Privacy Policy

This Privacy Policy explains how Mutualish collects, uses, discloses, and protects personal information when you use our website, email notifications, and related services (collectively, the “Service”). Mutualish is designed around a simple privacy principle: non-mutual interests are not intentionally revealed through the normal product experience.

1. Information we collect

We collect information you provide directly, including your email address, the email addresses you privately add, verification information, account actions, and information related to mutual matches. We also record whether invitation emails were sent, opened through the Mutualish invitation flow, verified, responded to, matched, suppressed, or opted out where applicable.

We collect limited first-party product analytics to understand how Mutualish is used and where the experience can be improved. These analytics may include a randomly generated visitor identifier, session identifier, authenticated user identifier when available, page path, event name, visible-tab engagement time, device category, and the hostname of a referring site. Our application analytics are designed not to store raw query strings, invitation tokens, the contents of email fields, or IP addresses. Our hosting and infrastructure providers may process technical network information such as IP addresses in their ordinary security and service logs.

2. Information about people who have not created an account

A Mutualish user may submit the email address of someone they know before that person creates an account. We use that address to operate the private-interest and invitation features, including checking for a future mutual match and, where appropriate, sending a discreet invitation. An invitation recipient can opt out of future Mutualish invitation emails. We do not intentionally reveal the identity of the person who submitted a non-mutual interest.

3. How we use information

We use personal information to operate Mutualish, verify accounts, save private interests, detect mutual matches, send invitations and match notifications, prevent duplicate or abusive activity, honor email preferences, provide support, maintain security, troubleshoot errors, measure product performance, improve the Service, and comply with applicable law.

4. How the matching privacy model works

Mutualish is built so that a one-sided interest remains private through the ordinary product experience. If two verified users independently add each other, Mutualish may reveal that mutual match to both of them. We do not provide hints, public profiles, or a public list of non-mutual interests. Although we use safeguards designed to protect this information, no online service can guarantee absolute confidentiality or security.

5. When we disclose information

We may disclose personal information to service providers that help us operate Mutualish, subject to appropriate contractual or platform protections. Current providers include Supabase for database and authentication infrastructure, Vercel for hosting and application infrastructure, and Resend for email delivery. These providers process information on our behalf according to their services and terms.

We may also disclose information when reasonably necessary to comply with law, legal process, or valid governmental requests; investigate fraud, abuse, security incidents, or violations of our Terms; protect the rights, safety, or property of Mutualish, our users, or others; or complete a merger, financing, acquisition, reorganization, sale of assets, or similar business transaction, subject to applicable law.

6. We do not sell personal information

Mutualish does not sell personal information for money and does not share personal information for cross-context behavioral advertising. We do not use third-party advertising analytics or ad-tracking pixels in the current Service. If our practices materially change, we will update this Policy and provide any choices required by law.

7. Cookies and local storage

Mutualish may use browser storage and similar first-party technologies to maintain authentication, remember legal acceptance, create privacy-preserving visitor and session identifiers, and support core product functionality. We do not currently use this information to serve third-party targeted advertising.

8. Email preferences

Invitation recipients can opt out of future invitation emails using the opt-out mechanism provided in Mutualish invitations. Verified users can also block future invitation emails through our Privacy Controls page. We may suppress addresses that hard-bounce, generate complaints, or should not receive further invitations. Transactional or service messages, such as requested verification codes, security notices, account messages, and mutual-match notifications, may be handled separately where permitted by law.

9. Retention

We retain information for as long as reasonably necessary to provide the Service, preserve the integrity of the matching system, honor suppression and opt-out requests, protect users, detect abuse, maintain security, resolve disputes, comply with legal obligations, and support legitimate business operations. Different categories of information may be retained for different periods. We may retain limited records after account deletion where necessary for fraud prevention, safety, legal compliance, dispute resolution, or to ensure that an opt-out remains effective.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, authenticated APIs, signed invitation and match links, and limited administrative access. However, no method of transmission or storage is completely secure, and we cannot guarantee that information will never be accessed, disclosed, altered, or lost.

11. Your choices and rights

Verified users can block future invitation emails or delete their Mutualish account and private selections through our Privacy Controls page. Depending on where you live, you may also have rights to request access to, correction of, deletion of, or a copy of certain personal information, or to object to or restrict certain processing. You may have the right to appeal a decision regarding a privacy request. We may need to verify your identity before completing a request and may deny or limit requests where permitted by law.

California residents may have additional rights under applicable California privacy laws, including rights to know, correct, and delete certain personal information and to receive information about certain disclosures. Because Mutualish does not sell personal information or share it for cross-context behavioral advertising, there is currently no sale or sharing opt-out to exercise for those practices.

12. Do Not Track and privacy signals

Some browsers offer “Do Not Track” settings. Because there is no single universally accepted standard for interpreting those signals, Mutualish does not currently respond to general Do Not Track signals. We do not sell personal information or use cross-context behavioral advertising. If applicable law requires us to recognize a particular universal opt-out signal for a practice we engage in, we will do so.

13. Adults only

Mutualish is intended only for people who are 18 or older. We do not knowingly permit minors to create or use Mutualish accounts. If we learn that personal information has been collected from a person under 18 in connection with an account, we may suspend the account and delete associated information, subject to legal and safety-related retention needs.

14. International users

Mutualish and its service providers may process information in the United States and other countries where our providers operate. Those countries may have data-protection laws different from the laws where you live. Where required, we will use legally recognized mechanisms for international data transfers.

15. Changes to this Privacy Policy

We may update this Privacy Policy as Mutualish evolves. If a change materially affects how we use personal information, we may provide notice through the Service or require renewed acceptance where appropriate. The effective date above identifies the current version.

16. Contact and privacy requests

Questions, privacy requests, account-deletion requests, or concerns about this Policy may be sent to hello@mail.mutualish.com. Please do not send sensitive information beyond what is reasonably necessary for us to verify and respond to your request.