Privacy Policy
privacy-beta-1.1Your health story is not the price of belonging.
This notice follows the real paths through PosMeet: joining, posting with a profile or pseudonym, entering a voice room, keeping a private journal, sending feedback and asking us for help.
Private starts private
Health choices and Journal entries are not placed on your profile or in Community.
Pseudonymous, not invisible
Anonymous posts hide your profile from members, not from protected safety systems.
No silent recording
Current beta live audio is not recorded. Any future recording needs a clear entry notice.
No health-data marketplace
The beta does not sell personal or health information or run behavioral advertising.
Limited beta notice
The short version
We collect enough to run a real community, but a sensitive-health community needs firmer boundaries than an ordinary social feed.
- Your sign-in email is not displayed to other members.
- Your selected conditions, support needs and journal entries are private account data. They do not appear on your profile unless you independently choose to write about them in Community.
- Choosing Anonymous on a contribution changes what other members see. PosMeet still keeps a protected account link so it can prevent abuse, apply blocks and investigate reports.
- We do not use Private Journal content, private health choices, feedback attachments or live room audio for behavioral advertising or generative-AI model training in the current beta.
- Other members can still screenshot, quote or infer identity from details you share. A privacy setting reduces exposure; it cannot make a shared story impossible to copy.
Not a HIPAA promise
What we collect
The same sentence—‘we collect user data’—can describe very different risks. This map names the product surface, examples and normal visibility.
| Area | Examples | Normal visibility |
|---|---|---|
| Account & security | Email, adult confirmation, locale, sessions, consent receipts and abuse-prevention hashes. | You and authorized PosMeet systems or operators. |
| Profile | Display name, avatar, bio and optional social details you choose to add. | Signed-in members, subject to your profile choices. |
| Health context | Participation role, selected conditions, support needs and journey stage. | Private to your account unless you deliberately mention it in a post or room. |
| Community & Circles | Posts, replies, reactions, saves, images and Circle membership or activity. | The signed-in audience or Circle access shown before you contribute. |
| Private Journal | Mood, symptoms, optional note, voice note and retention choice. | Not shown in Community or on your profile. Operational access is tightly limited. |
| Voice rooms | Reservation, room identity, attendance, speaking role, hand requests and moderation events. | Other people in the room see your room identity; safety records are restricted. |
| Feedback & safety | Private feedback, screenshots, reports, report-time content snapshots, blocks and review history. | You and specifically authorized Care or safety reviewers, as applicable. |
| Journey & notifications | Optional contribution facts, XP, level, keepsakes and delivery/read status. | Private by default; only profile elements you explicitly enable are displayed. |
| Product listening | Optional research questions, whether a prompt was shown or dismissed, your answer and improvement follow-up. | You and authorized PosMeet product operators. It is not used to infer your health status. |
| On-device storage | A temporary Story draft, return path, sidebar preference and other functional browser state. | Normally limited to the browser or device you are using; anyone with access to that device may see it. |
Account & security
Email, adult confirmation, locale, sessions, consent receipts and abuse-prevention hashes.
Who normally sees it: You and authorized PosMeet systems or operators.
Profile
Display name, avatar, bio and optional social details you choose to add.
Who normally sees it: Signed-in members, subject to your profile choices.
Health context
Participation role, selected conditions, support needs and journey stage.
Who normally sees it: Private to your account unless you deliberately mention it in a post or room.
Community & Circles
Posts, replies, reactions, saves, images and Circle membership or activity.
Who normally sees it: The signed-in audience or Circle access shown before you contribute.
Private Journal
Mood, symptoms, optional note, voice note and retention choice.
Who normally sees it: Not shown in Community or on your profile. Operational access is tightly limited.
Voice rooms
Reservation, room identity, attendance, speaking role, hand requests and moderation events.
Who normally sees it: Other people in the room see your room identity; safety records are restricted.
Feedback & safety
Private feedback, screenshots, reports, report-time content snapshots, blocks and review history.
Who normally sees it: You and specifically authorized Care or safety reviewers, as applicable.
Journey & notifications
Optional contribution facts, XP, level, keepsakes and delivery/read status.
Who normally sees it: Private by default; only profile elements you explicitly enable are displayed.
Product listening
Optional research questions, whether a prompt was shown or dismissed, your answer and improvement follow-up.
Who normally sees it: You and authorized PosMeet product operators. It is not used to infer your health status.
On-device storage
A temporary Story draft, return path, sidebar preference and other functional browser state.
Who normally sees it: Normally limited to the browser or device you are using; anyone with access to that device may see it.
We also receive ordinary technical information needed to deliver and protect the service, such as request time, browser or device details, IP-derived security signals, error diagnostics and actions taken in the interface. We do not need your precise location for the current beta.
Your browser can hold sensitive text
Who can see what
PosMeet uses several identity and audience choices. They are not interchangeable.
Profile post
Members see the display name, avatar and profile context you have chosen to show.
Anonymous post
Members see a neutral PosMeet identity. Your public profile and anonymous history are not linked for them.
Circle activity
People with access to that Circle see the contribution. Circle membership is not a public member directory.
Private Journal
Never shown in Community or on your profile. It is stored in a separate sensitive-data area.
Private feedback
Visible to you and authorized PosMeet Care operators. Attached images are not community media.
Safety report
Restricted to the reporter and authorized reviewers. We do not reveal the reporter to the reported member.
Anonymous to members—not to PosMeet
Why we use information
We tie each use to a product purpose rather than asking for a blanket right to do anything with health data.
- Provide the service: authenticate you, save preferences, display contributions, deliver media, reserve rooms and keep your Journal available to you.
- Personalize only when allowed: suggest relevant Circles or topics using the health-personalization choice described below.
- Protect people: enforce blocks, review reports, preserve short-lived evidence, stop abuse and maintain service integrity.
- Communicate: send sign-in links, neutral in-product notifications, room reminders and replies to private feedback.
- Improve reliability: diagnose failures and understand whether core flows work. Product research that needs health data or identifiable member content requires a separate, explicit basis—not a hidden extension of this purpose.
- Listen to members: show optional questions about confusing or unfinished experiences, remember a dismissal so we do not repeatedly interrupt you, and compare an improvement with the feedback that prompted it. You may skip these questions.
What we do not do in the current beta
Health choices, recommendations and Private Journey
Health personalization and contribution recording are optional systems with separate controls. They are not a condition of reading or participating in the core community.
Health personalization
Your participation role, selected conditions, support needs and journey stage may be used to suggest topics or Circles only after you make the separate Health Personalization choice. It is off without a current grant. Revoking it stops future use for recommendations; it does not delete the private facts you chose to keep in your account.
Private Journey, levels and keepsakes
If you start Private Journey, PosMeet records eligible contributions made after you enable it—such as posts, replies and verified helpful responses—to calculate XP, levels and keepsakes. Anonymous contributions can count through the protected internal account link, but are not exposed as a public anonymous-history page. Older activity and paused periods are not backfilled.
You can pause recording, hide profile display, delete an individual keepsake, export the records or clear the Journey without deleting your account. A policy update pauses recording until you review the new explanation.
Review personalization and Journey Sign-in requiredSee what is on, what appears on your profile and what can be paused or cleared.Voice rooms, images and audio
Audio and images can expose identity even when a display name does not.
Live rooms
Only rooms labelled Not recorded can be entered in the current Web Beta. Agora carries the live audio, but PosMeet does not keep the conversation audio. PosMeet still stores room reservation, room identity, attendance, role and moderation events. Other participants hear your voice and can make their own unlawful recording despite our rules. Leave a room at any time if it no longer feels safe.
A private check-in can be collected when you enter. Other members do not see your individual answer, and a host receives only a grouped room-level summary when at least five people have answered. PosMeet still stores the individual check-in in its restricted room-data area for the beta room flow and safety operations.
Safety-buffer and recorded modes are blocked in the current Web Beta. They cannot be enabled until the entry flow explains purpose, audience and retention, displays the mode before entry, and collects any separate consent required. A policy paragraph alone is not consent to record.
Images and voice notes
Profile and Community images are resized and re-encoded to remove embedded camera and location metadata before publication. Standard media is delivered from private Amazon S3 storage through CloudFront. PosMeet links a Community image only from its intended product surface, but standard-media URLs are not access-controlled: anyone who receives the exact URL can open or share it, and cached copies may remain briefly after removal.
Journal voice notes and feedback screenshots use the private-media path and short-lived authorized access. Journal text is application-encrypted before database storage. Voice files are protected by private storage and server-side encryption; PosMeet does not claim that they are end-to-end encrypted.
Service providers and international processing
A provider receives only the data needed for its job, but using a provider is still a disclosure that must be named.
Amazon Web Services / CloudFront
Store private and standard media and deliver standard media through a CDN.
Data involved: Uploaded images or audio, object identifiers and delivery requests.
Agora
Carry live room audio and connection diagnostics.
Data involved: Room/channel identifiers, technical connection data and live audio while connected.
Resend
Deliver one-time email sign-in links when production email is enabled.
Data involved: Email address and transactional message delivery data.
These services may process information outside your country. Before general availability, PosMeet will publish its operating entity, primary processing regions, full subprocessor register and any transfer mechanism required for the launch regions. PosMeet does not use these providers to target advertising. Final production agreements must restrict their use of member information to delivering the contracted service and meeting applicable legal obligations.
Open the service-provider registerSee the feature, data flow, current boundary and unresolved launch details for each provider.How long information stays
‘We keep data as long as necessary’ is not enough for a private-health product. These are the current beta rules and known limits.
Sign-in & sessions
15 minutes / up to 30 days
Magic links expire after 15 minutes and work once, then expired records remain for up to 7 days. Active web sessions last no more than 30 days; expired records remain up to 7 days and revoked records up to 30 days for security cleanup.
Private Journal
30 / 90 / 365 days, or until deleted
The period runs from each entry’s creation time. Shortening it can immediately make older entries eligible for irreversible deletion.
Safety evidence
Normally 180 days
Report-time post, reply and room-participant snapshots are restricted and normally retained for 180 days, unless a justified hold applies.
Private feedback
Two years after closure
The feedback thread, replies and private attachments are scheduled for deletion two years after it is closed.
Account deletion
7-day cooling-off period
You can cancel during the cooling-off period. Execution removes private data, retires identity and replaces necessary conversation positions with a non-identifying tombstone.
Consent & deletion proof
Up to 7 years
Minimal, non-content receipts may be retained to show which policy version was accepted or that a deletion request was completed, and to meet legal obligations.
Product listening
Normally 180 / 365 days
Prompt exposure is normally retained 180 days; answers and dismissals 365 days. A minimal completion receipt may remain until account deletion.
Story draft on this device
Up to 24 hours
Only when draft recovery is enabled. Publishing, signing out, expiry or clearing this browser storage removes the local recovery copy.
Caches, backups and safety holds
Beta schedules still to be finalized
Your controls and privacy rights
Every beta member receives practical controls; additional legal rights depend on where you live.
The self-service download is a convenience export of major account data. It is not represented as a complete statutory access response. The current Help path is private beta support, not yet a formal statutory-rights channel. General availability requires a monitored privacy contact and a verified process for broader access, correction, deletion, restriction or appeal requests—including consent, security and operator-access records.
You may edit or delete your own content where the product offers that control. Deleting an account is different from hiding a profile or pausing Journey. We will not discriminate against you for making a privacy request, subject to service features that genuinely need the data you delete.
Security and incident response
No system is risk-free. Our job is to reduce the chance and impact of exposure, especially for sexual-health information.
- Use encrypted transport, private object storage and separation between community and sensitive records.
- Limit operator access by role and record access to restricted safety and feedback material.
- Remove image metadata, use short-lived private-media links and keep credentials out of public URLs.
- Review providers and avoid advertising or tracking tools on sensitive member surfaces.
- Investigate unauthorized access or disclosure and notify affected people and authorities when law requires it.
Protect your email account and one-time sign-in links. Do not upload a face, legal name, test form, clinic name or another person’s information unless you are comfortable with the audience shown and have the right to share it.
Contact, policy changes and launch readiness
Trust depends on knowing who is responsible and what changed.
Signed-in beta members can use Help & feedback for a private privacy question. A monitored public privacy email, legal operating entity, mailing address and regional representative details have not yet been published. Those are release blockers for general availability, not optional polish.
Material changes will receive a new policy version and an effective date. If a change expands how sensitive health information is used, PosMeet should show an in-product notice and request a new, specific choice where required instead of treating continued use as silent consent.
Version integrity