What happens to what you tell us

Where your answers live

• On our own machine, and what you told us is encrypted. Not a rented cloud server. The database sits on a computer we own and run. Your consultation, your profile, your attraction answers, and anything you write to us are encrypted at rest.
• Your email address is encrypted now too. It was not until 11 August 2026, and this page said so at the time. It was stored plainly because the system looks you up by it when you sign in. That is now done with a scrambled form of the address that can be matched but not read, so the address itself is encrypted like everything else.
• What a copied database would still show. That accounts exist here, how many, when each was created, and a small number of plain facts the system has to sort on, including whether an account is a man's or a woman's. It would not show your address, your name, or a word of what you said.
• The key is not kept beside it. This protects a stolen disk or a stolen backup. It does not protect against somebody who gets into the machine while it is running, because the key is in use there. We would rather draw that line than let the word encrypted do work it cannot do.
• Your attraction answers are the most protected thing here. How you react to the photographs is never shown to a person, never shown to a match, and never read back to you. No screen in this system can display them. We keep one conclusion, used only to decide who not to send you.

What leaves the machine, and why

This is the part most services do not tell you. The AI is not running on our computer, so having a conversation means sending it somewhere. Three companies are involved, every one of them because the product does not work without them.

• Anthropic receives the conversation, every turn. That is what writes the next question. Without it there is no interview.
• OpenAI receives the recording of what you say, to turn it into text. We chose it because members here move between English, Hebrew and Yiddish in the same sentence, and it is the most accurate at that. A transcript that mishears you becomes a profile that misrepresents you.
• ElevenLabs receives the text of what your shadchan says, so it can be spoken aloud in a voice. It also receives your recording in one case: if the first transcription service fails, we try the second rather than lose what you just said. That is rare, and rare is not the same as never, so we are telling you.

Occasionally an unusual word, which can include a name, is sent to Anthropic so the voice pronounces it correctly.

What we do not do

• We do not sell anything to anybody, ever.
• We do not put your profile in a directory for other members to browse. There is no browsing here. A human matchmaker reads your profile and picks.
• We do not record your parents' marriage, or anyone else's private life, as a fact about you. What we keep is what you took from your own history, not the history.
• We do not use a compatibility score or a personality type. You will never be given a number.

Who reads it

• A human matchmaker reads your profile in order to match you, and to write the honest reason behind each introduction.
• The person you are introduced to never sees your profile. They see the case for meeting you, with no identifying details in it.
• One safety exception, and we say it before you start. If you tell us you are about to hurt yourself or somebody else, a person may need to see that in order to help. The alert that reaches us carries the time and the session, and never your words.

What is yours

• You can read your whole consultation back, word for word, in your portal.
• You can correct what we match you on. Your record is read from your conversation by a machine, so it can be wrong. Every field is yours to change, and your correction wins.
• You can stop at any point and everything is kept exactly as it was.
• You can ask us to delete your account. Say the word and it goes.

What we are still working on, said out loud

• Transcription happens off our machine. Running it locally, so your voice never leaves the room at all, is something we want and have not built. Until we have, we are not going to claim it.
• We have not yet finished confirming each vendor's retention terms. When we have, this page will say exactly what each one keeps and for how long. We would rather leave a gap here than fill it with something we have not checked.
• Deleting an account does not yet reach older backups. It removes you from the live system. Backups age out over time, and a deletion that reaches them is on the list.
• Backups taken before 11 August 2026 still hold addresses in the clear. Encrypting the column fixed the live database and could not reach into copies already made. Those copies are held offline and age out, and we are saying so rather than letting the word encrypted cover a set of files it does not cover.