Atachy Privacy Policy

We collect information you provide directly, information generated through your use of the Service, and limited information from service providers that support the Service.

Depending on the feature you use, we may collect:

• Your name or display name.
• Email address.
• Password credentials. Passwords are stored in hashed form rather than plain text.
• Date of birth.
• Account status and verification status.
• Records showing when you accepted the Terms of Service, Privacy Policy, or other consent prompts.
• Information associated with password reset, email verification, or account recovery.

The Service is limited to users age 18 and older. Date of birth is collected before a user may access dating functionality.

We ask for your date of birth before you can create an account, and we do not let anyone who enters an age under 18 create one. An account later found to belong to someone under 18 is handled as described in Section 13.

You may provide information used to create your profile or personalize matching, including:

• Display name.
• Profile photographs.
• Biography or profile text.
• Date of birth.
• Gender.
• Dating interest, including the genders or categories of people you are interested in meeting.
• Preferred age range.
• Job title.
• Employer.
• Height.
• Education.
• Zodiac information.
• Communication style.
• Workout information.
• Social-media information.
• "Going out" preferences.
• Home location and travel cities.
• Family-planning preferences.
• Drinking preferences or information.
• Smoking preferences or information.
• Cannabis preferences or information.
• Diet.
• Religion.
• Other profile fields made available through the Service.

Some of these fields may reveal or permit inferences about sensitive characteristics, such as sexual orientation, religious beliefs, lifestyle, health-related matters, or family-planning preferences.

Religion and Diet currently provide per-field visibility controls. Other profile fields do not necessarily provide the same per-field visibility control.

Where the Service provides a visibility control for a profile field, your choice to mark information as hidden or private controls whether that information is shown to other users. It does not necessarily mean that Atachy stops storing or processing the information.

Atachy offers an attachment-style questionnaire used to support matching and self-understanding.

We may collect and store:

• Your individual questionnaire responses, including the raw answer to each question.
• Calculated scores.
• Primary and secondary attachment-style classifications.
• The date and status of the assessment.

If a result doesn't name a style, you can optionally tell us which patterns feel like you, or that none do yet.

Raw questionnaire responses and calculated results are stored in Atachy's systems. The raw responses are stored in encrypted database fields.

Atachy does not display your attachment style to another user. If you choose to allow it, Rowan may use limited information from your results to tailor its guidance to users you have matched with, as described in Section 1.4. It is still not displayed to them.

The assessment is based on self-reported information. It is not a medical, psychiatric, psychological, or clinical diagnosis.

Because these responses and inferences may reveal information about emotional patterns, relationships, behavior, or mental and psychological characteristics, they may qualify as sensitive personal information or consumer health data under certain state laws.

If you use Atachy's AI relationship coach, currently called Rowan, we may process and store:

• The text you submit to the coach.
• Coach responses.
• Conversation turns and summaries.
• Relevant attachment-style results or other account context used to personalize the response.
• If you ask about a match who has chosen to allow it, that match's profile, the attachment style their results lean toward, and how confident those results are, used only to tailor guidance to you and never shown to you. Their assessment scores and answers are not used, and low-confidence results are not used.
• Information about third parties that you choose to include in your messages.
• Consent records associated with the coach.
• Usage and token records.
• Limited safety-event information generated when the Service detects content associated with a safety category, such as potential self-harm content.

If you choose to allow it, the same limited information about you may be used to tailor Rowan's guidance to users you have matched with. It is never shown to them. This is off unless you turn it on. You can turn it off at any time in Settings. Rowan then stops using it for all of your matches, and it also stops for a particular match after an unmatch or a block. Turning it off does not erase guidance already given or coaching history already saved to another user's account. We keep a record of when you turned this on or off.

If you tell the AI coach you are under 18, we keep that one message so our safety team can review it. We do not review the rest of your coach conversations.

AI coach conversations may contain highly sensitive emotional, relationship, sexual, behavioral, or mental-health-adjacent information. Do not submit information about another person unless you are comfortable with Atachy and its service providers processing that information as described in this Policy.

