your privacy rights, you may lodge a complaint with:

EEA/UK: Your local Data Protection Authority

• Find your DPA: https://edpb.europa.eu/about-edpb/about-edpb/members_en

California:

• California Privacy Protection Agency, or the California Attorney General

United States (generally):

• Federal Trade Commission: https://reportfraud.ftc.gov

8.5 Marketing Email Choices

Every marketing email we send you includes a working unsubscribe link in the footer.

Unsubscribing from marketing does not stop transactional messages — if you have an App account, we will still send you essential service messages such as security alerts, event confirmations, and notices about changes to these policies. You cannot opt out of those while you hold an account, but you can delete your account.

8.6 Safety Records and Your Access Request

This subsection applies to the App. There are limits on what a copy of your data can contain, because your data and another person's data are sometimes the same data. When you ask us for a copy:

• Hints you revealed. You will get the list of hints you revealed and when. You will not get the identity of the people who wrote them. That is someone else's information, and telling you would undo the anonymity that every user of the hints feature relies on. If you need the text of a specific hint you saw — for example because you are making a complaint about it — write to us and our Trust & Safety team can provide it for that hint, with the author's identity removed.
• Reports about you. If someone has reported you, records referencing you may exist. We will tell you the substance of an allegation where you need it in order to understand and challenge a decision we have taken about your account. We will not tell you who reported you, who revealed your hint, or anything from which you could work that out, and we may not confirm that an investigation is open where doing so would prejudice it. GDPR Article 15(4) permits us to withhold information where releasing it would adversely affect the rights and freedoms of others; on a dating platform, identifying the person who reported someone creates a real risk of retaliation, and we treat that as a case where we must withhold.
• Reports you filed. You will get the reports you filed and what you told us.

Whenever we hold something back, we will say so, say on what ground, and tell you that you can complain to a supervisory authority.

9. Security

We implement technical and organizational measures to protect your data:

9.1 Technical Measures

9.2 Organizational Measures

9.3 Your Responsibilities

To help protect your account:

• Use a strong, unique password
• Do not share your login credentials
• Log out when using shared devices
• Report suspicious activity immediately
• Do not send passwords, financial details, or sensitive personal information through our Website contact form — it is not an encrypted channel for that kind of data

9.4 Security Incidents

If we discover a data breach that poses a high risk to your rights, we will:

• Notify affected users without undue delay
• Notify relevant authorities within 72 hours (where required)
• Provide information about the breach and recommended actions

This applies to Website data as well. If our waitlist, ambassador applications, or contact form submissions were exposed, we will notify affected people using the email address we hold for them.

10. Location Privacy and Safety

ByChance uses location to show you nearby events and to verify that you are at an event when you check in. We take special precautions to protect your location privacy.

10.1 How We Protect Your Location

10.2 Anti-Stalking Measures

We have implemented safeguards against misuse:

10.3 Safety Tips

• Trust your instincts when meeting people in person
• Meet in public places for first encounters
• Tell a friend where you are going
• Use the in-app reporting feature for any concerns
• Call local emergency services if you feel unsafe

11. Lucky AI Assistant

Lucky is our AI assistant that helps you build your profile and answers questions.

11.1 How Lucky Works

• Lucky uses OpenAI's language models
• Conversations help extract interests and preferences for your profile
• Your conversations with Lucky are never shown your photos, and Lucky is not given your exact location. Separately, the same AI service we operate performs the photo content check and the photo analysis described in Section 2.5 — that is a different process from your conversations with Lucky, and the two are not combined
• Lucky cannot access other users' data
• Lucky operates only inside the App. There is no AI chat on our Website, and nothing you submit through a Website form is sent to an AI model

11.2 AI Data Processing

Photos are processed by a separate provider (Google's Gemini model) for the purposes and on the basis described in Sections 2.5, 4.1 and 5.2. Photos are never sent to OpenAI.

11.3 AI Limitations

• Lucky provides suggestions, not guarantees
• Lucky does not provide safety advice for real-world meetings
• AI responses are generated content, not verified facts
• You can disable Lucky in App settings

11.4 Your Control

• Delete conversation history anytime
• Opt out of AI features entirely
• Switch off Photo-Based Matching at Settings > Consent Settings (see Section 2.5)
• Request human support instead

12. Cookies and Similar Technologies

This section applies to our Website. The App does not use browser cookies, though it does use similar local storage and device identifiers as described in Section 2.2.

12.1 What Cookies Are

Cookies are small text files placed on your device by a website. "Similar technologies" include local storage, pixels, and software development kits that perform a comparable function. We describe all of these together as "cookies" below.

12.2 Cookies We Use

That is the complete list. The strictly necessary items above are the only cookies the Website sets.

We do not use: analytics cookies, advertising cookies, tag managers, retargeting pixels, social media tracking pixels, or cookies that follow you across unrelated websites. A Google Analytics tag that had previously been present on the site was removed in August 2026, and the Website now runs no web analytics tools at all. If we introduce analytics in the future, we will update this policy first and request consent where legally required before any non-essential cookie is set.

12.3 Your Cookie Choices

Strictly necessary cookies cannot be switched off, because the site and its forms cannot function securely without them.

12.4 Third-Party Cookie Policies

• Webflow (hosting and forms): https://webflow.com/legal/privacy
• Our content-delivery and security providers publish their own privacy notices; we will tell you which provider serves a given page on request.

13. Waitlist, Newsletter, and Ambassador Program

13.1 The Waitlist Is Not an Account

Joining the waitlist means one thing: we have your email address, and we will email you about the launch and about events. It does not create a profile, does not enter you into matching, does not reserve a place in the App, and does not obligate you to anything.

