Privacy
Wanting To is built around one idea: what you share about your intimate life belongs to you. This page is the whole picture: what we hold, how it's protected, who can see it, and where the limits are.
What "encrypted" means here
Every personal thing you write (your Preferences, Mood, messages, Experiences, Partner Agreements, notes, bio and journal) is scrambled before it is written down, each with a key belonging to you (or to the conversation it's part of). If someone walked off with the server's disk, a copy of the database or a backup file, what they would have is meaningless noise.
The honest limit: the running app can unscramble your data, because it has to show you your own matches and messages. So this protects your data at rest (disks, backups, database files, stray copies), not against someone who takes control of the live server itself. Making even that impossible would mean only you could ever read your data, which would also mean losing it all if you forgot your password, and no matching at all. We think this is the right trade; you should know we made it.
Your Intimacy Journal and Experience Reflections go further still: they live in a separate encrypted database that the analytics and administration code physically cannot open: not a policy, a structural rule the build enforces. A Reflection stays private to you unless you tick "Share this answer" on one of its answers; only the answers you share are shown to the partners in that Experience, encrypted under that Experience's own key, and you can unshare them at any time.
Account details are protected too. Your email address, the IP addresses in our security log, your browser's push-notification address and Stripe's billing references are all encrypted. Where the app has to find something (your account when you sign in, for example), it uses a one-way fingerprint instead of the readable value.
Everything we hold, and how it's protected
Identity/account
The minimum needed to run and secure your account. No real name, no street address, no city.
| What | Protection | Why |
|---|---|---|
| Email address | Encrypted | Encrypted, so the app can still send you mail. Your account is found at sign-in by a one-way fingerprint of the address, never the address itself. |
| Password (hashed, never stored as typed) | Hashed | A password hash can be checked but not reversed. |
| Two-step sign-in secret | Encrypted | Needed to check your 6-digit codes, so it is encrypted rather than hashed. |
| Username | Stored as text | Anonymous by design. It is never your real name. |
| Plan, verification & moderation state | Stored as text | Needed to run the service and enforce the age gate. |
| Card and billing details | Never stored | You pay on Stripe's own checkout page. We keep only Stripe's customer and subscription references, and those are encrypted. |
| Login history & security log | Encrypted | IP addresses and any email typed at sign-in are encrypted; the log never records your email address. Login history is kept 90 days and IP addresses are cleared from older entries. |
| Signed-in sessions | Hashed | Only a one-way hash of each sign-in token is stored, so a copy of the database can't be used to sign in as you. Expired sessions are deleted daily. |
| How you heard about us | Stored as text | Optional at sign-up; counted to see which channels work. Never about your intimate life. |
| Which Terms version you agreed to, and when | Stored as text | The IP address recorded with it is encrypted. A record we need in case a question about the agreement ever comes up. Deleted with your account. |
| Waitlist email address | Encrypted | Encrypted, and kept only until your invitation is used (or 7 days if you never confirm it), then deleted. |
| Privacy request log | Hashed | Records that an export or deletion was done, by a one-way fingerprint of the email, never the address itself. |
| Installed-app push subscriptions | Encrypted | A device address supplied by your browser, needed to deliver a push. Encrypted, and deleted with your account. |
| Your notification choices | Encrypted | Which notifications reach you where (Manage notifications), encrypted with your own key. |
| Wanting To Guide usage | Stored as text | How many questions you asked each day (for the daily limit, kept 60 days) and when you agreed to the Guide notice. No question text. |
| Experience check-ins | Stored as text | How many check-ins an agreed Experience has had, so they follow the schedule. Nothing about the Experience itself is stored here. |
| New Preferences reminders | Stored as text | When the latest "New Preferences to explore" round began for you and how many reminders were sent, so reminders follow the schedule. No Preferences are stored here. |
| Referral code you signed up with (e.g. a therapist's) | Encrypted | Used only to count sign-ups per code and to start any free Premium days. Which professional owns a code is kept in the separate professionals database, which never records who signed up. |
| Professional accounts (licensed therapists) | Encrypted | Names, email addresses and license details are encrypted. Kept apart from member accounts, with its own sign-in and required two-step verification. |
Intimate/private
Everything about your intimate life. All of it encrypted, none of it ever sold or shown as individual records.
