Privacy Policy

We collect the following types of information when you use BuckChats: • Account Information — When you sign up, we collect your email address and encrypted password. Your display name is either provided by you or auto-generated. • Profile Information — Information you voluntarily provide, including your name, date of birth, gender, profile photos, bio, interests, and preferences such as "looking for" and "meet preferences." • Usage Data — We collect information about how you interact with the Platform, including rooms visited, messages sent, gifts given, likes, matches, and session duration. • Device Information — We may collect device type, browser type, operating system, and IP address for security and analytics purposes. • Location Data — With your consent, we may collect approximate location data to provide location-based features such as distance filters and nearby user discovery. • Cookies & Local Storage — We use cookies and local storage to maintain your session, remember preferences, and provide a seamless experience. • Communications — Messages you send through our chat features, including cabin group chats and direct messages. These messages are stored to deliver the service and may be reviewed to enforce our community guidelines.

BuckChats uses FACEIO, a third-party facial authentication service, to verify your identity during the onboarding process. This section explains exactly what data is collected, how it is processed, and your rights regarding this data. What We Collect: • During identity verification, your device camera captures your facial image in real time. • FACEIO's system extracts facial features and converts them into a mathematical representation (a "face vector" or "face embedding") — an array of floating-point numbers. • This face vector is a hash-like representation and cannot be reverse-engineered back into your face image. • A unique Facial ID is assigned to your face vector and stored in our database to link your verification status to your account. How It Is Used: • To verify that you are a real person (liveness detection) and prevent fake accounts. • To prevent the same individual from creating multiple accounts (duplicate detection). • To display a "Verified" badge on your profile, building trust with other users. • We do NOT use facial recognition data for advertising, profiling, or any purpose other than identity verification. Where It Is Stored: • The face vector (not your photo) is stored on FACEIO's encrypted servers. FACEIO acts as a data processor on our behalf. • Your Facial ID (a unique string identifier) is stored in our database alongside your user record. • Raw camera frames are processed in real-time and are NOT stored, saved, or transmitted beyond the verification session. How Long It Is Retained: • Your face vector is retained on FACEIO's servers as long as your BuckChats account is active. • Upon account deletion, we will instruct FACEIO to permanently delete your face vector within 30 days. Your Rights: • You have the right to request deletion of your biometric data at any time by contacting us at support@buckchats.com. • You may decline identity verification, though this may limit certain features (e.g., the "Verified" badge will not be displayed on your profile). • For users in jurisdictions with specific biometric privacy laws (e.g., Illinois BIPA, Texas CUBI, Washington State), we obtain your explicit, informed consent before collecting any biometric data. Security: • All biometric data is encrypted in transit (TLS 1.3) and at rest. • FACEIO's processing infrastructure is designed to prevent unauthorized access, and face vectors are encrypted with application-specific keys. • We conduct periodic security reviews of our FACEIO integration.

We use the information we collect to: • Provide, maintain, and improve the BuckChats platform. • Authenticate your identity and manage your account. • Verify your identity through facial recognition during onboarding. • Enable live streaming, real-time chat, cabin rooms, gifting, and referral features. • Power the Discover feature to help you find and connect with other users based on your preferences and filters. • Send you transactional communications (e.g., password reset emails, verification status updates). • Send you notifications about cabin invitations, messages, likes, and other platform activity. • Detect and prevent fraud, abuse, fake accounts, and security threats. • Enforce our Community Guidelines and Terms of Service. • Analyze usage patterns to improve the user experience. • Comply with legal obligations.

We do not sell your personal information. We do not sell your biometric data. We may share your information in the following limited circumstances: • Service Providers — We work with trusted third-party services that help us operate the Platform. These providers only access your data as needed to perform their services and are bound by contractual obligations to protect your data. Our current service providers include: — FACEIO (by PixLab/Symisc Systems): Facial recognition and identity verification. — Agora: Live video and audio streaming. — Neon: Serverless PostgreSQL database hosting. — Upstash: Real-time data infrastructure (Redis). — Resend: Transactional email delivery. — Vercel: Application hosting and edge functions. — Supabase: Authentication and file storage. — Stripe: Subscription payment processing. • Other Users — Your profile information (name, photos, bio, interests, age, verification status) is visible to other BuckChats users. Messages you send in cabin group chats are visible to all cabin members. You control what information you share in your profile. • Legal Requirements — We may disclose your information if required by law, regulation, legal process, or governmental request. • Safety — We may share information when we believe in good faith that disclosure is necessary to protect the safety of our users, the public, or BuckChats. • Business Transfers — In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

Your data is stored on secure, encrypted servers. We implement multiple layers of security: • Passwords are hashed using industry-standard bcrypt encryption and are never stored in plain text. • Sessions are managed via secure HTTP-only cookies with appropriate expiration policies. • All data transmission is encrypted using TLS 1.3. • Biometric face vectors are stored in encrypted form on FACEIO's servers and cannot be reverse-engineered. • Database access is restricted through role-based access controls and network-level security policies. • We regularly monitor our systems for vulnerabilities and unauthorized access attempts. While we implement commercially reasonable security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data. If we become aware of a security breach that affects your personal data, we will notify you in accordance with applicable law.

