Privacy Policy

Last Updated: September 23, 2026

At Spicy Friends, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

This Privacy Policy is intended to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) for our commercial activities. Residents of Quebec may have additional rights under Quebec’s Law 25; they can exercise those rights by contacting the same privacy mailbox listed in Section 10. Other laws (including GDPR, UK GDPR, or the CCPA/CPRA) may apply to a particular processing activity; see Section 4.3.

We collect, use, and disclose personal information as described here and as needed to provide the Service you request. For sensitive information (including sexuality and intimate Content), we rely on the consent you give when you create an account, submit that information, or use those features, subject to legal exceptions. If you do not agree with these practices, do not use the Service.

If you want to keep your lifestyle activity separate from other parts of your life, consider choosing a profile name you do not use elsewhere.

1. Information We Collect

We may collect personal information from you in a variety of ways, including:

• Registration Information: When you register for an account, we may collect your email address, password, date of birth, profile name, location you choose to provide, and any other details you submit.
• Profile Information: Additional information you add to a profile, including preferences, interests, relationship status, partner or couple profile details (including dates of birth you enter for partners), and seeking information.
• Communication: Messages and other communications you send through our site, and correspondence you send to support or safety mailboxes.
• Usage Data: We may automatically collect information about your device and how you interact with our website, which may include your IP address, browser type, pages visited, and time spent on our site. Session IP addresses and user-agent strings are kept only for security and fraud prevention until the session ends, and for at most 8 days after last activity.
• User Content: Images, video, audio, writings, and other content you upload for profile pictures, albums, posts, messaging, events, places, groups, publications, Vendor Market listings and items, rendezvous, or other features.
• Social graph and safety records: Connections you make visible or store (for example friends or followers), blocks, reports, and similar records needed to operate those features.
• Location: Location you enter or search, and coordinates or map-request metadata when you use maps or geocoding (see Section 3.1).
• Push notifications: If you enable browser push notifications, a push subscription endpoint and notification payload.
• Points: Ledger entries if you participate in the contribution points program (earned, reversed, redeemed, or adjusted amounts).

1.1 Age Verification

We do not knowingly collect information from anyone under the age of 18. If we learn that a member is underage, we will delete their account immediately. Users must be of legal age to use our services.

We may use date of birth, member attestations, profile verification, automated screening of images or video, and, where reasonably necessary, a request for additional proof of age, as described in the Terms of Use. Those methods are safety measures. They are not a government-issued identity or age-verification system. We may restrict access from locations where the law requires a method we do not offer.

1.2 Payment, order, and Supporter information

If you purchase Supporter access through the Service, payment is currently Interac e-Transfer in Canada. We do not receive or store your online banking login or full bank account details. We may receive limited payment metadata needed to match your transfer to your account (for example sender name or note, amount, date, and the reference identifier you are instructed to include). We retain transaction records (amount, currency, term, profiles covered, verification status, and related support correspondence) for account management, fraud prevention, and legal and tax compliance.

If you order merchandise, we may also collect your name, email address, billing and shipping addresses, telephone number if needed for delivery, products and quantities ordered, delivery method, tracking information, tax location, returns, refunds, and customer-support communications.

We do not currently accept payment cards. If card payments become available, a third-party processor will collect card details. We expect to receive limited transaction information such as a processor token, card brand, last four digits, expiry month/year, authorization status, amount, currency, and dispute or fraud records—not full card numbers or security codes. Payment methods and product terms are in the Store and Membership Terms.

1.3 Profile verification materials

If you request profile verification, we may process:

• a short verification video and any challenge code associated with the request;
• face photographs you have placed in an album for that purpose; and
• notes from member attestations or in-person admin verification.

Only our admin team reviews verification videos in-product. We do not use verification materials for advertising. You may delete a verification video from your album after you are verified; we may still retain a record that the profile was verified and limited support notes. See Get Verified.

1.4 Sensitive information

Information about sexuality, intimate or sexually explicit images and video, messages, precise location you provide, and verification media is sensitive personal information. We collect, use, and disclose it only as needed to provide and secure the Service, to enforce our terms, and as described in this policy. You must have the consent of every depicted person before you upload intimate Content, as required by the Terms of Use.

1.5 Vendor Market listings

If you create a Vendor Market listing, we collect the business and offering information you submit. That may include a business name, tagline, description, category, photos, website links, phone number, email address, location and coordinates, service area, and item names, descriptions, prices, and photos. Other members can see listing information you publish. Category counts for Vendor Market may appear on publicly viewable pages. Reviews of listings are User Content from the reviewer.

