Privacy Policy

We collect the information you choose to share when you create an account and build your profile, including:

• Account details such as your name, email address, and date of birth used to verify you are 18 or older.
• Profile content you provide, including photos, bio, interests, date preferences, and the availability windows you publish.
• Activity on Greenlight, such as the date offers you send and receive, profiles you view, and messages exchanged after a date is accepted.
• Technical information such as device type, browser, and general usage data needed to keep the service secure and working.
• If you join Greenlight through a referral link from a member, a partner organization, or one of our events, we record which link you used, whether your account later completed identity verification, and whether it was later removed, so the team can count referrals. The referring member or partner is never shown who joined.
• If you check in to one of our in-person events, with the door code or through an event link, we record that and list you to other people checked in once your profile is published. If you and another person checked in agree to a date during the event, we may put both your first names together on the event's raffle wheel, which is shown on a screen at the event. The check-in screen, and the sign up screen for an event link, tell you this first, and you can leave the event at any time from Settings.
• How you found Greenlight: the website or campaign link that brought you here (for example an Instagram or email link), the site you came from (its name only), the type of page you first landed on, when you first visited, whether you signed up with email or Google, whether you used the website or the Android app, and your answer if you tell us how you heard about us. We use this to understand which ways of finding us work. It is stored with your account and deleted with it.

We use your information to operate and improve Greenlight, specifically to:

• Create and maintain your account and show your profile in the Discover feed.
• Enable the core experience: sending date offers, accepting them, and unlocking messaging once a date is confirmed.
• Verify eligibility, protect user safety, and detect or prevent fraud, abuse, and prohibited conduct.
• Send you notifications about offers, messages, and confirmed dates.
• Maintain, secure, and improve the reliability and quality of the service.

When your profile uses automatic photo ordering and is shown to another member in the Discover feed, we record which one of your photos was shown as the cover and whether that member went on to open your profile, so we can learn which photo performs best and order your photos accordingly. The link to the specific member who was shown your photo is removed after 30 days; the count itself is kept so your photo order stays learned rather than resetting.

We do not sell your personal information. We share data only in limited circumstances:

• With other users, only the profile information you choose to publish is visible. Your contact details and exact location are never shared automatically.
• With trusted service providers who help us run Greenlight (such as hosting, storage, authentication, and notification delivery via Resend), under obligations to protect your data.
• Email communications: emails we send through Resend, including service notifications, date offers, account security messages, profile and availability reminders, and newsletters, may contain a standard web beacon (a 1x1 transparent image) that tells us whether the email was opened, and links that pass through a tracking address run by Resend so we can count clicks. We use this to check that our emails arrive and to improve them. This information goes to our email provider, Resend. You can block the open beacon by turning off image loading in your email app. You can opt out of non-essential reminder emails at any time using the unsubscribe link included in the email footer.
• Analytics: we use PostHog (PostHog, Inc., US cloud) to understand how the product is used and to find what is slow or broken. Two things send data there. Our servers report that something happened (for example, that an offer was created) with nothing but the event name and the time. And in your browser, PostHog records which pages you open, which buttons and links you click, how long you stay on a page and how far down it you scroll, and how quickly pages load. It also records where on a page people click, how far they scroll and where the pointer rests, as positions on the page with no text from it, so we can see which parts of a screen get used (a heatmap). And when something in our code breaks, it records a crash report: the type of error and where in our code it happened, never the error's text, your messages, or your profile details. A click is recorded as which element you clicked, meaning the name it has in our own code, not the words shown on it and never what you typed: we do not record keystrokes, form contents, messages, or photos, and we never record or replay your screen. We also record the steps of a checkout: that you tapped to buy, that it started or failed to start and why, which plan or pack was chosen, and whether you came back paid or cancelled. Web addresses are stripped of anything that identifies another member before they are sent, and we drop the question mark and everything after it. The one exception is the marketing tags a link can carry when it brings you to the site (for example, which ad or newsletter you came from); those describe the link, not you, and we keep them so we can tell what is working. The two sources use different identifiers: server events use a pseudonymous identifier derived from your account with a secret key, while browser activity is tied only to a random identifier PostHog stores on your device, never to your account. Your IP address is discarded either way. We never send your name, email, messages, photos, preferences, or profile details.
• When required by law, or to protect the rights, safety, and security of our users and the public.
• All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages.

If you opt in to text messages from Greenlight Date, texting uses your mobile number to send the texts you chose (date reminders and offer alerts for members) and to keep a record of your consent. When you add or change your phone number in Greenlight Date and ask for a verification code, we also use that number to send you the code and keep a record of each confirmed verification for four years, including after account deletion, for security and abuse prevention. The record of a code request that is never confirmed is deleted after 30 days. We also keep a log of each text we send (the number, the time, and the delivery status) until the account it belongs to is deleted.

