TheOne — Privacy Policy and Terms of Use

**Effective date:** 01 SEP 2026 **Last updated:** 03 SEP 2026 **Version:** 1.0.0

This document contains two agreements and a set of regional supplements.

**Part A** is the Privacy Policy. It explains what personal data we process, why, on what legal basis, who receives it, how long we keep it, and what you can require us to do about it.

**Part B** is the Terms of Use. It is the contract between you and us. Creating an account or using the service means you accept it.

**Part C** is our Accessibility and Non-Discrimination commitment. It is binding on us, and it tells you how to hold us to it.

**Part D** is the Cookie and Tracking Technologies Policy. It forms part of Part A.

**Part E** contains supplements that apply depending on where you live, including the full California privacy notice. Where a supplement conflicts with Part A, the supplement governs for residents of that jurisdiction.

**Part F** contains appendices: the model withdrawal form, the catalogue of paid products, a summary of the community rules, and the version history of this document.

Words wrapped in `DOUBLE BRACES` are placeholders. They are filled by the publishing pipeline before this document is served, and none may remain in a published version.

How to read this document

If you want the short version, read this page. It is a summary and not a substitute for what follows; nothing in it overrides the detailed terms.

• **We are a multi-surface platform.** One account gives you access to several distinct surfaces — Dating, Storefront, BoxOffice, Billboard, Almanac, Marketing, Portfolio and Support. What we collect and show depends on which surfaces you activate. Activating Dating means publishing a profile to other people; activating Storefront does not.
• **We do not sell your personal data**, and we do not share it for cross-context behavioural advertising, as those terms are defined by US state privacy laws.
• **You control the sensitive parts.** Precise location, camera and contacts access, and any sensitive profile field are optional and revocable.
• **Payments run through a payment processor.** We never receive or store your full card number.
• **Deletion is real, and it is two-stage.** Your profile disappears from every surface immediately; the irreversible purge follows after a grace period. A small set of records — tax, safety, and the credit ledger that substantiates a refund — outlives the account because the law or your own interests require it.
• **Enforcement decisions can be appealed** to a human being who was not involved in the original decision.
• **You must be 18 to use Dating.** Other surfaces have a lower minimum, but never below the age of digital consent where you live.

1. Who we are and who is responsible for your data

The entity responsible for your personal data — the **controller**, in the language of European law — depends on where you live.

Company registration: Georgia Secretary of State, Control Number 24108657

Where two or more of our entities are involved in the same processing, they act as **joint controllers** and have agreed in writing which of them answers which obligation. You may exercise your rights against any of them, and we will route the request internally. A summary of that arrangement is available on request.

Where we process data on another party's instructions rather than our own — for example where a merchant sells through our Storefront and determines the purpose of their own mailing list — we act as a **processor** for that party and their privacy notice governs, not ours.

2. Where this policy applies

This policy applies to everything we operate under the TheOne brand: the websites and applications at `theoneapi.org` and its subdomains, our mobile applications, our public APIs, the events we run, and the support channels through which you reach us. We refer to all of it collectively as **the service**.

Some features carry their own supplementary notice — photo verification, identity verification, and any feature that processes biometric data. Where a supplementary notice exists, it applies **in addition** to this one, and where the two conflict on that feature, the supplementary notice governs.

This policy does **not** cover:

• third-party services you reach through a link from ours, which have their own policies;
• payment card handling by our payment processor, which is governed by its own notice;
• a merchant's own use of data you give them directly through the Storefront;
• any product we later launch under a separate policy, which we would tell you about at the point of launch.

3. Definitions

Legal documents that avoid defining their terms tend to hide the important choices. These are ours.

4. The data we collect

We have grouped the data by where it comes from, because that is what determines your control over it. Data you give us, you can usually change or withdraw. Data generated by use is harder to avoid without leaving the service. Data from third parties is the category people are least aware of, so it has its own section.

4.1 Data you give us

4.2 Data generated by your use of the service

4.2.1 How we count an audience without identifying it

When you watch something while you are signed out, we still need to know how many people watched it. A creator cannot be told honestly how their work performed if part of the audience is invisible. We do that without keeping anything that identifies you.

At the moment you press play we combine your IP address, your browser's user-agent string and a secret value we generate at random each day, and we store only the resulting hash. **Neither the address nor the user-agent is written into the viewing record itself.** The hash cannot be reversed, and nobody can arrive at it from your address without that day's secret.

That secret is deleted after 36 hours and is never written down anywhere else. Once it is gone, the stored hash cannot be connected back to you — not by us, not by anyone who obtains our records, and not by anyone who compels us to produce them. Not because we would decline, but because the information needed to do it no longer exists. Because the secret is different every day, the value recorded for you today and the value recorded tomorrow cannot be matched to one another either, so this cannot be used to follow you from one day to the next.

To be exact about the boundary: this describes the viewing record. Your IP address may still appear separately in the security and access logs described in §4.2 and §9, which exist to detect intrusion and abuse and are kept and deleted on their own schedule. We do not join those logs to viewing records to work out who watched what.

Where we cannot generate that day's secret, we record a value unique to the single request, which identifies nothing at all. We can then count plays but not people, and we say so wherever the figure appears.

None of this applies when you are signed in. Then your viewing is recorded against your account, as the table above describes, and the access and erasure rights in §10 apply to it.

4.3 Data we receive from others

4.4 Data we do not collect

Stating the boundary is as useful as stating the scope. We do not:

• receive or store your full payment card number, CVC, or online banking credentials;
• read files on your device outside what you explicitly select and upload;
• collect precise location in the background when the relevant feature is off;
• record audio or video except when you deliberately capture it in the service;
• buy contact lists to add people who never asked to hear from us;
• purchase personal data about you from data brokers to enrich your profile for advertising;
• keep the IP address or browser user-agent of a signed-out viewer as part of the record of what they watched — see §4.2.1 for what we keep instead.

4.5 Device permissions

Every permission below is optional at the operating-system level. Declining one disables the feature that depends on it and nothing else. You can change your mind at any time in your device settings.

