Operator
FaceFilter is operated by FOX PARTON.
Information processed
We use account email, password hash, encrypted residential address, declared birth date, consent records, profile/template answers and photos, contact preferences, messages/tags, reports, subscriptions and access audit records. Email-verification, password-reset and sign-in email-change tokens and recovery codes are stored as hashes; authenticator secrets are encrypted. Password-reset and email-change links expire after 30 minutes, work once, and do not turn off two-factor authentication. Identity/address evidence and OCR are private. Your full residential address and verification documents are private and are never shared with other people in the directory. Routine queue screens use address-free screening summaries. Designated identity-review staff may open the submitted evidence and required private declaration through short-lived, document-scoped access after password and two-factor confirmation, only for the identity decision and evaluation of automated screening. Evidence access is audited and appears in your private access history. Separately authorized emergency/legal access remains restricted to that purpose. Automated processing supports declared-detail consistency, eligibility/compliance checks and location relevance; it does not guarantee legal compliance or establish genuine identity. A chosen profile city may be public. Do not submit Social Security numbers or unrelated financial information.
Purpose and visibility
Information supports authentication, directory search, messaging, eligibility, residence checks, subscriptions and support/abuse/legal handling. Only eligible members use the directory. Your full residential address and verification documents are private and are never shared with other people in the directory. Routine queue screens use address-free screening summaries. Designated identity-review staff may open the submitted evidence and required private declaration through short-lived, document-scoped access after password and two-factor confirmation, only for the identity decision and evaluation of automated screening. Evidence access is audited and appears in your private access history. Separately authorized emergency/legal access remains restricted to that purpose. Automated processing supports declared-detail consistency, eligibility/compliance checks and location relevance; it does not guarantee legal compliance or establish genuine identity. A chosen profile city may be public. Hidden message bodies are not returned before per-message reveal. Routine secondary reviewers receive allowlisted screening results rather than raw address-bearing evidence. Relevant reported member content remains reviewable for safety.
Sensitive answers
Choose Unknown, Not applicable or Prefer not to disclose for traits you do not want to share. Private answers are excluded from public data. We do not infer sensitive interests from appearance, create biometric identity templates or use ID evidence for advertising.
Providers and AI
Available card payments use Stripe; crypto uses Plisio. The provider processes payment information and FaceFilter records payment references/status. We do not receive full card numbers or ask for wallet private keys. When configured, Resend delivers account-verification, password-reset, sign-in email-change and security-notification emails and staff review-ready notifications containing the destination email, applicable account or authenticated review link and security-event description; staff-review notifications exclude ID images, birth date, address and raw OCR; it does not receive your residential address, ID, private messages or authenticator secrets. Account-email delivery does not subscribe you to marketing. Server storage and PostgreSQL hold service records; Tesseract processes evidence locally. Automatic content rules work without AI. All real messages, including manually proposed labels, need static word/phrase checks and verified labels. When enabled, a small catalog of separately validated exact phrases can supply local labels. Text outside that catalog requires successful xAI Grok classification. All recipient previews, tags and content stay withheld until required checks finish. A required unavailable or failed checker prevents delivery. These checks do not guarantee semantic accuracy. Remote classification sends only the current message body and label taxonomy to an xAI Grok model. A validated local catalog match makes no external classification request. A prior successful Grok result may be reused for identical normalized text under the same classifier and labeling rules; the static pass still runs. FaceFilter does not add account identifiers, residential addresses, profile records, identity documents or conversation history to that request; text you write may itself contain personal information. Requests disable optional response storage, but xAI states that default security/audit logs may retain data for up to 30 days; zero retention is not guaranteed. Manual label proposals follow the same verified-labeling process and cannot remove required detected topics. The public message sandbox uses local static rules without xAI. Generated planning and mediation are future experimental features, disabled by default. If explicitly enabled and disclosed, the separately configured AI service may process planning or mediation text for suggestions. These uses do not authorize advertising or model training.
Combined trial coordination
FaceFilter and Townspeak use a shared trial service to count a member once, bind the same confirmed email and compare keyed fingerprints of independently reviewed legal name and birth date. It receives the confirmed email transiently and stores keyed email/identity fingerprints, app account identifiers, ownership versions, approval state and trial dates. Raw identity documents and residential addresses are not shared through this service. A bounded two-minute approval lease pauses combined access if confirmation becomes unavailable. Chapter-code bot credentials can create and list promotional codes only; they cannot read member records or approve identities. A protected encrypted recovery copy of each chapter code expires after its 30-day redemption window; credential hashes and minimal generation/audit metadata support revocation and abuse prevention.
Retention and security
Addresses, evidence, declarations, OCR and authenticator secrets are encrypted at rest. Verification links expire in 24 hours; authenticator enrollment expires in ten minutes, sign-in challenges in five minutes, and recovery codes work once. Evidence expires within 30 days and is erased earlier after a final decision. Detailed exceptional-access grant records, including encrypted reasons, expire after 30 days; minimal audit metadata may remain. Limited screening-versus-human decision outcomes may remain for accuracy evaluation, without retaining raw IDs, addresses, birth dates or raw OCR longer solely for analytics. Private messages held for unavailable classification expire after seven days and are never shown to recipients before all required labeling checks succeed. Classification cache entries contain only labels and a message hash, not raw text; finished call records contain token counts, cost and safe metadata, and expire after 30 days. Unresolved cost reservations remain until reviewed or settled; monthly/daily cost aggregates may remain for budget accounting. A keyed fingerprint of verified legal name and birth date may be retained for the invitation program to prevent repeated trials after account deletion; raw identity data is not added to this fraud-prevention record. Other content and financial records remain as needed for service and legal obligations; restricted backups persist until rotation. Controls reduce risk without guaranteeing perfect security.
Your choices
Edit profile answers and sharing, choose tag filters, leave messages hidden and cancel membership. Request access, correction or deletion through support. Cancel recurring billing before account deletion; self-service deletion is restricted while a recurring mandate remains active. A card subscription canceled at period end remains active until that date; contact support about hiding your profile sooner or another applicable privacy request. Do not send new ID evidence through public support.
Private account administration
Authorized human administrators can see signup IDs, signup times, the first token of a public profile name and a small private thumbnail of the current primary profile photo, plus aggregate signup, confirmation, review, paid and trial counts. This account console does not display email, surnames, addresses, birth dates, identity documents or review selfies. Access requires current administrator role, verified email, security setup and recent password/two-factor verification, expires after five minutes and is audited. The chapter-code bot credential cannot access this console.
Privacy contact
Privacy requests: partonfox5@gmail.com.
Clear intent makes better connections. If you're unsure about a policy, pause and ask before proceeding.