Privacy Policy

Information used by LinkUp

• Sign-in identity: a provider-issued user ID, verified email and available name. The app uses the email only for authentication and a server-configured moderator check. It does not include authentication emails in public profiles.
• Profile information: name, username, optional avatar and bio, general city/area, interests, eligibility result, accepted policy version and timestamps. The date of birth entered for eligibility is processed for the age check and is not saved in the LinkUp database.
• Hangouts: title, description, category, general area, date/time, capacity, optional cover, host and membership records. Private meeting details or an approved online link are stored separately from discovery responses.
• Social activity: group messages, connection requests and connections, saved hangouts, blocked accounts, reports, moderation actions, notifications and the last read message position.
• Technical information: temporary rate-limit counters, login session records when email authentication is enabled, and photo ownership, format, size and timestamps. Hosting and authentication providers process network/request information needed to operate their services.

Profile questions, photos and camera

New profiles require three different profile photos before entering the social experience. Existing accounts can retain their previous photo setup. You can add photos from your device or choose to take a profile photo with the camera. Camera access is requested only when you choose that option. No microphone access is requested. The camera stream is processed locally; pressing Take photo prepares and uploads a still image to the existing private R2 storage. The camera is stopped when closed, when leaving the capture component, or when the page is hidden.

Optional answers describe your ideal free afternoon, what you enjoy about meeting people and topics you like discussing. Draft answers, selected photo references, your place in setup and its update time are saved privately in D1 when you continue or save for later. Completing setup publishes your selected photos and answers with the profile to eligible members, subject to blocking. The first selected photo is the avatar. Incomplete drafts do not grant social access.

Photo content hashes are stored with image metadata to reject exact duplicate photos in a profile. They are not facial templates and are not exposed through public profiles. Images are compressed before upload and identifying image metadata is removed on the server; information visibly pictured is not automatically redacted.

Taking a camera photo is not liveness or identity verification. No liveness provider, automated face comparison or biometric-template system is connected. Live photo verification is explicitly unavailable and no verified badge is issued.

Drafts remain until replaced, completed or removed through account deletion. Replacing or removing a selection does not immediately delete an unused upload; remove unused uploads in Settings. Account deletion removes drafts, profile answers, uploaded photo bytes, references and content hashes through the existing retryable deletion flow.

Aadhaar verification

Aadhaar verification is not active in this version. No Aadhaar verification provider is connected, and this feature does not request or store card images, Aadhaar numbers, QR codes, OTPs, biometrics or verification results. Opening the verification page uses the existing account session and eligibility checks; it does not perform an identity check or grant a verified badge.

Do not include identity documents or government ID numbers in profiles, photos, captions or messages. Existing user-content uploads do not automatically detect or redact identity documents.

OWNER ACTION REQUIRED: Before enabling identity verification, complete the applicable provider/UIDAI onboarding, publish the actual provider identity, requested data, purpose, consent and withdrawal process, retention and deletion rules, and review the voluntary verification and age-assurance approach. These future practices must be reviewed before collecting verification information.

Experience photos and credits

Experience posts store the author, linked hangout, caption, audience, photo references and timestamps. Attendance confirmations record the event, attendee, confirming host and time. Credit transactions store the account, post/event reference, amount, transaction type and time; boost records store their start and expiry. These records support eligibility, credit limits, ranking and abuse prevention, using the same D1 database and private R2 image storage.

Authors choose eligible members, connections or only themselves. Boosting does not expand that audience. Blocks are checked when serving posts and photo bytes. Browser photo preparation resizes and compresses images; the server strips identifying image metadata. Visible details within a photo are not automatically redacted. Get permission from everyone pictured.

Deleting a post removes captions and photo bytes and reverses its reward. Minimal post identifiers and credit history remain until account deletion to prevent repeat rewards. Account deletion removes the account’s experience content, attendance and credit history. When a host deletes their account, experiences linked to their deleted events are removed too; other members’ credit reversal records remain in those members’ histories. Failed photo deletion hides the post immediately and can be retried. Reports are accessible only to the configured moderator, and human response staffing still requires owner setup.

