Privacy Policy

Effective Date: September 30, 2026

Controller: Homie Lab Inc. ("Chunkr," "we," "us," or "our")
Primary Contact: [email protected]
Mailing Address: Toronto, Ontario, Canada

Chunkr is built for a community that often has to think carefully about privacy. This Policy explains what we collect, why we collect it, when we share it, and the choices you have.

Quick Read

• Chunkr is an adults-only service.
• Some profile fields are sensitive and always optional.
• Discovery features show approximate location. If you choose to share a location in chat, the recipient can see that location.
• We do not sell personal data.
• Where mobile ads and subscriptions are available, Google AdMob supports advertising and RevenueCat helps manage Chunkr Ad-Free purchases. See Section 8A.
• Optional selfie verification uses AWS to check a live camera capture against your primary profile photo. Chunkr does not save the capture or a reusable face template; see Section 7A.
• You can request access, correction, deletion, and other rights depending on your location.

---

1. Scope

This Privacy Policy applies to the Chunkr mobile application, the chunkr.app website, and related services (collectively, the "Service"). It is intended to cover users in the European Union, European Economic Area, United Kingdom, United States, Canada, and other jurisdictions where Chunkr is available.

---

2. Information We Collect

Information You Provide

Face data processed for optional selfie verification includes a short selfie video, a reference frame extracted from it, your primary profile photo, and temporary face-detection, liveness, and similarity results. We retain limited verification records as explained in Sections 7A and 12.

Information Collected Automatically

Information From Third Parties

We may receive:

• basic profile information from social login providers if you choose Sign in with Apple or Google; and
• campaign or attribution information from analytics and marketing partners.

---

3. Sensitive Personal Data

Chunkr may process sensitive personal data, including:

• sexual orientation;
• sexual preferences or interests; and
• ethnicity, HIV status, and health practices, if you choose to disclose them.

These fields are optional. You decide whether to fill them in and, where applicable, how visible they are to others.

Face comparison for optional selfie verification may also constitute processing of biometric or sensitive personal data under applicable law. It is separate from optional profile fields and is described in Section 7A.

Legal Basis for Sensitive Data

Where required by law, including under GDPR Article 9, we rely on your explicit consent when you choose to provide sensitive data and make it visible within the Service.

How We Protect Sensitive Data

• Sensitive fields are not shared with advertisers for targeting.
• You can edit or delete these fields at any time.
• We use encryption in transit and storage controls designed to protect this data.

---

4. Legal Bases for Processing

Where GDPR or similar laws apply, we may process personal data under the following bases:

---

5. Location Practices

How Location Is Used

We use location data to support:

• approximate distance indicators;
• nearby discovery;
• the Right Now feature; and
• security or abuse-prevention checks.

Privacy Protections

• Discovery features show approximate location rather than exact coordinates. This protection does not apply to a location you deliberately send in chat.
• Displayed position may be fuzzed or randomized within a minimum radius.
• Uploaded photos may have EXIF location metadata removed before storage.
• Users may hide from Right Now while continuing to use other parts of the Service.

Optional Location Sharing in Chat

If you choose to send your current location in a conversation, we process and store the coordinates and any associated place or address information as part of that message. The recipient can view that location and open it in a maps app. Share only locations you are comfortable disclosing. You can revoke device location permission to stop future device-location access; this does not remove locations already sent.

Users in Sensitive Jurisdictions

If you are in a region where LGBTQ+ identity may create legal or personal risk, you should exercise extra caution. Product controls can reduce risk, but they cannot eliminate it entirely.

---

6. Messaging

Messages and attachments may be stored on our systems to enable the Service.

• Messages are generally stored server-side for sync and reliability.
• Data in transit is protected with TLS.
• Stored data is protected using infrastructure-level security controls.
• End-to-end encryption is not currently implemented.
• Messages and attachments may be reviewed where necessary for safety, moderation, legal compliance, or support.

For retention details, see Section 12 below.

---

7. Automated Processing and Moderation

Photo Scanning

We may use automated tools such as AWS Rekognition to scan uploaded images for:

• prohibited content;
• public nudity policy violations; and
• safety threats.

Text and Behavioral Signals

We may use automated systems to help detect:

• grooming patterns;
• threats of violence;
• fraud indicators; and
• spam.

Human Review

Automated systems are used to flag or prioritize content. Final moderation decisions that have significant impact are not intended to rely solely on automation without human review.

---

7A. Face Data and Optional Selfie Verification

Collection and consent

When you choose Settings → Get Verified, we ask you to agree to camera and face comparison processing before starting the check. A secure browser page then requests camera access and streams a short selfie video to Amazon Web Services (AWS) Rekognition Face Liveness. AWS extracts a reference image from that video. Our backend temporarily processes that reference image and your existing primary profile photo with AWS Rekognition to detect a face and compare the two images.

