1. Who is responsible for your data

FindLucid.com is operated by FINDLUCID LLC, 99 Wall Street #1978, New York, NY 10005, which is the data controller for your personal information. Questions or requests about your data go to support@findlucid.com. That inbox is monitored for privacy rights requests.

2. What we collect

Account: your email address (for magic-link sign-in), your password (stored only as a salted hash) if you set one, sign-in timestamps, and your acceptance of the Terms of Service. Profile: your display name and date of birth (required), plus anything you choose to add: bio, photos, height, intents, and preferences. Verification: if you complete selfie verification, we collect one selfie and derive a face template and a fraud check value from it, as described in section 17. If a selfie cannot settle your verification, we may ask you to add a photo of a government ID through a secure link, as described in section 17. Technical: device type, error logs, push notification tokens, your IP address and device identifiers (collected when you use the service and kept in security logs), and your approximate location (city-level or coarser) when you use discovery. We collect precise location only if you turn it on, and only after the explicit consent described in section 3. While the app is open, your stored location refreshes as you move, so the map, distances, and safety features work from where you are now. You can turn location updating off anytime in Settings (Location updating), which stops the refreshing, and you can clear your stored location there. Events: the events you RSVP to. RSVPing also saves the event for you; if you turn on 'Show on my profile' (off by default), members who can see your profile can see your saved events. Waitlist: if you join the waitlist, your email address. Founder invitations are email invitations to join FindLucid.com sent to early waitlist members; an invitation token expires after 30 days. Messages and support: your messages and matches, support tickets you open, and reports you file or that are filed about you. Plan Together: invites you send and receive, rooms you join, and messages you post in those rooms, including the AI concierge's replies, are collected too. Photo flag: the yes-or-no flag described in section 19. Home city: the home city described in section 4. Billing: if you subscribe, Stripe processes your payment and we never store your card number. For billing we store your subscription tier and status, the timestamp of your renewal consent, the version of the terms you saw, your cancellation record, and refund records. Tax and billing records are kept 7 years; deleting your account does not delete records the law requires us to keep, and we do not delete the payment-processor customer record while those records must be kept. We set only strictly-necessary cookies (see section 14). No advertising cookies, no tracking pixels, no third-party analytics.

3. Sensitive information: your explicit consent

Some profile fields are sensitive under privacy law: HIV status, sexual orientation, gender identity, sexual position and kinks, sobriety and drinking details, and precise location. These fields are always optional. The first time you set any of them, we ask for your explicit consent before saving them and before displaying them to other members on your profile. You can withdraw consent anytime by clearing the field; withdrawing is as easy as giving it. We never infer sensitive information about you, and we never use it for advertising. We ask for opt-in consent before using this sensitive information. Some state laws (including Colorado, Connecticut, Virginia, and Oregon) require this consent; the CCPA separately gives you the right to limit use of sensitive personal information. We extend the consent choice to every member. Consent is recorded per kind of information: setting one kind never consents to another, and clearing the last field of a kind records your withdrawal for that kind only. Precise location works the same way: your stored location refreshes as you move while the app is open, and you can withdraw location consent in Settings (Location updating), which stops the updating from that moment.

4. Why we collect it (and the legal basis)

We process your data to operate FindLucid.com. Under EU law our bases are: contract (running your account, matching, messaging, billing, and the product notifications described in section 13, which start on when you join and which you can turn off anytime in Settings); consent (sensitive profile fields and marketing emails, all opt-in); and legitimate interests (safety, fraud prevention, keeping the service working). Under US state laws we process data to provide the service you requested and with your consent where sensitive data is involved. Marketing emails always require your opt-in, and the notification defaults in section 13 never change that: product notification emails (likes and account activity) are service messages, not marketing. Messages the law requires us to send about your subscription (renewal reminders, receipts, price-change notices) are not marketing and are not subject to the marketing opt-out. When we send marketing emails, each one will carry a working unsubscribe link and our postal address, and we will honor unsubscribe requests within 10 business days, as the CAN-SPAM Act (15 U.S.C. Sections 7701-7713) requires. If you have no approved photos, discovery surfaces show a stylized placeholder silhouette personalized from your own profile selections (gender, body type, sexual position, and kinks) instead of a photo. Those selections are sensitive information under section 3; the silhouette shows only what you chose to put on your profile. We also use your home city to attribute your subscription to one of our launch metros in aggregate, for internal revenue planning. If a metro has fewer than 5 paying members, our internal map shows only the words "fewer than 5 paying members here," never the figure; your individual payment is never shown on the map.