What other members can see

Eligible signed-in members can see discoverable hangouts and public profiles, including general city and interests. Only joined participants can read the participant list, private meeting details and group chat. Members can report content they can access. Other members may copy information they see; share thoughtfully.

Blocking restricts the relevant profiles, requests, connections, shared group participation and chat through LinkUp’s server. It cannot control contact outside LinkUp or erase copies someone already obtained.

Why data is used

Information supports sign-in, eligibility checks, discovery, hosting and joining groups, chat, connections, account management, abuse prevention, reporting and deletion. LinkUp’s application code currently contains no advertising SDK, behavioural analytics integration, payments or data-sale feature.

Storage and service providers

The hosted application uses OpenAI Sites and Cloudflare infrastructure, with D1 for structured data and R2 for uploaded images. The project supports ChatGPT sign-in and has Supabase email sign-in configured. LinkUp does not receive the ChatGPT password.

Supabase processes account email/password credentials and verification/recovery delivery. Passwords pass to the authentication provider; LinkUp does not store them. Encrypted provider tokens and hashed opaque session identifiers are held server-side. Authentication emails use the owner-configured Resend SMTP integration. The operator must confirm actual provider regions and retention before public launch.

Meeting links open Google Meet, Zoom or Microsoft Teams only when a user chooses to open one. The provider receives that visit and handles any subsequent call under its own policies; LinkUp does not host or record calls. General-area map links open Google Maps with the selected area. Calendar export creates a file on the user’s device. The app does not automatically transmit those exports to a calendar provider.

Security and browser storage

Production delivery uses HTTPS. Application routes enforce permissions server-side, use parameterized database statements and validate inputs. Uploads accept bounded PNG/JPEG files and remove common identifying metadata. Private images and API responses are not intentionally cached by LinkUp’s service worker.

Provider cookies keep the configured sign-in session. If email authentication is enabled, LinkUp uses a Secure, HttpOnly, SameSite cookie containing a random session identifier. A separate cookie records explicit logout. Browser session storage remembers only whether the introductory animation has played. No security system can guarantee that all misuse or incidents will be prevented.

Retention and deletion

Profiles, messages, hangouts and social records remain until they are removed through applicable features, moderation or account deletion. Unused photos can be deleted in Settings. Rate-limit records expire and are cleaned during later requests. Optional email sessions expire after at most 30 days, or one day with a browser-session cookie when Remember session is unchecked.

Deleting a LinkUp account removes its profile, uploads, connections, requests, memberships, saved plans, messages, reports related to the account, notifications and hosted hangouts, including those groups’ messages. It also deletes the associated Supabase authentication user if that provider is enabled. It does not delete a separate ChatGPT account. A minimal deletion-completion record (user ID, status and timestamp) is retained for 24 hours and cleaned on later authenticated requests to prevent delayed writes restoring deleted data. A pre-existing suspension record may remain for abuse prevention. Moderator identities in retained actions are anonymized when that moderator deletes their account.

If cleanup fails, a pending deletion record remains and social access is stopped. The user can retry deletion in Settings. Hosted provider backups or operational logs may have provider-controlled retention that the operator must confirm.

OWNER ACTION REQUIRED: Confirm service regions, backup/log retention, suspension-record retention, legal bases and any legally required exceptions. Do not publish invented retention periods.

Your choices and questions

Edit your profile, remove unused photos, leave groups, remove connections, block/unblock members or delete your account. Visit Account deletion to start from a browser. Rights to access, correct or delete information may depend on the applicable jurisdiction.

OWNER ACTION REQUIRED: Publish a working privacy contact and response process so people who cannot sign in can request help or exercise their rights.

Age eligibility and updates

The initial social experience is configured for adults aged 18 or older. The age check is a date-of-birth declaration, not documentary identity verification. Accounts that fail eligibility cannot use social discovery. The operator must review the audience and age-assurance approach before a public launch.

Changes to this policy will be published here with an updated date. Material changes may require renewed acceptance.