Privacy Policy — Night Protocol LLC

Night Protocol LLC ("Company," "we," "us," or "our"), a Wyoming limited liability company, operates the domains listed at the end of this document, the Night Protocol desktop app, the Night Protocol MCP server and the Night Protocol Telegram bot (the "Platform"). This Privacy Policy describes what we collect, how we use and share it, how long we keep it, and your choices. If you do not agree with it, please do not use the Platform.

1. Information We Collect

1.1 Information you give us

• Account: email address, password (held by our sign-in service, Amazon Cognito; we never see it in plain text), your handle, the communities and roles you join, and your confirmation that you are 18 or older.
• Age Verification: a photo of your government-issued ID, a selfie, and the name and date of birth on the ID. Our team reviews them. They are stored in private storage and kept for seven (7) years under 18 U.S.C. § 2257 (section 5).
• Details you share: details you add per community, such as height, body type, ethnicity or race, preferences and what you are looking for. These are declared by you and controlled by you: you choose who can see each one (public, members in that community, on request, or private), whether a private one may count in matches without being shown, and you can change or delete them at any time.
• Your map pin: the place you put your pin. Other members in your communities see it where you place it; you can hide it at any time.
• Content: clips you publish from the desktop app, and their covers and tags. Clips you have not published stay on your own computer and are not sent to us.
• Interactions: interest signals, requests, meeting times, blocks, "not interested" choices, reports and feedback.
• Payments: order ids, amounts, subscription status and dates. Card details are entered on our payment processor's hosted page; we never see or store your full card number.
• Payouts and tax forms: if you are paid as a creator, our payout provider collects your legal name, taxpayer identification number (W-9, W-8BEN or W-8BEN-E) and payout account on its own hosted page and screens payees as the law requires. Night Protocol does not receive or store your SSN, EIN or bank numbers; we keep only the form type, whether it was submitted and verified, whether your legal name matched your Age Verification, the provider's payee id and status, the last four digits of your taxpayer number if the provider shows them, and your earnings and payout records (kept as financial records for at least seven years).
• Support: messages you send us.

1.2 Information collected automatically

• Device and connection: IP address, browser and app version, operating system. On each request we work out the U.S. state you are in from your connection to apply state age-verification laws; we store only the state code with that check.
• Usage: screens and features used and errors, recorded under a pseudonymous id. This is our own record; we do not use third-party advertising trackers.
• Browser storage: your sign-in session and app settings are kept in your browser's local storage.

1.3 Connected services

• Assistants: if you connect an AI assistant through our MCP connector, we keep the connection (which assistant, the permissions you approved, when it was last used) and a record of what it did for you, which you can see for 30 days. Your assistant receives only what it asks for on your behalf: other people appear as anonymous ids with an approximate distance band, never their accounts, handles, email addresses or exact locations, and never who asked about you. Your assistant's provider handles your conversation under its own privacy policy. You can disconnect it at any time.
• Telegram: if you link Telegram, we keep your Telegram user id, username and the link time. Your Telegram username is shared with another member only when both of you agree to continue on Telegram; your phone number is never shared. Night Protocol is not in the chat between you and does not store it or any message text. We keep a record that a handoff happened (the two members, when, and whether it was accepted) for up to 30 days. We recommend Telegram Secret Chats, which are end-to-end encrypted.

1.4 What we do not collect

We do not collect health information. HIV, PrEP and STI status and test dates are refused as details. We never ask your age again after sign-up and Age Verification.

2. How We Use Your Information

• Provide the Platform: your account, the map, matching within shared communities, content, Premium, Points, assistants and the Telegram bot
• Verify age and identity and keep the records the law requires (18 U.S.C. § 2257)
• Apply state age-verification laws for viewing content
• Process payments, subscriptions, free trials and refunds
• Keep members safe: blocks, reports, moderation, fraud and abuse prevention
• Communicate with you about your account and support requests
• Understand and improve how the Platform works
• Comply with legal obligations and enforce our Terms

3. Disclosure of Your Information

We do not sell your personal information and we do not share it for advertising.

3.1 Other members

Other members in a community you share see your handle, your pin and the details you made visible to them. Who asked about you is never shown to you or to anyone else.