5. We do not sell or share your personal information

We do not sell your personal information for money. Some services we use (Cloudflare Turnstile for bot protection, Google STUN for calls, Zippopotam for ZIP and postal code lookup) receive your IP address when your browser contacts them; they are free or public endpoints and we have no contract with them. We do not use cross-context behavioral advertising. We honor the Global Privacy Control signal (Sec-GPC): if your browser sends it, we record it as a standing opt-out of any future sale, sharing, or behavioral use of your data. This follows the California Consumer Privacy Act (California Civil Code Sections 1798.100 and following), which gives California residents the right to opt out of the sale or sharing of personal information and of targeted advertising; the Global Privacy Control signal is one of the opt-out preference signals the law recognizes. We apply these rights to all users.

6. Who we share with

Only the service providers needed to run FindLucid.com, each bound by data-protection obligations: Neon (database hosting), Vercel (app hosting), Resend (transactional email), Stripe (payments), Fireworks AI (AI processing for support chat and the Concierge), and Pusher (realtime message delivery, when enabled). Neon, Vercel, Resend, and Stripe are US-based; Pusher is UK-based; and Fireworks AI processes AI content globally by default, in the United States, Japan, Singapore, Australia, Canada, Taiwan, Malaysia, the United Kingdom, Germany, Sweden, the Netherlands, France, Switzerland, and Iceland, and in the European Union and the European Economic Area, and through Cloudflare at the data center closest to the user. Three additional services receive limited technical data when you use the related feature: Cloudflare Turnstile (bot protection on forms; sees your IP address and browser signals when you submit a protected form), Zippopotam (ZIP and postal code lookup; receives only the ZIP or postal code you enter), Nominatim, the OpenStreetMap place lookup (place lookup; receives only the place text you type when you use the type your city path, and no name, email, or account details), and Google STUN (voice and video call setup; when you start or answer a call, your device asks Google's STUN server for your public address to build the peer-to-peer connection, so Google sees your IP address at that moment; it receives no call audio or video, no names, and no account details). Calls connect directly between members' devices. That means the member you call can see your IP address, which shows your approximate location, and you can see theirs. Do not call a member you do not trust with that information. Travel links on the Travel page use our affiliate links (for example, Travelpayouts): clicking one tells the travel provider you came from FindLucid.com so the visit can be attributed. We do not send Travelpayouts your account information. If you click a partner link, your browser sends them your IP address, browser details, and the page you came from, the same as any link on the web. If you are in the EU/UK, your data is transferred internationally, including to the US and, for Fireworks AI, to the other countries listed in this section, under each provider's standard contractual clauses and data processing terms. We disclose data if the law requires it. Support and safety work at FindLucid.com is performed by FindLucid.com staff and by automated systems operating under FindLucid.com's direction; those systems may access account data for safety reviews, verification, and support, and those accesses are logged. Cross-account safety access: when a report names another member, or when a member is reported, our Trust and Safety and Customer Support staff may access the reported account's relevant records (the report itself, complaint history, attached evidence, and safety outcomes) to investigate. They never receive a full copy of another person's private account: access is limited to what the investigation needs, and every access is logged with the staff member's identity, the time, and the case reference. Our support assistant Beacon can only tell you the status of your own case, never internal notes and never other users' data. A member's record can be opened only for these purposes: running a verification review the member requested, answering the member's own support request, acting on a report or complaint about that member, safety investigation of that member, or a legal obligation. Nothing else opens it. The owner is excluded from verification review and from support reads of member content. Section 21 sets out how member profiles are handled inside FindLucid, and those limits bind leadership too. FindLucid is offered in the United States. If you use it from another country, your data is processed in the United States under this policy, except that AI content sent to Fireworks AI is processed as described in this section.