We do not collect payment card, bank, or other payment details for transactions between members and listing owners. Those transactions happen off the Service. See the Terms of Use (Section 13.1).

1.6 Place listings

If you create a Place listing, we collect the location information you submit. That may include a name, tagline, description, category, tags, photos, website links, phone number, map coordinates, an address or area description, whether the pin is exact or approximate, and whether the listing is Supporters-only. Reviews of listings are User Content from the reviewer.

Many Place listings are publicly viewable without an account. Supporters-only listings are withheld from logged-out visitors and may appear in signed-in lists with limited detail until an eligible member opens them. A Supporters-only setting is an access control on the Service; it is not a guarantee that the real-world location will stay private. See the Terms of Use (Section 13.2).

2. How We Use Your Information

We may use the information we collect for various purposes, including:

• To provide, maintain, and improve our website and services.
• To personalize your experience on our site.
• To communicate with you, including responding to your inquiries and sending you updates and promotional content (see Section 2.3).
• To monitor usage and analyze trends to improve our services.
• To enforce our terms, conditions, and policies.
• To process Supporter payments, verify Interac e-Transfers, grant or remove Supporter access for the purchased term, and handle refunds in line with our Terms of Use.
• To process and fulfill merchandise orders, calculate tax and shipping, send confirmations and delivery updates, manage returns or recalls, and provide customer support.
• If cards or recurring memberships become available, to authorize payments through our processor, administer recurring billing and cancellation, detect fraud, handle disputes, and maintain transaction consent records.
• To operate the points program, including awarding, reversing, and redeeming points.
• To process and analyze uploaded content (including images) for safety, security, and compliance purposes.
• To detect and prevent inappropriate or harmful content through automated screening.
• To complete profile verification you request.
• To display Vendor Market listings and items you publish, including contact details you choose to include.
• To display Place listings you publish, including location, map, and contact details you choose to include, subject to any Supporters-only setting.

2.1 Automated Content Processing

We use automated systems and machine learning to:

• Proactively identify potentially problematic content for human review
• Detect and prevent spam, scams, and other harmful activities
• Screen uploaded images for safety and compliance purposes
• Flag potential violations of our Acceptable Use Policy
• Help identify Content that may depict a person who appears under 18

Image scanning (including intimate images): When you upload images—including intimate or explicit images—we may share them with our content-screening provider using a short-lived URL. That provider analyzes the image for nudity and AI-generated content so we can apply safety ratings and enforce the Acceptable Use Policy. We strip or avoid sending location and similar embedded metadata where reasonably practicable. This processing is for platform safety and compliance only; it is not used for advertising. Automated screening prioritizes what to review; a person on our team makes enforcement decisions when reasonably practicable. You may ask us to reconsider a decision as described in Content Complaints and Appeals.

2.2 Session Replay and User Behavior

To troubleshoot technical issues and improve the user experience, Spicy Friends uses third-party tools for error reporting and, when you consent to analytics cookies, for session replay. Session replay allows us to see a visual reconstruction of your interactions with our service, including clicks, scrolls, page refreshes, and navigation paths.

• Consent: Masked session replay runs only after you accept analytics cookies (or enable analytics in Cookie Settings). Error and performance events sent for reliability are not gated by that cookie choice.
• Feedback: Signed-in users can submit a bug report or feedback that may include their profile name, an optional email, the message, and an optional screenshot, sent to the same error-monitoring provider. A masked session replay is attached only when analytics consent has already started a recording.
• Privacy Guardrails: Our replay implementation is configured to automatically mask and redact sensitive information. We do not record passwords, payment details, or specific text inputs in private fields. Media (such as profile pictures and videos) is blocked from replay recordings.
• Purpose: We use this data solely to identify bugs, fix crashes, and understand how users navigate our platform to make it more intuitive. This data is not used for cross-site advertising or sold to third parties.

2.3 Electronic messages (CASL)

We send transactional or relationship messages needed to operate your account (security, receipts, enforcement, and similar). Commercial electronic messages about the Service are sent only with consent required under Canada's Anti-Spam Legislation (CASL) and similar laws. You may withdraw consent to commercial messages using unsubscribe instructions in those emails or by contacting the Privacy Officer. Withdrawal does not stop transactional messages needed to operate your account.

3. Sharing Your Information

We do not sell or rent your personal information to third parties. We value your privacy.