Your mobile information will not be sold or shared with third parties for promotional or marketing purposes.

To deliver our texts, your number goes to our texting platform provider and the phone carriers, and we tell anyone we are required by law to tell. The platform provider and carriers handle your number to deliver those messages for us, and not for their own marketing or promotional purposes.

Greenlight Date does not text friends. When a member shares a date, the member sends the share link from their own phone, and Greenlight Date sends the friend no text.

We keep a record of each text consent and each opt out for four years after the last text or the opt out, whichever is later. The record holds the number, the time, a keyed hash of the IP address, the browser's user agent, where the consent was given, and the consent wording version. If you save a text choice on the public text messages page without an account, we keep a record of that choice for four years from the day you saved it. That record holds a keyed hash of the number (never the number itself), the time, a keyed hash of the IP address, the browser's user agent, the page, and the consent wording version. We use the birth date you enter there only to check that you are 18 or older, and we do not store it. A saved visitor choice does not by itself make a number textable. We also keep a record of each confirmed verification code (the number, the time, a keyed hash of the IP address, the browser's user agent, and the notice version) for four years, including after account deletion. The record of a code request that is never confirmed is deleted after 30 days. We also keep a log of each text we send (the number, the time, and the delivery status) until the account it belongs to is deleted. After a number opts out we do not text it again unless that person opts in again.

Consent is not a condition of using Greenlight Date. You can opt out at any time by replying STOP, and you can reply HELP for help.

By entering my number and turning on this option, I agree to receive Greenlight Date texts at that number for the message type I select: date reminders or offer alerts. Message frequency varies. Message and data rates may apply. Reply STOP to opt out; HELP for help. Consent is not a condition of purchase or using Greenlight Date. We do not sell or share mobile information for third-party marketing or promotional purposes.

Texting consent wording version: sms-consent-2026-11-10-v7. The full opt in wording is on our text messages page.

Safety and consent are at the core of Greenlight. Messaging only unlocks after a date offer is accepted, so you are never exposed to unsolicited messages. You control your own availability and what appears on your profile.

You can block or report any user at any time. Your location is never shared automatically, and we provide safety tools such as the ability to share your plans and an emergency contact before a date. We review reports and may remove content or accounts that violate our policies.

Our systems also automatically scan the text members write to each other for signs of scams or other policy violations. That means the messages in your conversations and the note you can add to a date offer (the note is scanned too, because it reaches someone who has not accepted a date with you yet). A flag records an identifier for the message or offer, who sent it, one or more category labels and a timestamp, never a separate copy of what you wrote, and flagged text may be reviewed by our team. Those records are deleted along with the message or offer itself when you delete your account, except where we must preserve reported content as evidence (see “Data retention”).

After a date that both of you confirmed, we may ask each of you a short check-in: whether you met, whether you would see them again, what stood out from a fixed list of words, an optional note of up to 120 characters, and whether you felt safe. Answering is optional. We store no answer until you agree to this on the check-in screen, and we record the version of this policy you agreed to. We keep your answers and when you gave them. If one of you blocks or unmatches the other after the date started, we also record that and who did it.

Your name is never shown next to a released review. There is one exception, and it happens right away: if you both say you would see each other again, we tell you both, and each of you sees the other person’s first name next to that yes. Everything else waits. On a Monday at least three days after you answer, your review (that you met, your yes or no, the words you picked, and your note) is released to the person it is about, mixed in with their other reviews and without the date, the place or your name. The release runs at the start of Monday in UTC, which is Sunday evening in New York. Only members with a Green subscription can read the reviews about them; other members see how many are waiting. Until at least three reviews about you have been released, none of them is shown and no count is shown; before that, the page says at most that reviews unlock after your third. A note with a phone number, an email address, a social media handle or a link is refused before it is saved. A note that may name a person, a place or a date, that looks like it could contain contact details or a way to reach you, or that reads as abusive, asks for money or asks someone to prove who they are, is saved but held for a member of our team, who reads it and decides whether it is released or dropped; a dropped note is erased. A held note that nobody on the team has decided on by the time the review is released is dropped automatically and erased, and the review is released without it. In the held notes queue the team sees the note and why it was held, not who wrote it. If you say you felt unsafe, or if either of you blocks or unmatches the other before the review is released, no review of that date is shown in either direction; a block or unmatch after a review was released does not take it back. If one of you answers that you met and the other answers that the date was cancelled or that they did not show, neither review is shown. If you answer that they did not show, that answer is not shown to them, and it counts against them only when two different people report the same thing about them within 90 days.