| What | Protection | Why |
|---|---|---|
| Gender, orientation, birthday, ZIP, bio | Encrypted | Encrypted with your own key. |
| Mood | Encrypted | Encrypted with your own key. |
| Preference selections (comfort, side, intensity) | Encrypted | Even which Preferences you looked at is unreadable. The whole list is one sealed value. |
| Messages & group chats | Encrypted | Encrypted with a key for that conversation. |
| Experiences (proposals, answers, boundaries) | Encrypted | Encrypted with a key for that Experience. |
| Partner Agreements & their notes | Encrypted | Encrypted with a key for that connection. |
| Notifications you have been sent | Encrypted | Encrypted with your own key. |
| Photos | Never stored | Journal photos were removed in Build 1.0.5 and every existing one was deleted. |
| Support tickets & replies | Encrypted | Encrypted, including your name, email and IP address; readable by the admins handling your ticket. |
| Reports you make about another member | Encrypted | Encrypted like any ticket. Contains only the messages you chose to share; the other person is never told who reported them. |
| Intimacy Journal entries | Encrypted | Separate database the analytics and admin code cannot open at all. |
| Experience Reflections | Encrypted | Same separate database; only a "done" marker lives in the main one. |
| Shared Reflection answers | Encrypted | Only answers a member chooses to share, encrypted under that Experience's key so its partners can read them. Unsharing deletes them. |
| Experience Request notes (something to share, a question for partners, and their answers) | Encrypted | Part of the Experience, encrypted under its own key like the rest of its answers. |
| Wanting To Guide conversations | Encrypted | Your questions to the AI Guide and its answers, encrypted with your own key. To answer, each question, the earlier messages in that conversation and the Preference's description are sent to Anthropic (Claude). Nothing identifying is sent. You can delete any conversation. |
| Notifications waiting for your summary | Encrypted | When you (or the platform) chose an hourly, daily or weekly summary, the notices wait here, encrypted under your key, until the summary goes out. Then they are deleted. |
| Messages from the Wanting To team | Encrypted | Notifications an admin chose to deliver to your Messaging inbox, encrypted under your key like your notifications. |
Aggregated insights
Counts across large-enough groups, from members who opted in. Never stored against a person.
| What | Protection | Why |
|---|---|---|
| Opted-in demographic & interest statistics (groups of 5+) | Never stored | Computed on the fly from opted-in members only. |
Photos
Messages and group chats are text only. Wanting To doesn't send photos between members at all, so there are no intimate images passing through the app to leak, forward or screenshot out of context. Profile pictures are chosen from a set of Wanting To avatars rather than uploaded, so there is no photo of your face in the app. The Intimacy Journal is text only too. Wanting To doesn't store photos of any kind.
Payments
Premium is paid through Stripe, on Stripe's own secure checkout page. Your card number never reaches Wanting To. We can't see it and don't store it. What we keep is a reference to your Stripe customer and subscription, so we know your plan is active. Stripe keeps the payment records that tax and card-network rules require, under its own privacy policy. Charges appear on your statement as WHATBOXLABS, never "Wanting To". Receipts go to the email on your account. Details are in the Subscription & Refund Policy.
Who else handles data for us
A few service providers help run Wanting To, each under contract and only for that job: Render hosts the app and its encrypted database; Resend delivers our emails (which never contain anything personal; see below); and Stripe processes payments. None of them receives your Preferences, matches, messages or journal in readable form. We never sell data, and there is no advertising or tracking code in the app.
