Privacy policy
This policy explains what cheza LLC, a Virginia limited liability company (“Cheza”, “we”), collects when you use the Cheza iOS app and our website, cheza.me, why we collect it, who sees it, and how long we keep it.
The short version: we collect what we need to match you and keep you safe. We don’t sell your data, we don’t show ads, we don’t track you across other apps or websites, and other players never see your phone number or where you live.
What we collect
When you use the app
| What | Why |
|---|---|
| Phone number | Your account and sign-in. We send it to Twilio to text your one-time code and to check it is a mobile (not internet) number. One account per number. |
| First name | Shown to other players. We never ask for your last name. |
| Date of birth | To confirm you are 18 or over. We keep it so your age stays current; other players see only your age. If you confirm a date of birth under 18, we don’t store it (see Children). |
| Gender (woman, man or non-binary) | Only to apply the “who I want to play with” preferences you and others choose. Never shown to anyone. |
| Home area | You give a ZIP code or share your device location during setup. We read your device location only after you allow it in the iOS permission prompt and on a Cheza screen that explains why; you can enter a ZIP instead. A ZIP becomes that ZIP’s central point; a device location is stored rounded to about 110 metres (roughly 360 feet). We use it only to work out approximate distances and keep you within the radius you choose. |
| Sports and play preferences | Your sports, your level in each (and a rating such as DUPR or NTRP if you give one), what you’re looking for (partner, buddy, coaching), your distance, age and gender preferences, and the times of week you’re free (morning, afternoon or evening on each day). |
| Bio | Up to 140 characters, shown on your profile. |
| Photos | Up to four. We remove location and camera data from the copy we show, and keep the original privately, as moderation evidence, until you remove the photo or your account is erased. |
| Verification selfie (optional) | Only if you choose to get the Verified badge. See “Verified badge and facial comparison” and “Biometric privacy notice” below. |
| Coach details (coaches only) | Credential document, issuing body, certification number, hourly rate, accepted payment methods (method names only, never handles), and whether you auto-accept coaching matches. |
| Activity | Likes and passes, matches, messages, session proposals and sessions, attendance (including late cancellations and no-shows), feedback you give and receive, friends, blocks, reports, for lessons the payment method chosen and whether it was marked paid (never a handle), venue corrections, sport requests, notification settings, and when you were last active. |
| Device and sign-in data | One record per signed-in device: a hashed sign-in token, IP address, a device and app description, and, if you allow notifications, an Expo push token. Sign-in attempts are logged against your phone number and a scrambled (hashed) IP address to stop abuse. |
| Messages to support | Whatever you send us, to answer you. |
| Acceptance records | When you accept the Terms, the Privacy Policy, the Assumption of Risk and Release, the Coach Terms, or the biometric consent, we record the version you accepted, the date and time, a scrambled (hashed) form of your IP address, and device information. We keep these records for as long as your account exists and for the limitation period after it ends, as evidence of what you agreed to. |
We don’t collect your email address, contacts, health data, card details or payment handles in the app.
On our website
The website uses Google Analytics, a service of Google LLC, to count visits and see which pages people use. It runs unless you decline or your browser sends Global Privacy Control. It sets two first-party cookies, _ga and _ga_8ZHDEQEZ3G, a random browser ID that lasts up to 13 months. Google Analytics 4 does not log or store IP addresses, and we keep Google signals and ads personalization off. Google keeps event-level data for 2 months. A notice on the website says this until you make a choice. If you press Decline, Google Analytics stops on that page, we delete its cookies, and it does not load again. If your browser sends Global Privacy Control, we treat it as a decline and set no cookie for it; Google Analytics does not load unless you press OK on the notice. We keep one cookie of our own, cheza_consent, for 12 months to remember a choice you make on the notice. Change it any time with “Cookie choices” in the footer, or install Google’s opt-out browser add-on (tools.google.com/dlpage/gaoptout). How Google uses this data: policies.google.com/technologies/partner-sites. The “Near me” button sorts venues in your browser and never sends your location to us.
