Privacy

Who holds it

HideShow is operated by ADRIANO DE. S. BAVIERA TECNOLOGIA DA INFORMACAO, trading as ALDL (registered CNPJ 35.232.261/0001-11), Rua Dea Lucia, 25, São Paulo - SP, CEP 05855-275, Brazil, established in Brazil. Privacy questions go to support@hideshow.chat, or through the contact form, which does not require an account.

What we collect

Everything below is either something you typed, something you uploaded, or something the product had to record in order to work. There is no advertising network here and no third-party analytics script; nothing on this site is watching you on behalf of somebody else.

Because you cannot have an account without it

• Email address and a password hash. The password itself is never stored; what is stored cannot be turned back into it.
• Date of birth. Used to compute an age and to refuse anybody under 18. The date is not shown to other people; the age is.
• That you confirmed you are 18 or over, and when. The tick on the sign-up form, kept as the record that the question was asked and answered.

Because you chose to put it on a profile

• Photographs. Shown behind a torn paper that tears away as chemistry grows: see the reveal ladder. Our server removes the face wherever the paper hangs before anyone else receives the picture. Stored as several processed sizes, never as the original upload alone.
• A main photo that was not accepted. A small copy, without its location or other details, is kept for 48 hours so our team can see what went wrong, then deleted automatically. Only our administrators can see it.
• Profile videos, if you add any. Stored as uploaded, with one still frame. Before 100% chemistry others see only that a video exists and how long it is; neither the video nor its frame is sent to them.
• Name, ID, bio, gender, languages, education, what you are looking for, relationship status, children, smoking, drinking, interests. All optional except the ID, and all visible to people you can be discovered by.
• City and country, and an approximate latitude and longitude derived from them. Used for the distance shown on a card. This is not device GPS: the product never asks your browser for your location.
• A selfie, if you ask to be photo-verified. Compared with your profile photographs and used for nothing else. If you choose Check automatically on the camera screen, which is the suggested option, face-matching software compares them, and when it is unsure, an OpenAI vision model is asked for a second opinion; for that, the selfie and up to three of your photos are sent to OpenAI, reduced in size, and OpenAI does not use them for training. That is processing of biometric data, done only with your explicit consent for that selfie, and the measurements taken of your face are used for that one comparison and not stored. Either way the selfie is deleted once the check is finished, and you can choose Have a person check instead and be verified by a person on our team.

Because the product is a conversation

• Messages, voice notes, stickers, gifts, reactions and photographs you send. Kept until you or the other person deletes the conversation, or until either account is deleted.
• A transcript of a voice note, when one was made. Optional, and the absence of one is a normal state.
• Puzzles asked and answered, kept as the record of what was asked and how it went.
• A chemistry score per conversation, computed from how the two of you talk, and the reveal level it unlocks.
• Read receipts, typing and online status, only while you are sending those signals; the setting is mutual, and turning it off stops you seeing them too.

Because you chose to keep something private

• Private photos, videos and notes. Encrypted before they are stored, titles included, so a leaked database or backup reveals nothing readable. This is encryption at rest, not end-to-end: the server unseals an item to show it to you and to each person you allow.
• Who you allowed, and when they last opened it. Each person is allowed individually. Access closes by itself if your conversation drops below Trusted, and you can take it back at any time. Nothing can stop someone you allowed from taking a screenshot.

Because somebody has to be able to be kept safe

• Blocks and reports you make. A report is visible to moderators with the conversation it concerns.
• An automated scam-risk signal on messages and conversations, from the same rating pass that scores chemistry.
• Conversations that are the subject of an open report are kept even if the account is deleted, because evidence that vanishes when the reported person leaves protects the wrong party.

Because the law requires it

• The IP address you signed in from, and when. Written when you create an account, when you sign in, and once a day while you stay signed in. Brazilian law (the Marco Civil da Internet, art. 15) requires the operator of an internet application to keep these records for six months and to hand them over only on a court order. So: kept for six months, deleted automatically after that, encrypted in the database, and readable by nobody through the app. There is no screen anywhere that shows them, to us or to anyone.
• Nothing else is logged with it. No device fingerprint, no page you visited, no advertising identifier.

Because we count which links bring people

• The tag on the link you arrived by. Links we post in emails, on Telegram and elsewhere can carry a tag such as utm_source=telegram; with no tag, the name of the website that linked here is used. It is kept in your browser for up to 30 days and saved with your account if you sign up. We only ever look at it as totals per link.
• A daily count of visits per link. Only a number: no IP address, no account and no identifier.
• Whether people come back. Each day we add one to a count of active members, and to a count of how many who joined in your week are still using HideShow. Only those numbers are kept. The one thing stored on your account for it is the date you were last counted, replaced every day, so there is no record of when you visit.

Because you spent money

• A credit ledger: every addition and every spend, with a reference to the payment. We do not see or store your card number; that stays with the payment provider.
• Names bought from the catalogue, and when.

Who else sees it

Only these, only for the stated job, and none of them for advertising.