4.6 Data about other people

If you give us information about someone else — an emergency contact, a referred friend, a person named in a report — you are responsible for having a lawful basis to do so, and for telling them we hold it where the law requires it. We process it only for the purpose you gave it to us for. A person who appears in our records only because you named them may exercise their own rights under §10, and we will honour those rights even though they have no account.

Information about people who are not members is covered by our supplementary notice at https://theoneapi.org/legal/non-members.

5. Why we use your data, and on what legal basis

European law requires a lawful basis for every purpose. The table is the summary; the subsections that follow explain the ones where the reasoning is not obvious.

Where we rely on **legitimate interests**, we have carried out a balancing assessment weighing that interest against your rights and freedoms, and we have recorded it. You can request a summary at privacy@theoneapi.org, and you can object under §10.

5.1 Providing the service you asked for

The contract we are performing is the one in Part B: you activate a mode, and we deliver that surface. This is the basis for the ordinary mechanics — storing your profile so it exists tomorrow, delivering a message to the person you sent it to, showing a listing to people searching for one, admitting you to an event you bought a ticket for.

Two consequences follow that people sometimes find surprising, so we state them plainly:

• **We cannot deliver Dating without publishing a profile.** Discovery is the product. Your visibility controls determine *who* sees it and *what* they see, but there is no version of the surface in which nobody sees anything.
• **We cannot deliver messaging without retaining messages for the recipient.** Deleting your copy of a conversation does not delete theirs, because their copy is their data too.

5.2 Payments, tax, subscriptions and credits

Purchase data is processed to charge you, to grant what you bought, and to keep granting it for as long as you have paid for it. Tax location is determined at checkout and retained because tax law requires us to be able to show, years later, why we charged the rate we charged.

Consumable credits are recorded in an **append-only ledger**: every grant, spend and refund is a separate immutable entry rather than an edit to a running total. This is deliberate. It means a disputed balance can be reconstructed exactly, and it is why §9 keeps the ledger longer than the account.

5.3 Personalisation and recommendations

We rank and filter what you see. The inputs are what you have told us you want, what you have done in the service, and the general popularity and quality signals of the content itself. The purpose is relevance, not manipulation: we do not rank content to maximise the time you spend in the service at the expense of what you came for.

You can influence this directly — adjust your discovery preferences, hide or block, tell us a recommendation was wrong — and you can object to profiling under §10.

5.4 Safety, integrity and security

This is the purpose with the broadest data reach, so it deserves the most explanation.

We use personal data to detect and act on: fraud and payment abuse; harassment, threats and stalking; illegal content, including sexual content involving minors; impersonation and catfishing; spam and coordinated inauthentic behaviour; automated access; underage accounts; and attempts by banned people to return.

The mechanics involve automated detection, human review, and — where an account presents a risk to others — immediate action before review. It involves linking accounts to each other through shared signals, because ban evasion cannot be stopped otherwise. It involves retaining certain signals after an account closes, for the same reason.

We consider this a legitimate interest not only of ours but of every other member, and in the case of content that is illegal, a legal obligation. Where sensitive data is caught up in an investigation — for example a report that quotes something you said about your health — we process it under the substantial-public-interest basis, and only to the extent the investigation requires.

**Cross-service safety.** Where we operate more than one brand or surface and a person is banned from one for conduct that would be banned everywhere, we may act across all of them. A ban for harassment on Dating is not confined to Dating.

5.5 Advertising and marketing

We advertise our own service on third-party platforms, and we may show promotions for our own features inside the service.

• **Own-service marketing by email, SMS or push** is sent with your consent where the law requires it, and you can withdraw it at any time from the message itself or in settings. Withdrawal is honoured without exception and without asking why.
• **Advertising our service elsewhere** may involve providing a platform with a hashed identifier so it can either exclude you from a campaign or build an audience resembling our members. We do not provide your profile content or your activity for this.
• **We do not sell your data and we do not share it for cross-context behavioural advertising.** If that ever changes, we will say so before it takes effect and provide an opt-out first, and we will honour the Global Privacy Control signal.
• **Measurement.** We measure whether a campaign worked. This produces aggregate numbers, not a dossier.

5.6 Research, improvement and model development

We analyse how the service is used in order to fix it, improve it and build new things. Where that analysis can be done on aggregated or de-identified data, it is.

We develop and evaluate models for ranking, matching, spam detection, content classification and safety. Where those models are trained on member content, we apply the following limits, and we state them as commitments rather than intentions:

1. **Private messages are not used to train recommendation or ranking models.** They are processed by safety classifiers, in an automated way, for the purpose of detecting abuse — and for no other purpose.
2. Training uses the minimum data necessary and, wherever the task allows, de-identified or aggregated inputs.
3. We do not sell member content to third parties for their model training.
4. You can object to processing based on legitimate interests, including this, under §10.

5.7 Legal compliance and claims

We process data to comply with the law that applies to us: tax and accounting retention, consumer protection, sanctions screening, content-moderation obligations, and lawful requests from courts and authorities. We also process it to bring or defend legal claims, which is why some records outlive an account — a claim can be brought after you have left.

5.8 Automated decision-making and profiling

We use automated systems in three places that matter to you.

Decisions with a **legal or similarly significant effect** — permanently banning an account, removing content, refusing a refund, or refusing a verification — are not made by an automated system alone. Either a person decides, or a person reviews the automated decision before it becomes permanent. Where an urgent risk requires immediate action, the automated restriction takes effect first and a person reviews it afterwards, and always immediately if you ask.

You have the right to obtain human intervention, to express your point of view, and to contest the decision. Do that through the appeal route in Part B §8. The reviewer will be someone who was not responsible for the original decision.

We do not use automated decision-making to set an individual's price on the basis of profiling.

6. How and with whom we share data

**We do not sell your personal data.** We do not share it for cross-context behavioural advertising. We do not disclose it for money or other valuable consideration.

What we do is set out below. Every recipient category is real; we have not listed hypothetical ones to give ourselves room.

A current list of the specific processors we engage, and the countries they operate in, is available on request at privacy@theoneapi.org.