- Early-access list: your email, ZIP code, your confirmation that you are 18 or over, which button or link on our website brought you to the form, who invited you, if a friend sent you their invite link, and, if you joined on our earlier one-page form, the sports you picked there. If you answer our second page, also your first name, the sports you play, your level as you describe it, how often you play, and whether you want an introduction before the app launches. We use it to tell you we received your entry, to tell you when Cheza launches near you, and to send you a short series of emails about Cheza before launch: a welcome, one question, a reminder to finish your answers, introductions you ask for, follow-ups after an introduction, and the launch notice. Every email after the first one has an unsubscribe link, and unsubscribing also ends any introduction in progress. If you ask for an introduction, we email you when we find a nearby player at your level; only if you both say yes do we share your first name and email address with that one player, and they share theirs with you. After that, what they do with your address is up to them, and deleting your entry later cannot take it back from them. A week after an introduction we ask whether you played, and we ask once more at two weeks if you answered “not yet”. If you reply to one of our emails, a person reads it and we keep it with your entry. If you answer a follow-up or report a problem with an introduction, we keep your answer or report with your entry, and after a report, we can end all further introductions for the reported entry. We delete your entry, and the introductions it was part of, whenever you ask, and in any case within 90 days after the App Store launch.
- Venue corrections and suggest-a-place: the text you type and the place you name. No contact details.
- For both forms, a scrambled (hashed) form of your IP address to cap submissions. We never store the address itself. Our server and access logs, which include IP addresses and the web addresses (URLs) requested, are kept for no more than 90 days.
What other players see
Before you match, other players see only: your approved photos, first name, age, approximate distance in whole miles (never less than “~1 mi”), your sports with level and rating, what you’re looking for, your bio, how your free times overlap with theirs, and badges that show counts (for example “Reliable · 11 sessions”). If you have the Verified badge, they see that too (see “Verified badge and facial comparison”). They never see your last name, phone number, exact location, gender, date of birth, or any rejected or pending photo.
After you match (or become friends, or join the same session), you can chat in the app. A venue appears only inside a match, on a proposal or a session, or on an open session a host lists. It never appears on your profile.
Never shown to anyone: your phone number, your exact location, who liked you, raw scores, or any negative feedback. Feedback is positive only and appears only as totals once enough players agree. Reports are private and the person reported is never told.
Public venue pages show the venue and a count of recent players. Anything describing people there (skill mix, busy times) is hidden until at least ten different players have played there.
If you use Share my session, your phone’s own share sheet sends the sport, venue, time and your match’s first name to whoever you choose. Cheza doesn’t send it.
Early-access introductions. The one case in which we share an early-access entry with another player is an introduction: when you ask for one and you both say yes, we share your first name and email address with that one player.
How we use it, including automated processing
We use your information only to run Cheza: matching and ranking, messages, notifications and reminders, badges, safety, enforcing our terms, answering you, and legal duties. Several steps are automated:
- Photo screening. Every photo is scanned by Amazon Rekognition before anyone sees it. Explicit content is rejected, unclear cases go to a person, and you can appeal a rejection once.
- Text screening. Bios, messages and venue names are checked by our own filter before they appear. Phone numbers and email addresses are refused; links, and text that suggests someone is under 18, are delivered and a person reviews them. Once our text-moderation provider (Amazon Bedrock) is switched on, the same text is also scanned by it and abusive text is refused. We keep a record that a scan happened and its result, never the text of a refused message.
- Age signals. Text that suggests someone is under 18 is flagged for a person to review.
- Child sexual abuse material (CSAM) detection. Photos and selfies will be checked by a hash-matching service that compares them against databases of known child sexual abuse material maintained with NCMEC, once our hash-matching provider is switched on. A match automatically hides the image and the account and preserves evidence; a person then reviews it. If it is confirmed, we must report it to the National Center for Missing & Exploited Children (NCMEC). We don’t tell the account holder.
- Selfie verification. If you choose to verify, a face comparison decides whether you get the Verified badge. Clear results are decided automatically; borderline results go to a person. See “Verified badge and facial comparison” below.
- Ranking. The order of players you see follows fixed rules: shared sports and goals, level, distance, availability overlap, verification, reliability and recent activity. A like you receive moves the liker up in your deck, but you are never told who it was. Nobody can pay for placement.