We use your answers to the first and last questions (whether you met and whether you felt safe), together with the confirmation, cancel and unmatch times already on your dates, to work out a reliability record for each member. It drives three things, and, once the reliability limits described below are turned on, a fourth: when you can send offers. The three are: a public "Shows up" badge on your profile, earned once three dates with at least two different people were confirmed as met by both sides and nothing has counted against you in the last 90 days; a "Hide unreliable members" option that Yellow and Green members can turn on in Discover; and your own record (attendance rate and counts), which you can see with a Yellow or Green subscription. We also read blocks and reports here, so a date you cancelled late after you had blocked or reported the other person does not count against you. Your yes or no, the words you picked and your note never go into that record.

When the reliability limits are turned on, the same record also limits what you can do after missed dates. A missed date can be a date you did not confirm, a date you cancelled or unmatched from in the last 24 hours before it, or a date where other members reported that you did not show up. Not every missed date counts. Cancelling for a safety reason does not count, a first unconfirmed date or late cancel can be forgiven, and a no-show report counts only when reports from more than one person back it up. As counted missed dates add up within 60 days, the limits get stronger. First your “Shows up” badge is not shown. Then we pause sending and countering date offers for 3 days, then for 30 days with a warning you must confirm. After you confirm that warning, a further counted missed date can lead to a ban. A pause does not cancel dates you already have or close your conversations.

If a pause or warning is in place, you can appeal in the app from the pause notice or the warning screen, in up to 1000 characters. Appeals are meant for medical problems and emergencies. A member of our team reads each appeal and accepts or denies it. An accepted appeal excuses one counted missed date and lifts a pause. It does not undo a ban. We accept at most one appeal from you in any 90 days. If your account is banned you cannot appeal in the app; write to support@greenlightdate.com.

We keep a record of the missed dates we counted, the limits we applied and when, the warning you confirmed and when you confirmed it, and each appeal you wrote with our decision. Our team can see this record on your account page. Other members cannot see it; they can see only whether you have the “Shows up” badge. We keep this record while your account exists and delete it when your account is deleted. Separately, our log of team decisions, such as a ban or an appeal decision and any note written with it, is kept after an account is deleted. Warning emails follow the email rules in “Data retention” below.

We keep check-in answers for as long as both accounts exist. When either of you deletes an account, every check-in answer between the two of you, in both directions, is deleted with it. Your consent record belongs to your account alone: it is deleted when you delete your account, and it stays when the other person deletes theirs. A note that was refused was never saved, and a note that was dropped, by our team or automatically at release, is erased at that moment. There is one exception to deletion. If the person your review is about reports your note, we take a copy of the note, which check-in and date it belongs to, and when you wrote it, under the rules for reported content in “Data retention” below. That copy records who wrote the note, our team can see it, and it is not removed by either of you deleting an account.

Identity verification is optional. If you choose to verify, you'll submit a selfie and a photo of a government ID. You may cover or mask sensitive fields on your ID, such as your driver's license number, Social Security number, or home address, before submitting it. We only need your photo, legal name, date of birth, and the ID's expiration date to be readable.

You can choose how your submission is reviewed:

• Manual review: a trained member of our team looks at your selfie and ID and approves or rejects your submission. If you agree on the review screen, Greenlight's own systems may compare your selfie with your profile photos. If they do, we keep the match score with the reviewer's decision, to help us improve our checks. The reviewer also records whether the profile photos show the same person. The score is not shown to the reviewer until after they make their decision, and it does not affect the decision. Your ID photo is never scanned. If you don't agree, no automated biometric processing is used in this path.
• Automated review: with your explicit, separate consent, our verification provider, Didit, scans your ID and takes a selfie to confirm you're 18 or older and that you match your ID. This path creates biometric data (a scan of your facial geometry), used by Didit to match your selfie to your ID photo, and by Greenlight itself to compare your selfie to your profile photos, and only after you've affirmatively agreed to it on a dedicated consent screen. A member of our team may also look at your verification selfie next to your profile photos to check the match. See "Biometric data" below for how this data is handled.