6.1 What we require of processors

Every processor is engaged under a written contract that: limits them to our documented instructions; requires confidentiality; imposes security measures at least equivalent to our own; restricts sub-processing to parties bound by the same terms; requires them to assist with your rights requests and with breach notification; and requires deletion or return of the data at the end of the engagement. We assess each processor before engaging them and review them periodically.

6.2 How we handle government and law-enforcement requests

We assess every request against the law that supposedly authorises it. We require valid legal process. We refuse or challenge requests that are overbroad, procedurally defective, or unlawful. Where the law permits it and there is no ongoing investigation that notice would prejudice, we tell the affected member before disclosing.

An emergency-disclosure request — where there is an imminent risk of death or serious physical harm — is handled on a fast path, and we disclose only what is necessary to address the emergency.

6.3 Sharing you initiate

Some features exist to let you share deliberately: sharing a profile or listing outside the service, sharing details of a plan with a friend or an emergency contact, or connecting an external account. When you use them, the recipient gets what you sent them, and what they do with it is outside our control and outside this policy. Other members can use the same features with your content, subject to the visibility settings you have applied.

7. Affiliates and group companies

Where we operate as part of a group, we and our affiliates share data with each other for the following purposes, and no others:

• **Safety across the group** — identifying accounts and behaviour patterns that are harmful, so that a person banned from one service can be prevented from simply moving to another.
• **Shared operations** — hosting, security, customer support, payments, analytics, finance and legal, where it is more sensible to run one function than several.
• **Improvement of shared systems** — including recommendation and safety systems used by more than one brand.
• **Group reporting** — consolidated audit, financial reporting and planning, generally on aggregated data.

Each affiliate is bound by terms equivalent to this policy. Sharing for these purposes rests on our legitimate interests, or on a legal obligation where the group is subject to one collectively.

A current list of affiliates is at https://theoneapi.org/legal/affiliates.

8. International transfers

We are established in United States and host primarily in the European Union. Some of the recipients in §6 process data outside the EEA and the United Kingdom, in particular in the United States.

Where we transfer personal data outside the EEA, the UK or Switzerland, we rely on one of the following:

Contractual mechanisms alone are not sufficient, so we also apply supplementary measures: encryption in transit and at rest, key management that limits who can decrypt, minimisation of what is transferred, access controls and logging, and a documented policy of assessing, challenging and — where lawful and appropriate — refusing disproportionate government requests. We reassess transfers when the legal position in a destination country changes.

You can request a copy of the transfer mechanism relevant to a specific recipient at privacy@theoneapi.org.

9. How long we keep data

We keep personal data only as long as we need it for the purposes in §5, or as long as the law requires. The categories below are the operative rules; where two apply, the longer governs, and where an open claim, dispute, investigation or preservation order exists, retention continues until it is resolved.

9.1 What happens when you close your account

Closure is deliberately two-stage.

**Immediately, within the same request:**

• your profile stops being visible on every surface — you leave discovery, listings, search and recommendations at once;
• your account can no longer be signed into with your credentials;
• pending marketing is stopped.

**During the grace period of 30 days:**

• your data is retained so that you can restore the account by signing in;
• it remains invisible to everyone else throughout.

**After the grace period:**

• the irreversible purge runs across our data stores. It is executed per record, keyed on your account identifier;
• the categories in the table above that we are required or permitted to keep survive it, in the narrowest form that serves their purpose;
• an audit record of the deletion itself is retained, naming which tables were purged and which could not be reached, because a deletion you cannot evidence is a deletion you cannot prove.

**What survives, and why.** Tax records, because the law says so. The safety window, because harm surfaces late. The credit ledger, because if you are owed a refund after closing your account, the ledger is the only thing that proves it. Messages in another member's inbox, because they are that member's data. Aggregated statistics, because they are no longer about you.

**What we will not do.** We will not retain your profile, your photos, or your content for our own use after the purge. We will not resurrect a deleted account for anyone other than you.

9.2 Inactivity

If you do not sign in for two years, we will notify you at your registered address and, absent a response, close the account and apply the deletion schedule above. Purchased entitlements that have not expired are honoured if you return within the grace period.

9.3 Suspension

While an account is suspended, the profile is not visible but the data is retained, because a suspension is temporary by definition and the account may be reinstated. You may ask us to delete it during the suspension instead, and we will.

10. Your rights

Depending on where you live, you have some or all of the rights below. Some are named differently in different laws; we have used the European names and noted the common alternatives.

10.1 How we handle a request

**Verification.** We will ask you to verify your identity before acting, in proportion to the sensitivity of what you are asking for. For a signed-in request, being signed in is usually enough. For a request that would disclose data or delete an account, we may require more. We will not ask for a government identity document unless the request cannot be verified any other way, and we delete anything you send for verification once the request is closed.

**Timing.** We respond within **one month**. Where a request is complex or you have made several, we may extend by a further two months and will tell you within the first month, with reasons. US state laws generally give 45 days with a 45-day extension; we apply whichever period is shorter for you.

**Cost.** Free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive — in particular where it is repetitive — and we will explain why.

**Refusals.** We can refuse a request that is unlawful, that we cannot verify, or that would infringe someone else's rights, trade secrets or intellectual property. A request for another member's data will be refused; they must ask themselves. If we refuse, we will tell you why and how to challenge it.

**Authorised agents.** You may use an agent where your law allows. We will require proof of the authorisation and, usually, verification of you directly.

**Appeals.** If we refuse, you may appeal by writing to privacy-appeals@theoneapi.org with the subject "Privacy Request Appeal". We will respond within the period your law provides. If you are a resident of a US state with a comprehensive privacy law, you may also complain to your state Attorney General; California residents may complain to the California Privacy Protection Agency.

10.2 What a data export contains

Your download includes: account and profile data; your content, including photos and messages you sent; your purchase and subscription history and your credit ledger; your usage history in a structured form; your consent and preference records; and the inferences we hold about you where they constitute personal data.

It does not include: data about other people that happens to sit alongside yours; internal notes whose disclosure would prejudice an ongoing safety investigation; security and anti-fraud signals whose disclosure would tell a bad actor how to evade detection; and material protected by legal privilege or trade secret. Where we withhold something, we will say that we have and on what ground.