Face data processed for the check includes the images and video, face locations and landmarks, image-quality information, a liveness confidence score, and a face-similarity score. Chunkr does not save the selfie video, extracted selfie frame, reusable face template or embedding, or numerical provider confidence scores in its database, file storage, or application logs. Your primary profile photo remains stored as part of your profile.

Verification is optional. You can decline or cancel it and use Chunkr without a verification badge. The check does not access Apple's Face ID enrollment data or create a Face ID profile.

Purposes and limits

We use this face data to check that a live person is present, compare that person's face with the primary profile photo they selected, and decide whether to display the Chunkr verified badge. We use the associated session records to operate the check, record consent, limit repeated attempts, and resolve verification problems. A successful check confirms a photo match at the time of the check; it does not establish legal identity, age, background, or intentions. You can contact support about a failed check or an accessible alternative.

Chunkr does not use verification face data for advertising, marketing, tracking across services, identifying people in other users' photos, or training its own AI models. We do not create a searchable face-recognition collection. No additional use of verification face data is currently planned; a new purpose would require an updated disclosure and any consent required by law before that processing begins.

Sharing and storage

AWS receives the selfie video and images needed to perform liveness detection and face comparison. Our backend, hosted by Supabase, temporarily handles the reference image and profile photo during the comparison. Supabase stores the primary profile photo and limited verification records: your account and photo identifiers, a reference to the photo, session identifiers, a protected session-ticket hash, consent version, check status, and timestamps. Chunkr does not configure an AWS S3 output bucket for selfie captures and requests no additional audit images.

Data travels over encrypted connections. Session records are restricted to our backend and authorized operational access. Other users can see your verification badge and profile photo under the Service's profile visibility rules; they do not receive the selfie video, extracted frame, or provider scores. The private camera page does not include our marketing or product analytics integrations. We do not send verification face data to advertisers or sell it.

Verification processing uses AWS US East (N. Virginia), and the primary profile photo and verification records are stored in our Supabase project in US East (Ohio). These services may also involve international transfers described in Section 11. AWS's processing of submitted images and videos is also governed by its Service Terms and Rekognition data-use practices. We have configured an AWS Organizations opt-out policy for Rekognition so submitted images and videos are not used for AWS AI service improvement. AWS may still process and retain content needed to provide the service. AWS states that opting out deletes historical content held for service improvement, excluding content required for service functions. The three-minute session availability period described below is not a statement that all provider-held copies are deleted within three minutes.

Retention, deletion, and withdrawal

• Selfie video, extracted frame, and detailed face-analysis results: Chunkr processes these for the check and does not retain a saved copy. AWS documents that the liveness session identifier expires three minutes after it is issued, after which the associated session data is unavailable through the session API. AWS's separate service-processing and data-use practices are described above; this API expiry does not establish a maximum retention period for every provider-held copy.
• Primary profile photo: Retained until you delete the photo or your account is deleted, subject to the backup, legal, and safety provisions in Section 12. Removing verification alone does not delete your profile photo.
• Verification badge record: Valid for six months. Removing verification deletes the current badge record. Changing or deleting the checked photo and certain moderation changes invalidate the badge. Expiry prevents further display of the badge but does not itself guarantee immediate deletion of the expired database record.
• Session and consent records: These contain no saved selfie capture, face template, or numerical provider scores. They may remain for the life of the account unless deleted earlier, including when the associated photo is deleted or a deletion request is fulfilled. Expiring a session or removing the badge does not erase historical session records automatically.

You can remove your current badge through Settings → Get Verified → Remove my verification, stop future camera processing by declining further checks, and revoke camera permission in your device or browser settings. To withdraw consent and request deletion of remaining verification records, email [email protected]. Deleting the underlying account removes its associated verification records from the active database when account deletion is completed. Backup copies and information required for legal or safety purposes are subject to Section 12; removing a badge is not the same as deleting an account.

---

8. Cookies and Tracking Technologies

We use cookies, pixels, SDKs, and similar technologies for website functionality, analytics, and attribution. See our separate Cookie Notice for full details.

In short:

• essential tools support the website;
• analytics help us improve the product; and
• attribution tools help us understand marketing performance.

We do not sell personal data.

