Privacy Policy

Find Albi ("we," "us," or "our") operates the Find Albi mobile application and website (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using Find Albi, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

We collect the following categories of information, mapped to standardized statutory categories where applicable:

Account Information (Identifiers) When you create an account, we collect your email address for authentication via magic link sign-in and your preferred name for personalization. We do not collect passwords.

Profile Content (Identifiers; Sensitive Personal Information) If you use our coaching features, you may voluntarily submit dating profile text (bios) and photos for AI analysis. We process this content solely to generate coaching feedback. Uploaded photos and bio text submitted for one-time analysis are deleted within 24 hours of processing. Content you explicitly save (e.g., bookmarked tips) is retained until you delete it or your account.

Practice Session Data (Internet or Electronic Network Activity) When you use the Social Gym (practice simulator), we store session metadata including scenario played, completion stage, message count, and timestamps. Chat messages within practice sessions are stored to enable session continuity and are retained for the lifetime of your account.

AI-Generated Reports (Inferences) Performance reports, coaching grades, and feedback generated by AI models based on your practice sessions are classified as "Inferences." These are derived from your interactions and stored alongside your practice session data.

Saved Tips (Internet or Electronic Network Activity) When you bookmark coaching tips during practice, we store the tip content and associated scenario metadata so you can review them later. Saved tips are retained until you remove them or delete your account.

Usage Analytics (Internet or Electronic Network Activity) We use PostHog for product analytics. During beta testing, session recording may be enabled to capture screen interactions for usability research. All text inputs and images are automatically masked and never recorded. Session recording is disabled by default and only activated during designated testing periods. Analytics data is retained for 12 months, after which it is aggregated and anonymized.

Device Information (Internet or Electronic Network Activity) We automatically collect standard device information (device type, operating system, app version) to ensure compatibility and diagnose issues.

Find Albi offers a public "Roast My Profile" feature at /roast that lets anyone — without creating an account — submit a dating profile bio (and optional photos) and receive an AI-generated humor critique by email. Because this feature is anonymous and one-shot, it has its own narrowly scoped data handling rules described below. None of the rest of this Privacy Policy's account-based provisions apply unless you also have a Find Albi account.

What we collect when you use Roast My Profile:

| Data | Why | Where it goes | |---|---|---| | Email address | To deliver your roast result via email and to enforce a one-roast-per-email limit | Stored in our database; used by our email provider to send you a single results email | | Bio text you paste | Sent to a third-party AI model to generate your roast | Stored in our database alongside the generated result | | Photos you upload (optional, up to 3) | Sent to a third-party vision AI model to inform the roast | Not stored. Photos are passed to the AI model at request time and discarded immediately. Only their decoded byte length and validated MIME type are kept long enough to validate the upload. | | Your IP address | Rate limiting and abuse prevention only | Held in memory for one hour, never written to our database |

Retention — 30 days, automatically enforced. All bio text, email addresses, and roast results submitted to the public roast feature are hard-deleted within 30 days by an automated daily cleanup job. After 30 days, the corresponding share link will return a "not found" page. We do not need to keep this data longer to operate the feature, and we deliberately optimize for short retention.

Email delivery. The single results email is delivered via Google Workspace SMTP. Google's processing of this email transit is governed by Google's standard Workspace data protection terms. We do not send marketing emails from this address; the only message you will receive is the one-time delivery of your Vibe Score result.

One roast per email. The public roast feature is gated to one submission per email address (after Gmail-style normalization for dots and + aliases). This is implemented to protect against abuse and to keep AI inference costs bounded; it is not a tracking mechanism.

No account, no profile, no link. Submitting a roast does not create a Find Albi account, and we do not link the email you submit to any existing Find Albi account even if it matches one. The public roast pipeline is intentionally siloed from the authenticated coaching product.

Right to earlier deletion. You can request deletion of your roast data before the automatic 30-day window by emailing privacy@findalbi.com with the email address you used to submit. We will delete your row within 7 days of verifying your request.

If you are located in the European Economic Area (EEA) or United Kingdom (UK), we rely on the following legal bases under GDPR Article 6 for processing your personal data:

• Contractual Necessity (Art. 6(1)(b)): Processing your email address for account creation and authentication; storing practice session data and chat messages to deliver the Service you requested.
• Explicit Consent (Art. 6(1)(a)): Processing your dating profile content (bios and photos) through AI models for coaching feedback. You provide this consent each time you submit content via our scoped consent notice. You may withdraw consent at any time by ceasing to submit content or deleting your account. The public Roast My Profile feature also relies on explicit consent — by submitting your bio you consent to its single-purpose use for roast generation, with mandatory deletion within 30 days.
• Legitimate Interests (Art. 6(1)(f)): Collecting device information and usage analytics to maintain, secure, and improve the Service. We balance our interests against your rights and only collect what is strictly necessary.
• Legal Obligation (Art. 6(1)(c)): Retaining certain records where required by applicable law (e.g., transaction records for tax compliance).

Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your profile content and practice conversations through AI models to generate coaching feedback
• Store your practice session history and saved tips
• Analyze usage patterns to improve the Service
• Communicate with you about your account or the Service
• Detect and prevent fraud or abuse

We do not use your personal content to train AI models. Your submitted profiles and chat logs are processed in real-time to generate feedback and are not added to any training dataset.