10.3 Controls in the service

Some things are faster to change than to request.

10.4 Complaints

Tell us first if you can: privacy@theoneapi.org. We would rather fix it than litigate it.

You may complain to a supervisory authority regardless. Our lead authority is none - we have no establishment in the European Economic Area. You may instead complain to the authority where you live, where you work, or where you believe the infringement happened. In the EEA the list is published by the European Data Protection Board; in the UK it is the Information Commissioner's Office; in Switzerland the Federal Data Protection and Information Commissioner. You also have the right to an effective judicial remedy.

11. Cookies and similar technologies

We use cookies, local storage, software development kits, pixels and similar technologies. The categories are summarised below; the complete treatment, including the inventory, consent mechanics and the position on Global Privacy Control, is in **Part D**, and the live inventory is at https://theoneapi.org/legal/cookies.

Our own audience measurement is described in §4.2.1. It sets no cookie, reads nothing from your device and stores nothing there, so it is not governed by the choice above; it relies on our legitimate interests under §5, and you can object to it under §10.

You can change your choice at any time at https://theoneapi.org/settings/privacy, and you can control cookies in your browser. Declining non-essential cookies does not reduce your access to the service; it reduces our ability to measure it. Some mobile operating systems provide their own tracking control, which we honour independently of the setting here. We honour the Global Privacy Control signal where it is presented.

12. Security

We apply technical and organisational measures proportionate to the risk, including:

• encryption in transit for all traffic, and encryption at rest for stored data;
• key management that limits which systems and which people can decrypt what;
• authentication protections including password hashing with a modern algorithm, multi-factor authentication where offered, and detection of credential-stuffing and takeover attempts;
• least-privilege access for staff, granted by role, reviewed periodically, and revoked immediately on role change or departure;
• logging of staff access to member data, with the case that justified it;
• network segmentation between surfaces, so a compromise of one is not a compromise of all;
• separation of duties, code review and change control for anything touching member data;
• vulnerability management, dependency scanning, and periodic penetration testing;
• backup and tested restoration, with backups held under the same protections as production;
• vendor security assessment before engagement and periodically afterwards.

**Support staff see only what a case requires**, and internal notes are kept in a store separate from the customer-visible conversation, so that an internal comment cannot leak into a reply by accident.

**No system is perfectly secure.** Protect your side of it: use a password you use nowhere else, enable multi-factor authentication, be sceptical of anyone asking you to move a conversation off-platform or to send money, and sign out on shared devices. We will never ask you for your password.

If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours of becoming aware of it where the law requires, and we will notify you directly, without undue delay, where the breach is likely to result in a high risk to your rights and freedoms.

13. Children and minors

**The Dating surface is restricted to people aged 18 or over.** No exception, in any country.

Other surfaces require you to be at least 16, or the age of digital consent in your country, whichever is higher.

We do not knowingly collect personal data from anyone below the applicable minimum age. We use date of birth at registration, signals that suggest a stated age is false, and — where we have reason to doubt an account — verification, to enforce this.

If you believe an underage person is using the service, report it through https://support.theoneapi.org. Reports of this kind are prioritised. If we determine that an account belongs to someone below the minimum age, we close it and delete the data, retaining only what is necessary to prevent the account being recreated and to comply with any reporting obligation.

Where content involving the sexual exploitation of a minor is identified, we remove it, preserve the evidence, terminate the account and report it to the competent authorities, including the National Center for Missing & Exploited Children where applicable.

Our age-assurance practices are described at https://theoneapi.org/legal/age-assurance.

14. Data transparency

Most privacy policies describe what a company *may* do. This section describes what we actually publish, on what schedule, so that the description above can be checked rather than trusted.

14.1 What we publish, and when

Where a legal restriction prevents us from reporting a specific figure, we say that a restriction applies rather than omitting the line silently.

14.2 Algorithmic transparency

Every surface that ranks or recommends does so from stated inputs. This is the summary; the detailed notice is at https://theoneapi.org/legal/ranking.

**Promoted and paid placement is always labelled** as such, and paying for placement never changes the factual information shown about a listing.

**Private messages are never an input to ranking or recommendation.** They are processed only to deliver them and to run safety classifiers over them.

14.3 Where your data lives

Where a processor operates outside these regions, the transfer mechanisms in Part A §8 apply.

14.4 Advertising transparency

We do not run third-party advertising inside the service. Where we promote our own features, the promotion is labelled. Where we advertise the service on a third-party platform, we may provide that platform with a hashed identifier so that it can exclude you from a campaign or find an audience resembling our members — and nothing else. We do not provide your profile content, your messages or your activity for advertising purposes.

If we ever introduce third-party advertising, we will say so before it starts, describe the data involved, and provide the controls the law requires before the first ad is served.

14.5 Notice before a practice changes

A new purpose for data we already hold is a change in practice, not a housekeeping edit. Before we begin processing your existing data for a materially new purpose, we will notify you, explain the purpose and its legal basis, and — where the basis is consent — ask for it and not proceed without it.

14.6 Your own transparency

Inside the service you can see, without asking us:

• what data we hold about you, through the export in Part A §10.2;
• your consent history — what you agreed to, when, and what you withdrew;
• your purchase and credit ledger, entry by entry;
• your enforcement history: every action taken against your account, the rule relied on, and the outcome of any appeal;
• the sessions and devices currently signed in, with the ability to revoke any of them.

This is at https://theoneapi.org/settings/privacy/data.

14.7 Independent scrutiny

We support scrutiny we do not control. Where the law provides for it, we grant vetted researchers access to data necessary to study systemic risks, under terms that protect member privacy — details at https://theoneapi.org/legal/research-access. We commission independent audits where the law requires them, and publish the outcome. Our security disclosure programme at https://theoneapi.org/.well-known/security.txt authorises good-faith research and commits us not to pursue researchers who stay within it.

15. Changes to this policy

We will change this policy over time. When we do:

• the updated version is published here with a new effective date and version number;
• **for material changes we notify you before they take effect** — in the service, by email, or both — with at least 30 days' notice;
• where a change requires your consent, we ask for it, and processing under the new purpose does not begin until you give it;
• the previous version remains available at https://theoneapi.org/legal/archive, and a summary of what changed is in Part D §4.