The Wanting To Guide (AI)
The Guide is optional. If you choose to ask it a question about a Preference, your question, the earlier messages in that conversation and the Preference's own description are sent to Anthropic, which makes the Claude AI, to get an answer. Your username, email, partners, Preference choices and anything else from your account are never sent. Anthropic may keep what it receives for a limited time under its commercial terms, for example to prevent misuse. In Wanting To, your Guide conversations are stored encrypted with your own key, you can delete any of them, and they're deleted with your account. The Guide gives general information, not medical or professional advice, and you agree to a short notice before your first question.
What your partners see
Administrators never see your Preferences. Each partner sees your matches and anything you've locked to "Always show" on your profile, with how much you want each one (Curious to Favorite). Beyond that, they see only what you've chosen to show that specific partner: your full list (including your reds, which simply mean "not for me") and your Mood. You set this per partner when you connect and can change it any time on their Partner page. Partner Agreement answers, including any note you write, are shown to that partner, since agreeing on expectations is the point of them. The same goes for a note you leave on a Preference: it's written for your partner, encrypted, and shown only to the two of you.
Your partners are told that something changed (you updated your Preferences, saved Agreements, want to discuss a match, ended the connection), but never what changed.
If you report someone
You can report a problem with anyone you're connected to or share a group chat with. Because your messages are encrypted and our team can't read them, you choose which of that person's messages to share as part of the report. Only those are visible to the administrators handling it, and nothing else from your conversations. The report is stored encrypted, and the other person is never told who reported them.
If you signed up through a therapist
Licensed therapists in our professional program can give clients a sign-up code, link or flyer. If you use one, your therapist sees only how many people have signed up with their code, never who, and never anything you choose, write or share in Wanting To. Professional accounts are kept in a separate database with their own sign-in, and are never connected to members' accounts.
What we put in emails
Emails from Wanting To never contain your Preferences, your matches, your messages, or anything from your journal. They say only that something is waiting for you in the app. Email itself isn't a private medium, so we keep it empty of anything that matters.
What administrators can see
Administrators run the platform, so they can see account-level things: your username, email address, plan, whether an account is suspended or banned, support tickets you submitted, and a security log of actions. They cannot see your Preferences, matches, Mood, messages, Experiences, Partner Agreements, journal or reflections. Nothing in the admin panel decrypts those, and the statistics administrators see are the opted-in, grouped counts below.
Research is opt-in
By default, you are not included in any statistics. If you choose "Yes, contribute anonymous statistics" on your profile, your answers can be counted in aggregate: only ever in groups of 5 or more, so no one can be singled out, and never your individual profile, partner connections, journal entries, Experience reflections, messages or identifying information. Those counts are worked out in memory from values that arrive with no member attached. You can change your mind any time.
How long we keep it
Your data stays while your account exists. Login history is deleted after 90 days, and IP addresses are scrubbed from older security-log entries automatically. Records of which emails we sent (never their content) are kept 30 days. A waitlist email address is deleted once its invitation is used, or after 7 days if it's never confirmed. Expired sign-ins are deleted every day. The app also keeps encrypted backups of its databases for about 7 days, in case something needs to be restored. Anything you delete is gone from those backups within that time.
If you delete your account, everything that is only yours is erased: profile, Preferences, Experiences, Agreements, journal, reflections, notifications and support tickets. A report you made about another member is kept, encrypted and no longer linked to you, so the record behind any safety action stays. Messages you sent to a partner are the one exception: they sit in a shared conversation, so the message stays in their thread with your content scrubbed and shown as "[deleted account]". If you paid for Premium, your subscription is stopped and your Stripe customer record is deleted; Stripe keeps only the payment records the law requires. We keep a note that a deletion was done (identified only by a one-way fingerprint of your email address, never the address itself) so we can confirm it if you ever ask.
Your data, your call
You can download everything tied to your account (decrypted, for you alone) or permanently delete it, from your profile page. Deletion is immediate and cannot be undone.
Last reviewed: 2026-10-13 (build 1.1.1).