The AI relationship coach is not therapy, medical care, mental-health treatment, or a crisis service. See the Terms of Service for important safety limitations.

At present, Atachy's Azure Face integration is configured for face detection rather than live one-to-one verification. For beta, Atachy intends to activate an optional live facial-verification feature using Microsoft Azure Face that performs liveness testing together with one-to-one comparison against the reference image used for verification.

When that feature is activated, the verification process is intended to:

• Send the images or session data needed for the verification to Microsoft Azure Face.
• Evaluate whether the live capture satisfies the liveness check.
• Compare the live capture against the applicable reference image on a one-to-one basis.
• Return a limited verification result to Atachy.
• Allow Atachy to retain the verification outcome and limited associated account-security information, such as whether verification succeeded, timestamps, attempt counts, and status information.
• Avoid retaining the submitted verification images, face templates, embeddings, or other face-geometry records in Atachy's own systems after the verification process.
• Retain only a boolean or comparable limited result indicating the verification outcome rather than retaining facial geometry for subsequent identification.

Microsoft Azure Face processes information as part of the verification session. Atachy will invoke the applicable session-deletion function promptly after each completed verification.

A successful facial-verification result is not a criminal background check and does not establish that a user is safe, trustworthy, free of a criminal history, or truthful about information other than the limited verification performed.

Because live facial verification may involve information regulated as biometric information under applicable state law, separate notice, consent, retention, destruction, and related requirements may apply.

Until live liveness and one-to-one facial verification is activated, Atachy's selfie check only detects whether a face is present. The notice, consent, retention and withdrawal terms for that check are in Atachy's Biometric Data Policy at atachyapp.com/legal/biometric-policy, and Atachy asks for your consent on a separate screen before the check. Live liveness and one-to-one facial verification will not be activated until the required biometric notice, consent, retention and destruction materials for it are in place.

If you record a profile voice prompt, Atachy collects and stores the audio clip you record and makes it playable by other users through your profile.

When you record a clip, Atachy sends the audio to Microsoft Azure AI Speech to create a written transcript. You can review and edit the transcript before your clip is published, and it is shown with your clip as its caption. Microsoft processes the audio to produce the transcript and does not keep it afterwards.

Atachy also keeps the original automatic transcript, which only moderators can see, for safety review. It is deleted with the clip.

Atachy does not use voice prompts to create a voiceprint, identify you by your voice, or derive any voice biometric identifier, and the transcript is not used to evaluate or score you.

Your clip and its transcript stay with your profile until you remove or replace them or your account is deleted under Atachy's account-deletion process. If a moderator removes your clip, it is hidden from everyone and kept only until you remove or replace it or your account is deleted.

Voice interaction with the AI relationship coach is not enabled for beta.

Atachy may offer voice interaction with the AI coach in a later product phase. If enabled, voice input may be transmitted to a third-party transcription provider and the resulting text may be processed by Atachy's AI provider to generate a response.

Before enabling that capability, Atachy will update its disclosures to identify the applicable processing details and will obtain any consent required by applicable law. This Policy does not represent that a particular voice-transcription provider, audio-retention period, or voice-processing configuration has already been selected.

We collect content you submit through the Service, which may include:

• Profile photographs.
• Profile voice prompts and their transcripts.
• Messages sent to matches.
• Reports or complaints about other users.
• Customer-support communications.
• Information submitted through safety or moderation tools.
• Other text, media, or content you choose to provide.

Messages and reports may contain information about both you and other people.

Screenshot or OCR upload is not enabled for beta. The Service should not be understood as presently supporting upload and automated analysis of another person's private communications through such a feature.

Atachy collects location information to support discovery and nearby matching.

The location used for matching is your home area: set from your device's location when you sign up, if you allow it, or from a city or address you enter, and you can change it in your profile. If you turn on live location (Premium), we also use your device's current location while it is on. We do not use your IP address to set your matching location.

Atachy applies measures such as jittering or clamping to home-location information before using it for user-facing location displays. Other users are shown only an approximate distance or other limited location indicator. Atachy does not intentionally display your exact stored coordinates to other users.