Continuing to use the service after a change takes effect means you accept it, except where consent is required.

16. How to contact us

Region-specific postal addresses and representatives are in Part E.

0. Outline of these Terms

This is a map, not a summary that replaces what follows. Where this outline and the section text differ, the section text governs.

**The five things most likely to matter to you**, with the section that governs each:

1. **Subscriptions renew automatically until you cancel** — §10.2 and §10.3. Cancelling does not delete your account, and deleting your account does not cancel an app-store subscription.
2. **Credits are not money** — §11. They expire, and they are forfeited if we terminate your account for breach.
3. **If you are in the EEA or the UK you have 14 days to withdraw**, and starting to use what you bought waives it in part — §12.1.
4. **Every enforcement decision can be appealed to a person who did not make it** — §8.4.
5. **If you are in the United States, disputes go to individual arbitration unless you opt out within 30 days** — §24.3. Opting out costs nothing and changes nothing else.

1. The agreement between us

These Terms of Use are a binding contract between you and Matriarch Solutions Inc ("we", "us", "our"). They govern your access to and use of the service defined in Part A §2.

**By creating an account, or by using the service, you accept these Terms.** If you do not accept them, do not use the service. If you are accepting on behalf of an organisation, you represent that you have authority to bind it.

These Terms incorporate by reference: the Privacy Policy in Part A; the Community Guidelines summarised in Part F §3 and published in full at https://theoneapi.org/legal/guidelines; the Cookie and Tracking Technologies Policy in Part D; the Accessibility and Non-Discrimination commitment in Part C; and any supplementary terms presented at the point you use a particular feature. Where supplementary terms conflict with these, the supplementary terms govern for that feature only.

1.1 Changes to these Terms

We may change these Terms. For material changes we will give you at least 30 days' notice in the service, by email, or both, before they take effect. Non-material changes — correcting a typo, clarifying wording without altering meaning, or reflecting a new feature you are free not to use — may take effect on publication.

If you do not accept a change, stop using the service and cancel any subscription before the change takes effect. Continuing to use the service afterwards means you accept it. We will not apply a changed term retroactively to a dispute that arose before the change.

2. Definitions

The definitions in Part A §3 apply here too. In addition:

3. Eligibility

You may use the service only if all of the following are true.

1. **Age.** You are at least 18 to use Dating. You are at least 16, or the age of digital consent where you live if that is higher, to use anything else.
2. **Capacity.** You have the legal capacity to enter into a binding contract.
3. **Lawfulness.** You are not barred from using a service of this kind under the law of your country, and you are not on a sanctions list that would make providing the service to you unlawful.
4. **No prior ban.** You have not previously been terminated by us for breach, unless we have agreed in writing to reinstate you.
5. **Offences.** You are not required to register as a sex offender under any jurisdiction's law.

One person, one account, unless we agree otherwise in writing. An account is personal to you and is not transferable.

4. Registration, credentials and account security

You must provide accurate registration information and keep it current. An email address or phone number that no longer reaches you is how people lose access to their own account and their purchases.

You are responsible for your credentials and for everything done through your account. Do not share your password. Enable multi-factor authentication where we offer it. If you suspect unauthorised access, tell us immediately through https://support.theoneapi.org — the sooner you do, the more we can do.

We may require verification of an email address, a phone number, an identity or a photograph before granting access to a feature, and we may withhold that feature until it is complete. We may re-verify where an account's behaviour warrants it.

You must not sell, rent, lend or transfer your account, and you must not create an account by automated means or on behalf of someone else without their instruction.

5. Licence, and what the licence does not permit

Subject to these Terms, we grant you a limited, personal, non-exclusive, non-transferable, non-sublicensable, revocable licence to access and use the service for its intended purposes, on devices you control. We reserve every right not expressly granted.

You must not, and must not permit anyone else to:

• copy, modify, translate, adapt or create derivative works of the service or any part of it, except as applicable law expressly permits notwithstanding this restriction;
• reverse engineer, decompile or disassemble the service, or attempt to derive its source code, except to the limited extent applicable law permits and only after asking us first;
• remove, obscure or alter any proprietary notice;
• rent, lease, sell, sublicense or otherwise commercialise access to the service;
• use the service to build a competing product, or to train a machine-learning model on content obtained from it, without our written permission;
• access the service other than through the interfaces we provide, or use any robot, spider, scraper, crawler or other automated means to access it, except through our documented public API under its own terms;
• scrape, harvest, index or bulk-download profiles, listings, content or data, whether manually or automatically;
• circumvent, disable or interfere with security, rate limiting, entitlement checks, geographic restrictions or content protections;
• probe, scan or test the vulnerability of the service or any network, or breach or circumvent authentication;
• access accounts, systems or data you are not authorised to access;
• impose an unreasonable load on our infrastructure, or interfere with anyone else's use of the service;
• introduce malware, or any code intended to disrupt, damage or gain unauthorised access.

**Responsible security research** is welcome under our disclosure policy at https://theoneapi.org/.well-known/security.txt. Research conducted within that policy is authorised and is not a breach of this section. Research outside it is.

6. Acceptable use

The full rules are in the Community Guidelines at https://theoneapi.org/legal/guidelines. What follows is binding in its own right.

6.1 Conduct

You must not use the service to:

• **harm or endanger anyone** — harass, threaten, stalk, intimidate, bully, incite violence against, or promote self-harm to any person;
• **abuse children** — post, request, or facilitate access to sexual content involving a minor, or sexualise anyone under 18 in any form, real or generated. We report this to the authorities and terminate immediately and permanently;
• **share intimate imagery without consent**, or threaten to;
• **impersonate** any person or organisation, or misrepresent your identity, age, or affiliation;
• **defraud** anyone — romance fraud, investment or cryptocurrency solicitation, advance-fee schemes, phishing, or any attempt to obtain money or credentials by deception;
• **traffic or exploit** — engage in or facilitate human trafficking, sexual services for payment, or the exploitation of any person;
• **discriminate or incite hatred** on the basis of race, ethnicity, national origin, religion, disability, sex, gender identity, sexual orientation, age or any other protected characteristic;
• **infringe rights** — post content that infringes anyone's intellectual property, privacy, publicity or contractual rights;
• **spam or manipulate** — send unsolicited bulk messages, operate fake or bulk accounts, artificially inflate engagement, manipulate rankings, matches, listings or reviews, or coordinate inauthentic behaviour;
• **advertise or recruit** — use the service for commercial solicitation, multi-level marketing, political campaigning or recruitment, except on a surface that is expressly for that and in accordance with its rules;
• **break the law**, or facilitate anyone else in doing so;
• **evade enforcement** — create a new account after termination, or use another person's account to do what your own is restricted from doing.

