The Open Connection — Privacy Policy

Beta version — pending legal review

Effective date: October 9, 2026

Last updated: October 14, 2026

Connecting with people can involve personal information. This policy explains what The Open Connection (TOC) collects, why we use it, who can see it, and the choices you have.

TOC is operated by Tommy Jedrzejczyk, doing business as The Open Connection. This policy covers our beta web app at https://app.theopenconnection.com and our website at https://theopenconnection.com. Contact us at [email protected].

1. Information we collect

Account information. Signup collects your email address, password, and date of birth. We use your date of birth to prevent people under 18 from joining. We also process the credential information needed for sign-in using a passkey or authenticator. If you choose to use Play, we use a third-party identity-verification service (see Verification below).

Profile and community information. We collect the information you add to your profile, such as a name, photos, relationship status, interests, and preferences, along with photos, album permissions, messages, event listings, RSVPs, and other content you submit. We also store the settings and connections needed to provide those features, including blocks.

Some information you choose to share may reveal sensitive details about your relationships, sexual orientation, sex life, or other aspects of your identity. Only share what you are comfortable sharing. Your profile requires a gender, a sexual orientation, and a relationship status, and these answers can reveal sensitive details about you. Your bio, interests, what you are looking for, who you are interested in, your comfort levels, and your “Before we connect” note are optional. You choose what to enter in each of these fields, and you can edit them at any time in Edit profile.

Photos. When you upload a photo, TOC strips location data and other EXIF metadata, including GPS, before the photo is stored. Other members do not receive that location or camera metadata.

Location information. TOC asks for device location through your browser for the Local feed, posting, and Near me events. It is rounded to an area of about 1 km, and only that rounded area is stored. Other members never see it. Your home city is a separate city you choose.

Place searches. Google receives the text you type into place search when you tag a location on a post or look up an event venue.

Technical information. When you sign in, we record your IP address, your browser and device type, and when the session was last used. We record which days you use TOC. We keep security records, such as failed sign-in attempts and a log of key account actions, and a copy of the account emails we send you. Feedback you send includes your browser type and the screen you were on. Our hosting provider keeps server logs, which can include app errors. Server error reports are sent to Sentry, a US service, and contain only technical error details, not your account or message content. We use this information to keep accounts secure, prevent abuse, and fix problems. We do not currently use an analytics service in the beta.

Last-active hour. We record the hour of the day you were last active in TOC, rounded to the hour. We use it only to order Play results. It is never shown to anyone. It is deleted with your account.

Verification. Play is only for members whose identity has been verified. To verify, you choose to use our provider, Didit (United States and European Union). Didit asks for a photo of your government ID and a selfie, and compares your face to the ID photo. This uses face geometry, which is biometric information. Before you start, we ask for your separate consent. We keep only that you passed, the date, and a reference number. We do not keep your ID image, selfie, face data or date of birth. Didit keeps its own record for up to 1 month and we ask Didit to delete it when you delete your account.

Support and safety information. We collect feedback, support requests, reports, and relevant records used to investigate abuse or protect the community. A report may include information another member provides about you.

Payments. The beta is free, and payments are not enabled. We do not collect payment-card details through the beta app.

2. How we use information

We use information to:

Create and secure accounts and provide profiles, messaging, photo sharing, and events.
Provide the Local feed, posting, and Near me events using your rounded device location.
Apply your sharing choices and privacy settings.
Send account, safety, and service notices. There are no push notifications in the beta.
Answer questions, investigate reports, prevent fraud and abuse, and enforce our Terms.
Diagnose problems, test features, and improve the beta using feedback and server error reports sent to Sentry.
Meet legal obligations and handle legal claims.

TOC news emails are on by default. You can turn them off at any time in Settings > Notifications or with the unsubscribe link in each news email. Other activity emails are off unless you turn them on. Essential account and safety emails are still sent.

We will explain a materially different use before it begins and obtain additional consent where required. Agreeing to our Terms does not replace any separate consent the law requires for sensitive information.

3. What other people can see

Your profile: Signed-in TOC members can see your profile, except members you have blocked or who have blocked you. People outside TOC cannot see it. Photo visibility follows the album’s sharing settings. Public photos are visible to signed-in TOC members, not people outside TOC.