Atachy uses Mapbox for geocoding and mapping functionality. Mapbox geocoding is routed through an Atachy server-side proxy, and Mapbox GL JS is used for maps presented in the client.

Atachy also uses Nominatim / OpenStreetMap for geocoding. At present, the Nominatim request is made directly from the user's browser, which means the user's network IP address and typed location may be transmitted to that service as part of the request. Atachy intends to move that request behind a server-side proxy before launch.

Depending on its precision and use, location information may be treated as sensitive personal information under certain state privacy laws.

Atachy supports Google and Facebook social login.

If you use a third-party login service, the applicable provider may provide Atachy with information necessary to authenticate your account, such as a provider account identifier and information associated with the authentication token.

Google Identity is used for Google Sign-In.

Meta / Facebook is used for Facebook login. The Facebook SDK is loaded when you visit the sign-in or sign-up pages, and it may remain loaded for the rest of that browsing session. Atachy states that it does not use the Facebook SDK for advertising, retargeting, or cross-context behavioral advertising.

At beta, subscriptions are billed through Stripe checkout, including purchases you start from the Atachy app. If Atachy later offers Apple App Store or Google Play in-app billing, the information below about those channels will apply.

For a web subscription processed through Stripe, Stripe processes payment-card information. Atachy does not need to receive your complete payment-card number.

For a native subscription, Apple or Google processes the purchase through the applicable app-store account and billing system.

Depending on the billing channel, Atachy may receive or retain transaction-related information such as:

• Customer, transaction, or subscription identifier.
• Subscription tier.
• Subscription status.
• Billing channel.
• Billing status.
• Transaction confirmation or receipt information.
• Amount paid.
• Renewal or cancellation status.
• Entitlement information.
• Limited account and contact information associated with the transaction.

Stripe, Apple, and Google process payment information under their own applicable terms and privacy practices.

We may collect technical information used to operate, secure, and improve the Service, including:

• Device type.
• Operating system and application version.
• IP address.
• Browser and user-agent information.
• Pages, screens, or features used.
• Session and request metadata.
• Error, diagnostic, and performance information.
• Security and abuse signals.
• Push-notification token.
• Notification-delivery information.

When you sign up, we look up the country of the IP address you are connecting from, using a database that runs on our own servers, to confirm that you are in the United States. We keep only whether that check passed or could not be completed, not the country it found.

If you enable notifications, Atachy may use Firebase Cloud Messaging to deliver notifications to your device.

Notification payloads may include limited information associated with activity in the Service.

At beta:

• A notification that you received a new "like" is intended to be non-identifying.
• A new-match notification may include the match partner's display name, and a new-message notification may include the sender's display name.
• Depending on your device and notification settings, the match partner's or message sender's display name may appear in a lock-screen preview.
• Atachy does not currently send chat-message content through push notifications.
• Atachy does not intend to include attachment-assessment results or AI coach content in push-notification payloads.

Your operating system and device settings may control whether notification content appears on a locked screen.

Atachy uses service providers to send transactional email.

These may include:

• Match and like notifications.
• Password-reset messages.
• Attachment-assessment result messages.
• Subscription or account notices.
• Safety or security communications.
• Welcome and safety messages.

Launch updates. If you ask us to tell you when Atachy opens without creating an account, we collect your email address, how you reached the form, the date of your request, the consent wording you agreed to, and the IP address and browser information sent with your request as a record of that consent. We first send one email asking you to confirm. Nothing else is sent unless you confirm. We use your address only for launch announcements, and every launch email has an unsubscribe link. When you unsubscribe, we delete your address and keep only a one-way coded version so we never email you again. When Atachy fully opens, we delete the launch list.

Atachy uses Resend for email.

Atachy does not send SMS at launch. If we add SMS features later, such as phone verification, we will update this Policy and name the provider first.

Some information processed through Atachy may qualify as sensitive personal information under state privacy laws.

Depending on the information you provide, the feature you use, and the law that applies to you, this may include:

• Location information where its precision or use causes it to be treated as sensitive.
• Information concerning sexual orientation or sex life.
• Religious beliefs.
• Health-related information.
• Psychological, behavioral, or emotional information.
• Reproductive or family-planning information.
• Inferences generated from sensitive information.
• Certain account-access credentials.
• Biometric identifiers or biometric information processed in connection with live facial verification.