6.2 Content standards

Content you post must not be unlawful, sexually explicit where the surface prohibits it, gratuitously violent, or designed to deceive. It must not contain another person's private information without their consent. It must not misrepresent a listing, an event, or what a buyer will receive.

6.3 Offline conduct

Conduct outside the service can breach these Terms where it relates to another member and creates a risk on the service — for example, harming a person you met here. We may act on credible reports of such conduct.

6.4 Reporting

Every surface has a reporting control, and you can report anything through https://support.theoneapi.org. We aim to acknowledge reports promptly and to tell the reporter the outcome. Deliberately false reports are themselves a breach.

7. Your content

7.1 Ownership

You keep ownership of the content you create and post. Nothing here transfers it.

7.2 The licence you grant us

You grant us a worldwide, non-exclusive, royalty-free, sublicensable and transferable licence to host, store, cache, reproduce, adapt, reformat, translate, transmit, publish and display your content **for the purpose of operating, securing, supporting, promoting and improving the service**.

Concretely, that licence is what permits us to: store your photo and show it to the people your settings allow; generate thumbnails and compressed versions; deliver your message to its recipient; run safety classifiers over it; back it up; and, where you have made content public, feature it in material promoting the service.

**The limits on that licence:**

• it lasts while you keep the content posted, plus the retention periods in Part A §9;
• deleting content ends the licence going forward, but not for copies retained under those periods, or copies another member lawfully received;
• it does not permit us to sell your content, or to license it to a third party for their own purposes;
• it does not permit us to use private messages for anything other than delivering them and running safety checks over them;
• sublicensing exists so our hosting and delivery providers can perform their function, not so that we can transfer your content to anyone we like.

7.3 Your warranties

You represent and warrant that you own or have the rights necessary to post your content and to grant this licence; that your content does not infringe anyone's rights; that any person appearing in your content has consented; and that your content complies with §6.

7.4 Feedback

If you send us ideas or suggestions, you grant us an unrestricted, perpetual, royalty-free right to use them without obligation to you. Do not send us anything you consider confidential.

8. Moderation, enforcement and appeals

8.1 What we may do

We may review, screen, refuse, remove, restrict, age-gate, label, demote or limit the reach of content, and we may restrict, suspend or terminate accounts, where content or conduct breaches these Terms, the Community Guidelines, or the law, or where it presents a risk to another person.

We are not obliged to monitor content generally, and the monitoring we do choose to perform does not make us responsible for anything we miss. Deciding not to act in one case is not a waiver of the right to act in another.

8.2 How decisions are made

Automated systems flag content and accounts. A person decides, or reviews an automated decision, before any permanent enforcement action. Where a risk requires immediate action — the categories in §6.1 concerning children, credible threats of violence, and active fraud — we may restrict first and review immediately afterwards.

8.3 Statement of reasons

If we take an enforcement action against you, we will tell you: what we did; the content or conduct it concerned; whether it was detected automatically, by a report, or by our own review; the specific rule or legal provision relied on; and how to appeal.

We may withhold or delay a statement of reasons where the law prohibits notice — for example where it would prejudice an ongoing criminal investigation — and we will provide it once the prohibition lifts.

8.4 Appeals

You may appeal any enforcement action through https://support.theoneapi.org within 6 months of being notified. Appeals are handled through our internal complaint-handling system, free of charge, and are **reviewed by a person who was not responsible for the original decision**.

We aim to decide appeals within 14 days. If we uphold your appeal, we reverse the action and, where a paid feature was affected, restore or extend the entitlement.

A reporter whose report we declined to act on may appeal on the same terms.

8.5 Out-of-court dispute settlement

Where the law provides for it, you may refer a moderation dispute to a certified out-of-court dispute settlement body after our internal appeal is exhausted. Their decision is not binding on either of us, and it does not affect your right to go to court. Details at https://theoneapi.org/legal/country-notices.

8.6 Repeat infringers and misuse of the system

We terminate the accounts of repeat infringers. We also restrict accounts that repeatedly file manifestly unfounded reports or appeals, after a warning.

8.7 Transparency

We publish periodic reports on enforcement volumes and outcomes at https://theoneapi.org/legal/transparency.

9. Safety, and the limits of what we can promise

**We do not conduct criminal background checks on members, and we do not screen every account.** Where a member has a verification badge, it means a specific check was passed — nothing more. A badge is not a warranty of anyone's identity, character, intentions or safety, and you must not treat it as one.

**You are responsible for your interactions with other people**, on the service and off it. Take precautions:

• meet in a public place the first several times, and tell someone where you are going and when you expect to be back;
• do not send money, gift cards or cryptocurrency to anyone you have met here, whatever the story, and however long it has taken to build;
• be sceptical of anyone who moves quickly to another messaging platform, who cannot video call, or whose circumstances conveniently prevent meeting;
• do not share your address, financial details, identity documents or passwords;
• report anything that concerns you — a report costs you nothing and protects people you will never meet.

Full guidance is at https://theoneapi.org/safety. Nothing in this section limits any liability that cannot lawfully be limited.

10. Subscriptions

10.1 What you are buying

A subscription is a recurring entitlement to a tier of features, at the price and for the term shown at checkout. The current catalogue is in Part F §2.

10.2 Automatic renewal

**Subscriptions renew automatically** at the end of each term, for a further term of the same length, at the then-current price, until cancelled. We charge your payment method at the start of each renewal term. Where the law requires it, we will remind you before a renewal, and where a term is longer than a month we will remind you regardless.