We may share your information with:

• Service Providers: We engage third-party companies and individuals to facilitate our services or provide services on our behalf, such as hosting, storage, analytics, messaging, email delivery, content moderation, maps, video, bot protection, shipping, fulfillment, tax calculation, customer support, fraud prevention, and payment processing. Payment-related activity may involve your Canadian financial institution, Interac, and email or communication providers we use for payment instructions or receipts. If cards become available, it will also involve the disclosed processor, acquiring bank, card network, and fraud or authentication providers. This includes sharing uploaded images with our content-screening provider (see Section 2.1) and using error-monitoring and, with your consent, session-replay tools (see Section 2.2). These service providers are contractually required to protect your information and use it only for the specific services they provide to us.
• Analytics providers (with consent): If you consent to analytics cookies, we use third-party analytics providers described in our Cookie Policy. Those providers may process identifiers and usage data under their own policies. You can change this choice at any time via Cookie Settings (see Section 9.1).
• Legal Requirements: We may disclose your information if required to do so by law, in a qualifying emergency, or in response to valid compulsory process, as described in Section 4.1 and our Legal Requests page.
• Corporate transactions: If Spicy Friends is acquired, merges, or sells assets that include personal information, we will notify you before that information becomes subject to a different privacy policy, unless the law requires or prohibits a different approach.

3.1 Processing Outside Canada (Transborder Transfers)

Spicy Friends is based in Canada. Personal information we collect may be processed outside Canada, including in the United States and other countries, by categories of service providers described below. Our primary cloud hosting, database, and object storage are operated in Canada. That does not mean all of your personal information stays in Canada—other providers in the table may process data abroad—and we do not promise that every copy or subprocess remains in Canada.

Laws in those other jurisdictions may differ from Canadian privacy law. We require our service providers, by contract, to use personal information only to provide the services we have engaged them for.

Under PIPEDA and applicable privacy law (including GDPR where it applies), we describe categories of recipients rather than listing every vendor by name. Current product-facing tools used with cookies (for example analytics and session replay) are named in our Cookie Policy.

4. Your Rights and Choices

Under applicable Canadian privacy law, you have the following rights and choices regarding your personal information:

• Right to know: You have the right to know what personal information we hold about you, how we use it, and to whom it is disclosed. This Privacy Policy describes those practices; you may also ask us for specifics that apply to your account.
• Right to access and correct: You may access and correct much of your account and profile information through your account settings. For information you cannot view or change there, contact our Privacy Officer (see Section 10).
• Right to withdraw consent: You may withdraw consent to our collection, use, or disclosure of your personal information, subject to legal or contractual restrictions and reasonable notice. If you withdraw consent for information we need to operate your account or provide the Service, some features—or your account—may no longer work.
• Access, deletion, and copies: You can delete your account through account settings, or request access to or deletion of your personal information by emailing [email protected]. We do not currently offer an in-product data-export feature; until that ships, requests for a copy of your personal information are fulfilled by contacting the Privacy Officer.
• Response time: We aim to respond to access and similar privacy requests within 30 days.
• Complaints: If you have a concern about our privacy practices, please contact our Privacy Officer first so we can try to resolve it. If you remain unsatisfied, you may complain to the Office of the Privacy Commissioner of Canada. Quebec residents may also contact the Commission d’accès à l’information.
• You may opt-out of receiving promotional communications from us by following the unsubscribe instructions in the emails we send you (see Section 2.3).
• You may choose to limit the information you provide when creating a profile, but this may impact your experience on the site.
• You can manage analytics cookies (including third-party analytics and masked session replay) through our cookie banner or Cookie Settings in the site footer. See our Cookie Policy for the tools currently in use.

4.1 Legal Requests and Law Enforcement

We disclose non-public personal information to law enforcement or government agencies only as described in our Legal Requests page. In summary, we:

• Produce non-public information when required by valid compulsory process we must follow, with verified member consent, as otherwise required by law, or in a qualifying emergency involving imminent danger of death or serious physical injury
• Reject or object to requests that lack proper legal authorization or that we believe are improper or overly broad
• Notify you if we receive a legal request for your information (unless prohibited by law or in rare exigent circumstances), and where we may do so, provide a copy of the process
• May preserve specified account data for up to 90 days on a formal law-enforcement preservation request, and longer when legally required

The Legal Requests page also describes what we typically hold, how foreign and civil process is treated, and where agencies should send requests.

4.2 Quebec (Law 25)

If you are in Quebec, you may have additional rights under Quebec's Act respecting the protection of personal information in the private sector (Law 25), including to access, correct, and withdraw consent; to request that we cease disseminating your personal information or de-index a hyperlink where the law allows; to portability of computerized personal information we hold in a structured, commonly used technological format; and to be informed of, and in some cases request that a person review, decisions based exclusively on automated processing that produce legal or similarly significant effects. Contact our Privacy Officer to exercise these rights. You may also complain to the Commission d’accès à l’information.