13.2 Emails We Send to Waitlist Subscribers

• Announcements about the App launch and availability in your city
• Early-access and beta invitations
• Alerts about ByChance events
• Occasional product updates

Every one of these includes an unsubscribe link. We do not send third-party advertising to our list.

When you unsubscribe, or when an email to you bounces or is reported as spam, we add your address to a suppression list held with our email provider so that we do not email you again. That suppression entry is the minimum record needed to keep honoring your choice, and we keep it indefinitely for that reason.

13.3 Ambassador Program Privacy

If you apply to be a ByChance Ambassador:

Ambassador applicants must be 18 or older, consistent with our age requirement for the Services generally.

If you become an ambassador, we may reference your first name, social handle, and publicly posted ByChance content in our own marketing, but only in ways you have agreed to. We will not publish your email address, phone number, last name, or personal statement.

Ambassador phone numbers are used only to contact you about the program. We do not add them to marketing SMS campaigns without separate, express consent, and we do not share them with third parties for marketing.

14. Children's Privacy

ByChance is not intended for anyone under 18 years of age. This applies to both the App and the Website.

14.1 Age Requirement

• You must be at least 18 to create an account
• You must be at least 18 to join our waitlist or newsletter, or to apply to the ambassador program
• We verify age during registration via date of birth
• Accounts of users discovered to be under 18 will be immediately terminated

We do not knowingly collect personal information from anyone under 18 through any Website form. We do not direct our Website or its marketing to children, and we do not use it to advertise to children.

14.2 If We Discover Underage Users

If we learn that we have collected data from someone under 18:

1. We will immediately terminate the account
2. We will delete all associated data, including any photos, any description derived from them, and any waitlist, newsletter, or ambassador application record
3. We will take steps to prevent the user from re-registering

14.3 Reporting

If you believe someone under 18 is using ByChance, or has submitted information through our Website, please report to: info@bychanceapp.com. A parent or guardian may also contact us at that address to have a minor's information deleted.

15. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the CPRA (together, the "CCPA"). This section covers both App users and Website visitors.

15.1 Categories of Personal Information

In the past 12 months, we have collected:

Sensitive personal information. Of the above, we treat your sexual orientation, and the description derived from your photos where you have switched Photo-Based Matching on, as sensitive personal information. We do not use sensitive personal information to infer characteristics about you for advertising, and we do not sell or share it.

15.2 Sources of Information

• Directly from you (registration, profile updates, photo uploads, Website waitlist, ambassador, and contact forms)
• Automatically (device info, App usage data, Website server logs and strictly necessary cookies)
• Third parties (mapping services; publicly available social media profiles of ambassador applicants)

15.3 Your California Rights

Right to limit the use of sensitive personal information. You can ask us to limit our use of sensitive personal information. Uses that help ensure the security and integrity of the service — such as investigating harassment — are outside the scope of this right under Cal. Civ. Code § 1798.140(e)(2), but we will apply the limit to everything else and log your request. You can exercise this right for photo-based matching yourself, at any time, in the App at Settings > Consent Settings > Photo-Based Matching — switching it off stops that use and deletes the derived description and the preferences we learned from it (see Section 2.5). For any other request under this right, email info@bychanceapp.com.

Exceptions to deletion. We honour deletion requests except where the law permits us to keep something. The main exception that applies at ByChance is safety-report evidence, which we keep under Cal. Civ. Code § 1798.105(d)(2) (helping to ensure security and integrity), and secondarily under § 1798.105(d)(8) and (d)(9). We apply the exception narrowly — only to the specific records described in Section 7.3 — and we will tell you when a partial exception has been applied and why.

Retention. The periods we keep each category of personal information for are set out in Section 7.

15.4 Do Not Sell or Share

We do not sell your personal information.

We do not share your personal information for cross-context behavioral advertising. We do not run analytics, advertising, or retargeting pixels on our Website, and we set no non-essential cookies — so a Global Privacy Control signal has nothing to opt you out of. If that ever changes, we will treat GPC as a valid opt-out request.

15.5 Authorized Agents

You may designate an authorized agent to make requests on your behalf. We require:

• Written authorization signed by you
• Verification of your identity
• Verification of the agent's identity

15.6 Contact for California Requests

• Email: info@bychanceapp.com
• Include "California Privacy Request" in the subject line
• We will verify your identity before processing
• If you only interacted with our Website, tell us which form you used and the email address you submitted, and we will verify by replying to that address

16. Changes to This Policy

16.1 How We Notify You

We may update this Privacy Policy from time to time. When we make changes:

Version 1.2 narrows a previously absolute deletion promise (see Section 7.3) and is therefore being published with 30 days' notice: it was posted on September 1, 2026 and takes effect on October 1, 2026. Until then, version 1.1 applies.

If you are a waitlist subscriber and not an App user, we will notify you by email at the address you gave us for any material change that affects you.

16.2 Your Continued Use

Your continued use of ByChance after the effective date of changes constitutes acceptance of the updated policy. If you do not agree with changes, you should delete your account and/or unsubscribe before the effective date.

16.3 Version History

17. Contact Us

Privacy Inquiries

Email: info@bychanceapp.com

Mail: Cluster AI LLC, Attn: Privacy Team, 2108 N St, Ste N, Sacramento, CA 95816-5712, United States

Data Protection Contact (EEA/UK)

Email: info@bychanceapp.com

General Support

Email: info@bychanceapp.com
In-App: Settings > Help & Support
Website: Contact form at bychanceapp.com/contact

Marketing and Unsubscribe Requests

Email: info@bychanceapp.com
Or: Click "unsubscribe" in the footer of any marketing email

Response Times

Appendix A: Glossary

Appendix B: Data Processing Activities

For GDPR transparency, here is a summary of our processing activities.

App

Website

Last Updated: September 1, 2026 | Version 1.2 | Effective October 1, 2026

Cluster AI LLC