7. Your rights and how to exercise them

Wherever you live, you can: see the data we hold about you, including the categories we collected and why; correct it; download a machine-readable copy (Settings > Download my data); delete your account and data (Settings > Delete my account); opt out of any sale or sharing of your data and of targeted advertising and profiling (we do not do these today; if that ever changes, the opt-out will appear here and in Settings); and limit our use of your sensitive information to what is necessary to run FindLucid.com. EU/UK users additionally have the right to restrict processing and to data portability under Articles 15-21 of the General Data Protection Regulation (Regulation (EU) 2016/679). We will never charge you more, remove features, or give you worse service because you exercised these rights. To make a request, use the data request form at findlucid.com/privacy/data-request or email support@findlucid.com from your sign-in address or use the Settings options above. We respond within 30 days for EU/UK requests and 45 days for US requests; if we need more time, we will tell you why and give you a new date before the first period ends. If we deny your request, you can appeal by replying to our decision within 30 days; a different reviewer will take a fresh look. We decide appeals within 45 days and tell you the result. If you disagree, you may contact your state attorney general: your state attorney general's office, whose contact information is published on your state government's website. You may use an authorized agent with your written permission. These rights implement the California Consumer Privacy Act as amended by the California Privacy Rights Act (California Civil Code Sections 1798.100 and following) for California residents, and we extend them to all users. Some records we keep for safety, fraud prevention, and legal reasons. Only tax records and the privacy-request log are kept because the law requires it. The records we keep on this basis include: billing and tax records (7 years), harassment and safety records (6 years), evidence tied to child-safety reporting (kept as the law requires), and records under a legal hold. When we keep something on this basis, we tell you what was kept and the legal reason, in plain words. If you are dealing with intimate imagery of someone under 18, we point you to NCMEC's Take It Down program; for adults, we point the depicted person to StopNCII.org to create their own case, and we never submit their imagery on their behalf.

8. How long we keep data

We keep each kind of data only as long as we need it for the purpose in section 4. Account and profile data (email, display name, date of birth, bio, photos, preferences): while your account is active. When you delete your account, we erase your profile, photos, likes, matches, messages, RSVPs, saved events, and settings, and remove your email from our waitlist. We do not delete the payment-processor customer record while billing and tax records must be kept, as section 2 describes. Some records are kept after deletion for the periods stated in section 7, including reported evidence. If you hold Founding Membership, deleting your account ends it permanently; it cannot be restored. The yes-or-no photo flag described in section 19 is kept with the message it belongs to and is erased when that message is erased or when your account is deleted. The yes-or-no flag on a profile photo is kept with the photo and is erased when the photo is removed or when your account is deleted. Sensitive profile fields: deleted when you clear the field or delete your account, whichever comes first. Sign-in tokens: expire within hours. Push notification subscriptions: deleted when the subscription expires or fails, or when you delete your account. Turning a push category off in Settings stops sends on that category at once; the device subscription itself is removed on expiry, failure, or account deletion. Founder invitations: expire after 30 days. Operational data such as error logs: kept only as long as needed to keep the service running and secure. Identity verification data: see section 17. Verification records (the decision and your consent record, no images): while your account is open, deleted with your account. Verification security records (pseudonymized): up to 3 years. Backups: encrypted copies roll off within 30 days. We may retain minimal records where the law requires it (for example, billing records). Records from safety and support follow their own schedule: general support tickets, tasks, messages, and internal notes: 3 years from the ticket's close, then deleted. Billing, refund, and subscription records: 7 years from the transaction, as tax law requires. Proof of your consent to the renewal terms: kept for 3 years or 1 year after your subscription ends, whichever is longer (California Business and Professions Code Section 17602). Harassment and safety reports and moderation outcomes: 6 years from final resolution. Evidence tied to child-safety reporting: kept as the law requires, not routinely deleted. Data-rights, DMCA, and intimate-imagery request records: 2 years from completion. Cancellation attempt records (one-click subscription cancellation log): 3 years from the attempt, then deleted. Staff access logs for safety case access: 7 years. A legal hold can pause deletion for any of these; when the hold ends and no other legal basis applies, deletion proceeds. Plan Together invites, rooms, and room messages are kept while your account is active. If your Plus ends, you can still read the rooms you already joined. Leaving a room does not erase what you already posted there. When you delete your account, we erase your Plan Together invites, your place in your rooms, and every message you posted. Short AI and system lines in a room may still show the first name you used in that room; they last only as long as that room is kept for the other members in it. Room content named in a report follows the safety-record periods in section 7 and this section.

