Privacy Policy

Effective

Contents

This policy explains what Beau collects, why, who can see it, how long it lasts, and what you can do about it. It is written to be read, so it says the uncomfortable parts plainly.

The short version. Beau is a missed-connections app. Its core content is a description of a person who may not be a Beau user and has not agreed to be described. If you turn on Nearby, Beau records a coarse location trail (about 110 m) while the app is closed. Post and profile photos are reachable by anyone with the link, signed in or not. Beau records app sessions for analytics, and those recordings include chat threads and photos. Deleting a post or your account does not remove every copy. Each of these is explained in its own section below.

1. Who we are and how to reach us

Beau is operated by Hank Software, LLC (“we”, “us”), a New York limited liability company. We are the controller of the personal data described in this policy.

Privacy questions and requests: privacy@heybeau.app. Removal requests from people who are described in a post and do not have a Beau account: safety@heybeau.app. All notices and requests under this policy may be sent by email; we do not require, and do not publish, a postal address.

2. Information you give us

Account

You create an account and sign in with one of three ways: with your email address (using a password or a passkey), with Apple, or with Google. If you use your email address, we store that address and the credential you use to sign in. If you use Apple or Google, we receive the sign-in identifier that provider issues for Beau and, if you share it, your email address. Apple’s identifier is specific to Hank Software, LLC’s Apple developer team; if the app were ever moved between teams, that identifier would change and you might need to sign in again. We ask for your date of birth and use it for one purpose: to calculate and display your age on your profile. We keep it until you delete your account. Beau does not verify age; the date you enter is taken as given (see Section 15).

Profile

Your display name, profile photos, and the categories you choose to describe yourself. The available categories include terms such as Bisexual, Transgender and Discreet, and fields for who you are interested in and what you are open to. These describe sexual orientation, gender identity and sexual preferences and are treated as sensitive data (see Section 9). Beau does not collect HIV status or testing dates. Your profile is visible to every signed-in Beau user.

Posts

A post is a first-person description of an encounter: your story, descriptors of the person you saw (build, clothing, what they were doing), the place, the time, and optionally a photograph. The photograph may be of the person you are describing. Posts are readable by every signed-in user and expire 45 days after they are created.

Messages and chat media

The text and photos you send in a Beau conversation. A conversation opens only after the consent gate described in our Terms is passed. Messages are stored for the life of the conversation, and a copy of anything you send remains in the other participant’s conversation even if you delete a post or your account.

Claims and hand-raises

When you indicate that a post might be about you (“that might be me”), we record the claim, the time, and its outcome (accepted, declined, or pending). A decline is delivered to you and is attributed to the person who declined.

Events and RSVPs

If you RSVP to an event, your RSVP and your profile photo appear on that event’s guest list, which is visible to other signed-in members.

Reports and support

When you report a post, profile or message, we store the report, the reason you give, and the reported content, and we keep the reported content for moderation even if the sender later deletes it.

3. Information about people who are not Beau users

Plain language. Beau posts describe real people. Many of them have never heard of Beau. If you are one of them, Section 12 tells you how to have a post removed without creating an account.

The central function of Beau is the processing of personal data about a third party: the person described in a post. That data may include a physical description, clothing, behavior, the venue and time of an encounter, and a photograph. We do not verify that the described person consented to being described or photographed, and we cannot: they are, by definition, someone the poster could not reach.

We process this data because it is the purpose of the service and the reason the poster is using it: to reconnect with someone they met. We weigh that against the described person’s interests and rights, and that balance is why Beau limits what a post may contain (see the Community Guidelines: describe the moment, not a way to find the person again), screens every post automatically before it can match, rejects identifying and sexual imagery, expires every post at 45 days, and provides a removal route that works without an account.

4. Information collected automatically

When you search for a venue while composing a post, the text you type is sent to Google Places together with your device’s last cached coarse location, so results are biased toward where you are. Google receives the query and a neighborhood-level location. Google’s own privacy policy applies to that request, and place data displayed in Beau is attributed to Google as its terms require.

The Nearby location trail (background location, opt-in)

Plain language. If you turn Nearby on, Beau asks iOS for “Always” location permission and records where you arrive and leave even when the app is closed. Each point is blurred to roughly a city block before it is stored. You cannot read the trail back, and neither can we through the app. Turn Nearby off and the whole trail, and every conclusion drawn from it, is erased.

Nearby is off by default. If you turn it on, Beau requests the “Always” location permission on iOS (and background location with a geofence on Android). The trail is built from visit and significant-location events reported by the operating system, so writes happen while the app is not running. We store four kinds of event: arrival, departure, waypoint, and app-open. Before storage, a database trigger coarsens each coordinate to approximately 110 meters; the precise coordinate is not retained.

The trail cannot be read back by you, by any Beau client, or by any other user. Beau’s server compares your coarse trail against the place and time in posts, and when your trail is plausibly near an encounter it records a proximity hit that surfaces the post to you as one you may have been present for. Proximity comparison happens on our server, not on your device.