Messages and staff access: Messages are available to their intended recipients. TOC staff can access messages and private photos when needed for safety or support. Messaging is not end-to-end encrypted. Recipients can retain or copy messages.

Private albums: A private album is visible only to people its owner has given access to. When the owner removes someone’s access, the album is hidden from that person. Removing access cannot erase copies someone already made.

Events: RSVPs are visible to people who can see the event. Posts do not show street addresses; a location tag on a post is a place name. Events are different: every event has a full street address. For an Open event, the venue and full address are visible to members who can see the event, before they RSVP. For a Private event, only the city is shown until the host approves you. Event details from the host, the guest list, and event chat open once you are Going. Messages show whatever members choose to write, including addresses.

Blocking: When you block someone, you can no longer see each other’s profiles, posts, comments, RSVPs, or messages, or contact each other through TOC. Your friendship, Likes, and private-album access between you are removed, and unblocking does not restore them. Unfriending removes private-album access between you in both directions. If you host an event, a blocked member is removed from its guest list. Blocking cannot remove information a person already saw or saved.

Other members must follow our rules on consent and discretion, but we cannot guarantee their behavior. Be thoughtful about sharing your home address, workplace, or other identifying details.

4. When we share information

We share information with:

Other members and event hosts, as explained above and according to your choices.
Service providers that help us operate TOC:
- Cloudflare sits in front of TOC. All traffic to the app and website passes through Cloudflare.
- DigitalOcean hosts the app and its database.
- Bunny.net stores and delivers photos used in posts, albums, messages, and events.
- Resend delivers our emails. It processes recipients’ email addresses and the content of the emails we send.
- Google provides place search. Our server sends Google the text you type and the general area of your home city. Google does not receive your name, your email, or your device location. If you tap “Get directions” on an event, Google Maps opens in your browser with that event’s address.
- YouTube (Google): Welcome and other videos play in a YouTube player inside TOC using YouTube's privacy-enhanced mode. YouTube may set cookies and collect viewing data once you press play, under Google's privacy policy.
- Arachnid Shield (Canadian Centre for Child Protection) checks each uploaded photo for child safety. The full photo is sent to Arachnid Shield, which compares it against known child sexual abuse material and handles it under its own retention practices.
- Sentry receives server error reports, which contain only technical error details, not your account or message content. Browser crash reports (the message plus a cleaned stack trace, up to 4000 characters) are sent to Sentry.
- Didit performs identity verification for Play. It receives your ID photo and selfie, and returns whether you passed and your date of birth for an age check. We do not store the date of birth.
- There is no separate push-notification vendor in the beta.
Authorities or other parties when necessary, to meet a legal obligation, respond to valid legal process, address fraud or a serious safety concern, or protect legal rights. We assess these requests and disclose information as required or permitted by law. Apparent child sexual abuse material is reported to the National Center for Missing & Exploited Children (NCMEC) as US law requires.
A new business owner, if TOC is involved in a merger, sale, or similar transaction, subject to applicable law and the privacy commitments that apply to the information. We will notify you of changes affecting your information.
Anyone else you direct us to share with, or separately agree to share with.

We do not sell beta personal information or use it for targeted advertising. We do not use beta data to train AI. We do not use analytics or AI services in the beta. The only outside moderation is the child-safety photo check described above.

5. Permissions, cookies, and tracking

TOC asks for only two browser permissions: location and passkeys. TOC requests location permission through your browser for the Local feed, posting, and Near me events. You can change that permission in your browser settings. Disabling it may affect features that need device location. Without location, you can still use the Friends feed, comment, like, message, and browse events by city, but you cannot use the Local feed or create a post. Passkey sign-in uses your browser’s or device’s passkey prompt. TOC does not request camera or microphone access, and the app blocks both. You choose photos with your device’s own photo or file picker, which gives TOC only the photos you select.

TOC uses only its own cookies, and only to make the app work. One keeps you signed in for up to 30 days and renews while you use TOC. One remembers a browser you have signed in on, for about 13 months, so we can recognize new devices. Short-lived cookies are used during signup and two-step sign-in. One remembers your blur choice until you close the browser. One keeps your recent searches on that browser for up to 180 days. The app also uses your browser’s session storage to remember where you scrolled, and its service worker stores only TOC’s icons on your device. Our fonts are served from TOC, not a font service. We do not use advertising or analytics cookies or cross-site tracking. The one exception to TOC-only cookies is the YouTube video player described above, which may set YouTube cookies once you press play.