10.3 Cancelling

You can cancel at any time in Settings → Subscription, or through the billing portal. Cancellation takes effect **at the end of the current paid term** — you keep the benefits you have already paid for until then, and you are not charged again.

Two things that catch people out, so we say them twice:

• **Cancelling a subscription does not delete your account.** If you want the account gone, delete it separately.
• **Deleting your account does not cancel a subscription bought through an app store.** Cancel that in the store, or it keeps billing.

10.4 Price changes

We may change prices. We will give you at least 30 days' notice before a new price applies to a renewal, and you may cancel before it takes effect. If the law where you live requires your active consent to a price increase, we will ask for it, and absent consent the subscription ends rather than renews at the higher price.

10.5 Trials and promotions

A free or discounted trial converts to a paid subscription at the standard price when it ends, unless you cancel before then. We will tell you when it ends and what it will cost. Trials are one per person, not one per account, and we may refuse a trial to someone who has had one.

10.6 Taxes

Prices are shown inclusive or exclusive of tax as indicated at checkout, and the applicable rate is determined by your billing location. Where a rate changes, the new rate applies to the next renewal.

11. Credits and one-off purchases

Credits are a **limited licence to use a feature a set number of times**. They are not money, not a deposit, and not a stored-value instrument.

• Credits have **no cash value** and cannot be exchanged, transferred, sold or redeemed for cash.
• Credits are added to your balance when your payment settles, and are spent when you use the feature they unlock.
• Credits expire 12 months after purchase, or when your account is closed.
• Unused credits are forfeited when you close your account, or when we terminate it for breach.
• We record every grant, spend and refund as a separate ledger entry, so a disputed balance can be reconstructed exactly. You can see your ledger in Settings → Purchases.
• If we withdraw a feature that credits unlock, we will refund unspent credits for that feature at the price you paid.

Tickets and other one-off purchases are governed by the terms shown at the point of sale, including any organiser's terms for an event.

12. Refunds and the right of withdrawal

12.1 If you are a consumer in the EEA or the United Kingdom

You have **14 days** from the day the contract is concluded to withdraw from a purchase of digital content or a digital service, without giving any reason. The model withdrawal form is in Part F §1; you may also simply tell us at https://support.theoneapi.org in any clear terms.

**Where you ask us to begin performance immediately** — which is what happens when you start using a subscription or spend a credit — you expressly request that performance begin during the withdrawal period and you acknowledge that:

• for a **service**, you lose the right of withdrawal once it has been fully performed, and if you withdraw part-way you owe a proportionate amount for what you used;
• for **digital content supplied other than on a tangible medium**, you lose the right of withdrawal once supply has begun, having expressly consented and acknowledged that loss.

We will confirm both acknowledgements at checkout, and we will reimburse using the same payment method you used, within 14 days of being informed, subject to the proportionate deduction above.

12.2 Everywhere else

Purchases are final and non-refundable except where local law requires otherwise, or where we choose to grant a refund. We may grant one at our discretion, and doing so once does not oblige us to do so again.

12.3 Purchases through an app store

If you bought through a mobile app store, that store's refund policy applies and we cannot process the refund ourselves. Ask the store.

12.4 Refunds we initiate

If we terminate your account for reasons other than your breach, or we withdraw a paid feature you have already bought, we will refund the unused portion pro rata or provide an equivalent credit, at your choice.

12.5 Chargebacks

If you dispute a charge with your bank without contacting us first, we may suspend the account until the dispute resolves, because we cannot deliver a paid service against a reversed payment. Please contact us first — it is faster, and it usually works.

13. Payment terms

Payments are processed by Stripe under its own terms. You authorise us and our processor to charge your payment method for all amounts due, including renewals and applicable taxes.

You must keep a valid payment method on file for as long as you have an active subscription. If a charge fails, we may retry it over a reasonable period and may suspend paid features until it succeeds. Repeated failure ends the subscription.

You are responsible for any bank or card fees, currency conversion charges, and any tax that is your responsibility rather than ours.

14. Third-party services, links and platforms

The service links to and integrates with third parties: payment processors, app stores, identity providers, mapping and calendar services, and merchants and organisers on our surfaces. Their terms and privacy policies govern their services. We do not control them, we do not endorse them by linking to them, and we are not responsible for their content, availability or practices. Visiting a linked site is at your own risk.

Where you connect an external account, you authorise us to access what that provider shares under the permissions you approve. You can disconnect at any time; disconnecting does not retroactively delete what was already shared.

15. Promotions, contests and referrals

Promotions, contests, sweepstakes and referral programmes are governed by their own rules, published with the promotion. Where those rules conflict with these Terms, they govern for that promotion. We may cancel or amend a promotion where it is affected by fraud, technical failure, or any cause outside our reasonable control that compromises its integrity.

Referral rewards are void where the referral is self-referral, automated, or otherwise contrived, and we may reverse a reward paid on such a referral.

16. Intellectual property

The service, our software, interfaces, designs, trade marks, logos, text and databases are owned by us or our licensors and are protected by copyright, trade mark, database and other laws. Nothing in these Terms transfers any of it to you.

You may not use our name, marks or branding without written permission, except to refer to the service factually.

17. Copyright complaints

If you believe content on the service infringes your copyright, send a notice to our designated agent containing all of the following:

1. a physical or electronic signature of the copyright owner or a person authorised to act for them;
2. identification of the copyrighted work claimed to have been infringed;
3. identification of the material claimed to be infringing, with enough detail for us to locate it;
4. your contact details — address, telephone number and email;
5. a statement that you have a good-faith belief that the use is not authorised by the owner, its agent or the law;
6. a statement, **under penalty of perjury**, that the information in the notice is accurate and that you are the owner or authorised to act for them.

**Designated agent**

**Counter-notice.** If your content was removed and you believe it was removed in error or by misidentification, you may send a counter-notice containing: your signature; identification of the removed material and where it appeared; a statement under penalty of perjury that you have a good-faith belief it was removed by mistake or misidentification; your contact details; and your consent to the jurisdiction of the appropriate court. We will forward it to the complainant, and unless they file an action we may restore the material in 10 to 14 business days.