• PayPal, and NOWPayments if you pay in crypto. They receive what a payment needs. We receive back only a payment reference and whether it succeeded.
• Google, if you choose Continue with Google. Google tells us your email address and that it has confirmed it. On the website that is all: not your name and not your photograph. In the Android app, Google’s sign-in also carries the name on your Google account, which the sign-up form fills in for you to keep or change, and your Google photo, which we do not keep. Google learns that you signed in to HideShow. You can sign in with an email address and password instead, and an account made with Google can set a password from "Forgot password" at any time.
• OpenAI. Message text is sent to be scored for chemistry and for scam risk, to generate a puzzle about a profile, and, only if you turn captions on during a call, to translate one spoken sentence. If you consent on the selfie screen and face-matching software is unsure, your selfie and up to three profile photos are sent for a second opinion on whether they show the same person. It is not used to train anything on our instruction. If you order stickers of yourself, the photos you pick (up to three) are sent to OpenAI’s image model to be drawn as cartoons; stickers of the two of you also send the other person’s photos, and only after they agree. When transcription is switched on, voice notes are sent to be written out as text. For “Us, in 10 years”, each of your main photos is sent to OpenAI’s image model to make one picture of the two of you, only after you have both said yes; the picture is kept for the two of you alone and deleted with the conversation or either account. Messages you write to Helena, our support assistant, are sent to OpenAI to be answered, together with what she needs about your own account to answer you (your balance, plan, recent credit history and verification status), and nothing about anyone else.
• Cloudflare Turnstile, when the human check is switched on, and only on the forms anybody can reach without an account: creating one, asking for a password reset, writing to us, and signing in after several failed attempts. It checks that a browser is a person rather than a script, and sees the request in order to do it. It is not used for advertising and sets no advertising cookie.
• An email provider, which delivers account mail (verification and password reset) and activity emails. What an activity email contains is described below.
• A STUN/TURN server during a video call, which sees network addresses in order to connect two people. Call audio and video are peer-to-peer and are never recorded.
• Where the files live: object storage for photographs, and a database. Both under our control.
• Nobody, for the photo check. A photo sent in a conversation is checked for explicit content by a model running on our own server, and if it is likely to be explicit the person it was sent to sees it blurred and is asked before it shows. The photo is not sent anywhere to be checked, and the check is not kept as a record against you.
• The friend you name for a date check-in, only if you set one. When you set it they get one email saying what it is. If you then do not check in, they get a second with what you told us -- where and when -- and the name and HideShow id of the person you were meeting, because that is the one thing a worried friend cannot find out another way. Nothing tracks where you are; the place is only the words you typed. The check-in is deleted with your account, and one that names you as the date stops naming you if you delete yours.

Captions on a call are transcribed by your own browser. Where the browser has a local speech model, no audio leaves your device; where it does not, the browser sends it to its own vendor, and the button says which is happening before you turn it on.

What an email contains

When email notifications are on and you are not using the app, we email you about new connections, likes, messages, gifts, missed calls, credits you receive and things shared with you. These emails can include the other person’s first name, their profile photo exactly as hidden or clear as it is for you in the app (attached to the email, not a link), your chemistry together, and a short preview: the first line of a message, or the name of a gift and its note. A message that disappears once read, or one our scam check flagged, is never quoted.

Email passes through your email provider and ours, and stays in your inbox until you delete it. You can keep the emails and remove the details: Profile, then turn off “Names, photos and previews in emails”, and each email will only say that something happened. You can also turn activity emails off entirely.

What is kept in your browser

No advertising or analytics cookies, and no third-party analytics. What is stored locally is your session token, the tag of the link you arrived by (for up to 30 days), and small preferences that never reach us: the language you picked, whether a call starts with your camera off, whether captions are on, and which conversations have shown you a one-time tip.

What the Android app keeps on your phone

The conversations you open in the app are kept on the phone, so you can read them without a connection: the chat list and the latest messages of each. They are encrypted with a key held in the phone’s secure storage, never included in a backup, and deleted, key and all, when you sign out or delete your account. One-time messages, photos, videos and voice notes are not kept.

How long

• While the account exists, for everything on it.
• Until deleted, for a conversation: by either person, from their side, or by ending it.
• Until you delete the account, at which point photographs are removed from storage as files and rows, conversations are deleted, and the profile is scrubbed.
• Six months, for the sign-in records above, counted from each record and not from the account. They are the one thing deleting your account does not remove, because the obligation to keep them is not ours to waive, and they expire on their own.
• Kept after deletion: an empty tombstone row so that references elsewhere do not dangle, any conversation that is the subject of an open safety report, the messages you wrote to support, the credit ledger, which is a financial record, and those sign-in records until their six months are up. Nothing else.

Where it lives

The company is Brazilian, and Brazilian law governs what it does with your data. The servers and the object storage holding it may be in Brazil, the European Union or the United States depending on where the service runs, and the providers named above are in several countries of their own.

If you are writing from outside Brazil, that means your data crosses a border to get to us. Brazil is a country the European Commission has not issued an adequacy decision for, so where EU law applies the transfer rests on the contractual safeguards we have with our providers and on your agreement to use a service run from Brazil. Your own country’s rights do not disappear because of where we are: you can always write to support@hideshow.chat and ask.

What you can do about it

• See all of it. Profile → Download my data gives you one JSON file: your profile, every conversation including what the other person wrote, your likes, your credit history.
• Take it elsewhere. That file is the portable copy.
• Correct it. The profile is editable.
• Delete it. Profile → Delete my account on the website, or You → Delete account in the Android app. Both ask for your password, because a stolen session token should not be able to delete anything. An account made with Google confirms with Google instead.
• Object, or complain. Write to support@hideshow.chat. If that does not settle it you can complain to the ANPD, Brazil’s national data protection authority (Autoridade Nacional de Proteção de Dados) (https://www.gov.br/anpd/).

One thing an export deliberately does not contain: who liked you without matching, and any report somebody made about you. Those are facts about other people, and a product where your data export names the person who reported you is a product where nobody can safely report anybody.