Privacy Policy

1. Scope

This policy applies to anyone who joins the Somebody waitlist, creates an account, or otherwise interacts with the Somebody website or application (the "Service"). It should be read together with our Terms of Service.

2. Joining the waitlist

If you join the waitlist, we collect only your email address, your first name if you choose to give it, and whether you've opted in to occasional marketing updates (off by default). Your email is used to tell you when verification opens for you and, if opted in, to send occasional product updates — each such email includes a way to opt out. Waitlist information is not shared with anyone outside the systems described in clause 6 and is not used for any purpose beyond what's described here.

3. Information we collect as a member

• Your email and password, for authentication.
• Profile information you choose to provide: name, age, gender, bio, prompts and answers, interests, and suburb/state/postcode.
• Photographs you upload.
• Your Verification Document (a photo ID, NDIS plan, Centrelink DSP letter, or Companion Card) — see clause 4 and clause 5.
• Your self-identification as part of the NDIS/disability community — see clause 4.
• Messages, including optional voice messages, sent to your Matches.
• Basic activity data (for example, when you last used the Service) to power an "active now"/"active today" indicator.
• If you enable push notifications, a device/browser subscription reference used solely to deliver them — this reference does not itself contain location or other personal data.
• Technical information necessary to operate the Service securely, such as session and authentication data.

We do not collect your live or precise location — only the suburb/postcode you enter yourself.

4. Sensitive information and your consent

Your self-identification as part of the NDIS/disability community is sensitive information for the purposes of the Privacy Act, as it discloses information about disability. If you choose to submit an NDIS plan, Centrelink DSP letter, or Companion Card as your Verification Document (rather than a photo ID), that document also discloses sensitive information in the same way. Under Australian Privacy Principle 3, we may only collect sensitive information with your consent. By checking the self-identification checkbox and/or submitting a disability-related Verification Document and completing signup, you expressly consent to our collection and limited use of that information solely for the purposes described in clause 5 and to identify you as part of this Service's intended community. You may withdraw this consent at any time by deleting your account (clause 8); doing so does not affect the lawfulness of anything we did with your information before withdrawal.

5. Your verification document, specifically

Your Verification Document (a photo ID, NDIS plan, Centrelink Disability Support Pension letter, or Companion Card) is used for exactly one purpose: checking that it appears genuine and matches your stated name before your profile becomes visible to other Members, confirming you are a real person — using a combination of manual review by our team and AI-assisted review — both held to an equal standard. It is not used to verify disability, benefit, or scheme status, which is self-identified (see clause 4). This is a document check, not a cross-check against the National Disability Insurance Agency, Services Australia, or any other government system — no such check is available to us. It is stored in private file storage that is never publicly accessible. Where review is AI-assisted, the document is transmitted to our processor, Anthropic, solely to produce that assessment; Anthropic does not use it for any other purpose, including training its models, under our arrangement with it. The document is deleted from our systems once verification concludes — approved or rejected — and is never shown to any other Member or used for any purpose beyond verification.

6. How we use your information

We use the personal information described above to:

• create and administer your account, and verify your eligibility to use the Service;
• operate core features, including profile display, matching, messaging, and photo-privacy;
• send you Service-related communications, including match, message, and account notifications;
• investigate and act on reports of misconduct, and enforce our Terms and Community Guidelines;
• maintain the security and integrity of the Service; and
• comply with our legal obligations.

7. Photos

Photos are stored privately and never issued as public links. While browsing, other Members see only a server-generated blurred version of your photos — not a client-side filter. Your unblurred photos are shown only to a Member with whom you have a confirmed mutual Match.

8. Who we disclose your information to

• You — via your own account, at all times.
• Our administrative team — solely for profile verification and handling reports, on a need-to-know basis.
• A mutual Match — sees your unblurred photos and any messages you send them, and nothing else about your account.
• Service providers — Supabase (hosting, authentication, database, and file storage), Resend (transactional email delivery), and Anthropic (AI-assisted verification and content-moderation processing). Each processes personal information on our behalf, under contract, solely to provide the Service, and is prohibited from using it for their own purposes.
• Local NDIS-related providers — never receive your name, profile, or any individually identifying information. We may use your interests and general suburb internally to select which locally-relevant provider listing to display to you; a provider only ever receives aggregate reach data for their listing (for example, how many members in a region saw it), never who saw it.
• Law enforcement or regulators — where required or authorised by law, for example in response to a valid legal process or to protect the safety of a Member.
• Meta (Facebook/Instagram) — only if you accept optional cookies via our cookie banner, and only on our public pages (not the logged-in Service). We share limited technical signals, such as that an ad led to a waitlist signup, so we can measure and improve our ad campaigns. Declining keeps this off entirely; see clause 14.

We do not sell your personal information, and we do not operate third-party advertising networks or cross-site trackers within the logged-in Service. The only "advertising" you'll see inside the Service is a locally-relevant NDIS provider listing selected using your interests and general suburb, as described above. Our public marketing pages (for example the waitlist page) may use the consent-gated Meta Pixel described above.

9. Overseas disclosure

Some of the service providers listed in clause 8 may store or process information outside Australia, including in the United States. Where this occurs, we take reasonable steps to ensure your information is handled consistently with the Australian Privacy Principles, including through contractual commitments with those providers. By using the Service, you acknowledge that your information may be processed overseas as described in this clause.

10. Data security

We use industry-standard technical and organisational measures to protect your information, including encrypted storage, access controls limiting administrative access to what's necessary for the purposes in clause 6, and private (non-public) file storage for photos and Verification Documents. No method of storage or transmission is completely secure; if we become aware of a data breach likely to result in serious harm, we will notify affected Members and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

11. Data retention and deletion

We retain your personal information for as long as your account is active, or as needed to provide the Service. You can permanently delete your account at any time from Account → Sign out. Deleting your account removes your profile, photos, Verification Document (if still held), matches, and messages from our active systems — this is a genuine deletion, not a deactivation, and cannot be undone. Some information may be retained for a limited period afterward where required by law or to resolve disputes. If you'd prefer we action a deletion request directly, or want your waitlist entry removed, email support@somebody.dev.

12. Blocking and reporting

If you block another Member, neither of you can see or message the other again. Reports are visible only to our administrative team, for the purpose of review and action.

13. Access, correction, and complaints

You may request access to, or correction of, the personal information we hold about you at any time by emailing support@somebody.dev. We will respond within a reasonable time, and in any event within 30 days. If you believe we have mishandled your personal information, you can lodge a complaint with us at the same address, or with the Office of the Australian Information Commissioner at oaic.gov.au.

14. Cookies

We always use essential cookies necessary to keep you logged in and your account secure — these aren't optional and aren't affected by the choice below. On our public marketing pages, our cookie banner also asks whether you'll accept a Meta Pixel, used only to measure ad performance (for example, that an ad led to a waitlist signup). It never loads unless you accept, it never runs inside the logged-in Service, and declining doesn't limit anything you can do on Somebody.

15. Children's privacy

The Service is not directed at, and is not available to, anyone under 18. We do not knowingly collect personal information from a person under 18. If we become aware that we have, we will delete it promptly.

16. Changes to this policy

We may update this policy from time to time to reflect changes to the Service or our legal obligations. We will update the "last updated" date above and, for any change that materially affects how your information is handled, take reasonable steps to notify Members before it takes effect.

17. Contact us

Questions, access/correction requests, or complaints about this policy can be sent to support@somebody.dev.