9. Security and breach notification

We use industry-standard measures: encrypted connections, a passwordless email-link sign-in option plus email-and-password accounts whose passwords are stored only as salted hashes, and access controls on our systems. Private 1:1 chats and group chats are end-to-end encrypted: messages are locked on your device before they are sent, and only you and the people you are talking to can read them, not even FindLucid.com. Your private encryption keys never leave your devices. Two exceptions. Your conversation with FindLucid.com Support is not end-to-end encrypted, so the support team can read what you send them and help you. Plan Together rooms in the Concierge are not end-to-end encrypted either: every member in the room and the AI concierge can read every post, we store the posts on our servers, and we can open them only for the purposes in section 21 (your own support request, a report or complaint, a safety investigation, or a legal obligation). Support chats are visible only to you and authorized support staff. Honest limits: posts from before encryption are labeled Not encrypted, and encryption hides what was said, not the fact it was said (we still know who posted and when). No system is perfect. If a breach exposes your personal data, we notify the relevant supervisory authority within 72 hours where required (Articles 33 and 34 of the General Data Protection Regulation (Regulation (EU) 2016/679)) and notify affected users without undue delay. We also notify affected members and state attorneys general as required by applicable state law.

10. Security incidents and legal process

We disclose personal information only: (a) in response to valid legal process; (b) to protect safety in an emergency, where the law permits; or (c) to investigate and prevent security incidents, using IP addresses and device identifiers to block attacks. We do not disclose biometric data under this paragraph. Nothing in this paragraph takes away any right you have under privacy law.

11. Age: 18+ only, and your age display

FindLucid.com is for adults 18 and older. You must provide your real date of birth at signup; our systems reject anyone under 18, and accounts found to be underage are removed. If the date of birth you enter shows you are under 18, we reject the signup and delete the date of birth and email address you entered within 30 days. You must not misrepresent your age. We do not knowingly collect data from anyone under 18, and we delete it if we learn it was provided. In profile settings you can choose whether your age is shown to other users (on by default); hiding it does not change the 18+ requirement. In limited cases we may ask for a photo of a government ID. Its image, ID number and any data read from it are permanently deleted at the moment of decision. Verification confirms adulthood only; it does not certify that any profile detail is accurate. Our service is not directed to children and we do not knowingly collect personal information from anyone under 18.

12. Verification

What "Verified" means, and what it does not mean. One-time selfie verification at sign up. "Verified" means the member completed a live selfie check and a member of our team reviewed that selfie before the profile appeared in discovery. Our reviewers check that the selfie shows a live person who appears to be an adult. Your date of birth is entered by you; we do not require government ID to verify, and verification is not an identity check, an age certification, or a background check. It does not certify that any profile detail is accurate.

13. Notifications

Notifications start on when you join: likes, matches, messages, support updates, verification updates, billing notices, and your daily drop, by push and by email. These are product notifications about your account activity, not marketing. You can turn off any category, on either channel, anytime in Settings, under Privacy, and your choice is honored by every sender from that moment. Push also needs your device's own permission: the app asks for it only when you tap to enable device notifications, after telling you what they are for, never automatically when the site loads. If your device denies or blocks permission, we do not keep asking, and your saved notification choices stay as you set them. When push is enabled on a device, we store a push subscription (endpoint and encryption keys) so we can deliver notifications to that device; we delete it when the subscription expires or fails, or when you delete your account. Billing notices are required notices: if you turn both billing channels off, a billing notice may still reach your account email of record, and we record that fallback. Marketing email is separate: it is opt-in only, as section 4 states, and these notification defaults never sign you up for it.