- Early-access introductions. Each night an automated match proposes pairs of early-access entries who asked for an introduction: the same sport, the same level, and the same or nearby ZIP codes. A person approves each proposal, or, once we switch on automatic approval, a pair in the same ZIP code at the same level is approved automatically. Nothing is shared until both players say yes.
- Show-up rate. Late cancellations and no-shows lower how often you are shown, and two no-shows in three months pause your access to open sessions for a week.
When a person investigates a report, they may read messages between you and the reported person, only from the trailing 30 days, and every read is logged. Nobody browses conversations.
Verified badge and facial comparison
If you choose to obtain a Verified badge, Cheza and its verification provider, Amazon Rekognition (Amazon Web Services), will process a live selfie and your profile photo to compare facial features and determine whether they appear to match. This process may involve biometric information or a biometric identifier under applicable law.
Apart from the child-safety exception in “Biometric privacy notice” below, Cheza does not retain the live selfie, facial image, or facial template after the verification process is completed: the selfie is deleted in the same request as the comparison, and a selfie that is never compared is deleted within 24 hours of upload. Cheza retains only the verification result (approved or rejected). A similarity score is kept only until the verification is decided, and is then deleted. Cheza does not sell biometric information or use it for advertising or unrelated profiling.
The verification provider processes the selfie and profile photo to perform the comparison. Under AWS’s published terms, Amazon Rekognition may store and use inputs processed by the service solely to provide and maintain the service; our AWS account has opted out of AWS using our content to improve or develop its AI services, so AWS does not use these images to train its models. The schedule in “Biometric privacy notice” below sets out exactly how long each item is kept.
Verification is optional. You may use Cheza without obtaining a Verified badge, although some users or features may choose to rely on the badge as one limited signal of account authenticity. A Verified badge is not a guarantee of a person’s identity, safety, character, qualifications, or conduct. It is a selfie-to-profile-photo match only, and no government ID is checked.
Biometric privacy notice
This notice applies to every user, wherever you live, and is our public retention and destruction policy for biometric information, including under Illinois law. We treat the verification process as collecting and processing biometric information, even though we keep no image or face template.
What is processed. Only if you choose to verify:
- the live selfie you take for verification;
- your profile photo;
- the facial features of both, which are compared to see whether they appear to match;
- the match result (approved or rejected);
- a similarity score, kept only until the verification is decided.
Purpose. Only to determine whether your live selfie appears to match your profile photo, so that we can give you the Verified badge. We never sell biometric information, and we never use the selfie, the facial features or the score for advertising, ranking or profiling, or to train any facial-recognition model. We never use any of it for any other purpose. Once you have the badge, the Verified status itself is shown on your profile, is one of the fixed ranking rules (see “Ranking” above), and lets players who choose to see only players with the Verified badge see you.
How long we keep it (retention and destruction schedule).
| Item | Destroyed |
|---|---|
| Selfie and comparison data (the facial features used in the comparison) | When the comparison completes, whatever the result; in every case within 24 hours of upload, including a selfie that is never compared, except as the child-safety exception below describes. |
| Similarity score | When the verification is decided (automatically, or by a person for a borderline result). |
| Verification result (approved or rejected) | Kept while your account exists; deleted with the account purge, seven days after you delete your account (see “Deleting your account”). |
| Your consent record | Kept as the acceptance records are: for as long as your account exists and for the limitation period after it ends. |
One exception: child-safety checks. Once our hash-matching provider is switched on, every photo and selfie is also checked against databases of known child sexual abuse material (see “How we use it, including automated processing”). If that check matches, the law requires us to preserve the image: we report it to the National Center for Missing & Exploited Children and keep it as evidence for one year from that report, or longer if the law requires. That is the only case in which a selfie is kept beyond the period above, and it is used for nothing else.
These limits apply to every copy we hold, apart from that exception. Our provider, AWS, may store inputs solely to provide and maintain its service under its published terms, and does not use them to improve its AI services (we have opted out).