TOC does not respond to Do Not Track or Global Privacy Control signals. TOC does not use advertising or analytics tracking. The one exception is the in-app YouTube player, which may set YouTube cookies and collect viewing data once you press play, as described above.

6. Keeping and deleting information

While your account is active, we keep information needed to provide TOC and for the purposes explained in this policy.

To delete your account, go to Settings > Account > Delete account, or sign in and visit Delete account. You first verify your identity and then confirm deletion. You do not need to type “DELETE.”

When you delete your account, your data is erased within 30 days, subject to the limited retention below:

Safety and abuse records: kept for 1 year.
Server logs and sessions: kept for 90 days.
Backups: roll off within about 7 days.
Verification record: the pass/fail result, date and reference number are kept until you delete your account; Didit’s copy is deleted within the period in the Verification section.

Messages you sent stay in the other members’ conversations, shown as from “Deleted Member.” You can delete a message yourself before you delete your account.

We may retain information longer when necessary to meet a specific legal obligation or preserve records for a legal claim. We restrict use of retained information to those purposes and delete it when it is no longer needed.

Removing TOC from your home screen, signing out, or clearing your browser data does not delete your account. Copies another member has made outside TOC are outside our control.

7. Your choices and privacy rights

You can edit your profile photos, display name, date of birth (until it is verified), gender, orientation, relationship status, home city and up to two other cities, bio, interests, what you are looking for, who you are interested in, comfort levels, and “Before we connect” note. You can manage who can see your private album and remove anyone’s access, who can tag you (friends, anyone, or no one), who can send you message requests (single women, single men, relationships), your blocked members, your blur setting for explicit photos, your notification and email choices, and your browser permissions. You can contact [email protected] to ask to access, correct, obtain a copy of, or delete your personal information, or withdraw consent for a use based on consent.

Depending on where you live and which laws apply, you may also have rights to opt out of certain processing, restrict or object to a use, use an authorized agent, appeal a decision, or complain to a privacy regulator. We will handle requests within the deadlines required by applicable law and explain any lawful exception. We may ask for information reasonably needed to verify your identity or an agent’s authority. We will not penalize you for exercising a protected privacy right.

To ask us to reconsider a privacy request decision, email [email protected] with the subject line “Privacy appeal.” Some information is needed to operate your account; if you ask us to remove it, we may be unable to continue providing that feature or account.

8. Security and storage locations

To help protect information, we use:

HTTPS for every connection to TOC, with browsers told to always use HTTPS (HSTS).
An encrypted connection between the app and its database.
Password storage as bcrypt hashes, never as plain text.
Encryption of the secrets used for authenticator-app sign-in.
An identity check before account deletion or a password change.
A temporary sign-in lockout after repeated failed attempts.
An email alert when your account signs in on a new device.
Two-step sign-in for administrators.
An audit log of key account and administrator actions.

No system can guarantee complete security. If a security incident requires notification, we will notify affected people and authorities as required by law.

Information is stored and processed in the United States and Canada:

United States: The app and its database run on DigitalOcean in New York. All traffic to the app and website passes through Cloudflare before it reaches those servers. Photos are stored with Bunny.net in Los Angeles; to load quickly, temporary copies of photos may be kept on Bunny.net servers near the viewer. Resend sends our email, Sentry receives server error reports, Google provides place search, and YouTube (Google) plays in-app video, all in the United States. Didit performs verification in the United States and European Union.
Canada: Arachnid Shield, run by the Canadian Centre for Child Protection, checks uploaded photos for child safety.

9. Adults only

TOC is for adults aged 18 and older. We do not knowingly allow minors to create accounts. If you believe a minor has provided personal information, contact [email protected] so we can investigate and take appropriate steps to remove it.

10. Changes to this policy

We will post updates with a new effective date. For material changes, we will notify you through the app or by email before they take effect, unless a legal or urgent safety reason requires otherwise. Where required, we will ask for new consent before using previously collected information in a new way.

Questions or requests: Tommy Jedrzejczyk, doing business as The Open Connection, [email protected].