• Your verification photos are stored privately and are never shown on your profile or to other members.
• Once a decision is made, photos submitted for manual review are permanently deleted. For automated verification, Didit keeps your ID document and selfie until a person on our team approves or declines your verification, deletes them at that moment, and in any case within 30 days of Didit's decision. During that review the team member may view your selfie only, loaded from Didit into our admin tools each time they look; no one at Greenlight views your ID document. Greenlight never stores a copy of your ID document and never reads the barcode on its back. We keep a record of the decision itself, including its status, timestamps, and the reason if rejected. For automated verification we also keep a copy of your verification selfie for up to 3 days when the result is not a clear match, as described under "Biometric data" below.
• Verification submissions are rate limited to prevent abuse.
• The main effect of verification is a "Verified" badge on your profile. Automated verification works like this. A clear match shows your Verified badge right away. If the score is borderline and we still have your selfie copy, a person on our team checks it and your badge is held while they check. Otherwise we ask you for a new photo. The hold ends with their answer, and within 72 hours at the latest. If the score is borderline and our team has found before that your selfie and photos do not show the same person, the badge is held until a person decides. If the score clearly does not match, we ask you for a new photo. If your photo can't be checked, you can contact support@greenlightdate.com, or have an admin revoke your verification so you can verify again. A reviewer who finds the selfie does not match your profile photos can remove the badge. If you completed automated verification, setting a new main profile photo later is re-checked against your stored facial geometry template, and your Verified badge may pause until it matches; manual review isn't re-checked this way. New photos and videos still go through our review before they appear. Videos are checked automatically by Google Cloud for sexually explicit content. A video the check rates as clearly explicit is removed automatically, and we send you a notification if you have notifications turned on. A video the check is unsure about waits for a person on our team to look at it before anyone else can see it.

Automated identity verification (see "Identity verification" above) is optional, requires your consent, and is processed by our verification provider, Didit. It is never used for advertising, and your biometric data is never sold.

• What's processed: your government ID document image, a selfie, and the facial geometry Didit derives from them to match your selfie to your ID photo and check for liveness. Separately, Greenlight's own systems compare your verification selfie to your profile photos, to confirm they show the same person. We keep a copy of your verification selfie image for up to 3 days for every result that is not a clear match, including a check that could not finish, so a member of our team can view it next to your profile photos and check the match. We also keep the match score, the reviewer's result, and an encrypted facial geometry template, so we can re-check future profile photo changes against it. For manual review, if you tick the optional box on its review screen, we may create facial geometry from your selfie and your profile photos only to compute a match score against your profile photos. If we do, we do not store that facial geometry, and we keep only the score and the reviewer's decision.
• Why: to confirm your identity, that you're 18 or older, and that any photo you later set as your profile photo is really you. Apart from the optional face matching for manual review described above, we don't use this data for any other purpose.
• Outside manual review, the profile photo comparison applies only to members who agree to it on the verification consent screen. Manual review has its own optional box. If you verified before we added this comparison, you are not face matched unless we ask you to verify again, and you will see this same consent screen before that happens. Members who agreed to an earlier version are not matched under this one, and we keep their stored facial geometry.
• Separately, whenever any member sets a new main profile photo, it is checked automatically to confirm it shows one clear face and meets our photo quality rules. This automatic check does not compare the photo to anyone, and nothing from it is kept.
• Consent: we only start automated verification after you've explicitly agreed on a dedicated consent screen, separate from this Privacy Policy. You can decline and use manual review instead: a human reviews your ID and selfie. Manual review uses no automated biometric processing unless you tick the separate, optional box on its review screen.
• Retention: Didit keeps your ID document, selfie, and any biometric data it derived from them until a person on our team approves or declines your verification, and deletes them at that moment. If no one has done so within 30 days of Didit's decision, Didit deletes them then. Our team may view your selfie, and only your selfie, inside Greenlight's admin tools, loaded from Didit each time, and every view is logged; Greenlight does not store it. If your date of birth shows you are under 18, Didit deletes them right away and no one at Greenlight views them. If you withdraw consent or delete your account first, we ask Didit to delete them right away. Our Biometric data policy sets out the full schedule. Greenlight itself never stores your ID images or document numbers; we keep the verification outcome (verified or not), a session reference, timestamps, and the match score and reviewer's result. Our copy of your verification selfie is kept for up to 3 days for every result that is not a clear match, including a check that could not finish, and deleted sooner once our team has confirmed the result or when you withdraw consent. Separately, we keep the encrypted facial geometry template, the match score and the reviewer's result described above until you delete your account, and delete them when you do, or when you withdraw consent; it is never used for advertising and never sold. If you ticked the optional face matching box for manual review and a match score was made, we keep that score and the reviewer's decision until you delete your account, or delete them sooner if you withdraw. Exception: if we ban your account for violating our policies, we may ask Didit, our identity-verification provider, to keep a copy of your facial data in a safety blocklist so a new verification attempt on another account with the same face is automatically declined. Blocklist data is retained beyond the standard 30-day period and remains in place until we remove it.
• Withdrawing consent: to withdraw your consent to face matching without deleting your account, email support@greenlightdate.com. We delete your stored facial geometry template, your selfie copy if we still hold it, and your match score and reviewer's result, and any manual review match scores, ask Didit to delete your verification session, and remove your Verified badge. Withdrawing doesn't affect a decision already made, and you can verify again through manual review, without ticking the optional face matching box.