4.3 International users (GDPR / CCPA)

We are a Canadian business. We do not currently operate an establishment in the European Economic Area, the United Kingdom, or California, and we do not sell personal information. If those laws apply to a particular processing activity:

• EEA/UK: Spicy Friends Ltd. is the controller of personal information we collect. Legal bases include performance of our contract with you (to provide the Service), legitimate interests (security, abuse prevention, and improving the Service in ways that do not override your rights), consent (analytics cookies and commercial email where required), and legal obligation. You may have rights of access, correction, erasure, restriction, objection, and portability, and the right to complain to a supervisory authority. Transfers from the EEA/UK, if any, rely on appropriate safeguards such as contractual clauses with our processors.
• California: We do not sell or share personal information as those terms are used in the CCPA/CPRA. Sensitive personal information (including sexual orientation you provide, the contents of messages, and precise location if you provide it) is used to provide the Service and for safety, not to infer characteristics for cross-context advertising. You may request access, deletion, and correction through our Privacy Officer.

5. Security

We strive to use commercially acceptable means to protect your personal information, including:

• All data transmission between you and our servers is encrypted using HTTPS
• Database and Media backups are encrypted at rest
• Data is backed up daily and stored in multiple secure locations

However, no method of transmission over the internet or electronic storage is 100% secure. While we implement industry-standard security measures, we cannot guarantee absolute security. When we share content with third-party processors, we ensure they maintain appropriate security measures and data protection standards consistent with this policy.

6. Security incidents

If we become aware of a suspected security incident involving personal information, we investigate it.

If a breach of security safeguards involving personal information under our control creates a real risk of significant harm to an individual, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law. We will give those notices as soon as feasible. Where Quebec’s Law 25 applies, we may also notify the Commission d’accès à l’information.

Notices to affected individuals will describe, at a high level, what happened, the personal information involved if known, and steps people can take to protect themselves.

We keep records of breaches of security safeguards as required by law.

If you have questions about a security incident, or believe your personal information may have been affected, contact our Privacy Officer at [email protected].

7. Data Retention

• Your profile becomes immediately inaccessible to other users when you delete your account
• Account deletion is processed within 30 days of your request
• Deleted data may persist in encrypted backups for up to 60 days until those backups are rotated/overwritten.
• Session IP addresses and user-agent strings are kept only for security and fraud prevention until the session ends, and for at most 8 days after last activity.
• Verification videos you leave in an album are retained as User Content until you delete them or the account is deleted. We may keep a record that verification occurred.
• Points ledger entries may be retained in anonymized or aggregated form after account deletion as needed to keep the program auditable.
• Order, payment, refund, subscription-consent, tax, fraud, chargeback, shipping, and product-safety records may be retained for the period reasonably required by tax, accounting, limitation, payment-network, consumer-protection, recall, and other legal obligations. Deleting a member account does not require deletion of records we must retain for those purposes.

Exceptions:

• Content in group conversations may remain (but without identifying information)
• Anonymized deletion-reason categories, and any comments you provide when deleting, may be retained to improve the Service. We do not keep your email address or profile display name with those records.
• Data may be preserved longer if required by law enforcement with proper legal authorization, including a preservation request as described in Legal Requests

8. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to review the privacy policies of any third-party sites you visit.

9. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page with an updated effective date. We encourage you to review this policy periodically for any changes.

9.1 "Do Not Track" and Opt-Out Settings

• Do Not Track (DNT): Some browsers transmit "Do Not Track" signals. Because there is currently no universal standard for how these signals should be interpreted, Spicy Friends does not currently alter its practices in response to DNT headers.
• Cookies, analytics, session replay, and Global Privacy Control (GPC): See our Cookie Policy. Analytics cookies are off until you opt in. A GPC signal is not consent to analytics.
• Additional controls: You may use browser extensions that block common analytics scripts, or contact our Privacy Officer at [email protected] about your privacy options.

10. Contact Us

We have designated a Privacy Officer who is accountable for our personal-information practices and for responding to privacy questions and requests.

• Privacy Officer / privacy requests: [email protected]
• General support: [email protected]
• Postal: Privacy Officer, Spicy Friends Ltd., 7242 Wellington Rd 124, Guelph, Ontario, Canada N1H 6J3

If you have questions about this Privacy Policy or our data practices, please contact the Privacy Officer at the address above.