Privacy Policy

Effective 2026-11-03 · Version 2

Status: draft, not reviewed by a lawyer.

1. Who we are

NextMove is operated by AI Eh-B'y, a Canadian company in Newfoundland and Labrador ("we", "us"). We are responsible for the personal information we hold and follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector.

Our Privacy Officer is the person in charge of the protection of personal information and handles questions, requests and complaints: privacy@ai-eh-by.ca. For anything else, write to support@ai-eh-by.ca.

This policy covers every part of NextMove:

the website nextmove-sb.ai-eh-by.ca;
the web app at app.nextmove-sb.ai-eh-by.ca, which you can install on your phone;
the emails and notifications we send.

NextMove is for adults only (18 and older). Location and safety are the product: no one sees where you are, how far away you are or even that you are nearby until you and that person have both said yes.

2. What we collect

Account

Your name, email address, the ID your sign-in provider gives us (Google, or your email address and password), your birth date, language, time zone and display theme, your plan, your verification level and a trust score. If you sign in with an email address and password, the password is handled by Google Identity Platform; we never see it or store it in readable form.

Content

Profile: photos, prompts and answers, bio, an optional voice intro, gender, pronouns, height, job, education, languages, lifestyle answers (drinking, smoking, cannabis, exercise, diet, pets, kids, star sign and, only if you choose to answer, religion and politics), interests, music, love language and your personality quiz answers. For each field you choose who sees it: people you are introduced to, only after an intro, or no one (used for matching only).
Sensitive profile information: your sexual orientation, relationship style, the modes you turn on (including Encounters and Companionship), what you are seeking, your boundaries and dealbreakers. See section 13.3.
Location: while you are "open now" and the app is open, your device's position (latitude, longitude and accuracy), the public venue it matches, and the home or work areas you ask us to avoid. See section 13.1.
Intros, connections and chat: the intros we propose to you and your answers, your connections, messages, photos, voice notes and GIFs you send, meetup plans, and your after-meeting check-ins.
Safety: your trusted contacts (name, email address, phone number), check-in timers and panic alerts; the people you block; one-way hashes of phone numbers you choose to hide from; your reports.
Verification: a selfie you take to get the verified badge, and later your phone number (section 13.4).
Linked accounts: if you link Facebook, Instagram, Spotify, Strava or LinkedIn, the data you allow (section 13.5).
Events: events you host or join.
Payments: your plan and purchases (section 13.7).

Device and usage

Notifications: if you turn on push notifications, your browser's push address and keys; your notification choices and quiet hours.
Delivery records: for each email, text message and push notification, who it went to, the type, the language, the time and whether it was delivered. Never the content of an email.
Consent records: the versions of the terms, the community guidelines and this policy you accepted, and each separate permission you gave (location, sensitive profile information, selfie verification, linked accounts, hiding from contacts, missed connections, push, email, SMS), with the date and time, language, the wording version, IP address and browser.
Technical: our hosting keeps request logs (IP address, browser, time, page and errors) for security and troubleshooting; any location written to a log is rounded to about 150 m. We use no advertising or analytics tools, no crash-reporting tools and no third-party trackers.

This website

Forms: what you send through the contact, support or account deletion forms (name, email address, topic, message, and the page and language you used). We store it in our database in Canada.
Theme setting: if you choose light or dark, your browser remembers it (section 8).
Cookies: the website sets none.

The apps

There are no iOS or Android apps yet: NextMove is a web app you can add to your home screen. It asks your browser for these permissions, each only when you use the feature: location (while open now and on the find-each-other screen), notifications, camera (to take a photo or selfie, only when you choose to), microphone (only while you record a voice intro or voice note) and, where your browser supports it, contacts (to pick numbers to hide from; they are hashed on your device before anything is sent). When native apps exist, this section will describe them before they are released.

3. Why we use it, and what we never do

We use this information only to run the service: sign you in, check that you are an adult, build your profile, find strong matches near you, introduce you, help two people who both said yes find each other, run chat, keep people safe, moderate content, verify accounts, process payments, send the notifications you choose, record your consent and comply with the law.

We never sell personal information, never use it for advertising or to build advertising profiles, never track you across other websites or apps, never show your location to anyone before a mutual yes, and never give your content to anyone to train AI models.

Automated decisions. Who you are introduced to is decided by an automated matching system (section 13.2). It does not make decisions with legal effects, and you can always say no to an intro. You can ask us what information was used and which main factors led to an intro, and ask a person to review an automated moderation decision: write to privacy@ai-eh-by.ca.

By creating an account you agree to this use; the sign-in screen says so, and we record which versions of the terms, the community guidelines and this policy you accepted.

