Curtains is operated by Billion Flower Moon Studios LLC, a Wyoming limited liability company.
These guidelines are for US law enforcement and government agencies asking for records about Curtains members. We publish them so members can see how we handle requests too. They don't create rights for anyone, and accepting a request doesn't waive any objection we may have to it.
Curtains is an iOS dating app offered only in the United States. It's built to hold little, and we delete data on a short schedule. We store member data with our cloud providers in the United States. We can only produce what we still have.
If you're a member who wants to report a crime, see Police and legal requests in our Safety Center.
1. What we hold, and for how long#
| Records | How long we keep them |
|---|---|
| Sign-in data: a keyed hash of the member's Apple user ID (not the ID itself), and the email address and first name Apple shares with us. The email may be the member's own address or an Apple private relay address. | While the account exists. Deleted from live systems within 72 hours of account deletion, and from backups within 30 days. |
| Profile: photos, profile name, profile ID, date of birth, preferences and settings | While the account exists, on the same deletion timeline |
| Messages | While the conversation is open. Deleted 30 days after the conversation closes (an unmatch, a block, a soft match expiring or an account being deleted), and out of backups within 30 days after that. Longer only for an open report, a legal hold or a legal obligation. |
| Who messaged whom, and when (not content) | While both accounts exist |
| Scenes | Deleted from our servers when they expire, 24 hours after posting |
| Evidence vault: a copy of reported content (a reported profile's photos, a reported Scene, or a reported message plus up to 20 messages around it) | 1 year, longer only under a legal hold |
| City: the city the member confirmed (the app suggests it from the IP address), and a record of each change | While the account exists |
| Connection state: the state the member's connection last came from, and when | Latest check only, replaced each time |
| IP addresses recorded with account activity: when the member signed up, signed in, uploaded a photo or Scene, or bought Tickets, with the time | 90 days. If the account is reported, 1 year. Longer only under a legal hold. |
| Server logs: technical request data | 30 days |
| Device and push tokens | While the account exists, on the same deletion timeline |
| Face check results: the outcome, which profile photos matched, and when | While the account exists |
| Apple age-check outcome, and its date | While the account exists |
| Purchase and Ticket records (we see Apple transaction IDs, never card details) | 7 years |
| Reports, support requests and appeals | 2 years after the case is closed; then only a basic record of the case (its type, dates and outcome) |
| Email to and from us | 24 months |
| Calls, texts and voicemails to our phone line | 24 months |
| App analytics events: pseudonymous product events, with no message content and no location finer than city | 12 months |
| Accounts we've taken action against (for example, restricted or banned) | The account's data, for 1 year after the decision, even if the account is deleted |
| Ban-enforcement data: hashed Apple ID, device signals and photo hashes of banned accounts | As long as the ban lasts |
| Material in a report to NCMEC | Preserved for 1 year from the report |
Our Privacy Policy (section 8) has the full schedule.
2. What we don't have#
- No device location, precise or otherwise, and no location history. Curtains never asks for the device's location. We keep only the city the member confirmed (with a record of each change) and the latest state check of their connection.
- No face-check images or scans. The face check runs on the member's phone, and we receive only its outcome, which photos matched, and when. No member ever sends us a selfie for it.
- No Apple user ID. We store only a keyed hash of it, so we can't produce the ID itself. Apple, not Curtains, holds the Apple account behind a private relay email address.
- No payment card details. Members pay through Apple; we see transaction IDs only.
- No Scenes after they expire, and no messages after they're deleted (30 days after a conversation closes), unless they were reported or preserved first.
3. How to send a request#
- By email: legal@curtainsdating.com, from an official government email address.
- By mail or hand delivery: Billion Flower Moon Studios LLC, care of its registered agent, 2106 House Ave, Cheyenne, WY 82001, USA. If you serve our registered agent, please also email a copy to legal@curtainsdating.com.
Every request should include:
- your name, agency, badge or ID number, official email address, and a phone number at your agency
- a copy of the signed legal process
- the member's Curtains profile ID (shown in the menu on their profile) or profile name, and the email address on the account if you have it
- the specific records you need, and the date range
- any deadline, and whether a nondisclosure order applies
We check that every request is genuine, and we may call your agency on a publicly listed number to confirm it. We respond only to valid legal process, we produce only the records it requires, and we may object to requests that are unclear or too broad.
