Privacynotice

Where data protection law applies, SceneCheck, LLC is the data controller: the party that decides how your information is used. You can reach us at hello@scenecheck.app.

This notice covers the SceneCheck app, scenecheck.app, and the links people share from the app. It applies to anyone who uses the app, visits the site, or joins the early-access list.

• You sign up with your phone number: you give it.
• You fill in your profile or your health practices: you give it.
• You pair, confirm a scene, or leave feedback: you give it.
• You file a report, a crisis report or an appeal: you give it.
• You join the early-access list: you give it.
• You use the app or visit the site: collected automatically.

Your phone number. We send a code to it once, through Prelude, to check it is yours. We keep a one-way hash of it, never the number.

Your profile. Your scene name, pronouns, age range, years in the community and community links are stored as they are. Your bio, location, home community, limits, safeword, accessibility needs, FetLife link and the lists you pick (limits, role, orientation, relationship style, languages, negotiation style) are encrypted before they are stored. There is no photo and we never ask for your legal name.

Your sexual health practices, only if you fill them in. Every answer is encrypted before it is stored, and you choose who can see them.

Scenes and feedback. Who you confirmed a scene with and when, and your yes or no answers to the questions. These are sealed: stored so that only the service that counts scores can open them, and no screen shows who gave which answers. The one exception is a flagged safety case, which takes a typed reason to open. Every opening is logged.

Reports, crisis reports and appeals. The category you pick and what you write. What you write is encrypted.

Your device. A one-way hash of your phone's device ID, so a banned account can't simply come back, and a push token, encrypted, so we can send you notifications.

Usage. Screens you open and actions you take in the app and on the site, tied to a random account ID, never your number. Sensitive screens, such as health practices and reports, are recorded under a generic name. Nothing sensitive goes with your account ID: what a report or crisis report is about never reaches PostHog, and appeal reasons, moderation flags and health-profile choices are only counted as weekly totals with no account attached.

Your email, only if you join the early-access list on the website.

Running SceneCheck. Signing you in, pairing you with people, confirming scenes, and counting scene scores.

Who sees what. People you pair with see your scene name, pronouns and, once three different people have left feedback, your scene score. After a confirmed scene, they also see the rest of your profile. Your health practices show only to people you choose. Nobody can search for you.

Keeping people safe. A person reads every report. Opening one takes a typed reason, and every opening is logged. What you write in your profile, health notes, vouches and applications is screened automatically, by OpenAI, for hate, threats, graphic violence and sexual content involving minors. Reports and crisis reports are never sent for screening.

Fixing what breaks. Usage events go to PostHog and error reports to Sentry, tied to a random account ID.

• Download your data: Settings, Privacy & Data. It includes your profile, your scores, the feedback released about you, your appeals and your health practices.
• Delete your account: Settings. You choose whether your feedback is deleted or kept anonymously. Reports you filed or were named in stay, with your ID removed, because a safety record can't disappear when someone leaves. Feedback you kept anonymously stays until it is 48 months old. The admin audit log keeps its entries too, without your ID.
• Access and correction: email hello@scenecheck.app and we will reply within 30 days.
• Objection and portability: depending on where you live, you may object to how we use your information or ask for it in a portable format.
• Complaints: if you are in the UK or EU, you can complain to your local data protection authority.

The app and site only talk over HTTPS, and the app checks it is talking to SceneCheck's real server. Sensitive fields are encrypted with AES-256-GCM before they are stored. Your phone number and device ID are kept only as keyed one-way hashes. Who played with whom, feedback and reports are sealed, so only the service that counts scores can open them, with a key held in Amazon Web Services. Admin actions are written to an audit log that cannot be edited.

No system is perfectly secure. Each service we use runs its own security program.

Our database and servers run on Railway in the eastern United States (Virginia). Encryption keys are held in Amazon Web Services in the United States. PostHog stores usage data in the United States. If you use SceneCheck from the UK or EU, your information is transferred to the United States under the safeguards those providers offer, such as standard contractual clauses.

• Records of account-recovery attempts are deleted after 24 hours.
• Health practices you shared with a partner are anonymized in that shared copy after 90 days.
• Your account, profile and phone hash are kept until you delete your account, or until 24 months after your last sign-in. If you have notifications on, we send a push 30 days and 7 days before. Signing in keeps your account.
• Scenes are deleted after 24 months, with the health checks, shared health snapshots and pairing records that go with them. Feedback older than that keeps counting toward scores with no reviewer attached. Feedback is deleted 48 months after it was written.
• Closed reports and crisis reports are deleted 36 months after they were filed. If you delete your account sooner, reports stay with your ID removed, and crisis reports you filed are deleted.
• Moderation records are deleted 36 months after they were made: flags, appeals, role applications, custom list entries sent for review, and automatic screening results. Open ones wait until they are closed.
• A banned account is deleted 24 months after the ban, unless an appeal is still open. Its phone hash and device hashes stay on a ban list until 5 years after the ban, so the same phone or device can't sign up again until then.
• The admin audit log, the record of what admins did, is kept.
• Database backups keep a copy of the database for up to 3 months, so data you delete can sit in a backup until that backup expires.
• Your early-access email stays with Buttondown until you unsubscribe.

Prelude

sends and checks the sign-in code. It receives your phone number.

Railway

hosts our servers, our database and this website.

Cloudflare

answers the lookup that points your device to scenecheck.app. Your traffic itself goes straight to Railway. When you join the early-access list, Cloudflare also checks that a person sent the form. For that check your browser talks to Cloudflare, which sees your IP address and browser but not your email address.

Amazon Web Services

holds the key that seals scenes, feedback and reports, and records each time an admin opens a case.

OpenAI

screens what you write in your profile, health notes, vouches and applications. It receives the text only, not who wrote it.

PostHog

counts how the app and site are used.

Sentry

collects error reports from the app and servers.

Expo, Apple and Google

deliver push notifications.

Buttondown

keeps the early-access list.

scenecheck.app sets no cookies and stores nothing in your browser. The app keeps your sign-in and settings on your phone, encrypted if you turn on the app lock. There are no advertising trackers anywhere in SceneCheck, and nothing tracks you across other websites.

Write to hello@scenecheck.app. This is a working draft that reflects how SceneCheck works today. The final, legally reviewed version is being prepared with counsel before launch.