Privacy Policy

Blind Fate · last updated 16 August 2026

The short version: we collect almost nothing, we sell exactly nothing, and the most interesting thing about you, your face, never even reaches us. The long version is below, and it is genuinely all there is.

One honest note first. Blind Fate has not opened yet. This policy covers what the signup page does today and what the app will do when it opens on Friday 11 September 2026. It will be updated on that day, and whenever anything here changes.

Who we are

Blind Fate is run by Blind Fate App Ltd, a company registered in England and Wales (company number 17377337), registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the data controller for everything described here, and we are registered with the Information Commissioner's Office under registration number ZC213736. You can reach us at blindfateapp@gmail.com, and that goes to an actual person, not a ticketing system.

What we collect, and why

Today, from the signup page:

Data	Why	Lawful basis
Your email address	To send you one message on the day the app opens. One. Then we're done.	Consent
The code on the poster or link you came from	To know which posters worked and which are decorating a wall for free	Legitimate interests
The date and time you signed up	Ordering the list	Legitimate interests
Where you are, if you choose to tell us. It is a free text box asking for a town, and it is optional and asked only after your email has landed	To know which city to open in next. "Cardiff uni" typed forty times is how we would find out where to go after Exeter	Consent

That is everything. No name, no phone number, no tracking pixels, no advertising cookies, no analytics scripts quietly taking notes. We do not sell or share any of it, and honestly, there is nothing here worth selling.

On that town box: it is a word you type, not your device's location. We never read your phone's position from this page, and the box can be left empty without it costing you anything. This page used to say we collected "no location" at all, which was true of your device and untrue of the box, so it now says both things properly.

We used to ask for a phone number so the launch message could be a text. We stopped: the signup page no longer has the field and the server no longer stores one. A number we would use once is a number we should not be keeping, so we do not.

When the app opens, additionally:

Data	Why	Lawful basis
First name, subject studied, interests	To match you, and to tell the person across the table who they are meeting. Your age is never collected or shown. The ID check confirms you are over 18, and that yes or no is all we hold	Contract
Identity and age check (result only, see below)	To keep the app 18+ and everyone on it real	Legal obligation and substantial public interest
Rough location, when you press the button	To pick a venue you can actually walk to, rather than one an hour away	Contract
Your bookings and whether you turned up	To run the service and keep no-shows rare	Contract
Messages you send in the app	To let matched people arrange the evening, and for safety investigations if something goes wrong	Contract and legitimate interests
A notification token for your phone	So we can tell you that a table has been booked, that someone liked you, or that it is time to head home safely. It is a code your phone's app store issues to this app, it identifies the handset rather than you, and it is deleted when you delete your account or install the app elsewhere	Contract

The ID check, in detail

Before your first booking you verify your identity through Didit, a specialist identity provider. You photograph an identity document and take a short selfie. Here is the part we are genuinely proud of:

We never receive your document or your photographs. They go directly to Didit and are never sent to us. We could not leak them if we tried, because we never have them.
We store four things: whether the check passed, whether you are over 18, a reference number, and a one-way code that lets us recognise the same person again (see below). Not your name, not your date of birth, not your document number, not a single pixel of any image.
The one-way code, and why it exists. We take your document number, mix in a secret only our server holds, and run it through a one-way scramble. The result is a meaningless string of characters. It cannot be turned back into your document number, and it is useless anywhere else. We keep it for one reason: so that blocking someone actually works. Without it, a person you blocked could delete the app, reinstall it, and be matched with you again as though you had never blocked them. The same code keeps a no-show cooldown from being cleared the same way. It is deleted when you delete your account.
The session is deleted at the provider as soon as the result reaches us.

The selfie is used for a liveness and face-match check, which makes it biometric data under UK GDPR. It is processed by Didit for that single purpose and is not retained by us in any form.

No photos, anywhere

Blind Fate has no profile photographs. You cannot upload one, other users cannot see one, and there is nothing to browse, rate or screenshot. Nobody can be found on it by a flatmate, an ex, or their mum. This is a design decision, not a setting, and there is no toggle to get wrong.

Location, precisely

When the app opens, your location is used for two things only: choosing a venue within your walking limit, and confirming you actually arrived (which is how venues get paid: a yes or a no, never a trail). We round coordinates before using them, we never store a movement history, and venues see table counts and times, never who or where anyone is.

How long we keep things

Signup emails: until the launch message is sent, then deleted. No phone numbers are held, because the signup page does not ask for one.
Account data: while your account exists, and 30 days after you delete it.
Verification results (pass or fail, over 18 or not): while your account exists. The underlying documents are never held by us at all.
Messages: 90 days, or longer where needed for a safety or legal investigation.
Safety reports and blocks: as long as necessary to protect other users, which may be after your account is deleted.

Who else sees your data

Didit: identity verification, as above.
Cloudflare: hosting and storage.
Expo: delivers the notifications to your phone. The text of a notification, which can include a first name, tonight's venue, or the first line of a message, passes through their servers on the way to your lock screen. Worth knowing: like any messaging app, what a notification says is visible on a locked phone unless you turn previews off in your phone's settings.
Resend: sends the one launch email, and only sees the address it is being sent to.
Venues: a first name and a table time, so they can seat you. That is the entire handover. They do not get your surname, your number, or anything to remember you by beyond a table that showed up.

Those four are companies whose servers sit outside the UK, mostly in the United States and the EU, so some of your data is handled there. We rely on the standard data protection terms each of them publishes for transfers of this kind. They are processors, not partners: they may only do the specific thing we ask them to do with your data, and nothing else. If you want to know exactly where a particular piece of your data sits, ask us and we will tell you.

We do not sell your data, we do not use it for advertising, and no "trusted partners" are lurking behind that sentence. Our business model is venues paying us when tables get filled, which means we do better when you have a good evening, not when we know more about you.

Deleting everything

When the app opens, you will be able to delete your account from inside it. That deletion is real: profile, bookings, verification result and blocks are wiped, and your messages are anonymised. It is not a "deactivation" that keeps everything and hopes you come back.

One thing is kept rather than wiped, and we would rather say so than have you find out. If you actually turned up to a venue, that night has a billing line against it, because the venue is invoiced per person who walked in. Deleting it would take money off a bill they had already earned. So the line stays and you are taken out of it: your name and your account are stripped, and what remains is a date, a time, a venue and an amount, with nothing left pointing back to you. How deletion works walks through the steps and lists exactly what goes and what stays.

Your rights

You can ask us for a copy of your data, ask us to correct or delete it, object to how we use it, or withdraw consent at any time. Email blindfateapp@gmail.com and we will respond within one month. If you are unhappy with how we handle any of it, you can complain to the Information Commissioner's Office at ico.org.uk, though we would love the chance to fix it first.

Age

Blind Fate is for people aged 18 and over. It is not intended for anyone under 18 and we do not knowingly hold data about under-18s. Every user is age-checked against a real identity document before their first booking, not a checkbox that says "I promise".

Changes

If this policy changes materially we will say so on this page and, where the change affects you, tell you directly. The date at the top always tells you when it last moved.

← back to Blind Fate