Retention runs on two clocks. Raw trail events are deleted after 30 days. Proximity hits, which are conclusions drawn from the trail, are retained indefinitely by design, so that a post you were plausibly near can still be surfaced after the underlying trail has expired. Dismissing a proximity hit hides it from you; it does not delete the record. Switching Nearby off erases the trail and every proximity hit derived from it, not just future collection.

Device and usage analytics

We use PostHog (hosted in the United States) to record named events (what you tapped, which screen you were on), feature-flag assignments, reports of crashes in the app’s native code, and a city-level location derived from your IP address.

Performance and error monitoring

We use EAS Observe, a service operated by Expo (United States), to measure how quickly Beau starts and moves between screens, and to record errors in the app’s code together with the technical trace of where in the code they occurred. Observe identifies your installation by a random identifier that is generated by the app and reset if you uninstall and reinstall it; it also receives your device model, operating system version and app version. It does not receive your account, your name, your email, or the content of anything you write, and we do not link it to your Beau account. Screen names sent to Observe are the type of screen (for example “a post”), never which post, profile or conversation it was.

Session recordings

Plain language. Beau currently records the screen for every session, on every screen. Text you have typed but not sent is masked. Photos, and messages that have already been sent, are visible in the recording. This includes private conversations.

PostHog session replay is enabled for all sessions. The recording captures the sequence of screens and interactions as rendered on your device. Text you are typing is masked before it is captured. Images are not masked, and messages already sent in a conversation are visible in the recording, including chat photos. Recordings are stored in the United States and are retained for 30 days, then deleted. We use recordings to diagnose bugs and understand how the app is used. Access is limited to Hank Software, LLC staff with a support or engineering need.

Notifications

Push notifications are delivered through Apple’s and Google’s push services via Expo. A notification may contain the sender’s display name and the text of a message, or a post’s headline, and can appear on a locked screen. A notification never reveals the identity of a person who has raised a claim on your post before you accept it. To hide notification content on your lock screen, use your device’s notification preview settings; Beau does not override them.

5. How we use information

Content you write is not used to train Anthropic’s models, and we do not permit any processor to use your content to train machine-learning models. We do not sell personal data and we do not share it for cross-context behavioral advertising. Beau does not show advertising.

6. Automated decisions and how to get a human to look

Three automated systems can affect you without a person deciding first: the safety screen can prevent a post from matching; the photo classifier can reject a profile or post photo before anyone sees it; and three reports on a post hide it automatically pending review. A rejected photo is retained for approximately 30 days so that you can appeal, then purged; it is not deleted at the moment of rejection.

You can ask for human review of any of these outcomes from the post or photo itself, or by writing to safety@heybeau.app. A Hank Software, LLC moderator will review the decision and tell you the outcome. We will respond within 24 business hours.

7. Who can see your information

Item Who can see it
Profile Every signed-in Beau user. Profile photos are additionally reachable by link; see the row below.
Posts Every signed-in Beau user, for 45 days. A deleted post remains readable to anyone who was already matched through it.
Post and profile photos Anyone who has the link, signed in or not. Post and profile photos are stored in publicly readable storage; the URL is permanent, unauthenticated and can be indexed. A photo rejected by moderation remains reachable by URL until the purge sweep, up to about 30 days.
Messages and chat photos The other participant. If either participant reports a message, that message and any attached photo become readable by a Hank Software, LLC moderator. Moderators cannot read conversations that have not been reported.
Event guest lists Signed-in members viewing the event, including your profile photo.
Nearby trail No one, including you. Only the server’s proximity comparison reads it.
Session recordings Hank Software, LLC staff with a support or engineering need.

8. Service providers

We share personal data with the following processors, each bound by contract to use it only to provide their service to us. This list must match the App Privacy labels in App Store Connect field for field.

Provider What reaches them Why
Supabase Everything: account, profile, posts, photos, messages, location trail, reports Hosting, database, storage, authentication (AWS us-east-1, United States)
Loops Your email address and the six-digit code inside the message — sign-in, sign-up confirmation and password recovery — plus delivery records for those messages. No name, profile, posts or messages. Sending account emails. Our emails carry a code and never a link.
Anthropic Post text (story, descriptors, place, time); search queries Match judging, safety screening, query parsing. Not used to train models.
Amazon Web Services (Rekognition) Profile and post photos Automated content classification
Google (Places) Typed venue queries plus coarse location bias Place search and place details
Apple and Google Map tiles and camera regions; notification payloads via APNs and FCM Maps, notification delivery
Expo Push tokens and notification payloads; a random installation identifier, device model, operating system and app version, startup and navigation timings, and error reports with code traces Push relay, over-the-air updates, performance and error monitoring
PostHog (United States) Named events, screen names, session recordings including chat threads and photos, IP-derived city, native crash reports Analytics, session replay, feature flags, crash reporting

We may also disclose personal data to comply with law or a valid legal request, to protect the safety of a person, to enforce our Terms, or to a successor in a merger, acquisition or sale of assets, in which case this policy continues to apply. We disclose information to law enforcement only under valid legal process or where we believe there is a credible threat to someone’s safety.

Almost everything Beau processes reveals sexual orientation. Membership alone implies it; the profile categories and the “interested in” and “open to” fields describe orientation and sexual practice directly; and the Nearby trail records presence at gay venues, saunas and Pride events, from which orientation can be inferred. Under several US state privacy laws this is sensitive data, and some treat parts of it as consumer-health data.

We collect only the sensitive information you choose to give us: the profile fields you fill in, and, if you turn it on, the Nearby trail. Every one of these is optional. We process it on the basis of your acceptance of the Terms of Service and this Privacy Policy when you create your account, and you can withdraw that at any time by removing the profile fields, turning Nearby off (which erases the trail), or deleting your account.

10. How long we keep information

Data Kept Note
Account and profile Until you delete your account Subject to the limits in Section 11
Posts 45 days, then expired A lifespan, not a deletion: the record is retained in expired state
Deleted posts Indefinitely, soft-deleted Still readable to an existing match participant
Nearby location trail 30 days Erased entirely, with all proximity hits, if Nearby is switched off
Proximity hits Indefinitely Outlives the trail; dismissal hides, does not delete
Rejected photos About 30 days, then purged Retained for appeal; not deleted on rejection
Moderation events Indefinitely Labels, confidence and thresholds for each decision
Messages Life of the conversation A copy remains with the other participant
Reported messages Retained for moderation Readable by an administrator
Session recordings 30 days Deleted by PostHog on our configured schedule
Date of birth Until account deletion Used only to display your age

Where a retention period says “indefinitely”, we keep the record for as long as the account or the related conversation exists, and thereafter only as needed for moderation history, legal compliance or defense of claims.

11. Deleting your account, and what deletion cannot reach

Plain language. Deleting your account removes your profile, your photos, your Nearby trail and your access. It does not remove every trace of you, and the exceptions are deliberate.

You can delete your account from Settings. When you do, we delete your profile, profile photos, sign-in link, Nearby trail and proximity hits, RSVPs and pending claims. Four things survive, by design:

  1. Deleted posts are soft-deleted. A post you delete is hidden from feeds and search but stays readable to anyone already matched through it, so a conversation that began from it keeps its context.
  2. Messages you sent remain in the other person’s conversation. We do not reach into another user’s conversation to remove your side of it.
  3. Reported content is retained for moderation. A reported message and its photo stay in our moderation records.
  4. A description of you inside someone else’s post is theirs, not yours. If you were described in a post, deleting your account does not remove that post. Use the removal route in Section 12 instead.

Post and profile photos that were reachable by URL become unreachable when the underlying storage object is purged, which may take up to 30 days after deletion.

12. If you are described in a post and do not use Beau

You do not need an account to ask us to remove a post about you. Email safety@heybeau.app with enough detail for us to find the post (where and roughly when the encounter was described, and anything about the description that identifies it as you). You do not need to prove it is you; if the post plausibly describes you, we will remove it. We will respond within 24 business hours. We will not tell the poster who asked.

If the post contains a photograph of you, we remove the photograph immediately on request. If a post reveals that you were at a place where being seen could harm you (see the Community Guidelines), we treat it as an outing report and remove it without waiting for you to identify yourself further.

13. Your choices and rights

Controls in the app

Rights under applicable law

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to certain processing, to withdraw consent, to opt out of sales or targeted advertising (Beau does none), and to not be discriminated against for exercising these rights. To exercise a right, email privacy@heybeau.app; we will verify your request through your signed-in account or, for non-users, through the details of the post in question, and respond within the time the law allows (45 days for most US states, extendable once). You may appoint an authorized agent where the law permits.

14. Security, and the screenshot block

We use administrative, technical and physical safeguards appropriate to the data, including encryption in transit, row-level access policies in our database, and access restricted to staff with a need. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur.

Beau’s chat screen blocks screenshots on the device. That block is a courtesy, not a guarantee: it can be defeated with another camera or on some devices, and it does not apply to Hank Software, LLC’s own session recordings described in Section 4, which do capture chat screens. Do not rely on the block for anything you would not want kept.

15. Children

Beau is for adults, and you must be 18 or older to use it. We do not verify age or identity, and we do not use age-assurance technology; we rely on the date of birth you provide. We do not knowingly collect personal data from anyone under 18, and no post may describe anyone who appears to be under 18. If you believe a minor has an account or is described in a post, email safety@heybeau.app; we remove such accounts and posts immediately and, where the law requires, report to the appropriate authority.

16. Where your data is processed

Beau is offered in the United States. Hank Software, LLC is based in the United States, and our providers process data in the United States. If you use Beau from outside the US, your data is transferred to and processed in the US, where the law may differ from the law where you live and where government authorities may be able to obtain it under US law.

17. Web and cookies

Beau is a mobile app and does not use cookies. Our marketing website (heybeau.app) does not use cookies. Because neither uses cookies or tracking technologies, browser “Do Not Track” and Global Privacy Control signals have nothing to act on.

18. Changes to this policy

We will post the date of the current version at the top of this page and keep previous versions available. For material changes, especially any change to what Beau records in the background, what is publicly reachable, or what is recorded in sessions, we will tell you in the app before the change takes effect and, where the law requires, ask for your consent again.