Privacy Policy

Blind Fate · last updated 14 September 2026

The short version: we collect almost nothing, we sell exactly nothing, and the most interesting thing about you, your face, never even reaches us. The long version is below, and it is genuinely all there is.

Blind Fate opened in Exeter on Friday 11 September 2026. This policy covers the app and our website, and we update it whenever anything here changes.

Who we are

Blind Fate is run by Blind Fate App Ltd, a company registered in England and Wales (company number 17377337), registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the data controller for everything described here, and we are registered with the Information Commissioner's Office under registration number ZC213736. You can reach us at blindfateapp@gmail.com, and that goes to an actual person, not a ticketing system.

What we collect, and why

On the website:

Data	Why	Lawful basis
Your email address, if you ask us to email you the link	To send you that one email, straight away. We do not keep the address: no list, no second email. So the same address is not mailed twice by accident, a scrambled one-way code made from it is kept for 25 hours, then deleted	Consent

That is everything. No name, no phone number, no tracking pixels, no advertising cookies, no analytics scripts quietly taking notes. We do not sell or share any of it, and honestly, there is nothing here worth selling.

Before the app opened, the website kept a list of emails so we could tell people the day it launched. That email went out, and on 14 September 2026 every address on the list was deleted.

In the app:

Data	Why	Lawful basis
First name, subject studied, interests	To match you, and to tell the person across the table who they are meeting. Your age is never shown to anyone. The ID check gives us a yes or no on being over 18 and the year you were born, which we use only to keep age gaps sensible (see the ID check section below)	Contract
Identity and age check (result only, see below)	To keep the app 18+ and everyone on it real	Legal obligation and substantial public interest
Rough location, when you press the button	To pick a venue you can actually walk to, rather than one an hour away	Contract
Your bookings and whether you turned up	To run the service and keep no-shows rare	Contract
Messages you send in the app	To let matched people arrange the evening, and for safety investigations if something goes wrong	Contract and legitimate interests
If you came through someone's Blind Fate link: which link, when you tapped it, whether your phone is an iPhone or Android, and a scrambled one-way code made from your internet connection	So the person who sent you can be paid for bringing you in. The scrambled code is only used to connect your tap to your sign-up on the same phone. It cannot be turned back into your internet address and is deleted after 48 hours. When a new account is made, the same kind of scrambled code is kept for 3 hours so that, if several people sign up from one shared connection (a campus network, say), nobody is wrongly credited to a link. So the same phone is not counted twice in a day, each tap is also filed under a short scrambled tag that changes every day and cannot be traced back to you; that tap record (a time, iPhone or Android, and the tag) is kept for up to 400 days so the person who sent you can see their numbers. The person who sent you sees a numbered row, never your name or details	Legitimate interests
Ideas and bug reports you send us from the app	So we can read them and fix what is broken. We keep what you wrote, which screen you were on and the app version, against your account so we can follow up. A bug report is also emailed straight to us, with your first name and what you wrote. When we fix it we may leave you a short note in the app saying so (and a notification, if yours are on); that note is deleted once you have seen it, after 90 days, or when you delete your account	Legitimate interests
A notification token for your phone	So we can tell you that a table has been booked, that someone liked you, or that it is time to head home safely. It is a code your phone's app store issues to this app, it identifies the handset rather than you, and it is deleted when you delete your account or install the app elsewhere	Contract
Your gender, and who you would like to be matched with	To match you for dates. Put together, those two answers can say something about your sexuality, and the law treats that as sensitive, so we ask for it separately and plainly rather than burying it in a form	Explicit consent

Some shared tables are for women only. To run those we use the gender you gave us when you signed up, and only that: we use it to decide who can see the table and who can join it. It is the same field you already gave us, we ask for nothing extra, and we never use your orientation on shared tables at all.

The sensitive one, said out loud

Your gender on its own is ordinary. Who you want to be matched with is ordinary. Together they can reveal your sexual orientation, which UK data protection law calls special category data and protects more strictly than the rest. We are not going to pretend otherwise, so:

We ask you directly, with a box you have to tick yourself, at the moment we collect it. It is never pre-ticked and never bundled into agreeing to the terms.
We only ask people who want dates. Tables of six do not use it at all, so if that is all you are here for, we never ask.
Saying no costs you dates, not the app. Mates tables carry on exactly as before. We think a "consent" you have to give to use something at all is not really consent.
If you do not consent, we do not use it. That is not a promise about intentions: our matching refuses to pair anyone who has not consented.
You can withdraw at any time in Settings, as easily as you gave it. Withdrawing stops date matching. It does not delete your account.
It is never shown on your profile and never used for anything but matching. It is not sold, shared, or used to advertise anything to you.