---

8A. Mobile Advertising and Subscriptions

Google AdMob

Where advertising is enabled, Chunkr uses Google AdMob to display full-screen ads during browsing breaks. Ad behavior depends on your app version and privacy choices. Earlier versions request non-personalized ads. In versions that support personalized advertising, Google may personalize ads when applicable consent permits it; on iOS, Chunkr also requires your App Tracking Transparency permission. Otherwise, the app requests non-personalized ads, and Google may further restrict serving to limited ads or no ads based on your choices and regional requirements. Advertising still involves data processing: the ads SDK may process IP addresses (including an approximate location inferred from them), device or advertising identifiers where available, ad impressions and interactions, and diagnostic and performance information. These support ad delivery, personalization where permitted, measurement, frequency limits, and fraud prevention. Chunkr does not send profile fields, messages, photos, verification face data, or precise GPS coordinates as ad-targeting parameters.

The app checks Google's User Messaging Platform before requesting ads and presents consent messages when required by that platform. Where available, Settings → Ad privacy choices lets you revisit those choices. In supported iOS versions, Google’s IDFA explainer leads to Apple’s tracking permission prompt. You may decline without losing access to Chunkr, and can change tracking permission in iOS Settings → Privacy & Security → Tracking. Device advertising and tracking controls also apply. Website analytics preferences and Share Usage Analytics in the app are separate from ad privacy choices. Non-personalized advertising may still require consent for identifiers or device storage.

Google processes advertising information under its applicable terms and Privacy Policy. See how Google uses information from services that use its technology. Our commitment not to sell personal data does not mean that no information reaches advertising providers.

RevenueCat and store purchases

Apple or Google processes payments for Chunkr Ad-Free. RevenueCat helps us validate purchases, restore access, and determine whether your subscription is active. We send RevenueCat your internal Chunkr account identifier and process store receipts or purchase tokens, product and transaction identifiers, purchase history, renewal and expiration information, subscription status, and relevant app/device technical information. These records are linked to your Chunkr account; they are not anonymous purchase records. We do not send your profile fields, private messages, photos, or verification face data to RevenueCat through this integration, and we do not receive your full payment-card details from the stores.

This processing supports the subscription you request, customer support, and fraud prevention. See RevenueCat's Privacy Policy, Apple's Privacy Policy, and Google's Privacy Policy. Subscription checks may occur when you sign in or return to the app, including to determine whether ads should be suppressed.

While your ad-free entitlement is active, Chunkr suppresses new ad requests and ad presentation. An ad-free subscription does not disable essential account or billing processing, change your separate analytics preferences, or erase information previously collected by providers.

Purchase and subscription records may remain as needed to administer purchases, resolve disputes, prevent fraud, and meet legal or accounting obligations, including after cancellation or account deletion. Store and provider records are subject to their own retention policies. Contact [email protected] to request access or deletion; we will explain applicable retention exceptions. Deleting your Chunkr account does not automatically cancel a subscription with Apple or Google.

---

9. How We Use Personal Data

We may use personal data to:

• create and maintain accounts;
• authenticate users;
• display profiles and support discovery features;
• provide approximate location-based features;
• enforce safety rules and investigate abuse;
• moderate content;
• operate customer support;
• deliver and measure mobile ads subject to applicable privacy choices;
• validate purchases, restore subscriptions, and provide ad-free access;
• analyze product usage and improve the Service;
• send marketing messages when allowed; and
• comply with law or respond to valid legal requests.

---

10. How We Share Data

Service Providers

We share data with service providers that process data on our behalf.

Expo Insights is limited to app-launch measurement. We do not send Expo your Chunkr account identifier, sensitive profile fields, messages, photos, or precise location through this integration.

Website PostHog analytics requires the separate Analytics preferences choice described in our Cookie Notice. We forward sanitized public-page events through our server and queue removal requests when consent is withdrawn.

PostHog product analytics is controlled by Settings -> Share Usage Analytics. The mobile client starts opted out and sends events only after the stored preference loads as enabled. We identify an enabled account only by its opaque Supabase UUID and remove dynamic identifiers from screen names. We do not send PostHog email addresses, profile fields, message or review content, precise location, initial deep links, touch autocapture, error payloads, or session recordings, and automatic GeoIP enrichment is disabled. Turning the setting off resets the PostHog identity and stops future product events.

Face-data sharing, storage, provider processing, and exclusions are explained specifically in Section 7A.

Email Delivery and Preferences

We use Resend to deliver account, security, support, and subscription emails, along with optional activity or marketing emails where enabled. Resend processes the recipient email address, message content and template variables needed for the email, and delivery information such as delivery failures, bounces, and complaints. We retain preference and consent records to respect your choices and prevent unwanted sends. See Resend’s Privacy Policy.

Manage optional email choices in notification settings or through the unsubscribe or preference link in an email where provided. Essential account, security, and billing notices may still be sent when optional emails are disabled. Email preferences do not cancel a paid subscription, and an ad-free subscription does not itself opt you into marketing.