Atachy processes sensitive information for purposes such as:

• Providing the matching features you request.
• Generating attachment-style results.
• Checking and improving the accuracy of our questionnaire, in aggregate.
• Personalizing AI coach interactions you request.
• Providing profile and preference features you choose to use.
• Performing optional facial verification.
• Maintaining safety, fraud-prevention, and moderation systems.
• Protecting user accounts and the Service.
• Complying with applicable law.

Where applicable law requires separate consent before collecting or processing particular sensitive information, Atachy will present the required consent request before beginning the covered processing.

Before Atachy collects or uses your location, who you're interested in, or your religion, relationship and lifestyle details, we ask for your consent on the sign-up form, as its own checkbox, separate from the Terms of Service, with a link to its full text. We record the wording you agreed to and when. You cannot create an account without agreeing, and you can withdraw this consent at any time in Settings → Account. Our consumer-health-data consent, for quiz results and the AI coach, is a second, separate checkbox on the same form, described in Section 11.

Until live liveness and one-to-one facial verification is activated, Atachy's selfie check only detects whether a face is present. The notice and consent for that check are in Atachy's Biometric Data Policy at atachyapp.com/legal/biometric-policy and on the consent screen shown before the check.

We use personal information to:

1. Create, authenticate, maintain, and secure user accounts.
2. Determine eligibility to use the adult-only Service.
3. Create and display dating profiles.
4. Provide profile voice-prompt functionality, including creating the transcript shown with your clip.
5. Generate attachment-style scores and classifications.
6. Provide discovery, matching, messaging, and communication features.
7. Provide AI coach features requested by users.
8. Perform optional facial liveness and one-to-one verification when that feature is enabled.
9. Deliver notifications and email communications.
10. Process subscriptions and maintain billing and entitlement status across web and native billing channels.
11. Respond to support requests.
12. Detect, investigate, prevent, or respond to fraud, spam, abuse, harassment, scams, safety incidents, and violations of the Terms.
13. Operate blocking, reporting, and moderation functions.
14. Diagnose errors, monitor performance, and maintain the Service.
15. Understand how users interact with the Service and improve features.
16. Protect Atachy's rights, users, systems, and property.
17. Comply with legal obligations and lawful requests.
18. Establish, exercise, or defend legal claims.
19. Send marketing email where permitted by law and subject to applicable opt-out rights.

We may use assessment information in aggregate, without identifying you, to check and improve the accuracy of our questionnaire.

Atachy does not use attachment-assessment results or AI coach content to provide a medical or psychological diagnosis.

Atachy uses third-party artificial intelligence services to generate AI relationship-coach responses.

At launch, the text-based AI relationship coach uses Anthropic's Claude API.

Information sent to the AI provider may include:

• The text of your coach conversation.
• Relevant attachment-style results, including limited information about a match you ask about who has chosen to allow it, as described in Section 1.4.
• Relevant conversation history or summaries.
• Context you have provided about relationships or other people.

Atachy may store coach conversation turns and summaries in its own systems to maintain conversation context and provide the feature.

Atachy does not claim that AI output is factually accurate, clinically appropriate, unique, or suitable for emergency or high-stakes decisions.

Atachy does not intend to use your AI coach conversations or attachment-assessment data to train a general-purpose Atachy foundation model.

Anthropic zero-data-retention treatment is not currently enabled for Atachy's account. Atachy therefore does not represent that Anthropic retains no prompts or responses. The applicable default retention and other contractual or technical settings remain relevant to Anthropic's processing.

If Atachy later enables voice interaction with the AI coach, audio may be transcribed by a third-party provider and the resulting text may be processed through the AI provider. Atachy will identify the applicable processing details and obtain any required consent before enabling that feature.

We disclose information as described in this Policy.

Other users may see information that you choose to make visible through your profile or Service features, such as:

• Display name.
• Profile photographs.
• Biography.
• Approximate distance or location information shown by the Service.
• Selected profile fields.
• Profile voice prompts and their transcripts.
• Messages or other content you direct to another user.