4. What each kind of request needs#
We follow the federal Stored Communications Act (18 U.S.C. §§2701–2713).
| What you're asking for | What you need |
|---|---|
| Basic subscriber information (18 U.S.C. §2703(c)(2)): for example, the profile name and profile ID, the email address on the account, when the account was created, the IP addresses we recorded when the member signed up, signed in, uploaded or bought Tickets, and purchase records | A subpoena (a §2703(d) court order or a search warrant also works) |
| Other records that aren't content (§2703(c)(1)): for example, who a member messaged and when, the city the member confirmed and its changes, the latest state check of their connection, and device information | A court order under 18 U.S.C. §2703(d), or a search warrant |
| Content (§2703(a) and (b)): for example, messages, photos, Scenes, profile text and evidence-vault copies | A search warrant |
5. Preservation requests#
- Under 18 U.S.C. §2703(f), we preserve the records that exist when we receive your request, for 90 days. If you renew the request before then, we preserve them for one more 90-day period.
- Preservation is a snapshot. It doesn't capture anything created after we receive the request.
- Send preservation requests to legal@curtainsdating.com with the member's profile ID (or profile name), the records to preserve and the date range. We confirm preservation by email.
- Send them as early as you can. Scenes are deleted 24 hours after posting, messages 30 days after a conversation closes, and the IP addresses we record with account activity after 90 days.
- We release preserved records only with legal process (section 4), or in an emergency (section 6).
- Preserving records doesn't, on its own, lead us to notify the member (section 7).
6. Emergencies#
We may disclose information without legal process if we believe in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay (18 U.S.C. §2702(b)(8) and (c)(4)).
If you believe someone faces imminent danger of death or serious physical injury, email legal@curtainsdating.com with EMERGENCY at the start of the subject line, and include:
- what the emergency is, and who is at risk
- why the information is needed without delay
- the member's profile ID (or profile name), and the specific information you need
- your name, agency, badge or ID number, official email address, and a callback number we can confirm through your agency's public main line
Send emergency requests by email, not by phone. We treat them as our top priority. We disclose only what's needed to deal with the emergency, and we may ask you to follow up with legal process.
We may also contact law enforcement ourselves if we believe in good faith that someone is in danger of death or serious physical injury.
7. Notice to members#
Our policy is to tell members before we disclose their information in response to legal process, so they can object. We don't give notice when:
- the law or a court order prohibits it (for example, a nondisclosure order under 18 U.S.C. §2705(b));
- the request is an emergency (section 6);
- the case involves the sexual exploitation of a child; or
- we believe notice would put someone at risk of death or serious physical injury.
If you believe notice would put someone at risk or jeopardize an investigation, get a nondisclosure order and send it with your request. When a nondisclosure order expires, or an emergency has passed, we notify the member then, unless another exception still applies.
8. Safety alerts#
When we ban an account because it may be using a false identity or trying to get money from members by fraud, we send safety alerts to every member who received a message from it (fraud bans and safety alerts). If an alert would harm your investigation, ask us to delay it. We delay it as far as the law allows; some state laws set a deadline we can't extend.
9. Requests from outside the United States#
We're a US company, and Curtains is offered only in the United States. Authorities outside the US should use a mutual legal assistance treaty (MLAT) or letters rogatory, or, where one applies, an order under an agreement made under the US CLOUD Act. In an emergency involving imminent danger of death or serious physical injury, contact us as described in section 6, and we'll respond as far as US law allows.
10. Child safety#
We report apparent child sexual exploitation to NCMEC's CyberTipline, as 18 U.S.C. §2258A requires: child sexual abuse material, and the sex trafficking or online enticement of a minor. A report can include information about the people involved, including their IP addresses. We preserve the report materials for 1 year from the report. If you're following up on a CyberTipline report, include its report number. We release report materials only with legal process or as federal law otherwise allows.
11. Records certification and testimony#
If you need records certified as business records (for example, under Federal Rule of Evidence 902(11) or a state equivalent), say so in your request, and we'll provide a certificate of authenticity with the records. A certificate usually makes live testimony unnecessary. If you still need testimony, serve separate legal process for it.
12. Civil cases and members' own data#
- The Stored Communications Act doesn't allow us to disclose the content of members' communications in response to a civil subpoena. Other records need valid legal process, and we notify the member first (section 7).
- Members can get a copy of their own data through a privacy request (Privacy Policy, section 9).
