Privacy Policy
lashou collects the minimum needed to run ten words → portrait → meeting someone. Here is exactly what we store, where, and who can see it.
Updated 2026-11-05
What we collect
At signup: email, password (bcrypt hash only, never the plain text), display name.
While using it: your ten words, the AI portrait (summary, strengths, a question to ask), the gender and intent you pick, invitations, chat messages.
Technically: a session cookie, an analytics cookie, and rate-limit counters derived from your IP (kept at most one day).
We do not collect: contacts, precise location, photos, ID documents, device fingerprints.
What email is used for
Only: sign-in verification codes, password resets, and invitation notifications you opted into. Your email never appears on discovery cards, share pages, or anywhere another user can see it.
Apart from those notifications, we send no marketing mail. You can turn them off any time in Profile → Settings.
Who can see your information
Other users: your name, portrait summary, need tag, gender tag. Your email and ten words are never shown on other people's pages.
Share links: only when you create one, and the link shows your name, ten words and portrait. Turn it off and the link dies immediately.
Processors: DeepSeek (receives only the ten words, to write the portrait), Resend (sends codes and notifications), Cloudflare (CDN and protection), Google Tag Manager / Google Analytics (aggregate traffic stats).
We never sell or rent your data, and never use it for ad targeting.
How long we keep it
Profile and messages stay while your account exists. Verification codes expire in 20 minutes and are deleted within a day; rate-limit counters last at most one day.
You can hide yourself from discovery at any time. For full deletion of the account and messages, email the address below and we handle it within seven working days.
Cookies
session: keeps you signed in (httpOnly, 7 days).
lsh_s: only says "signed in", used to avoid a flash of the marketing page; carries no identity.
_ga / _ga_*: Google Analytics. Blocking it does not affect any feature.
Security
HTTPS everywhere; the database only listens on localhost; daily 03:30 backup, readable only by the server administrator.
No system is perfectly secure. We minimise what we store and keep least privilege.
Minors
The service is for people 18 and over. Signup requires confirming you are 18+; accounts found to belong to minors are deleted.
Changes and contact
Updates to this page change the date at the top.
Privacy requests (access, correction, deletion, complaints): [email protected]