Atachy does not display your attachment-style classification to another user.

Atachy does not intentionally display your email address, phone number, password credentials, raw attachment-assessment answers, AI coach conversations, or exact stored geographic coordinates to other users.

A new-match or new-message push notification may display the other member's display name as described in Section 1.13.

Atachy uses third-party providers to operate the Service. Based on the current product architecture, these include:

• Anthropic, for AI relationship-coach processing.
• Microsoft Azure SQL, for primary database infrastructure.
• Microsoft Azure Blob Storage, for storage of profile media and other file content used by the Service.
• Microsoft Azure Face, for face detection and the planned live liveness and one-to-one facial-verification feature.
• Microsoft Azure AI Speech, for creating transcripts of profile voice prompts.
• Microsoft Azure Monitor / Application Insights, for observability and diagnostics.
• Stripe, for web subscription billing and payment processing.
• Apple App Store, for native iOS subscription billing, if offered later.
• Google Play, for native Android subscription billing, if offered later.
• Resend, for email.
• Namecheap, Atachy's email host, when we respond to a privacy request you make.
• Firebase Cloud Messaging, operated by Google, for push notifications.
• Google Identity, for Google Sign-In.
• Meta / Facebook, for Facebook login. The Facebook SDK is loaded when you visit the sign-in or sign-up pages, and it may remain loaded for the rest of that browsing session.
• Vercel, for hosting and delivery.
• Mapbox, for geocoding and mapping functionality.
• Nominatim / OpenStreetMap, for geocoding.
• MaxMind GeoLite data, to check which country a sign-up comes from. The lookup runs on Atachy's own servers; no information is sent to MaxMind. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.

These providers may receive information associated with the functions they perform, subject to the applicable configuration, contractual terms, and law.

For Nominatim / OpenStreetMap, the current browser-side request may transmit the user's network IP address and the typed location to the service. Atachy intends to move that request behind a server-side proxy before launch.

Atachy does not currently use a live transcription provider for AI coach voice input or a live OCR or vision provider for screenshot analysis. Those features are not enabled for beta.

We may disclose information if reasonably necessary to:

• Comply with law, regulation, subpoena, court order, or other legal process.
• Respond to lawful government or law-enforcement requests.
• Protect the safety or rights of Atachy, users, or others.
• Investigate fraud, abuse, harassment, threats, or security incidents.
• Tell a member that someone they were in contact with was banned for fraud, a false identity, threats, or sexual violence, so they can protect themselves.
• Enforce the Terms of Service.
• Establish, exercise, or defend legal claims.

Atachy responds to requests from law enforcement and government agencies as required by applicable law.

How to submit a request. Send requests to legal@atachyapp.com from an official agency email address. Include the agency, the requesting officer's name, badge or ID number and contact details, the legal process you are serving, and the identifiers of the account involved (for example, the account's email address or profile name).

Legal process. We disclose member information only in response to valid legal process issued under applicable U.S. law (such as a subpoena, court order, or search warrant), except in an emergency as described below. Where the law requires a search warrant for the content of communications, we require one.

Emergencies. If we believe in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay, we may disclose information without legal process. Send emergency requests to the same address with "EMERGENCY" in the subject line and describe the emergency.

Preservation. On a valid preservation request, we will preserve the identified records for 90 days while the requester obtains legal process. Data that has already been deleted under Section 7 may not be available.

Notice to members. Unless the law or a court order prohibits it, or notice would create a risk of harm, we may notify the affected member before disclosing their information.

If Sowilo LLC or the Atachy business is involved in a merger, acquisition, financing, reorganization, bankruptcy, asset transfer, or similar transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable law.

Atachy does not sell personal information for money.

Atachy does not use personal information for cross-context behavioral advertising or targeted advertising based on activity across unrelated businesses.

Atachy does not use an advertising network, retargeting pixel, or data-broker integration.

The Facebook SDK is used for social-login functionality. It is loaded when you visit the sign-in or sign-up pages, and it may remain loaded for the rest of that browsing session. Atachy states that it is not used by Atachy for advertising or retargeting.

