Privacy Policy

• Your raw prompts are never stored, and are never shown to another person.
• Matching happens only when you turn it on. When it is off, nothing is analyzed or sent.
• When it is on, your prompt is sanitized in your browser. If it looks sensitive, it is dropped before it ever leaves your device.
• Other people only ever see a short, generated topic summary. They never see your words, your details, or your name.
• You can export or delete everything at any time, from your settings.

Pairlumo is the controller of the personal data described here. For privacy questions or to exercise your rights, contact privacy@pairlumo.com.

We keep what we need to run the Service, and no more.

• Account data: a generated account identifier, an optional display name (only ever shown back to you), and, if you choose email sign-in, your email address.
• Sanitized topic data: when matching is on and a prompt is eligible, we store a short, generated topic summary and structured topic labels (category, intent, keywords). All of it is derived from the sanitized text. None of it is your prompt.
• Room data: the messages you send in a matched room, your per-room alias, and basic room metadata, for the life of the room and a short window after.
• Safety data: reports you file or that concern you, blocks, and a trust score, so we can keep the community safe.
• Device and technical data: an extension install identifier, version, and coarse, privacy-safe operational logs (for example, that a match was created).
• Rate limiting: to stop one person creating unlimited accounts we have to be able to tell that two requests came from the same place. We do that with a keyed hash of the network address rather than the address itself, so the address is used to compute the hash and then discarded. What is stored cannot be turned back into an address, and these records expire within the hour.

• Raw prompts. Your prompt text is sanitized in your browser and is never written to our database.
• Sensitive prompts. Prompts that appear to contain passwords, security codes, API keys, payment cards, bank or government identifiers, addresses, phone numbers, email addresses, medical details, or content about self-harm, exploitation, or violence are withheld automatically and never transmitted.
• Your conversation history with the AI. The extension only reads the single prompt you just submitted. It does not read the AI’s replies, your past conversations, or any other website.
• Precise location, contacts, browsing history, or saved credentials.

By default, only a short topic summary such as “Marketing a consumer finance app.” That summary is generated from a fixed internal vocabulary of topic labels. No span of your own text is ever copied into it. That is what makes the summary safe by construction rather than safe by filtering: there is nothing of yours in it to leak. You may optionally choose to share a sanitized excerpt or your exact prompt. Exact sharing requires a separate, explicit opt-in, and we do not recommend it.

• to operate matching, rooms, and messaging;
• to keep the Service safe (moderation, reports, blocks, rate limiting, abuse prevention);
• to understand and improve the Service using aggregate, privacy-safe analytics that never contain prompt or message text;
• to communicate with you about your account or sign-in; and
• to comply with legal obligations and enforce our Terms.

Where required by law, our legal bases are your consent (matching is off until you opt in), the performance of our contract with you (running the Service you asked for), and our legitimate interests in security and improvement, balanced against your rights.

• Raw prompts: never stored.
• Sanitized text and topic summaries: deleted within 24 hours.
• Messages: deleted about an hour after a room closes.
• Rooms: deleted about a day after they close; match history keeps only the topic title, for up to 30 days.
• Privacy-safe analytics: up to 90 days, then aggregated or removed.
• Account data: until you delete your account, after which it is removed (subject to short-lived backups and any legal retention obligation).

We do not sell your personal data. We share only as needed to run the Service:

• Hosting and database providers that store data on our behalf under contract.
• An embedding provider (optional): if the operator has configured one, sanitized topic text may be sent to it to compute a similarity vector. Withheld prompts are never sent. If no provider is configured, no prompt-derived data leaves our servers.
• Authorities, when we believe in good faith that disclosure is required by law or necessary to protect the safety of any person.

Data may be processed in countries other than yours. Where required, we use appropriate safeguards for international transfers.

Depending on where you live, you may have the right to:

• access, correct, or delete your personal data;
• export your data (available any time from your settings);
• object to or restrict certain processing, and withdraw consent;
• turn matching off, or pause everything instantly, at any time; and
• lodge a complaint with your local data protection authority.

You can export or permanently delete your account and data yourself from your settings, or contact privacy@pairlumo.com. We do not discriminate against you for exercising these rights.

We use a single, strictly necessary signed session cookie to keep you signed in on the website, and the browser extension stores your session token and preferences in local storage on your own device. We do not use advertising or cross-site tracking cookies. See our Cookie Notice for details.

We use industry-standard measures including encrypted transport, row-level access controls, hashed session tokens, input validation, rate limiting, and non-guessable room identifiers. No system is perfectly secure. We therefore design so that the most sensitive thing you give us, your prompt, is never stored in the first place. It cannot leak from a database it was never written to.

The Service is for adults. It is not directed to anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has used the Service, contact us and we will remove the account.

We may update this policy. If we make material changes, we will update the “Last updated” date and, where appropriate, notify you. Your continued use after changes become effective means you accept the updated policy.

Privacy questions or requests can be sent to privacy@pairlumo.com.