Curtains is operated by Billion Flower Moon Studios LLC, a Wyoming limited liability company.
In brief#
- Curtains is a dating app, not a health service. Profiles have no health-related fields, and the app never asks about your health.
- Some laws protect "consumer health data" broadly enough to reach three things on Curtains: the face check, our automated safety checks when they flag that someone may hurt themselves, and health information that you or another member share with us. This policy explains how we handle each.
- We never collect precise location, and we don't use geofencing around places that provide health care.
- We use consumer health data only to provide Curtains and for safety. We never sell it, and we never use it for advertising.
- You can get a copy of it, have it deleted or withdraw your consent, and appeal if we say no.
1. What this policy covers#
Washington, Nevada and Connecticut have laws that protect "consumer health data": information that identifies or reveals something about a person's physical or mental health. Washington's law is the broadest. It covers, for example, biometric data and health information inferred from other data.
This policy explains what consumer health data could reach Curtains, and what we do with it. It covers the Curtains app and the website, curtainsdating.com. It adds to our Privacy Policy and doesn't replace it. We follow it for everyone, in every state where Curtains is available.
2. The consumer health data we may collect#
| What it is | Where it comes from | What we use it for |
|---|---|---|
| The face check. Your phone compares a live selfie with your profile photos. Washington's law could treat the face images and scans as biometric data. They never leave your phone, and they're deleted right after each check. We receive only the results: the outcome, which photos matched, and when. You consent first, and you can skip it. | Your phone | Helping keep fake accounts off Curtains. Our Biometric Information Policy explains the details. |
| A flag from our automated safety checks that a message or profile text suggests someone may hurt themselves. That's an inference about mental health. | Our automated checks on messages and profile text (Privacy Policy section 4) | Deciding whether a person should review that content. We don't add it to anyone's account as a label: it stays only in the record of that review. |
| A report that a member may hurt themselves, and anything about health that a member writes in another report | Other members | Looking into the report |
| Health information you choose to share in your profile, a message, a Scene, a report or an email to us: for example, when you ask for a refund because of a disability (our Terms, Section 7.1, ask for a physician's written confirmation) | You | Providing Curtains as you asked (showing your profile, delivering your messages), the safety checks and reviews in section 4 of our Privacy Policy, and handling your request |
How we handle it:
- We don't seek it. Nothing in the app asks about your health.
- We use it only to provide Curtains and for safety, as the table above describes. We don't use it to infer anything else about your health. Before using it for anything else, we'd update this policy and ask for your consent.
- We never sell it, and we don't use it or share it for advertising. Curtains shows no ads.
- It never goes to our analytics providers. App analytics events never include message content, profile text or images.
- We share it only as section 4 describes.
Other members can see your profile, the matches you choose can see your Scenes, and the people you message receive what you write. Share health details only if you're comfortable with that.
3. What we don't collect or do#
- No health fields. Profiles have no health-related fields: nothing about drinking, smoking or drug use, HIV status or disability.
- No precise location. Curtains never asks for permission to use your phone's location, and never uses it. We use only the city you confirm, and a check of which state your connection comes from, to keep Curtains closed where it isn't available.
- No geofencing. We don't set up virtual boundaries (geofences) around any place that provides health care, at any distance, to identify or track people, collect data from them or send them notifications. We don't use location, IP addresses or anything else to work out whether someone has visited such a place.
- No outside sources. We don't buy, license or otherwise get health information about you from data brokers or any other company.
- Gender identity, sexual orientation and who you're interested in describe who you are and whom you'd like to meet, not your health. We never use them to infer anything about your health. We protect them as sensitive data, collected only with your consent (Privacy Policy, sections 2.2 and 10).
4. Who we share it with#
Affiliates: none. Billion Flower Moon Studios LLC has no parent company, subsidiary or sister company, so there are no affiliates to share with.
| Who | What they receive | Why |
|---|---|---|
| Other members | Your profile, your Scenes (only the matches you choose) and the messages you send them | To provide Curtains, as you asked |
| Service providers: cloud providers | Everything in section 2 that reaches our servers | Hosting and storing Curtains' data |
| Service provider: network and security provider | The app's traffic on its way to our servers, and emails you send us on their way to our inbox | Delivering the app's traffic, protecting it from attacks, and routing our email |
| Service provider: automated moderation provider | Message text and profile text, without your email address, profile ID or other account identifiers | Checking it for signs of harm before it's shown. The flag in section 2 comes from this check. |
| Service providers: image safety providers | Photos and Scenes, including anything about health they show | Checking every uploaded image against known child sexual abuse material |
| Service provider: email delivery provider | Our replies to emails you send us, which can quote what you wrote | Sending our emails |
| Email inbox provider, under its own terms | Emails you send us | Hosting our email inboxes |
| Service provider, only if you call or text us: phone provider | What you tell us | Our phone line |
| The National Center for Missing & Exploited Children | Only what a report the law requires contains | Privacy Policy section 6.4 |
| Law enforcement, courts and government agencies | Only what the law requires us to disclose, what's needed in an emergency involving a risk of death or serious physical injury, or what's needed to look into fraud or abuse | Privacy Policy section 6.4 |
| A new owner of the business | Only if it keeps the promises in this policy, after we've told you, and with your consent where the law requires it | Privacy Policy section 6.5 |
Our service providers process information only for us, under contracts that let them use it only to provide their service to us. Our email inbox provider handles the emails you send us under its own terms. Section 6.1 of our Privacy Policy describes each provider.
We don't share consumer health data with anyone else, and we've never sold it. Before sharing it in any other way, we'd ask for your separate consent where the law requires it.
