Privacy Policy
Effective Version 2.0 — 23 August 2026. This replaces every earlier version.
The short version You choose when to be seen. No one ever receives your coordinates — not another user, not a map, not an advertiser. Presence expires on its own. We do not sell your data and we do not train AI on it.
Who this is for SHALLOW is offered in the United States, for people physically in the United States, who are 18 or older.
What we collect What you give us. Your email address (that is how you sign in), your first name, your birthdate, photos you choose to add, and anything you write: bio, interests, intent, prompts, and your optional "tonight I'm..." note. We store your birthdate to prove you are 18 and to show your age; other people see the age, never the date.
What your device gives us while you are diving. Your precise location and how accurate your phone says it is. Nothing while you are surfaced.
What the service records as you use it. Which Current you are in and when your presence expires, Waves you send and receive, connections, Deep Dive messages including photos and voice memos, blocks, reports, your consent record with its version and timestamp, how many Waves you have sent tonight, and whether you have an active subscription.
What is collected automatically. Your IP address, device and browser type, and ordinary server logs held by our hosting and database providers.
What stays on your phone. Local storage holds your profile, your settings, your sign-in session and any venue code you used. There are no advertising cookies and no tracking pixels anywhere in SHALLOW.
How location actually works While you are diving, your coordinates go to our server to answer one question: which Current are you standing in.
Other people never receive your coordinates, your distance in meters, a movement trail, or a pin representing you on any map. Your coordinates live on your presence record only while that presence is alive, and the record is removed when you Surface, leave, or your timer runs out.
At the moment a Current is anchored, we send those coordinates once to Google Maps Platform to ask what venue is there, so the Current can carry the venue's name. That is the only time your location leaves our systems, and Google receives no name, profile or account information with it.
Precise location is sensitive personal data. We do not sell it, we do not share it for advertising, and we do not use it for anything except placing you in a Current.
What other people see While you are floating: your first name, your age, your bio, interests, intent and prompts, your "tonight" note, and that you are in the Current with them. Your photos are sent to another person's device only at the moment they open your bubble — they are never broadcast to the room. In Hidden mode, and any time you are surfaced, other people see nothing at all.
The map Scout shows public venues with live head counts. It never shows people, and it never shows a Current that is not a recognized public place. If you anchor somewhere the venue lookup does not recognize as a public venue — your home, a friend's house, a private space — that Current does not appear on the map or in the nearby list at all. It stays reachable only by being there or by a code you hand out. Head counts are counts; they are never identities.
What we never do We do not sell your personal data. We do not use advertising networks, ad targeting, data brokers, or analytics trackers. We do not show your profile to people outside your Currents. We do not train AI on anything you write, say, or photograph. Under Texas law we say it plainly: we do not sell sensitive personal data.
Who else touches your data — the complete list Supabase stores it. Your profile, photos, presence, messages and account live in a Supabase-hosted Postgres database in the United States.
Netlify hosts the app and runs our server functions. Requests pass through Netlify, and its logs can include your IP address.
Resend delivers your sign-in codes and service email. It receives your email address.
Google Maps Platform names venues and draws the map. It receives coordinates for a venue lookup when a Current is anchored, and it serves map tiles when you open Scout. It receives nothing that identifies you.
Stripe processes payments if you subscribe. Your card details go directly to Stripe and never touch our servers.
Apple and Google deliver push notifications, and only if you turn notifications on. If you never enable them, neither company receives anything from us.
That is the entire list. Nobody else receives your data, and none of these companies is permitted to use it for their own purposes.
Payments SHALLOW Unlimited is 20 US dollars per month, billed by Stripe until you cancel. We store only whether your subscription is active and when the current period ends. We never see, store, or have access to your card number. You can cancel at any time, and cancelling stops future charges.
Artificial intelligence No AI system reads your profile, your photos, your location, or your messages, and nothing you create is used to train any model. For transparency: SHALLOW's founder tests the app using assistant accounts that appear only to him and converse only with him; they never see another person's profile, Current, or messages. If we ever introduce an AI feature that touches your data, we will say so here and ask you to agree before it applies to you.
How long we keep things Presence disappears the moment you Surface, leave, or your timer ends. Your profile, photos and messages are kept while your account exists. Consent records are kept while your account exists and for two years after, because they are the proof of what you agreed to. Reports and safety records are kept up to three years after an account closes, because they exist to protect other people. Payment records are retained by Stripe as long as tax and accounting law requires. Ordinary server logs follow our providers' standard retention, typically thirty days or less.
Your rights and choices You can get a copy of your data, correct it, delete it, withdraw consent, turn notifications off, float hidden, block anyone, and disappear from every Current instantly. Most of this is in the app; for anything else, email us and we will answer within 45 days.
If you live in Texas. The Texas Data Privacy and Security Act gives you the right to confirm whether we process your data and to access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. We do not do any of those three things at all. If we ever deny a request, you may appeal by replying to our answer; if we deny the appeal, you may contact the Texas Attorney General.
If you live in California. We do not sell or share personal information as those terms are defined by California law. You may request to know, delete, or correct your information, and we will never treat you differently for asking.
Deleting your data Open the app and go to You → Delete my data. This immediately and permanently removes your profile, photos, presence, Waves, connections and Deep Dive messages. It cannot be undone. Reports other people have made about conduct are retained as a safety record, and a person who reports someone is never revealed to them.
You can also remove individual photos at any time, leave a Current instantly, and block or report anyone.