Privacy
Your address book stays under your control.
Philia collects only what is needed to deliver invitations, match chosen contacts, prevent abuse, and operate the service.
What the server stores
Philia stores your display name and verified login, recovery contacts you verify, provider IDs verified through official OAuth, contacts you choose to sync, and questions and clues you create. It never receives social passwords or contact photos.
Contact directory
A selected phone number or email is normalized and stored once in a shared directory. Contact names stay separate and are never treated as verified identity. Unsyncing removes your selected batch; a detail remains only while another authorized sync or account references it.
Question matching and invitations
Recipients must come from contacts you added. The server checks ownership and converts the normalized phone or email into a keyed matching value without storing the raw target with the question. Generic invitations never contain your identity, question, or clue.
Social verification
A typed handle is not proof of ownership. Verification requires the provider’s official consent screen and a stable account ID. Unsupported handles stay private hints and cannot create a match.
Questions and retention
Questions and clues are stored to deliver them and check mutual matches. They remain private and are not public profile content. Expiry and deletion jobs must be enabled before production retention promises are offered.
Access boundary
Authenticated server routes are the only path to the database. Browser code never receives service credentials, and Philia does not call server-readable records end-to-end encrypted.
Profile images and motion
A replacement avatar is stored as one size-limited private image and overwrites the previous image. Optional motion effects use local sensor values only; those values are never transmitted, recorded, or used for identification.
Authentication and analytics
Firebase provides phone, email, and Google authentication and may use reCAPTCHA to prevent abuse. Philia verifies the ID token but stores no OTP, password, or reCAPTCHA token. Analytics must never receive contacts, questions, clues, identity documents, or private chat.
Adult eligibility and Terms
The submitted birth date is used only to determine whether someone is at least 18 and is not stored. Philia records the result, assurance method, Terms version, and acceptance time.
Safety reports and support
Ordinary peer chat stays off Philia’s servers. A submitted report may include up to ten selected text messages for trained reviewers; images are excluded. Support requests retain only the details needed to respond.
Deletion and retention
Account deletion removes authentication, application records, private profile images, and uploader-owned contact links. Narrowly necessary safety, fraud, payment, or legal evidence may remain under restricted access and cannot rebuild a deleted profile.
Your choices
You can unsync contacts, revoke contact permission, disable analytics, block accounts, leave conversations, report safety concerns, and permanently delete your account.