Everything sensitive or optional is a separate choice, off until you turn it on, and never bundled with sign-up: location; sensitive profile information (orientation, intimacy modes, boundaries, religion, politics); selfie verification; each linked account; hiding from your contacts; missed connections; push notifications (each type separately); optional emails; and text messages. Each is recorded with its own version. You can withdraw any of them at any time in Settings (or by turning off the permission in your browser, unlinking an account, or deleting your account); withdrawing stops that use from then on. Without location, NextMove cannot introduce you to people nearby, but you can still use your profile, connections and events.

Other users, only as described in section 13: before a mutual yes, the person you are introduced to sees your first name, age, photos, the mode and the match reason, and the profile fields you made visible to intros. Never your location, venue or distance.
Your trusted contacts, only when a safety timer is missed or you press the panic button (section 13.6).
Service providers that process data for us, only to provide the service:
- Google Cloud (Canada): app servers, database, file storage, Secret Manager, scheduled tasks, backups and logs, in the northamerica-northeast1 region (Montréal); pages may be delivered through Firebase Hosting, Google's worldwide network.
- Google Identity Platform (United States and other countries): sign-in, including email and password and Sign in with Google.
- Vertex AI (Google, on its global endpoint, so requests may be processed outside Canada): writes match reasons, icebreakers, openers and meetup suggestions, and checks text for harmful content (section 13.2). Google does not use these requests to train its models.
- Cloud Vision (Google, United States and other countries): checks each photo for nudity, violence and other unsafe content. It does not recognize faces.
- OpenStreetMap (Overpass API, Germany): our servers send a search area around a rounded position to list nearby public venues; nothing that identifies you.
- Your browser's push service if you turn on notifications: Apple (Safari), Google (Chrome and most Android browsers), Mozilla (Firefox) or Microsoft (Edge). It receives your browser's push address and the notification, encrypted so only your browser can read it.
- Google Workspace (Gmail API, United States and other countries): sends our emails from our no-reply address on our own domain and delivers website form messages to us. It receives the recipient's email address and the whole email (subject and text, for example a safety alert with the venue name and a map link), and, for a website form, everything you typed in it and your email address.
- Stripe (United States and Canada), only if you buy something (section 13.7).
- Twilio (United States), once text messages are switched on: sends phone verification codes and safety alerts by text message. It receives the phone number and the text of the message (a code, or a safety alert with the venue name and a map link), and tells us whether it was delivered.
- Facebook, Instagram, Spotify, Strava and LinkedIn, only if you link them (section 13.5).
Law enforcement: only when the law requires it (for example a court order or warrant), or when we believe in good faith that someone's life or safety is at immediate risk. We check each request, disclose only what it requires and record it.
Business transfer: in a sale or transfer of our business, under the same protections (we will tell you).

6. Where it is stored and transfers

Our database, files, backups and logs are in Canada (Montréal). Some providers above (sign-in, AI processing, image checks, push services, page delivery, email, payments, text messages and linked accounts) may process data outside Canada (and outside Quebec), including in the United States and Europe, where courts and authorities may be able to access it under local law. We use providers that protect the information by contract and with security measures comparable to ours, and we send them only what they need. We assessed these transfers before using them, as Quebec law requires.

7. How long we keep it

Account and profile (including sensitive profile information, avoid areas, matching signals, consent records, blocks and hidden contacts): until you delete your account.
Location: only your latest position, deleted 2 hours after it was sent or as soon as you stop being open now. We keep no history of coordinates; we keep which allowed venue you were open at, by day, for 8 days (no coordinates), for missed connections and the weekly best-nearby list.
Intros: 90 days after the intro was created (so the same two people are not introduced again within 7 days); daily intro counters 2 days; best-nearby lists 8 days.
Find-each-other sessions: both positions, the what-I'm-wearing note and the spot photo are deleted when the session ends (at most 30 minutes); the session record is deleted 7 days after it ends.
Connections and chat: until either person unmatches or deletes their account; then deleted on both sides.
After-meeting check-ins: 2 years.
Safety: trusted contacts until you remove them; check-in timers and panic alerts 2 years.
Verification selfies: deleted as soon as it is reviewed (30 days if it is never reviewed); the result (verified level and date) until you delete your account.
Reports, moderation decisions and the audit log of staff access: 2 years after the case is closed, also after an account is deleted, to keep people safe; to prevent banned people from coming back we keep one-way hashes of their email address and phone number.
Linked accounts: until you unlink them; the access token and everything we derived from it are then deleted.
Push subscriptions: until you turn notifications off or sign out on that device, or after 60 days without being renewed.
Delivery records: 13 months.
Payments: billing records 6 years (tax records); your plan until you delete your account.
Short-lived security records (attempt counters, linking requests): 30 days at most.
Website form messages: 13 months in our database.
Under-age sign-ups: the account is deleted right away; a one-way hash of the email address is kept so the account cannot be created again.
Backups: copies of the database made before each update of the app, stored in Canada: 35 days.
Hosting logs: 30 days.

