Privacy Policy

How we think about this

We do not sell your data, and we never have. There are no advertisers here, no ad networks, and no third-party tracking software of any kind — not Google Analytics, not Facebook, not a single tracker embedded in the app.

We also do not run an engagement algorithm. Nothing here is designed to keep you scrolling, and nothing you see is ordered by what holds attention longest. A reading is something you finish.

We collect what the product needs to work and stop there. Most of this policy is about sensitive data — birth details, messages, face verification — because that is what we actually hold.

Birth data

Your birth date, time, and place are used to compute chart structure and compatibility. Other members never receive your raw birth time or coordinates — only derived signs, archetype summaries, and compatibility scores. Birth data is stored on our servers to power your profile; we do not sell it.

Profiles and the Field

By default, new accounts are hidden from the Field (discovery). You opt in explicitly when you choose to be visible. Your public Field photo and public persona are visible to other members browsing the Field. Lens-specific photos and bios unlock only after you accept a connection.

Messaging

When both people have set up a PRISMA ID, direct messages are end-to-end encrypted: we store only ciphertext for those threads and cannot read them, because the keys never leave your devices.

Threads where one side has not set up a PRISMA ID are not end-to-end encrypted. They are encrypted at rest with a key held by our servers, which means we are technically able to read them and will only do so where the law requires it. Messages sent before August 2026 were stored without encryption; they remain readable to us unless deleted.

Read receipts are on by default, so the people you are talking with can see when you have read their messages — and you see the same of them. Typing indicators, online status, and last seen are off by default. You control all of them in message privacy settings.

Photos

Profile photos are hosted on Cloudinary. Public photos are readable by our CDN for display.

You cannot send photos inside a conversation yet. When you can, they will be encrypted on your device before they leave it and stored separately from profile photos, so we hold only ciphertext and cannot open them. The one exception will be a report: if someone reports a photo, their device attaches a readable copy to that report so we can act on it, and we delete that copy once the report is resolved.

AI companion (Jung)

The in-app companion may send chart-derived facts from your profile to OpenAI to generate replies. Your message text is also sent for the conversation. Do not share information in Jung chat that you would not want processed by an AI provider.

Face verification

Face verification is optional and requires your explicit consent to process biometric data. It exists to keep fake profiles off PRISMA.

The selfies themselves are never saved. They are held in memory only long enough to check that you are a live person and that you match the photos already on your profile, then discarded — they are never written to disk, never added to your album, and never shown to anyone.

What we do keep is a numeric face pattern derived from that check — not a picture, and not something a person can look at. We keep it to re-check your verification and to stop one person from running several accounts.

It is deleted when you delete your account, and automatically after twelve months without signing in, whichever comes first. If that happens you stay verified — only the pattern is discarded. You can also ask us to delete it at any time at the address below.

Taking your data with you

From Dashboard → Edit profile you can download everything you gave us as a single file: your account, your birth details, everything you wrote on every face, your readings, and the messages you sent. It is ordinary JSON, so it opens anywhere and can be taken anywhere.

Two things are deliberately not in it. Messages other people sent you and their profiles, because those are their words and not yours to take. And your face verification pattern — a download ends up in inboxes and folders, and we will not create a copy of your biometric data outside our own systems. The file tells you both, and records when your face data was collected and whether it still exists.

Deletion

You can delete your account at any time from Dashboard → Edit profile. Deletion is immediate and permanent — there is no recovery period.

It removes your account, your profile and photos, your birth data, your face verification pattern, your connections, and the invites you sent. Your one-to-one conversations are deleted for both sides, since a thread with a deleted account cannot be continued. In group threads, your messages are deleted and you are removed, but the group itself stays for the people still in it.

Safety records are the exception: if you reported someone or someone reported you, that report and its copy of the message are kept, so that deleting an account cannot erase evidence of harassment. Full details of what is deleted and what is kept.

Usage measurement

Once a day, we record that a visit happened: which page was opened, and a two-letter country code that our network provider gives us. It tells us whether people are finding the product and roughly where from.

We do not store your IP address, your device, your browser, or where you came from — and visits are not linked to your account, even when you are signed in. It is our own measurement, on our own servers. No analytics company receives any of it.

Contact

Privacy questions: privacy@prisma.app