5. How long we keep it#
Consumer health data is kept as long as the record it's part of (Privacy Policy section 8):
| Where it is | Kept for |
|---|---|
| Face-check results | While the account exists, or until you withdraw your consent (Biometric Information Policy, section 4) |
| A flag from our automated checks | Only in the record of that review, and deleted with the review's notes 2 years after it's closed |
| Reports, support and appeal records | 2 years after the case is closed |
| Your profile and photos | While the account exists. Deleted from live systems within 72 hours of account deletion; out of backups within 30 days. |
| Scenes | Deleted from our servers when they expire, 24 hours after posting. A reported Scene is first copied to the evidence vault. |
| Messages | While the conversation is open. Deleted 30 days after it closes, and out of backups within 30 days after that. A reported message, plus up to 20 messages around it, is copied to the evidence vault. |
| Email to and from us | 24 months |
| Evidence vault | 1 year, longer only under a legal hold |
You can have it deleted sooner (section 6.1).
6. Your rights#
6.1 What you can ask for
- Access. Ask whether we collect, share or sell your consumer health data, and get a copy of it. We'll include a list of every company or organization we've shared it with, and an email address or web address for contacting each one. We have no affiliates, and we've never sold it.
- Correction. Ask us to fix information that's wrong. You can edit your profile yourself in the app.
- Deletion. Ask us to delete your consumer health data.
- We delete it from our live systems when we act on your request, and it's out of our backups within 30 days after that. We tell each service provider that holds it to delete it too.
- This includes health information in emails and support requests you've sent us, even where our Privacy Policy would otherwise keep those records longer.
- We keep a copy only where we need it to look into a report, fraud, abuse or illegal activity (for example, in the evidence vault), or where a legal hold requires it.
- You can also remove it yourself: edit your profile, unmatch to remove a conversation for both of you, or delete your account (Privacy Policy section 9.4).
- Withdrawing consent. Withdraw any consent you've given, at any time. To withdraw your face-check consent, use Settings → Legal & privacy → Face check. To stop us using health information you've shared, remove it or ask us to delete it.
We won't discriminate against you for using these rights.
6.2 How to ask
- In the app: Settings → Legal & privacy.
- By email: privacy@curtainsdating.com.
- By mail: Billion Flower Moon Studios LLC, 2106 House Ave, Cheyenne, WY 82001, USA.
We make sure a request comes from you before we act on it. In the app, your signed-in session does this. For email or mail, we'll ask you to confirm the request from the email address on your account. You can also use an authorized agent (Privacy Policy section 9.2).
We answer within 45 days. If we need more time, we may extend once, by up to 45 more days. If we do, we'll tell you why within the first 45 days. Requests are free.
6.3 If we say no: appeals
If we turn down all or part of a request, we'll explain why. To appeal, reply "appeal" to our answer, or write to privacy@curtainsdating.com. We'll look at your request again and send you a written decision, with reasons, within 45 days. If we turn down your appeal, we'll tell you how to contact your state Attorney General. Section 8 gives the details for Washington, Nevada and Connecticut.
7. How we protect it#
- Encryption in transit and at rest.
- Restricted, logged access to member data. Only people who need access for their work can reach member data, and they're bound by a duty of confidentiality.
- A restricted evidence vault, with every access logged.
- Contracts that limit what our service providers can do with your information.
- Collecting as little as we can (section 3).
We store your data with our cloud providers in the United States. The people who run Curtains work remotely, including from outside the United States, and reach member data through restricted, logged access.
No system is perfectly secure. If a breach affects your information, we'll tell you and the authorities as the law requires.
8. State notices#
Washington. This is our consumer health data privacy policy under Washington's My Health My Data Act (RCW 19.373). Section 2 lists the categories of consumer health data we collect, where they come from and how we use them. Section 4 lists what we share, the categories of third parties we share it with, and our affiliates (we have none). Section 6 explains how to use your rights. We don't collect precise location, and we don't use geofencing. If we turn down your appeal, you can complain to the Washington Attorney General at atg.wa.gov/file-complaint.
Nevada. This policy is also our consumer health data privacy policy under Nevada law (NRS chapter 603A). You can review and correct your information as section 6 explains. Section 9 explains how we tell you about changes. No third party collects consumer health data about your activity over time and across other websites or online services when you use Curtains. If we turn down your appeal, you can contact the Nevada Attorney General at ag.nv.gov.
Connecticut. Connecticut's privacy law treats consumer health data as sensitive data. We ask for your consent before the face check. A flag from our automated checks that someone may hurt themselves is used only to decide whether a person should review that content, to protect that person's safety, and it's kept only in the record of that review. We never sell consumer health data. Only people bound by a duty of confidentiality, and service providers under contract, can reach member data. We don't use a geofence around any mental health, reproductive or sexual health facility. If we turn down your appeal, you can contact the Connecticut Attorney General at portal.ct.gov/ag.
9. Changes to this policy#
When we change this policy, we update the "Last updated" month and year at the top. For a material change, we'll tell you in the app or by email at least 30 days before it takes effect. Before we collect a new category of consumer health data, use it for a new purpose or share it in a new way, we'll update this policy and ask for your consent where the law requires it. Earlier versions are archived; email privacy@curtainsdating.com for a copy.
10. Contact us#
Billion Flower Moon Studios LLC, 2106 House Ave, Cheyenne, WY 82001, USA · Phone: +1 (307) 317-0275
- privacy@curtainsdating.com: privacy rights and questions about this policy
- support@curtainsdating.com: app help and appeals
Section 16 of our Privacy Policy lists all our contact addresses.
Related policies: Privacy Policy · Biometric Information Policy · Terms · Safety center