If Atachy's practices change, this Policy and any legally required notice or opt-out mechanism will be updated before the new processing begins.

Atachy retains information for the periods and purposes described in this Policy, subject to legal obligations, safety needs, permitted exceptions, and the technical deletion processes actually implemented.

Different categories of data may be retained for different periods.

While your account is active, Atachy generally retains information needed to provide and secure the Service, including account, profile, assessment, match, message, subscription, and AI coach information.

When you delete your account, Atachy closes it immediately and permanently erases your personal information after a 30-day grace period, except information we must keep for legal, safety, or fraud-prevention reasons, which is kept in pseudonymized form as described in Sections 7.4 and 7.5. Until the grace period ends, you can restore your account by signing in.

If a safety matter involving the account, such as an open report, is still under review when the grace period ends, Atachy may delay the purge until that matter is resolved, for no more than 30 additional days.

You can delete your account in Settings → Account → Delete Account.

Where applicable law requires deletion of personal information, Atachy will process qualifying requests subject to lawful exceptions.

Atachy stores both raw attachment-assessment responses and calculated results while the information is associated with an active account.

For an account that is deleted, raw assessment responses and associated assessment information are intended to follow the account-deletion process in Section 7.2, including the 30-day grace period and any safety-review delay described there, followed by hard purge of personal information, subject to lawful exceptions.

Atachy stores ordinary coach conversations, conversation turns, and summaries while needed to provide the coach feature.

The in-app "Delete coaching history" function removes ordinary conversation history and summaries. It does not erase separate safety, consent, or token-usage records, which are retained as described below. If we are required by law to preserve information, deletion may be delayed until that requirement ends.

You can also stop using Rowan at any time in Settings → Relationship Coach. This withdraws your consent to coaching, so Rowan stops responding to new messages from you. Your past conversations stay until you delete them.

Upon account deletion, Atachy intends to remove ordinary identifiable coach history through the account-deletion process described above.

CoachSafetyEvents, CoachConsents, match-coaching consent records, and CoachTokenUsage records that are retained after deletion are intended to be pseudonymized so that they are not retained in identifiable form merely because the account was deleted.

Those pseudonymized records are retained without a fixed expiry.

Atachy may retain limited safety and moderation records after an account is closed where reasonably necessary and permitted by law to prevent abuse, investigate reports, enforce bans, protect users, prevent repeat misconduct, resolve disputes, maintain security, or comply with legal obligations.

These records may include:

• User-report records.
• Block records.
• Limited or pseudonymized account identifiers.
• Relevant timestamps.
• Moderation outcomes.
• Safety-event categories.

Atachy seeks to limit continued retention to information reasonably necessary for the applicable purpose.

Atachy uses administrative and technical safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

Based on the current product architecture:

• Data is protected in transit using encryption.
• Attachment-assessment raw responses and results use application-level column encryption.
• AI coach conversation and turn text use application-level column encryption.
• General database information relies in part on Microsoft Azure SQL platform-level encryption.
• File and media storage relies in part on Microsoft Azure Blob Storage platform-level encryption.
• Atachy uses access controls.
• Atachy uses security monitoring and logging.
• Atachy uses account-authentication controls.
• User photographs may be delivered using short-lived signed URLs.

Chat message bodies also use application-level column encryption.

Atachy has verified the Azure SQL and Azure Blob Storage encryption configuration in its QA and production environments.

Atachy does not represent that every database field, blob, log, backup, or vendor-held copy receives the same form or layer of encryption.

No system can guarantee absolute security. Users should maintain strong account credentials and notify Atachy if they believe an account has been compromised.

Depending on your state of residence and whether a particular privacy law applies to Atachy, you may have rights concerning your personal information.

Those rights may include the right to:

• Confirm whether Atachy processes your personal information.
• Access personal information.
• Correct inaccurate personal information.
• Delete personal information.
• Obtain a portable copy of certain information where required by law.
• Opt out of sale of personal information.
• Opt out of sharing or targeted advertising where applicable.
• Limit or withdraw consent to certain sensitive-data processing.
• Appeal a denial of a qualifying privacy request.
• Exercise privacy rights without unlawful discrimination.