14. Cookies

FindLucid.com sets only strictly-necessary cookies, disclosed here: a sign-in session cookie (keeps you logged in, 14-day expiry), a CSRF token cookie (protects sign-in from forgery, session only), and a privacy-choice cookie (remembers your Global Privacy Control opt-out for one year). There are no advertising cookies, no tracking pixels, and no third-party analytics. We count page visits with our own first-party analytics as described in section 15. That measurement is aggregate only: never tied to your account, never sold. If your browser sends a Global Privacy Control signal, we collect no analytics from your visit at all. That sentence covers the page-visit analytics described in section 15; the anonymous Concierge use counters described in section 15 are not page-visit analytics and follow the rule stated there. Cloudflare Turnstile, described in section 6, runs on protected forms to check for bots. When you check out, you leave our site for Stripe's hosted payment page; cookies on that page are set by Stripe under its own policy. You can clear cookies in your browser settings; clearing the session cookie signs you out.

15. Analytics

FindLucid.com runs its own first-party analytics. We count page visits only after you agree in the cookie notice: if you decline, or have not chosen yet, we collect nothing, and a recorded decline is enforced on our servers as well as in your browser. You can change your choice anytime in Settings, Privacy. We count page visits in aggregate: which pages are viewed, rough device type, the site that referred you, coarse location (country, region, and city only, never precise), marketing campaign codes from link parameters (such as utm_source and utm_campaign), and an anonymous session marker that rotates daily and cannot be traced back to you or your account. We process your IP address to run the service and do not store it. We never store your identity, your precise location, or full page URLs. Analytics data is never joined to member records, never sold, and never shared with third parties. If your browser sends a Global Privacy Control signal, we do not collect analytics from your visit at all. The consent and Global Privacy Control sentences in this section and in section 14 govern the page-visit analytics described here, with its session marker. Separately, Concierge use is counted in aggregate daily counters by type of use: conversations, intakes, plans by entry path, plan kind, style, and main-spot category, invites, and outcomes. Those counters hold no identifier, no session marker, and no content, and are never tied to an account, so the server-side counters are kept whether or not you agree to the page-visit analytics and whether or not your browser sends a Global Privacy Control signal. One outcome is different: an intake closed mid-flow is reported from your browser only under the page-visit rules above, consent and Global Privacy Control included.

16. AI assistance

Our support assistant Beacon and our Concierge may use an AI language model to help answer your questions and requests. When they do, your chat messages, including the recent conversation for context, are sent to our AI provider Fireworks AI for processing. Fireworks AI will not use your content to train its own models or to improve its service, and it is contractually barred from using this data to train, fine-tune, or otherwise improve any shared or foundational model. Fireworks AI operates under a Zero Data Retention policy: it does not log or store prompt or generation data into persistent storage, and prompt and generation data exist only in volatile memory for the duration of the request, or, if prompt caching is active, for several minutes in volatile memory. Fireworks AI logs metadata, such as the number of tokens in a request, to deliver the service, and it may use safety screening tools on content under its terms. We never send Fireworks AI your credentials, your photos, or your payment information, and we never send it your full profile. Apart from what you type in the chat, the only extra items sent are the retrieved listings, events, or help articles the answer is based on, your first name where the feature already uses it, and, when you ask Beacon a question about your own account while signed in, the facts from your own record that are needed to answer it. If you would rather not use AI for support, email support@findlucid.com to talk to a person; you do not have to use the Concierge. Plan Together rooms work the same way, with one difference you should know: when the AI answers in a shared room, the room's recent posts are sent to Fireworks AI, including posts and first names from every member in the room, not only your own. A post by another member can therefore send your earlier room posts to Fireworks AI again, under the same no-training and zero-retention terms above. Nothing from your private 1:1 chats, your matches, or your profile is sent for a room answer.

17. Identity verification and biometric data

To get the verified badge on FindLucid.com, you may choose to complete selfie verification. We collect one selfie. If a selfie cannot settle your verification, we may ask you to add a photo of a government ID through a secure link; everything in this section covers that photo the same way. From your selfie we compute a face template: a string of numbers that describes your face geometry. It is not a photo, and we do not store it in a form intended to reconstruct the image. We also compute a fraud check value: a one-way code from your selfie used only to flag the same photo being submitted under different accounts, for a person to review. Before we collect your selfie, we ask for your written consent first, at sign up. A separate written notice describing exactly what we collect, why, and how long we keep it sits one tap from the consent box, and checking the box is your written consent under that notice. We keep your template and fraud check value for verification and fraud prevention: to detect duplicate submissions, to let you recover your account with a future selfie, and to compare a new verification selfie against the face templates of accounts we have banned, so a banned person cannot return with a new account; a close match is sent to a person to review, never an automatic ban or rejection. Your selfie is encrypted with AES-256-GCM encryption before it is stored, and the encryption key is kept separate from the database. Your selfie is deleted from active systems when a decision is recorded on your submission, by cryptographic erasure of the encrypted file and its key; remaining backup copies expire within 30 days. If a reviewer judges that a selfie shows an apparent minor, we reject the verification, delete the selfie and any template made from it, and handle the account under our 18+ rule. If no decision is made within 7 days, the submission is closed and your selfie and all data read from it are destroyed. After a decision we keep only: the decision itself, a tamper-evident audit hash, timestamps, the record of your consent, the fraud check value, and, if your verification is approved, your encrypted face template. The decision and consent record are kept while your account is open and are deleted with it. We keep your encrypted face template and your fraud check value until the earliest of: you delete your account, you verify again, or three years after your last interaction with FindLucid.com. We keep a pseudonymized security record (an action, a coded user id, a reason code, and a timestamp). A coded id is still personal information while it can be linked; we keep it for three years after account deletion under the security and fraud-prevention exceptions to deletion (California Civil Code Section 1798.105(d)) and do not use it for anything else. You can withdraw your consent at any time in Settings, under Verification, or by emailing support@findlucid.com: we delete your face template and fraud check value, and your verified badge is removed until you verify again. We never sell, lease, trade, or otherwise profit from your biometric data, and we never use it to train models or for advertising. If your account is deleted under the 30-day verification deadline (Terms of Service section 12), we keep only the pseudonymous security audit row described above. To see, correct, or delete this data, email support@findlucid.com. The provider-run check: the verification screen may offer you a liveness check run for us by Didit Identity, Inc., a company based in Delaware, United States, which acts as our processor for that check. Before the check opens your camera, we show you a separate short notice naming Didit and ask for your explicit consent; without it, nothing is sent. If you agree, Didit receives the live capture from the check and, where we already hold your profile photo, that photo, so the capture can be compared against it. Didit does not receive your messages, your matches, or the rest of your profile. No government ID is asked for in this check. Didit processes and stores check data in the European Union, on Amazon Web Services, by default. We have set Didit to delete the data from your check 30 days after the check, and the face template created for a check is deleted when that check session ends; we do not ask Didit to keep templates. We have also turned off the setting that would let Didit use verification data to improve its models, so your check is not used for that. Didit may keep a fraud-prevention blocklist entry created from a check after the check data itself is deleted; removing one of those entries is a separate step we take with Didit when your erasure request covers it, and we tell you when it is done. When you delete your account or withdraw your biometric consent, we instruct Didit to erase your check sessions completely, including any retained template, and that instruction overrides the 30-day setting. A passed provider check means the liveness check passed: a real, live person was present for the check. It is not an identity verification, and we never describe it as one. If a provider check does not pass, that attempt ends, but it is never a ban: you can try again, or ask us for a human review of the decision, and that review can overturn it and verify you.

Read the full selfie verification notice

18. Changes

We announce material changes in the web app and by email at least 14 days before they take effect. A material change that applies to data we already collected, including biometric and sensitive data, applies only with your fresh consent. We keep prior versions available on request.