8. Cookies and storage on your device

We use no advertising or analytics cookies. What we keep on your device:

Web app: one cookie, __session (HttpOnly, Secure, 14 days), keeps you signed in; deleted when you sign out. The sign-in library (Firebase) keeps your sign-in in your browser's IndexedDB; cleared when you sign out. In your browser's local storage: nextmove.lang (language), nextmove.theme (theme), nextmove.auth.lastProvider (which sign-in method you used last, never your email), nextmove.installBanner.dismissed (you closed the install banner), nextmove.voiceNotice.seen (you saw the recording notice before your first voice recording). In session storage, cleared when you close the tab: nextmove.pendingLink (a sign-in in progress while you link two sign-in methods; removed when the sign-in is done), nextmove.pendingReauth (that you were asked to sign in again before deleting your account; removed when you come back), nextmove.onboarding.step (the setup step you were on; removed when setup is finished) and nextmove.safetyTimer (your running check-in timer's end time, so the countdown survives a reload; removed when the timer ends or you confirm). The service worker caches the app's own files (no personal data) so it opens quickly.
Website: nextmove.theme in local storage if you choose light or dark. No cookies.
When it is cleared: signing out removes the session cookie, the sign-in and this device's push registration. Account deletion also removes nextmove.auth.lastProvider. The language, theme, banner and recording-notice settings stay until you clear your browser's site data.

9. Your rights

Access and export: Settings > Download my data gives you a copy of your data in a structured, commonly used format (JSON).
Correction: edit your profile and settings in the app.
Withdraw consent: section 4.
Deletion: section 10.
Automated decisions: section 3.
Other requests: write to our Privacy Officer at privacy@ai-eh-by.ca to ask for access, correction, deletion or information about how we use your data. We answer within 30 days.
Complaints: contact our Privacy Officer first. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

10. Account deletion

Delete your account in the web app from Settings > Delete account, or without the app from the account deletion page at nextmove-sb.ai-eh-by.ca/delete-account. The deletion is immediate: your account, profile, photos, location, modes, connections and chats (on both sides), linked accounts, selfies, safety contacts and notification registrations are deleted. Reports and moderation records (2 years), billing records (6 years), backups (35 days) and hosting logs (30 days) are kept for the periods in section 7. If you have a paid plan, cancel it first; the deletion page explains how.

11. Security, breaches and risks

Encryption in transit (HTTPS) and at rest; photos and files in private storage, shown only through short-lived links; linked-account tokens encrypted; database access limited to the app's own service account; session cookies that are HttpOnly and Secure; every staff access to a person's private data logged. No system is perfectly secure. Meeting people in person carries real risks: meet in public, tell someone you trust, and use the safety features (section 13.6). We keep a record of every privacy breach (confidentiality incident). When a breach creates a real risk of significant harm (a risk of serious injury under Quebec law), we notify the people affected and the Office of the Privacy Commissioner of Canada and, for people in Quebec, the Commission d'accès à l'information, as the law requires.

12. Children

NextMove is only for people 18 and older. We ask for your birth date before you can use it; if it shows you are under 18, the account is blocked and deleted right away (we keep only a one-way hash of the email address so it cannot be created again). Reports that a user may be a minor are reviewed first. If you think a person under 18 is using NextMove, contact privacy@ai-eh-by.ca and we will remove the account.

13. Product features

13.1 Location and proximity

Location is used only while you have turned on "open now" and the app is open on your screen; we do not collect it in the background. Your position is matched to an allowed public venue (cafés, bars, gyms, parks, libraries, campuses and similar) within 75 m. If there is no allowed venue, or you are in a home or work area you marked, or at a place such as a school, clinic, hospital, pharmacy, shelter, place of worship or police station, nothing is recorded. We keep only your latest position, for 2 hours at most, and no history of coordinates; which allowed venue you were open at is kept by day, for 8 days.

No one can see your location, your distance, your venue or even that you are nearby before you both say yes. A venue's "vibe" shows only how many people are open to each mode, and only when there are at least 3, never who. After a mutual yes, the two of you share direction and a distance band (never exact metres) for at most 30 minutes; either of you can end it at any time, and once it ends no more positions are shared. Blocked people never see you.

Missed connections ("you were both at this venue this week") are used only if both of you turned them on.

13.2 Matching and AI

The matching system compares people who are open now and near each other. Your hard filters (modes, who you are seeking, ages, dealbreakers, verification requirements) always apply both ways. It then scores shared interests, lifestyle, relationship style and intent, personality, languages, past feedback and trust, and spreads intros fairly. It learns from outcomes (intros accepted or declined, meetings that happened, check-ins).