Atachy does not currently sell personal information or use personal information for cross-context behavioral advertising as described in Section 6.

To submit a privacy request, contact:

privacy@atachyapp.com

Atachy may need to verify your identity before completing a request. The information requested for verification will depend on the nature of the request and the sensitivity of the information involved.

Atachy will respond within the time required by applicable law.

Authorized agents may submit requests where applicable law permits, subject to legally permitted verification requirements.

You can request access to, export, correction, or deletion of your personal information by emailing privacy@atachyapp.com. We handle these requests manually, acknowledge them within 10 business days, and respond within 30 days, extendable once by up to 30 days. If applicable law gives you a right to appeal our decision, email privacy@atachyapp.com and identify the request you are appealing. We decide appeals within 45 days.

For step-by-step instructions on deleting your account and your data, see atachyapp.com/legal/data-deletion.

Certain states require consent before processing specified categories of sensitive data.

Where such a law applies and consent is required, Atachy will provide a clear request for consent before beginning the covered processing.

A general agreement to the Terms of Service or acknowledgment of this Privacy Policy is not intended to replace a separate sensitive-data consent when applicable law requires a separate, specific consent.

Atachy asks for this consent on the sign-up form, as its own checkbox, separate from the Terms of Service and from the consumer-health-data consent, with a link to its full text, and records the wording you agreed to and when. You cannot create an account without agreeing. You can withdraw it at any time in Settings → Account. When you withdraw, we delete your location, who you're interested in, your religion, relationship and lifestyle details, and any faith or LGBTQ+ interests, and we hide you from Discovery; your account, matches and conversations stay. You can agree again at any time, which means adding your home location again. Consumer-health-data consent is described in Section 11.

Where applicable law provides a right to withdraw consent to future non-biometric sensitive-data processing, you may submit a request to:

privacy@atachyapp.com

Withdrawal does not necessarily require Atachy to erase information that may lawfully be retained for another permitted purpose, but Atachy will honor deletion or cessation rights where required.

For the selfie check, you can withdraw your consent at any time in Settings, as described in Atachy's Biometric Data Policy at atachyapp.com/legal/biometric-policy. Withdrawal mechanics for live liveness and one-to-one facial verification will be provided before that feature is activated.

This Section is intended to serve as Atachy's consumer health data privacy notice where the Washington My Health My Data Act, Nevada consumer health-data law, or a similar state law applies.

Atachy's standalone consumer health data notice is published at atachyapp.com/legal/health-data.

Atachy is not a health-care provider and does not offer medical or mental-health treatment. Nevertheless, information users voluntarily provide through assessments, lifestyle fields, AI coach conversations, or safety features may reveal or permit inferences about mental, behavioral, emotional, reproductive, sexual, or other health-related matters and therefore may qualify as consumer health data under certain state laws.

Depending on what you choose to provide, Atachy may collect:

• Attachment-style assessment responses and results that reveal or infer psychological or behavioral characteristics.
• AI coach conversations concerning emotional or relationship matters.
• Inferences generated from those conversations.
• Safety-event information indicating that content may relate to self-harm or another safety category.
• Lifestyle or wellness information that you voluntarily provide.
• Family-planning information.
• Information concerning sexual or reproductive matters that you voluntarily provide.
• Other information that applicable law treats as consumer health data because it identifies or permits an inference concerning physical or mental health status.

Atachy obtains this information:

• Directly from you.
• From your activity within the Service.
• From assessment calculations.
• From AI-generated inferences based on information you provide.

Atachy uses consumer health data, where applicable, to:

• Provide the assessment or AI coach feature you request.
• Personalize responses.
• If you choose to allow it, tailor AI coach guidance for users you have matched with, without showing them your results.
• Maintain conversation context.
• Provide user-directed profile features.
• Protect safety and investigate misuse.
• Maintain security.
• Comply with applicable law.

Atachy does not use this information to diagnose or treat a medical or mental-health condition.

