Privacy Policy

1. Information We Collect

Information You Provide:

When you create an account and use Besties, we collect:

• Name and school email address
• Photos you upload to your profile
• Academic information (major, graduation year)
• Interests you select
• Posts, comments, and other content you create
• Messages sent through the app
• Missed Connections posts and comments
• Coffee Chats topics you select and the card you place on the board

Information Collected Before You Have an Account:

If you join a waitlist, we collect the name, email address, and school you submit so we can contact you. If you attempt to create an account and the attempt is rejected — for example because the email address is not a valid school address — we may retain a record of the attempted address and the reason it was rejected, to protect the Service against abuse and to prevent invalid signups. We retain this information whether or not you go on to create an account.

Automatically Collected Information:

• Device information (type, operating system)
• Usage data (features used, interactions)
• Log data (IP address, access times)
• Push notification tokens (if enabled)

2. How We Use Your Information

We use your information to:

• Provide and operate the Service
• Create and maintain your account
• Connect you with other verified students
• Display your profile to other users
• Enable messaging and social features
• Send push notifications about activity
• Send you service-related communications, including updates, surveys, and requests for feedback
• Communicate with you about your account, the Service, and related matters
• Improve and personalize your experience
• Prevent fraud, abuse, and security issues
• Enforce our Terms and Conditions
• Comply with legal obligations

3. Information Sharing

With Other Users:

Your profile information (name, photos, major, graduation year, interests) is visible to other verified students, unless you have enabled Private Mode.

Direct messages are only visible to the intended recipients.

Coffee Chats:

Coffee Chats is opt-in. If you join the board, a card showing your name, photo, and selected topics is visible to other verified students browsing the board that week, and your card expires automatically. Because joining is an explicit choice to be found for this purpose, your card is visible on the board even if you have Private Mode enabled. You can choose not to join, and you control which topics you select.

Missed Connections Privacy:

Missed Connection posts are shown to other users without your name attached, and anyone responding to a post does so anonymously. Your identity is never automatically revealed to another user. However, Besties, Inc. maintains internal records that link posts and responses to the account that created them. We may access these records to investigate safety concerns, enforce our Terms, respond to reports, or comply with legal requirements. By using this feature, you understand that your posts and responses are not anonymous to Besties, Inc.

We Do Not Sell Your Data:

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We May Share Information With:

• Service providers (Firebase/Google for hosting, authentication, database, and analytics; Expo for push notification delivery and app updates; OpenAI for content moderation; Resend for sending email; Kickbox for verifying email addresses at signup)
• Law enforcement when required by law or to protect safety
• Other parties with your explicit consent

4. Push Notifications

If you enable push notifications, we collect your device's push token to send you notifications about messages, friend requests, and activity.

You can control notification preferences in your device settings or within the app.

5. Email

We use your email address to verify your account and to contact you about your account and the Service.

We may also email you when someone reaches out to you in the app — for example a friend request, a coffee invitation, or a message — if you are not able to receive push notifications and have not seen the activity. These emails tell you only that someone reached out; they never include the content of what another user wrote. Every such email includes an unsubscribe link, and unsubscribing stops these notification emails while still allowing essential account messages such as email verification.

6. Data Security

We implement reasonable security measures to protect your information, including encrypted data transmission (HTTPS/TLS), secure authentication, and access controls.

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention & Account Deletion

We retain your information for as long as your account is active or as needed to provide the Service.

When You Delete Your Account:

• Your profile is immediately hidden from all other users
• Your name is changed to "Deleted User"
• Your photos are removed from view
• Your push notification token is cleared
• You are signed out and cannot log back in
• This action is permanent and cannot be undone

Missed Connections posts and comments are an exception: because they were never displayed with your name, they may remain visible on the Service after your account is deleted, without being linked to your name or profile for other users. If you want one removed before deleting your account, delete the post first or contact us at support@allmybesties.com.

Data We May Retain After Deletion:

• Information required for legal compliance
• Information needed to resolve disputes
• Information necessary to enforce our Terms
• Aggregated, anonymized analytics data

8. Your Rights and Choices

You have the right to:

• Access your personal information
• Correct inaccurate information through profile settings
• Delete your account (Settings → Delete Account)
• Export your data (contact support)
• Control push notification preferences
• Block and report other users
• Enable Private Mode to hide from the Discovery feed

9. Children's Privacy

Besties is an adults-only Service, restricted to users 18 years of age and older who are current college students. The Service is not directed to children, is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18.

If we learn that we have collected personal information from a person under 18, we will delete that information and terminate the account promptly, without prior notice. We act on such reports as our highest priority.

If you believe someone under 18 has created an account or provided us with personal information, contact us immediately at support@allmybesties.com and we will remove the account and its data.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights including the right to know what personal information we collect, the right to delete personal information, and the right to non-discrimination for exercising your rights. We do not sell personal information.

To exercise these rights, contact us at support@allmybesties.com. We will respond within 45 days.

11. Third-Party Services

We use third-party services:

• Firebase (Google) — hosting, authentication, database, file storage, and analytics. Privacy Policy
• Expo — push notification delivery and over-the-air app updates. Privacy Policy
• OpenAI — automated content moderation for Missed Connections posts and comments. Privacy Policy
• Resend — delivery of account and notification emails. Privacy Policy
• Kickbox — checking at signup whether an email address is valid and able to receive mail. Privacy Policy

Analytics:

We use Google Analytics for Firebase to understand how the app is used — for example which features are opened and how often. This helps us improve the Service. This analytics data is about app usage and device characteristics; we do not use it to build advertising profiles, and we do not sell it.

Email Address Verification:

When you sign up, we send the email address you enter to Kickbox to check whether it is a real, deliverable school address. This protects the Service from invalid and abusive signups and prevents our messages from being sent to addresses that do not exist. We send only the email address for this check — not your name, profile, or any other information about you. Kickbox handles the data it receives under its own privacy policy, linked above, which describes its practices independently of ours.

Content Moderation:

We moderate Missed Connections posts and comments in layers. Some checks, including our prohibited-language filter, run entirely on your device as you type — this content is not sent anywhere for that check. In addition, Missed Connections posts and comments are sent to OpenAI's moderation API to detect and remove harmful content. According to OpenAI's data usage policy, API data is not used to train their models by default. However, OpenAI may retain this data for up to 30 days for abuse monitoring and safety purposes.

Your private communications are not sent to OpenAI. Direct messages, Coffee Chat conversations, group chats, and messages inside Missed Connections conversations are not proactively screened or monitored, and images are not screened. These surfaces rely on reporting and blocking, which you can use at any time.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by one or more of the following:

• Updating the "Last Updated" date above
• Posting a notice within the app
• Emailing users (for material changes)

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. International Users

Your information may be transferred to and stored on servers in the United States. By using Besties, you consent to this transfer.

14. University Affiliation

Besties is an independent service by Besties, Inc. and is not officially affiliated with, endorsed by, or sponsored by any university.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how your data is handled, please contact us: