Privacy Policy

The short version

Spliced is about how you and someone else actually fit together. That only works if you are honest with it, and you will only be honest with it if you know where your answers go.

So: we keep what we need to run the service, we share as little as we can, and we do not sell your personal information for money. Some of it does go to advertising platforms so we can tell whether our ads work — that part is a choice, and you can turn it off.

Delete your account and we delete it the same day, apart from a few things we explain below.

What this covers

Spliced (listed as "Spliced: Social Compatibility" on the App Store, Google Play and TikTok) is run by Grayfin Labs Inc., a Canadian company. This policy covers the website, the web app, and the iPhone and Android apps.

Cookies and the equivalents on your device have their own page — see our Cookie Policy.

What we collect

What you give us

• Your name, email address and date of birth when you sign up. A phone number if you want text notifications, and a photo if you want one.
• Your answers to Spliced questions, and anything you write — the note on an invitation, the name of a group.
• Your subscription, if you have one. Card details go to our payment providers, not to us.

What other people give us

When someone invites you to Splice, they type in your name and either your email or your phone number so we can reach you. If you never sign up, we delete those details once the invitation has lapsed — currently 90 days.

What we pick up along the way

• Your device, operating system and app version, which is how we tell whether a bug affects everyone or only one kind of phone.
• Crash reports and performance data when something goes wrong.
• A rough location — the city your IP address suggests, not where you actually are. We do not ask for or use precise location today. A future feature might, and it would ask you first.
• Which parts of the app you use, if you have turned analytics on.

What we use it for

• Running Spliced — your account, your Splices, your results, and the emails and notifications that go with them. We rely on our agreement with you for this.
• Keeping it safe — spotting fraud, abuse and the accounts that exist to cause trouble. We rely on our legitimate interest in a service that works.
• Making it better — understanding what people use and what breaks. Consent, where local law asks for it.
• Measuring our ads — whether the ads we run bring people here. Consent.
• Obeying the law — tax records, and anything a court or regulator properly requires.

How we use AI

Vibe Check and Deep Splice insights are generated by an AI provider. What we send is stripped first: your answers and match percentages, with the other person referred to only as "partner #1". No names, no email addresses, no account identifiers.

Our provider does not use what we send to train its models.

Who else sees it

Other Spliced users see your profile name, your photo, and your results on Splices you share with them. They do not see your email address or phone number unless you tell them yourself.

Behind the scenes, we use other companies to run parts of Spliced. They are bound by contract to use what they receive only to do that work. The ones in use today:

• Stripe — payments on the web. Your email and name; card details go to them, not through us.
• Apple and Google — signing in, payments in the apps, and the delivery of notifications.
• RevenueCat — keeps track of who has a subscription across both stores.
• PostHog — analytics. What gets used and what breaks.
• Sentry — crash and error reports.
• Tenjin — tells us which ad an app install came from.
• Meta, TikTok and Google — measure whether our ads work. See below.
• Anthropic — generates Vibe Check and Deep Splice insights, from the stripped data described above.
• Resend and Telnyx — send our emails and text messages.
• Cloudflare, Vercel, Railway, Neon and Expo — hosting, storage and app delivery.

If we add or drop a provider, this list is the part that changes. We may also share information where the law requires it, or if Spliced is ever sold or merged — in which case whoever takes it on is bound by this policy.

Advertising

We run ads on other platforms, and we want to know whether they work. To measure that, we tell those platforms when someone who saw an ad goes on to sign up or subscribe.

What that involves depends on where you are. On the web it is a scrambled version of your email address, which the platform can match against its own records but cannot read, along with what you paid. In the apps it is the advertising identifier your phone provides, which you can reset or switch off in your device settings.

Some US laws count this as 'selling' your data, even though no money changes hands. None of it happens unless marketing is turned on, and turning it off stops it.

We do not show ads inside Spliced. If that changes, this page changes first.

Your choices

Analytics and marketing are two separate switches, and neither is needed for Spliced to work.

Age

You need to be at least 13 to use Spliced, and at least 14 in Quebec. We ask for a date of birth at signup and do not let younger accounts through.

Some countries set a higher age before a young person can agree to analytics or advertising on their own — as high as 16. Below it, we do not ask, and both stay off. Nothing is measured, nothing goes to an advertising platform, and there is no switch to turn on. That changes on the birthday itself, and we ask then.

If you believe a child under our minimum has an account, email us and we will remove it.

How long we keep it

While you have an account, we keep what the account needs. When you delete it, we delete it — there is no waiting period and no way for us to bring it back.

What goes

• Your account and everything attached to it: your answers, sessions, notification tokens, saved preferences, consent records and sign-in codes.
• Invitations you sent that nobody had answered yet — including the contact details of whoever you invited.
• A subscription you bought from us on the web is cancelled before anything is deleted, so the billing stops first. One bought in the App Store or Google Play is not — only the store can cancel that, so do it there first or you will keep being charged for an account that no longer exists.

What stays

• Splices and groups you completed with other people. Those are partly theirs, so they survive with you shown as "Deleted User" — your name, photo and contact details are removed from them.
• A group is deleted outright once every member has left.
• We keep records of payments, including the payment provider's transaction details and the name and email attached to them, for as long as tax and accounting law requires, typically up to seven years, even after an account is deleted.
• Anything else the law requires us to hold on to.

You can delete your account from Settings, on the web or in the app.

Where your data goes

We are Canadian, and most of the companies above are American. So your information is stored and processed in Canada and the United States, and sometimes elsewhere.

For transfers out of the EEA, the UK and Switzerland we use the European Commission's Standard Contractual Clauses, with the UK Addendum where the UK is involved. For Quebec, we assess each provider before we send anything and hold them to equivalent protection by contract.

Your rights

Wherever you are, you can ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. Email us and we will sort it out — usually within 30 days.

• EEA, UK and Switzerland — access, correction, deletion, a portable copy, and the right to object to or restrict what we do. Where we rely on consent, you can withdraw it without affecting what came before. You can also complain to your local data protection authority.
• Quebec — the same, plus the right to a portable copy, to have information de-indexed from search results in some circumstances, and to be told if a decision about you was made by automated means alone. Spliced does not make decisions of that kind.
• California and other US states — the right to know, delete and correct, and to opt out of the sharing described under Advertising. Turning marketing off is that opt-out. We will not treat you differently for using it.
• Canada, outside Quebec — access and correction under PIPEDA, and a complaint to the Office of the Privacy Commissioner if we get it wrong.

Keeping it safe

Everything travels encrypted. Your password is stored hashed rather than as readable text, and access to production data is limited to the people who need it.

Sign-in links and emailed codes are single-use and short-lived — a code lasts ten minutes and stops working after five wrong tries.

Crash reports are set up not to carry your account details or your IP address, so a crash tells us what broke without telling us who it happened to.

No system is perfect, and we would rather say that than promise otherwise. If something does go wrong in a way that puts you at risk, we will tell you and the relevant regulator as quickly as the law requires.

Changes and contact

When we change this policy we update the date at the top. If a change affects something you already agreed to, we ask again rather than assume.