19. Photo checks in chats and on profiles

Some photos get an automatic check for explicit content. In a private chat, the check runs on the sender's own device, before the photo is encrypted and sent. It never runs on our servers. We never receive an unencrypted copy of the photo for this check, and we receive no score from it. The photo itself still travels and is stored only as encrypted message content, as section 9 describes. Encryption hides what was said. It does not hide that a photo was sent, when it was sent, or whether the sender's device flagged it. The only thing this check adds in plain form is the yes-or-no flag, next to the encrypted message. A flagged chat photo arrives blurred, and the person receiving it can tap to view it. Profile photos get the same check. When you add a public profile photo, the check runs on your own device before the photo is uploaded. It never runs on our servers. We receive no score from it, and the only thing the check adds is a yes-or-no flag stored with the photo. A flagged profile photo shows blurred to other members until they tap to view it. In your profile settings you can turn on 'NSFW is ok' (off by default) if you want flagged photos shown to you unblurred, on profiles and in private chats. We store the setting on your account. It is not shown on your profile, and it only changes what you see. Private photos are separate: they stay hidden until the owner grants you access, whatever your setting says. Your own photos are never blurred for you. The check is automatic and it can be wrong. It can miss an explicit photo, and it can flag a photo that is not explicit. A flag alone never creates a report. A member can still report a photo, and our other rules in the Terms still apply. A flag also never blocks a photo and never penalizes anyone. The flag alone is never grounds for enforcement; our other content rules still apply to the photo itself. This paragraph never limits our duties for unlawful content, including child sexual abuse material, which we remove and report as the law requires (18 U.S.C. Section 2258A). The flag is sensitive metadata: it shows that a photo was flagged as explicit. We do not use it for profiling or advertising. Photos cannot be sent in group-session chats at all.

20. Roommates

If you use Roommates, we store what your listing says: whether you have a room, need a room, or want to team up; the neighborhood; the budget; the move-in window and length of stay; your listing text; any photos you add; and your logistics answers (cleanliness, sleep and guest patterns, smoking, pets). We also store moderation results for listing text and records of reports about listings. A listing expires automatically 30 days after it goes live and is no longer shown. Listing photos and logistics answers are deleted 30 days after expiry; moderation results and report records are kept 6 years with the safety records described in this policy. Roommate matching reads only the logistics in this section. It never reads protected-trait information from your profile, such as race, sexual orientation, gender identity, family status, disability, or lawful source of income. Stating anything like that on your profile is always optional, and Roommates does not use it for listings, search, filtering, or matching. Messages with another member about a room go through the same encrypted chat described in this policy. We collect no rent, deposits, or fees for Roommates, and we run no background checks.

21. How we handle your information inside FindLucid

Privacy is a core value at FindLucid.com. Members trust us with their information, and we protect it, including from ourselves. Nobody here browses member profiles or photos for oversight or curiosity. A member's record can be opened only for these purposes: running a verification review the member requested, answering the member's own support request, acting on a report or complaint about that member, safety investigation of that member, or a legal obligation. Nothing else opens it. These limits bind everyone involved in running FindLucid, whatever their role: staff, moderators, support, agents, associates, and owners. No one at the company has standing access to a member's personal profile or photos. A member's record opens to any of us only for the purposes above, and an owner's account opens a member's record only in connection with a report or complaint about that member. The blur on flagged explicit photos in section 19 applies in full to owner accounts: an owner sees flagged photos only blurred, even inside that complaint flow, and no internal setting or override lifts that blur for an owner.

22. Who operates FindLucid.com

FindLucid.com is operated by FINDLUCID LLC, 99 Wall Street #1978, New York, NY 10005. Privacy contact: support@findlucid.com. This policy is effective October 17, 2026; last updated November 5, 2026 (version 2026-11-05).

23. Concierge date facts

If you use Plan a date in the Concierge, the planning facts you choose to give are stored in a dedicated record tied to your account: your planning area, budget comfort, what to skip, the plan-around facts you give (step-free access needs, allergies, and quieter-place needs), and the music you love (genres and favorite performers). They are used only to plan dates for you. Limitations facts (step-free access needs, allergies, and quieter-place needs) are saved only with your explicit agreement given in the flow. They are never shown on your profile, never shared with another member, and never sent to our AI provider as your data in another member's conversation. In Plan Together rooms the planner applies everyone's saved facts together without telling anyone whose facts shaped the plan or what they are. You can see, change, or fully clear your date facts at any time in the Plan a date flow (Forget my date facts), and the record is deleted when your account is deleted.