Your written release. Before you take the selfie, a separate screen asks for your consent. It is not part of the Terms or any other agreement. It describes the face comparison, its purpose, our provider, what we keep and delete, and that we never sell biometric information or use it for advertising. You consent by ticking a checkbox that is never ticked for you. For Illinois residents, the consent also includes this sentence: “For Illinois residents: I authorize Cheza and its verification provider, Amazon Web Services (Amazon Rekognition), to collect, use, and disclose my biometric identifier or biometric information solely for the verification purpose described above, for the period reasonably necessary to complete that purpose and as stated in Cheza’s Biometric Privacy Notice.” Nothing is captured until you tap Continue with verification. We record the exact wording you accepted, its version, the date and time, and your account.
No secondary use. We don’t disclose biometric information to anyone except our verification provider, which performs the comparison for us, or where the law requires it.
You don’t have to verify. Verification is optional, and the alternative is simply not to verify: you can use all of Cheza without the badge. The only difference is that players who choose to see only players with the Verified badge won’t see you.
Who processes it for us
We use these service providers, under contracts that limit them to processing data for us. Our data is stored in the United States; the photo delivery network may hold short-lived copies at edge locations in North America and Europe. Brevo, our email provider, stores and processes your email address and the emails we send you on servers in the European Union.
| Provider | Purpose | What they receive |
|---|---|---|
| Twilio (Verify, Lookup) | Sign-in codes; mobile-number check | Phone number, code delivery data |
| Brevo | Sending our emails (early-access emails and notices to our team) | Your email address, the emails we send you, and a shortened form of your entry in the notices we send our own team. Brevo keeps a log of each email it sends for us, showing whether it was sent, delivered or bounced, for 90 days. We have turned off its open and click tracking, so it does not record whether you open an email or follow a link in it. |
| Amazon Web Services: S3, CloudFront | Photo and document storage and delivery (US East, Ohio) | Photos, selfies (briefly), coach documents |
| AWS: Rekognition | Photo moderation, selfie comparison | Photos, selfies |
| AWS: Bedrock (once switched on) | Text moderation | Bios, messages, venue names |
| AWS: Amplify Hosting | Website and staff console hosting | Website requests, form submissions in transit |
| Render | Runs our servers and scheduled jobs (Ohio) | All app data in transit |
| Neon | Database hosting (AWS US East, Ohio) | All stored app data |
| Expo (once push notifications are switched on) | Push notification relay to Apple | Push tokens, notification content |
| Geoapify | Looks up coordinates for venue addresses our staff enter | Venue addresses only, no personal data |
| A hash-matching provider for known child sexual abuse material (once switched on) | Known-image detection | Image fingerprints or images |
Our AWS account has opted out of AWS using our content to improve its AI services. Bedrock doesn’t keep or train on what we send. Profile photos shown in the app are delivered through Amazon CloudFront, which may hold a cached copy for up to an hour at its edge locations in North America and Europe; the stored originals stay in the US. Twilio (Verify, Lookup) processes our data in the United States, and so will Expo (push service) once push notifications are switched on.
The one case in which we share an early-access entry with another player is an introduction: when you ask for one and you both say yes, we share your first name and email address with that one player. We contact the early-access list by email only, never by text message.
We also share information when the law requires it (including NCMEC reports), to protect someone’s safety, or with a buyer if Cheza is sold or merged, under this policy.
What we never do
- We never sell or share your personal data for advertising.
- We never show ads, and no advertising code runs in the app or on the website. No analytics code runs in the app. On the website, Google Analytics runs unless you decline it or your browser sends Global Privacy Control, and never for advertising.
- We never track you across other companies’ apps or websites.