3.2 Service providers

We use Amazon Web Services (hosting, storage, sign-in and email), a card payment processor (payments), a payout provider (creator and referral payouts, tax forms and year-end tax reporting), and Telegram (only if you link it). They may use your information only to provide their service to us.

3.3 Legal requirements

We may disclose information if required by law, court order or governmental authority, or if we believe in good faith that disclosure is necessary to protect rights, property or safety. This includes mandatory reporting of child sexual abuse material (CSAM) to the National Center for Missing and Exploited Children (NCMEC) and law enforcement, as required by 18 U.S.C. § 2258A.

3.4 Business transfers

In the event of a merger, acquisition or sale of assets, your information may be transferred to the successor entity, subject to this Privacy Policy.

3.5 With your consent

We may disclose your information for any other purpose with your express consent.

Handle links. Someone who is not signed in and opens a member's link (night-protocol.com/<handle>) sees only a way to join or log in, never anything about the member. If you join in the same browser session after opening a member's link, we record that member as your referrer; they see how many people joined through their link, not your handle. Signed-in members who open a link see only what that member's settings already show them on the map.

4. Where Your Data Lives

Accounts and Platform data are stored with Amazon Web Services in the us-east-1 region (Northern Virginia, United States). Map links never sign anyone in: a link opens only for the member it was made for, after they sign in the normal way.

5. Data Retention and Deletion

• Your account: kept while it is active. When you delete it in Profile › Account Settings › Delete account, it is disabled at once and erased after seven (7) days.
• Age Verification and 2257 records: kept for seven (7) years, including after account deletion, as the law requires.
• Clips: when you unpublish or delete a clip, our server copy is deleted and backup versions expire within 30 days. Unpublished clips were never on our servers. A clip paused until its creator completes Age Verification stays on our server, hidden, for up to 60 days; then the server copy is deleted.
• Details: deleted when you delete them or your account.
• Assistant activity: shown to you for 30 days.
• Payment records: kept as long as tax and payment rules require.
• Moderation incident records: when a clip is refused as not consensual or prohibited, a locked copy of the file, its fingerprint (a hash), the uploader and the people tagged are kept for seven (7) years, including after account deletion. Only administrators can see them, and we may disclose them to authorities when the law requires it.

When retention is no longer required, we delete or anonymize the information.

Messages under content. Messages between a creator and a viewer are stored while the clip exists and for 90 days after it is deleted, then permanently deleted. A report keeps its own copy of the last 20 messages of that conversation for our safety review, kept with our other moderation records. We do not scan messages automatically.

6. Security

We use administrative, technical and physical safeguards to protect your information, including encryption in transit, private storage for Age Verification records, and short-lived sign-in tokens. No method of transmission or storage is completely secure. You are responsible for keeping your sign-in credentials confidential. To report a vulnerability, see night-protocol.com/security.

7. Children's Privacy

The Platform is strictly for people 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that a minor has provided personal information, we delete it and close the account. If you believe a minor is using the Platform, contact us immediately.

8. Your Rights and Choices

• See and change your details and who can see each one (in Profile, under each of your roles)
• Hide your pin, block people, or mark them "not interested"
• Disconnect assistants and unlink Telegram at any time
• Unpublish your clips at any time
• Delete your account in Profile › Account Settings › Delete account
• Depending on where you live, ask to access, correct, delete or port your personal information, or object to or restrict some processing, subject to legal retention duties

To exercise these rights, contact us as shown in section 13. We respond to verified requests within the time the law requires.

9. California Residents (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know, delete and opt out of the sale of personal information. We do not sell or share personal information. For CCPA requests, contact us as shown in section 13.

10. Nevada Residents

Nevada residents may opt out of the sale of certain personal information. We do not sell personal information. To submit a request, contact us as shown in section 13.

11. International Users

The Platform is operated from the United States. If you use it from outside the United States, your information is transferred to and processed in the United States, which may have different data protection standards than your home country.

12. Changes to This Policy

We may update this Privacy Policy. The date at the top shows the last change and, where appropriate, we also give notice on the Platform. Continued use after a change means you accept the revised Policy.

13. Contact Information