We use Vertex AI to write the one-line reason and the icebreaker for an intro from the fields both people made visible (never private fields, never data from linked accounts), to suggest openers and meetup plans, to translate, and to check messages and profile text for harassment, scams, hate and content involving minors. A message flagged as possibly harmful shows "Are you sure?" before it is sent. AI output can be wrong; you decide what to send. We keep only the result, not the request.

13.3 Sensitive information

Your sexual orientation, intimacy preferences, the Encounters and Companionship modes, your boundaries and dealbreakers, and religion and politics if you add them, are sensitive. We collect them only with your explicit, separate consent, use them only for matching and to show them to people you are introduced to under your visibility settings, and never share them with any other company. Encounters is never on by default, is invisible to anyone who has not turned it on, and, like Companionship, requires selfie verification. A consent and boundary reminder appears before every Encounters or Companionship intro.

13.4 Verification and selfies

To get the verified badge you take a selfie in the app. A member of our team compares it with your profile photos; we do not create a biometric template, measure your face or use face recognition. The selfie is stored privately and deleted as soon as it is reviewed; we keep only the result. Phone verification by text message will be added once text messages are switched on; your number is then stored in E.164 format and used only for verification and safety alerts.

13.5 Linked accounts

You can link Facebook, Instagram, Spotify, Strava or LinkedIn to improve your matches. Each one is optional and separate. We receive only what you allow on the provider's screen (for Facebook: public profile, pages you like and music, birthday, age range, gender, hometown, location, photos, and friends who also use NextMove). We turn it into private matching signals and suggested profile text that you review: nothing from a linked account is shown to anyone without your OK. Friends who also use NextMove can be avoided or preferred, as you choose. Tokens are stored encrypted. Unlinking deletes the token and everything we derived from it. These providers handle your data on their side under their own privacy policies.

13.6 Safety features

You can add trusted contacts. If you start a check-in timer and do not confirm in time, or press the panic button, we alert them with the venue name and a location rounded to about 150 m (as a map link), by email and push and, once text messages are switched on, by text message to a contact who agreed to texts by giving you the code we send to their phone. Each contact gets the alert in their own language. Please make sure your trusted contacts agree to receive these alerts. The panic button also shows a prominent link to call 911. Blocks are absolute and work both ways. Reports go to our moderation team; every staff access to a person's private data is logged.

13.7 Payments

Plans (Plus, Premium), boosts and event tickets are paid through Stripe on its own secure page; we never see your card number. Stripe receives your account ID, email address and what you buy; we receive the plan, the status and a receipt. Paid plans may not be available yet; prices are always shown before you pay.

13.8 Emails, text messages and notifications

We send only transactional emails and texts (account, security, safety alerts, events you joined and digests you turned on); we do not send marketing. Emails come from our no-reply address on our own domain, sent through Google Workspace; text messages are being set up and are off for now (Twilio, section 5). Optional emails and text messages are separate choices you can turn off in Settings, and optional emails have an unsubscribe link that works without signing in. Push notifications are off until you turn them on; you choose each type, and none is sent during your quiet hours except safety alerts. A notification never contains a name, a venue or a location ("Someone you'd click with is nearby"). They pass through the push services in section 5.

13.9 Voice intros and voice notes

You can record an optional voice intro for your profile and send voice notes in chat. The browser asks for the microphone only when you press record, and recording stops when you press stop, or after 30 seconds for a voice intro and 60 seconds for a voice note. Recordings are stored privately in Canada (Google Cloud, Montréal) and shown only through short-lived links: your voice intro to the people you choose under your visibility settings, a voice note only to the person you sent it to. We do not transcribe recordings, do not recognize or measure voices and create no voiceprint or other biometric data from them. A voice intro is kept until you replace or delete it or delete your account; voice notes are kept like the rest of the chat (section 7). Before your first recording the app shows a notice: record only your own voice, and do not record other people without their consent.

If you use Sign in with Google, we ask Google only for your basic profile: your name, email address and Google account ID (the openid, email and profile scopes). We use them only to create your account and sign you in, and we never ask for access to your Gmail, contacts, calendar or files. Our servers also use Google APIs under our own Google Cloud and Workspace accounts, not your Google account: Gmail API (gmail.send, to send our emails from our own address), Cloud Vision (to check photos) and Vertex AI (section 13.2).

NextMove's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

14. Changes to this policy

We post every change here with a new version number and effective date, and record it in our changelog. We tell you about material changes in the app before they take effect, and the app asks you to accept the new version before you continue.

15. Contact

Privacy Officer: privacy@ai-eh-by.ca. General contact: support@ai-eh-by.ca. AI Eh-B'y, Newfoundland and Labrador, Canada.

This policy is available in English, French and Spanish, and each version has the same effect.