We retain your data only as long as necessary for the purposes described in this policy:

| Data Type | Retention Period | |---|---| | Account information (email, preferred name) | Lifetime of account; deleted immediately upon account deletion | | Profile content submitted for coaching | Deleted within 24 hours of processing | | Practice session metadata & reports | Lifetime of account | | Chat messages (practice sessions) | Lifetime of account | | Saved tips | Until you remove them or delete your account | | Public Roast submissions (email + bio + result) | 30 days, automatically hard-deleted by a daily cleanup job | | Public Roast photos | Not stored — discarded immediately after the AI request completes | | Usage analytics | 12 months, then aggregated and anonymized | | Session recordings (beta only) | Deleted when the beta period ends | | Payment transaction records | 7 years (legal/tax obligation) |

Inactive accounts: If your account is inactive for 18 months, we will send a notification to your registered email. If there is no response within 30 days, your account and all associated data will be permanently deleted.

Find Albi uses artificial intelligence to generate coaching feedback, practice conversation responses, and performance reports. Here is how these systems work at a high level:

How AI coaching works:

1. When you submit profile content or engage in a practice conversation, your input is sent to a third-party AI model.
2. The AI evaluates your input against communication principles (e.g., conversational flow, engagement signals, tone calibration) and generates structured feedback.
3. Feedback is categorized by severity (positive reinforcement, nudges, warnings, critical errors) and tagged with the underlying principle (e.g., game theory, neuroscience, communication, attachment theory).
4. Performance reports assign a letter grade (A+ through F) based on aggregated feedback across a practice session.

Important limitations:

• AI-generated feedback is advisory only and does not constitute professional advice.
• No real-world decisions (e.g., account restrictions, access limitations) are made solely by automated means. Tier limits and session caps are rule-based, not AI-driven.

Your rights regarding automated processing:

• Right to Human Intervention: You may request that a human review any AI-generated coaching assessment by contacting us at the email below.
• Right to Contest: You have the right to contest the substance of any AI-generated feedback or report.
• Right to an Explanation: You may request an explanation of how a specific AI output was generated.

To exercise any of these rights, contact us at privacy@findalbi.com.

Find Albi uses third-party AI model providers to power coaching feedback and practice conversations. When you use these features, your input is sent to these providers for real-time processing.

These providers process your data according to their own privacy policies and data processing agreements. We select providers that do not use API inputs for model training. Your data is transmitted securely and is not stored by these providers beyond what is necessary to fulfill the request.

We share data with the following specific third-party entities ("subprocessors") to operate the Service:

| Subprocessor | Purpose | Data Shared | |---|---|---| | Google (Gemini API) | AI model provider for coaching feedback, practice conversations, and roast generation | User-submitted text, chat messages, roast bios, roast photos (transient) | | OpenAI (GPT API) | AI model provider (alternative/fallback) | User-submitted text, chat messages | | Anthropic (Claude API) | AI model provider (alternative/fallback) | User-submitted text, chat messages | | Google Workspace (Gmail SMTP) | Transactional email delivery for the public Roast feature only | Recipient email address, single results email | | Supabase | Cloud database and authentication | All account and session data | | Vercel | Web application hosting | Web traffic, server-side request data | | PostHog | Product analytics and session recording | Anonymized usage events, masked screen recordings | | Stripe | Payment processing | Payment method details, transaction records | | RevenueCat | Subscription management | User ID, subscription status, purchase history |

All subprocessors are bound by data processing agreements (DPAs) that require them to protect your data in accordance with applicable law. We will update this list if our subprocessors change and notify you of material additions.

Your data is stored securely using Supabase, a cloud database platform with enterprise-grade security. All data is encrypted in transit (TLS) and at rest. We use Row Level Security (RLS) policies to ensure users can only access their own data.

We implement appropriate technical and organizational measures to protect your information. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

We do not sell, rent, or trade your personal information.

We share your information only with the subprocessors listed above and in the following additional circumstances:

• Legal Requirements: We may disclose your information if required by law, court order, or governmental regulation.
• Safety: We may disclose information if we believe in good faith that it is necessary to protect the safety of any person or to address fraud or security issues.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections described here.

You have full control over your data:

• Access & Export: You can view your practice history, saved tips, and account information within the app.
• Deletion: You can permanently delete your entire account and all associated data at any time from the Settings page. This immediately removes your profile, chat history, practice sessions, saved tips, and all other records. Deletion is completed within 24 hours.
• Public Roast Deletion: Public Roast submissions are automatically hard-deleted within 30 days. To request earlier deletion, email privacy@findalbi.com with the address you used to submit.
• Opt Out of Analytics: Session recording (when active) can be opted out of by contacting us.

EEA/UK residents also have the right to:

• Access, rectify, port, and erase your data
• Restrict or object to certain processing
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

To exercise these rights, contact us at the email below.

Find Albi is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us and we will promptly delete it.

Notice at Collection: This Privacy Policy serves as our notice at collection. The categories of personal information we collect and the purposes for which they are used are described in the "Information We Collect" and "How We Use Your Information" sections above. We do not collect personal information for purposes materially different from those disclosed.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with the following rights:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information. You can do this instantly via Settings > Delete My Account.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: We only use sensitive personal information (dating profile content) for the purposes you explicitly consent to.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Global Privacy Control (GPC): We honor Global Privacy Control signals. If your browser or device transmits a GPC signal, we will treat it as a valid opt-out request for the sale or sharing of personal information under applicable law. No further action is required on your part.

To exercise your California privacy rights, contact us at privacy@findalbi.com or use the in-app account deletion feature. We will verify your identity before processing requests and respond within 45 days as required by law.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy within the app and updating the "Last Updated" date at the top. Your continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Find Albi 2108 N St Ste N Sacramento, CA 95816 United States

Email: privacy@findalbi.com App: Use the "Delete My Account" feature in Settings for immediate data deletion.