This is the policy that governs the data BothWant collects from you. It is also a description of the kind of company we are trying to be — one that does not require its customers to read seven thousand words to find out where their answers are stored.
What we collect.
The complete list, with no surprises after the comma:
- —Your
email— used to log you in, and to send you exactly two kinds of email (transactional and the optional weekly journal). - —A
password hash— derived via Argon2id with a per-user salt. We do not store, log, or transmit your password itself. - —Your
encrypted answers— ciphertext only. We cannot read these and we have not constructed any system that would allow us to. - —Operational metadata —
account_created_at,last_login_at,partnership_id. Used to make the product work; not used for analytics.
That is the complete list. It does not contain your name, your phone number, your IP address persisted longer than the request, your device fingerprint, your contacts, your photos, or anything else you may be reflexively expecting an internet service to ask for.
How we use it.
Your email is used to authenticate you and to send you the two email types listed above. Your password hash is used to verify you on sign-in. Your encrypted answers are used inside a sealed reveal function, on the server, to compute the yes-yes intersection with your partner — and never for anything else.
Your answers are not analytics. There is no dashboard at BothWant where someone — engineer, support agent — can read what couples have said yes to. The architecture forecloses the question, not just the answer. If you would like to verify this for yourself, the architecture is described in detail at /security.
We use anonymized, PII-masked product analytics (PostHog, with masking enforced at the SDK level) to understand which screens are confusing and which buttons are getting clicked. The analytics pipeline does not see your email, your answers, or your partnership ID.
Your rights.
You can do the following from your /settings page, without contacting us:
- —Export everything we have on you — a JSON file with your account row, your encrypted blob, and your partnership records. The blob is yours; we cannot decrypt it for you, but you can decrypt it client-side using your password.
- —Update your email address. Updating it does not invalidate your encryption key, which is derived from your password.
- —Change your password. This re-derives your encryption key and re-encrypts your blob server-side without ever decrypting it in the clear (we use a key-encrypting-key wrap pattern, described at
/security). - —Delete your account, in full. See below.
If you delete your account, we delete you in full — every record across every table, including your partnership and your matches — and we roll forward our backups to exclude you within 30 days. There is no archive. There is no soft-delete. There is no “in case you change your mind”; if you change your mind, you sign up again.
If you are in the EU, the UK, or California, the rights enumerated above already cover what your local law requires (access, rectification, erasure, portability). You do not need to invoke a specific clause to exercise them — the buttons are in Settings.
Children.
BothWant is not designed for, marketed to, or appropriate for anyone under 18. We do not knowingly collect data from minors. If we learn that we have, we delete it.
Contact.
For privacy questions, write to privacy@bothwant.com. A human on our team reads it.
For security disclosures, write to security@bothwant.com. We will acknowledge within 48 hours and we will not threaten you with a CFAA letter.