How long we keep it
| Data | How long |
|---|---|
| Profile, preferences, photos, coach documents, verification result | Until you delete your account; erased seven days after you ask. A photo you remove yourself is deleted at once. |
| Photos removed by a moderator | The original is kept privately as evidence; copies stop being shown at once (a cached copy can last up to an hour). There is no fixed period: the original stays until you delete that photo yourself or your account is erased. |
| Verification selfie, comparison data and score | See the schedule in “Biometric privacy notice”. |
| Messages, sessions, matches, feedback | For as long as your account is open, with no maximum period. When you delete your account, they are handled as the “Deleting your account” section describes: they stay visible to the other people in them, without your name. |
| Message access window for reports | A reviewer may read only the trailing 30 days of the reported pair’s messages. |
| Reports, moderation records, audit log | Kept after account deletion as safety and legal records. We keep them without a fixed limit because we need them to enforce our terms and to meet our legal obligations. |
| Sign-in attempt log | 48 hours. |
| Retired sign-in tokens (hashed) | Up to 45 days. |
| Notification records | 30 days. |
| CSAM evidence | Cheza may preserve content and account information for periods reasonably necessary to investigate reports, protect users, comply with legal obligations, and enforce its terms. When required by a valid preservation request under applicable law, including 18 U.S.C. § 2258A(h), Cheza will preserve responsive material for the period required by law. In practice, material we report is preserved for one year from the report, or longer if a valid request extends it. |
| Minor block | The phone number and block marker, indefinitely (see Children). |
| Early-access list | We delete entries, the introductions they were part of, the answers, replies and reports about them, and the record of emails we sent them whenever you ask, and in any case within 90 days after the App Store launch. Brevo’s delivery log for each email is kept by Brevo for 90 days. |
| Website analytics (unless you decline or your browser sends Global Privacy Control) | Google keeps event-level data for 2 months. The _ga cookies in your browser last up to 13 months, and our cheza_consent cookie, which remembers your choice, lasts 12 months. |
| Database backups | Overwritten within six hours. |
Deleting your account
Go to Settings → Delete account and type “delete” to confirm. What happens:
- Straight away: you are signed out everywhere, your profile leaves every deck, upcoming sessions and matches end, and the number can’t sign in. This can’t be undone.
- Seven days later: we erase your name, date of birth, gender, location, bio, availability, preferences, photos, coach documents, verification result, devices and push tokens, notification settings and likes. Your phone number is released.
- What remains: conversations, sessions and feedback you shared with others stay visible to them under a placeholder instead of your name, because they are part of other people’s history too. Reports, moderation records and the audit log remain. The records of what you accepted (the version, the date and time, and a hashed form of your IP address) remain for the limitation period, as evidence of what you agreed to. If a legal hold applies, the erasure waits until it ends.
A departed player appears as “A departed player” in match and chat lists, and as “Left Cheza” in the chat header and status line.
Your rights
We give these rights to every user, wherever you live, whether or not a privacy law requires us to. You can ask us to:
- access the personal data we hold about you, and get a copy in a portable format;
- correct it (most of it you can edit in the app);
- delete it (in the app, or by writing to us);
- opt out of the sale of personal data, targeted advertising and significant profiling (we do none of the first two);
- withdraw consent, for example to selfie verification or device location.
Write to support@cheza.me from inside the app or with the phone number on your account so we can verify it is you. We answer within 45 days. If we refuse, you can appeal by replying; if we still refuse, you can complain to the Virginia Attorney General. We won’t treat you differently for using these rights.
Children
Cheza is for adults only. Nobody under 18 may use it, and our services are not directed at children under 13 (COPPA).
If you confirm a date of birth under 18 at signup, we stop immediately, don’t store the date of birth, and keep only your phone number and a block marker so that number can’t sign up again. If we learn by a report, a photo or a message that an account belongs to someone under 18, we hide it quietly, a person reviews it, and if confirmed we close it, remove its content and erase its profile data, keeping the same block marker and the audit record. A wrongly blocked adult can contact support for review.
Law enforcement and legal holds
We share information with law enforcement only when the law requires it (such as a valid subpoena, court order or warrant) or in good faith to prevent death or serious harm. We handle requests with counsel and record them. We will tell you about a legal request for your data before we disclose it, unless the law or a court order forbids it, or telling you could put someone in danger or compromise an investigation. Information under a legal hold is kept, and excluded from deletion, until the hold ends.
Security and breach notification
We encrypt data in transit and at rest, keep originals and documents in private storage, limit staff access, and log every moderation action. No system is perfectly secure. If a breach affects your personal data, we will notify you, and the Virginia Attorney General, as Virginia law (Va. Code § 18.2-186.6) requires, along with any other authority the law of the state where you live requires, without unreasonable delay. We keep a written plan for responding to a breach.
Changes
If we change this policy in a way that affects you, we will tell you in the app before the change takes effect.
Contact
Privacy questions and requests: support@cheza.me. We are cheza LLC, a Virginia limited liability company.