SHY privacy policy

Your information deserves care.

This policy explains the information SHY uses to operate the service, why it is used, who can see it, and how to exercise your choices.

Last updated August 22, 2026. This policy applies to SHY services at shyapps.com and the SHY app.

• What we collectAccount, profile, and usage details you give us or that keep the service working.
• How we use itTo operate SHY, keep people safe, and improve the product.
• When it is sharedOnly as part of the service, with providers we name, or when the law requires it.
• Your choicesAccess, correction, export, deletion, and regional rights.

Information we collect

Information you give us

• Account information — email address, password credentials, and (if you choose Google Sign-In) the basic profile your provider returns.
• Profile information — name or display name, date of birth, gender and pronouns, photos, prompt answers, values, interests, intention, and any other field you choose to complete.
• Verification information — a live-capture photo used to confirm a real person is behind the profile.
• Content — messages you send through Whisper, plans you create, and media you upload.
• Support and safety information — reports you file, appeals you submit, and correspondence with our team.

Information we collect automatically

• Usage information — the surfaces you open, the actions you take, and diagnostic events used to keep the service working.
• Device information — device and browser type, operating system, app version, and identifiers needed to deliver notifications.
• Approximate location — with your permission, to support nearby discovery and safety tools. Precise coordinates are not required to use SHY.

Information from others

• Payment confirmation — our payment processor tells us whether a purchase succeeded. Card numbers never reach SHY.
• Reports about you — information other members provide when they report or block an account.

Sensitive information

Some information you may choose to share — such as details that reveal sexual orientation, religious belief, or health — is treated as sensitive under some laws. You decide whether to provide it, you can remove it at any time, and we use it only to operate the features you chose it for. We do not use sensitive information for advertising, and we do not sell it.

How we use information

We use information to provide the service, help people discover compatible connections, facilitate communication, operate safety and moderation tools, maintain account security, respond to support requests, and improve the product. Our public pages do not load advertising trackers. We will update this policy before introducing optional marketing-site analytics.

When information is shared

Profile information is shown to other people only as part of the service experience. Messages are available to people in the conversation. We use service providers to operate core infrastructure, authentication, notifications, diagnostics, and payments where applicable. We may disclose information when required by law or to protect the safety, rights, and security of people and the service.

Your choices and rights

• Access, correct, or update account information in the app.
• Manage available visibility, location, and permission controls in the app or through device settings.
• Request access, correction, deletion, or an export of personal information.
• Review the cookie policy for the current browser-storage inventory.

For the in-app steps and a direct request route, see Privacy Rights.

Security and retention

SHY uses access controls and security measures designed to protect information, described further on our security page. No service can promise perfect security, and we do not.

How long we keep information depends on what it is and why we hold it:

• Account and profile information — kept while your account is active.
• Deleted accounts — when you request deletion, the account enters a 30-day grace period during which you can cancel. After it elapses, account data is purged from our production systems.
• Messages — kept while the conversation exists for the people in it; removed with the account.
• Safety and moderation records — reports, enforcement decisions, and records of banned accounts are kept after deletion where needed to keep removed users off SHY, resolve disputes, or meet a legal obligation.
• Payment records — transaction records are retained as long as tax and accounting law requires.
• Diagnostic logs — kept on a short rolling basis for reliability and abuse prevention.

Where information is processed

SHY's primary infrastructure runs in the United States, operated by the providers listed on our Data Recipients page. If you use SHY from outside the United States, your information is transferred to and processed there.

Legal bases for processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process personal information on these bases: performance of a contract (operating your account and the features you use), legitimate interests (keeping SHY safe, preventing abuse, improving the service), consent (optional permissions such as location or notifications, and any sensitive information you choose to share, which you may withdraw at any time), and legal obligation (responding to lawful requests and meeting record-keeping duties).

Your rights by region

California

California residents may request access to the categories and specific pieces of personal information collected, request deletion or correction, and request details about disclosures. SHY does not sell personal information and does not share it for cross-context behavioral advertising, including for anyone under 16. You may limit the use of sensitive personal information; SHY already restricts it to operating the features you chose. Exercising these rights never results in a lower level of service.

EEA, UK, and Switzerland

You may request access, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You may also lodge a complaint with your local supervisory authority.

Virginia, Colorado, Connecticut, Utah, and other US states

Where your state grants them, you have rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, sale, and certain profiling. SHY does not conduct targeted advertising or sell personal information. Where a state provides an appeal route, you may appeal a declined request by replying to our response.

Nevada

Nevada residents may direct us not to sell covered information. SHY does not sell personal information.

Authorized agents and verification

An authorized agent may submit a request on your behalf with proof of authorization. Before acting on a request we may ask for information needed to verify that the account is yours — never a password or one-time code.

Automated decisions

Discovery ranking and safety systems help order what you see and flag possible abuse. Decisions that meaningfully affect an account — suspensions and bans — involve human review, and you can appeal them.

Children

SHY is not intended for people under 18, and we do not knowingly provide the service to children.

Changes to this policy

When this policy changes, we update the date at the top of this page and, for material changes, notify you in the app or by email before they take effect.

Contact

For a privacy request or question, email privacy@shyapps.com. For general help, see SHY Help.

See also: the third-party services SHY relies on and the cookie policy.