Advertising and Subscription Providers

We share the information described in Section 8A with Google AdMob for mobile advertising and with RevenueCat, Apple, and Google for purchase validation and subscription management. These providers may process information in the United States and other countries as described in Section 11. Their roles and processing depend on the applicable service terms; advertising data is not covered solely by the service-provider table above.

Other Users

Depending on your settings and use of the Service, other users may see:

• your profile information;
• your profile and shared photos;
• your approximate discovery location, or a more precise location you choose to send in chat; and
• messages you send them.

Legal and Safety Disclosures

We may disclose information:

• in response to valid legal process;
• to help prevent imminent harm;
• where required for child safety reporting;
• to investigate serious criminal conduct; or
• to protect the rights, safety, or security of users, Chunkr, or others.

Where legally permitted, we may challenge broad requests and notify affected users.

Sale of Data

We do not sell personal data.

---

11. International Transfers

Chunkr infrastructure and vendors may process data in the United States and other countries.

Where required by law, cross-border transfers may rely on:

• Standard Contractual Clauses;
• contractual protections with processors; and
• additional technical or organizational safeguards.

Questions about international transfers can be sent to [email protected].

---

12. Data Retention

We retain data for as long as needed for the Service, safety, legal compliance, and legitimate business purposes.

Face-data retention

Section 7A sets out separate retention practices for temporary selfie processing, AWS session data, primary profile photos, badge records, and session/consent records. The general retention periods in this section do not mean Chunkr saves verification selfie captures. A six-month badge validity period and a three-minute AWS session availability period are not automatic deletion schedules for all related records.

Purchase Records

Purchase and subscription records follow the purposes and retention exceptions in Section 8A; canceling a subscription does not immediately erase its transaction history.

Account Deletion

To request deletion in the app, open Settings → Delete My Account and follow the confirmation steps. You can also email [email protected] from your account email address with the subject Chunkr account deletion, including if you no longer have the app. We may ask for information needed to verify account ownership; do not send your password.

To request deletion of particular data while keeping your account, use the available editing or deletion controls, or email us describing the data you want removed.

Account deletion covers your account, profile, and associated personal data, subject to the retention exceptions described here and in Sections 7A and 8A. Deleting your account does not cancel an Apple or Google subscription; cancel it separately through the purchasing store.

When you delete your account:

1. your profile may be hidden promptly;
2. some data may remain during a restoration grace period or backup cycle; and
3. residual data may be deleted over time according to backup, legal, and safety retention schedules.

---

13. Your Rights

Rights Available to Most Users

You may have the ability to:

• access your data;
• correct inaccurate information;
• delete your account and associated data;
• download a copy of certain data; and
• manage visibility settings for sensitive fields.

Additional Rights for Users in the EU, EEA, and UK

Where applicable, you may also have rights to:

• withdraw consent;
• object to certain processing;
• restrict processing; and
• complain to your local supervisory authority.

Additional Rights for California Residents

California residents may have rights to:

• know what categories of personal information we collect and use;
• request deletion;
• request correction;
• opt out of sale or sharing, where applicable; and
• receive non-discriminatory treatment when exercising privacy rights.

Chunkr does not sell personal information.

Canadian Users

Canadian users may request access to personal information and challenge its accuracy under applicable law.

How to Exercise Rights

• Use in-app controls where available.
• Email [email protected].

We may need to verify your identity before fulfilling a request.

---

14. Security

We use technical and organizational safeguards designed to protect personal data, including:

• encryption in transit;
• infrastructure-level access controls;
• authentication and authorization safeguards;
• rate limiting and abuse-prevention measures;
• photo metadata stripping where appropriate; and
• employee access controls and training.

No system is perfectly secure. We cannot guarantee absolute security.

Breach Notification

If a data breach requires notice under applicable law, we will provide notice to regulators and affected users as required.

---

15. Age Restriction

Chunkr is strictly for adults 18 and older.

• We do not knowingly allow minors on the Service.
• If we learn that an account belongs to someone under 18, we may remove the account and associated data.
• Illegal content involving minors may be reported to NCMEC or law enforcement as required.

---

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes may be communicated through the app, by email, or on the website.

Where a change requires your consent, we will seek it before the relevant processing begins. Updating this Policy does not itself provide consent for optional processing.

---

17. Contact

For privacy questions, legal requests, or app support, email [email protected].

Phone: +1 (647) 684-0908

Mailing Address:
Homie Lab Inc.
517 Richmond St East Suite 1015
Toronto, ON M5A 1R4
Canada

---

Last Updated: September 30, 2026