Payments are handled by Stripe, an outside payment processor. Stripe receives your card details directly, and we never store your full card number. We receive limited billing information needed to manage your account, such as your subscription status, the last four digits of your card, and your transaction history.

Greenlight uses cookies and local storage to keep you signed in and to keep the service secure. We don't use advertising cookies, and we don't track you across other sites. If you leave sign-up partway through, we save your progress on this device for up to 2 days so you can pick up where you left off. It is deleted when you finish your profile or after 2 days. We also keep the link that brought you to Greenlight on this device and use it for up to 30 days, until you sign up.

Our analytics provider, PostHog, also stores one identifier on your device so it can tell one visit apart from the next. That identifier is random and is never linked to your account. See "Data sharing" above for exactly what browser activity is recorded. It is not required to sign in or to use Greenlight.

We keep your personal information for as long as your account is active and as needed to provide the service. Deleting your account from Settings takes effect immediately: your profile, offers, and messages are removed right away, and we immediately start deleting your photos and videos from storage. Bugs, outages, or failed deletes can delay or prevent the removal of some files, including older files and files uploaded while the deletion runs. A file named in a member report can also stay in storage. The same failures can delay the removal of your sign in record, including your email address, at our authentication provider. While that removal is pending, we keep the ID of that record, with no name or email attached, so that we can try again. We keep trying for about three days. If those attempts fail, the sign in record and the ID stay until our staff remove them. Except where we are required to retain certain information to comply with legal obligations, resolve disputes, prevent abuse, or enforce our agreements, we delete or anonymize your personal data at that time.

Reports work differently. When a member reports another member, we take a copy of the content the report is about, as it stands at that moment, so that it still exists if we or law enforcement need to look at it later. That copy is stored apart from the live app, is never visible to other members, and is not removed by either member deleting their account.

• What is copied: the messages exchanged between the two members, the date offers between them and any text written on those offers, the reported member’s profile photos and videos, a reported post-date review note with its details (which check-in and date it belongs to and when it was written), and the report itself. Both members’ own words are included, because a conversation only makes sense as a whole.
• For how long: 90 days from the report. If the report leads us to file a CyberTip report with the National Center for Missing & Exploited Children, that becomes one year from the date of that filing, which may be later than the report itself. If the same member is reported again before that period ends, every copy already on file for that member (from that report and any earlier ones) is kept at least as long as the newest report’s own period. In other words, a member who keeps being reported stays under this retention for as long as new reports keep coming in, not just 90 days from any one report.
• Then what: once that period has passed (including any extension from a later report against the same member, as described above) and our review of the report is closed, the copy becomes eligible for deletion and is deleted in our next purge of expired holds. While either is still outstanding, it is kept.

Data from identity verification follows this schedule:

• Manually reviewed selfies and ID photos are deleted as soon as a decision is made.
• Automated (Didit) verification documents, the selfie and biometric data are deleted by our provider when a person on our team approves or declines the verification, and in any case within 30 days of Didit's decision.
• In both cases, Greenlight itself retains the outcome (verified or not), a session reference where applicable, and timestamps, and never your ID images or document numbers. For automated verification, Greenlight also keeps the match score and the reviewer's result, and keeps a copy of your verification selfie for up to 3 days when the result is not a clear match (deleted sooner once our team has confirmed the result or when you withdraw consent). Separately, Greenlight keeps an encrypted facial geometry template to re-check future profile photo changes, until you delete your account, and deletes it when you do. See "Biometric data" above.

Routine transmission, security, and delivery records held by our communication infrastructure providers (including the recipient email address, subject line, message content, delivery status logs, and email open and click events maintained by Resend) survive account deletion for up to 30 days (and up to an additional 7 days in automated infrastructure backups) for fraud prevention, abuse investigation, and deliverability verification before being permanently purged in accordance with the provider’s standard retention schedule.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct or update inaccurate information through your profile settings.
• Delete your account and associated personal data.
• Object to or restrict certain processing of your data.

You can exercise most of these rights directly in the app, or by contacting us using the details below.

We may update this Privacy Policy from time to time. If we make material changes, we'll let you know through the service or by email. Your continued use of Greenlight after the effective date of any change means you accept the updated policy.

If you have questions about this Privacy Policy or how we handle your data, contact us at support@greenlightdate.com.