The ID check, in detail

Before your first booking you verify your identity through Didit, a specialist identity provider. You photograph an identity document and take a short selfie. Here is the part we are genuinely proud of:

We never receive your document or your photographs. They go directly to Didit and are never sent to us. We could not leak them if we tried, because we never have them.
We store five things: whether the check passed, whether you are over 18, the YEAR you were born, a reference number, and a one-way code that lets us recognise the same person again (see below). Not your name, not your full date of birth, not your document number, not a single pixel of any image.
Why the year. It is the only thing that lets us keep age gaps sensible — an eighteen-year-old is never matched with someone in their thirties. It is used for that and nothing else, it is never shown to anybody, and a year on its own does not identify you.
The one-way code, and why it exists. We take your document number, mix in a secret only our server holds, and run it through a one-way scramble. The result is a meaningless string of characters. It cannot be turned back into your document number, and it is useless anywhere else. We keep it for one reason: so that blocking someone actually works. Without it, a person you blocked could delete the app, reinstall it, and be matched with you again as though you had never blocked them. The same code keeps a no-show cooldown from being cleared the same way. It is deleted when you delete your account.
The session is deleted at the provider as soon as the result reaches us.

The selfie is used for a liveness and face-match check, which makes it biometric data under UK GDPR. It is processed by Didit for that single purpose and is not retained by us in any form.

No photos, anywhere

Blind Fate has no profile photographs. You cannot upload one, other users cannot see one, and there is no picture to rate or screenshot. This is a design decision, not a setting, and there is no toggle to get wrong. Your profile is words only: your first name, what you study and a few lines of your own. People who could be matched with you can read it in the Dates tab, so somebody you know who is also on the app could recognise you from it. If there is anyone you would rather not see, block them, and neither of you is shown to the other again.

Location, precisely

In the app, your location is used for two things only: choosing a venue within your walking limit, and confirming you actually arrived (a yes or a no, never a trail). We round coordinates before using them, we never store a movement history, and venues see table counts and times, never who or where anyone is.

So we can set the check-in circle fairly, each check-in attempt also keeps, for 30 days, how far it was from the venue and how accurate the phone said its reading was. That record has no name, no account and no location attached: it is a distance and a venue, nothing else.

How long we keep things

Website emails: not kept. The pre-launch list was deleted on 14 September 2026, after the launch email. Asking for the link now sends one email and stores no address. No phone numbers are held.
Account data: while your account exists. Deleting your account removes it straight away (see "Deleting everything" below for the two things that are anonymised rather than wiped).
Verification results (pass or fail, over 18 or not, birth year): while your account exists. The underlying documents are never held by us at all.
Messages: 90 days, or longer where needed for a safety or legal investigation.
Link taps: the scrambled connection code is deleted after 48 hours. Which link brought you in stays with your account, so the person who sent you can be paid.
Safety reports and blocks: as long as necessary to protect other users, which may be after your account is deleted.

Who else sees your data

Didit: identity verification, as above.
Cloudflare: hosting and storage.
Expo: delivers the notifications to your phone. The text of a notification, which can include a first name, the venue and time of a booking, or the first line of a message, passes through their servers on the way to your lock screen. Worth knowing: like any messaging app, what a notification says is visible on a locked phone unless you turn previews off in your phone's settings.
Resend: sends our emails: the confirmation when you leave your address on the website, the launch email we sent when we opened, and the bug reports you send from the app, which come to us with your first name and what you wrote.
Venues: a first name and a table time, so they can seat you. That is the entire handover. They do not get your surname, your number, or anything to remember you by beyond a table that showed up.

Those four are companies whose servers sit outside the UK, mostly in the United States and the EU, so some of your data is handled there. We rely on the standard data protection terms each of them publishes for transfers of this kind. They are processors, not partners: they may only do the specific thing we ask them to do with your data, and nothing else. If you want to know exactly where a particular piece of your data sits, ask us and we will tell you.

We do not sell your data, we do not use it for advertising, and no "trusted partners" are lurking behind that sentence. We do better when you have a good evening, not when we know more about you.

Deleting everything

You can delete your account from inside the app, in Settings, under "delete my account". That deletion is real: profile, bookings, verification result and blocks are wiped, and your messages are anonymised. It is not a "deactivation" that keeps everything and hopes you come back.

One thing is kept rather than wiped, and we would rather say so than have you find out. If you actually turned up to a venue, we keep a record of that night, because it is part of our accounts with that venue and we are required to keep those. So the record stays and you are taken out of it: your name and your account are stripped, and what remains is an entry in our accounts with that venue, with nothing left pointing back to you. How deletion works walks through the steps and lists exactly what goes and what stays.

Your rights

You can ask us for a copy of your data, ask us to correct or delete it, object to how we use it, or withdraw consent at any time. Email blindfateapp@gmail.com and we will respond within one month. If you are unhappy with how we handle any of it, you can complain to the Information Commissioner's Office at ico.org.uk, though we would love the chance to fix it first.

Age

Blind Fate is for people aged 18 and over. It is not intended for anyone under 18 and we do not knowingly hold data about under-18s. Every user is age-checked against a real identity document before their first booking, not a checkbox that says "I promise".

Changes

If this policy changes materially we will say so on this page and, where the change affects you, tell you directly. The date at the top always tells you when it last moved.

← back to Blind Fate