Depending on your jurisdiction, you may have the following rights: • Access — Request a copy of the personal data we hold about you, including whether we hold any biometric data. • Correction — Request correction of inaccurate or incomplete data. • Deletion — Request deletion of your account and all associated data, including biometric data stored by FACEIO. • Portability — Request your data in a portable, machine-readable format. • Restriction — Request that we restrict the processing of your personal data in certain circumstances. • Objection — Object to the processing of your personal data for certain purposes. • Withdraw Consent — Where processing is based on consent (e.g., biometric data collection), you may withdraw your consent at any time. This will not affect the lawfulness of processing carried out before withdrawal. • Opt-Out — Opt out of non-essential communications and notifications. To exercise any of these rights, contact us at support@buckchats.com. We will respond to your request within 30 days (or sooner if required by applicable law). Account Deletion: You can request full account deletion at any time. Upon deletion, we will: — Remove your profile, messages, and activity data within 30 days. — Instruct FACEIO to permanently delete your face vector. — Retain only data required by law (e.g., transaction records for tax purposes).

BuckChats uses the following types of cookies and similar technologies: • Essential Cookies — Required for authentication, session management, and core Platform functionality. These cannot be disabled without breaking the Platform. • Preference Cookies — Remember your settings, theme preferences, and locale to provide a personalized experience. • Analytics Cookies — Help us understand how users interact with the Platform so we can improve the experience. These are anonymized where possible. We do NOT use: • Third-party advertising cookies • Tracking pixels or web beacons • Cross-site tracking technologies • Fingerprinting technologies You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Platform.

BuckChats integrates with the following third-party services, each with their own privacy practices: • FACEIO (PixLab / Symisc Systems) — Powers facial recognition and identity verification. FACEIO processes facial image frames in real-time to generate face vectors. See FACEIO's privacy policy at faceio.net/privacy-policy. • Agora — Powers live video and audio streaming in cabins and rooms. Agora may process audio/video data during live sessions. See Agora's privacy policy at agora.io/privacy-policy. • Supabase — Provides authentication, file storage, and real-time subscriptions. See Supabase's privacy policy at supabase.com/privacy. • Stripe — Processes subscription payments. Stripe collects and processes payment information directly; we never store your full credit card number. See Stripe's privacy policy at stripe.com/privacy. • Neon — Provides serverless PostgreSQL database hosting. See Neon's privacy policy at neon.tech/privacy. • Vercel — Hosts the Platform and processes HTTP requests. See Vercel's privacy policy at vercel.com/legal/privacy-policy. • Upstash — Provides real-time data infrastructure (Redis) for caching and rate limiting. See Upstash's privacy policy at upstash.com/trust/privacy. • Resend — Handles transactional email delivery (e.g., password reset, welcome emails). See Resend's privacy policy at resend.com/legal/privacy-policy. Each third-party service operates under its own privacy policy, and we encourage you to review them.

We retain your data according to the following schedule: • Account Data — Retained as long as your account is active. Deleted within 30 days of account deletion request. • Profile Photos — Retained as long as your account is active. Deleted upon account deletion. • Biometric Data (Face Vectors) — Retained on FACEIO's servers as long as your account is active. Deleted within 30 days of account deletion or upon explicit request. • Messages — Chat messages within cabins are retained for the duration of the cabin's existence. Direct messages are retained as long as both users' accounts are active. • Live Room Data — Chat messages, gift events, and viewer counts within live rooms are ephemeral and are cleared when a room ends. • Transaction Records — Subscription and payment records are retained for 7 years as required by tax and financial regulations. • Security Logs — IP addresses, login timestamps, and security events are retained for 90 days for fraud prevention and security purposes. We may retain anonymized, aggregated data indefinitely for analytics and service improvement purposes. This data cannot be linked back to individual users.

BuckChats is not intended for users under the age of 18. We do not knowingly collect personal information from children. Our identity verification system (FACEIO) includes age estimation capabilities. If the system estimates that a user attempting to verify is under 18, enrollment will be rejected. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete that information promptly, including instructing FACEIO to delete any associated biometric data. If you believe a minor has created an account, please contact us immediately at support@buckchats.com.

BuckChats is operated from and hosted in the United States. Our service providers may process data in various countries around the world. If you are accessing the Platform from outside the United States, please be aware that your data may be transferred to, stored, and processed in the United States or other countries where our service providers operate. For users in the European Economic Area (EEA), United Kingdom, or Switzerland: • We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for international data transfers. • You can request a copy of the applicable SCCs by contacting us. For users in California (CCPA/CPRA): • You have the right to know what personal information we collect, how it is used, and to whom it is disclosed. • You have the right to request deletion of your personal information. • You have the right to opt-out of the "sale" of personal information. Note: We do not sell personal information. • You will not be discriminated against for exercising your privacy rights. By using BuckChats, you consent to such transfers in accordance with this Privacy Policy and applicable law.

We may update this Privacy Policy from time to time. When we make material changes, we will: • Post a notice on the Platform. • Update the "Last updated" date at the top of this page. • For significant changes affecting biometric data processing, we will seek your renewed consent where required by law. The "Last updated" date indicates when the policy was last revised. Continued use of BuckChats after changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy, your biometric data, or how we handle your personal information, please contact us at: Email: support@buckchats.com For biometric data deletion requests, please include "Biometric Data Request" in the subject line and your registered email address in the body. We will process your request within 30 days. For GDPR-specific inquiries, you may also contact our Data Protection Officer at dpo@buckchats.com.