Where necessary to provide a feature you request, consumer health data may be processed by service providers, including:

• Anthropic, for AI relationship-coach processing.
• Microsoft Azure, for storage and application infrastructure.
• Resend, for emails you request that include your attachment-assessment result, including when they are sent automatically after you confirm your email following such a request, and for safety notifications to Atachy's moderation team.
• Namecheap, Atachy's email host, when we respond to a privacy request you make.

Atachy may also disclose consumer health data when legally required or reasonably necessary for safety, security, fraud prevention, or legal claims as permitted by applicable law.

Atachy does not sell consumer health data.

Where applicable law requires consent to collect or share consumer health data, Atachy will obtain the required consent before the covered activity unless an applicable statutory exception permits processing necessary to provide a product or service you requested.

Where a separate consent is legally required for sharing, Atachy will not rely solely on consent to collection.

Atachy asks for this consent on the sign-up form, as its own checkbox, separate from the Terms of Service and from the sensitive-data consent, with a link to its full text, and records the wording you agreed to and when. You cannot create an account without agreeing. You can withdraw it at any time in Settings; withdrawing stops new collection, and you can delete what is already saved by deleting your history or your account. Using your results to tailor AI coach guidance for users you have matched with requires a separate choice, described in Section 1.4, which is off unless you turn it on.

Where applicable, you may have the right to:

• Confirm whether Atachy collects, shares, or sells your consumer health data.
• Access that data.
• Receive information about third parties or affiliates with whom it has been shared or sold.
• Withdraw consent to future collection or sharing.
• Request deletion.
• Appeal a refusal of a qualifying request.

Submit requests or qualifying appeals to privacy@atachyapp.com. We decide appeals within 45 days.

Service-related communications may be necessary to operate your account and may not offer an unsubscribe option where the communication is transactional or security-related.

Atachy may send marketing email to members where permitted by law. Marketing email will include a method to unsubscribe.

If you unsubscribe from marketing email, Atachy may still send account, security, billing, legal, and other transactional communications.

Atachy does not send SMS at launch. If we add SMS features later, such as phone verification, we will update this Policy and name the provider first.

Atachy is intended exclusively for adults age 18 and older.

We do not knowingly permit anyone under 18 to maintain an account.

We ask for your date of birth before you can create an account, and we do not let anyone who enters an age under 18 create one. If a report, our AI coach, or our moderators indicate that an account may belong to someone under 18, we place the account on hold while we review it. If we confirm that the account belongs to someone under 18, we close it permanently and erase it right away, unless the law requires us to preserve it as described below, without the usual 30-day grace period. We keep only a pseudonymized record of the case and its outcome, and we keep the email address (in a protected, hashed form) from being used to register again until the person turns 18, where we know their date of birth. You can appeal a closure by emailing support@atachyapp.com.

If you believe a minor has created an Atachy account, contact:

privacy@atachyapp.com

or

support@atachyapp.com

If we find apparent child sexual abuse material on Atachy, we report it to the National Center for Missing & Exploited Children (NCMEC) as required by law, and we preserve the related account and content as the law requires instead of deleting them.

Messages, AI coach conversations, support communications, and other Service features may allow you to provide information concerning another person.

You are responsible for ensuring that you have a lawful basis or other appropriate authority to submit information belonging to another person.

Do not upload or submit another person's private communications, photographs, identification documents, health information, intimate content, or other sensitive information unless you have the right to do so.

Screenshot or OCR analysis is not enabled for beta. If Atachy later enables a feature that permits automated analysis of screenshots or other private communications, Atachy will review and update the applicable disclosures before activating that feature.

Atachy may update this Privacy Policy as the Service, law, or data practices change.

The updated Policy will identify a new "Last updated" date.

Where required by applicable law, Atachy will provide additional notice or obtain consent before materially changing how sensitive personal information or consumer health data is collected, used, or shared.

Material changes will not be applied retroactively in a manner prohibited by applicable law.

Questions, privacy requests, or complaints may be sent to:

Sowilo LLC d/b/a Atachy

Privacy: privacy@atachyapp.com

Support: support@atachyapp.com