**Misrepresentation.** Knowingly misrepresenting that material is infringing, or that it was removed by mistake, carries liability for damages under applicable law.

**Repeat infringers.** We terminate, in appropriate circumstances, the accounts of members who repeatedly infringe.

18. Suspension and termination

18.1 By you

You may stop using the service at any time and delete your account in Settings → Account → Delete. Deletion is governed by Part A §9.

18.2 By us

We may suspend or terminate your access, with notice where it is feasible and lawful to give it, if:

• you breach these Terms, the Community Guidelines, or the law;
• your account presents a safety, security, fraud or legal risk;
• your payment fails repeatedly and the arrears are not cured;
• we are required to by law, or by a court or regulator;
• you have been dormant for two years, after notice; or
• we discontinue the service or the surface, on reasonable notice and with the refund in §12.4.

For the categories in §6.1 concerning children, credible threats of violence, and active fraud, we may act **immediately and without prior notice**.

18.3 Consequences

On termination: your licence ends; your profile stops being visible; unused credits are forfeited except where §12.4 applies; and you must not create a new account without our written agreement.

18.4 Survival

These provisions survive termination: §7.2 for copies lawfully retained, §7.3, §7.4, §16, §17, §19, §21, §22, §23, §24, §25, §27, and any payment obligation accrued before termination.

19. Availability, changes and beta features

The service is provided **on an "as is" and "as available" basis**. We do not warrant that it will be uninterrupted, timely, secure or error-free, or that defects will be corrected.

We may modify, suspend or discontinue any part of the service. Where we discontinue a paid feature you have already bought, §12.4 applies. Maintenance may make the service unavailable temporarily, and we will give notice of planned maintenance where practical.

Features marked beta, preview or experimental are provided without any warranty at all, may change or disappear without notice, and should not be relied on.

20. Content of other members

Content on the service is created by members, not by us. We do not endorse it and we do not verify it. You may encounter content you find inaccurate, offensive or objectionable. Your recourse is to block, to report, and to stop using the feature — and, where the content breaches our rules, our recourse is §8.

21. Disclaimers

To the fullest extent permitted by law, we disclaim all warranties, express or implied, including the implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from a course of dealing or usage of trade.

We do not warrant: that you will find a match, a buyer, an audience or a result of any kind; that any member is who they say they are; that any member's conduct will be lawful or safe; or that any content is accurate.

**Nothing in these Terms excludes or limits liability for:** death or personal injury caused by negligence; fraud or fraudulent misrepresentation; or anything else that cannot lawfully be excluded or limited. **If you are a consumer, your statutory rights are unaffected by anything in this document.**

22. Limitation of liability

To the extent permitted by law:

**(a)** we are not liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for loss of profits, revenue, data, goodwill, opportunity or anticipated savings, however caused and on any theory of liability;

**(b)** we are not liable for the conduct of any member, on or off the service, or for any content a member creates;

**(c)** our total aggregate liability for all claims arising in any 12-month period is limited to the greater of the amount you paid us in the 12 months before the event giving rise to the claim, and EUR 100.

**If you are a consumer in the EEA or the United Kingdom**, the following applies instead of (a) and (c) to the extent it is more protective: we are liable without limitation for intent and gross negligence, for death or personal injury, and under any applicable product liability law; for slight negligence we are liable only for breach of an essential contractual obligation — an obligation whose fulfilment makes performance possible and on which you may reasonably rely — and that liability is limited to the foreseeable damage typical for this kind of contract.

Some jurisdictions do not allow certain exclusions or limitations, so parts of this section may not apply to you.

23. Indemnification

You will indemnify and hold us harmless against third-party claims, liabilities, losses and reasonable legal costs arising from: your breach of these Terms; your content; your infringement of a third party's rights; your interactions with other members; or your breach of law. This does not apply to the extent the claim arises from our own act or omission, and it does not apply to consumers where local law prohibits it.

We may assume the exclusive defence of any matter subject to indemnification, at your expense, and you will cooperate with it.

24. Resolving disputes

24.1 Talk to us first

Before starting formal proceedings, contact legal@theoneapi.org with a description of the dispute and the resolution you want. Most disputes end here, faster and more cheaply than they would elsewhere. We will respond within 30 days.

24.2 If you are a consumer in the EEA, the UK or Switzerland

You may bring proceedings in the courts of your country of residence, and mandatory consumer-protection law there applies regardless of the governing law in §25.

The European Commission's online dispute resolution platform is at `https://ec.europa.eu/consumers/odr`. We are not willing to participate in dispute resolution proceedings before a consumer arbitration board; our position on this is stated here so that you do not have to ask.

24.3 If you are in the United States

**Please read this section carefully; it affects how disputes are resolved.**

Except for the carve-outs below, you and we agree that any dispute arising out of or relating to these Terms or the service will be resolved by **binding individual arbitration** administered by not applicable - we do not require arbitration under its consumer rules, and **not** in court, and **not** as a class, collective or representative action. The Federal Arbitration Act governs the interpretation and enforcement of this section.

**Carve-outs.** Either party may bring an individual claim in small-claims court, and either party may seek injunctive relief in court to protect intellectual property or to stop unauthorised access.

**Opt out.** You may opt out of arbitration by writing to legal@theoneapi.org with the subject "Arbitration Opt-Out", within 30 days of first accepting these Terms. Opting out affects nothing else in this agreement, and we will not treat it as a reason to change how we deal with you.

**Costs and venue.** Where the applicable rules require us to pay filing and arbitration fees for consumer claims, we will. Arbitration will take place in the county where you live, or remotely, at your election.

**Severability.** If the class-action waiver is held unenforceable as to a particular claim, that claim proceeds in court and the rest of this section continues to apply to the others.

24.4 Time limit

To the extent permitted by law, any claim must be brought within one year of the event giving rise to it. This does not apply where local law provides a longer mandatory period, and it does not apply to consumers where local law prohibits it.

25. Governing law and venue

These Terms are governed by the law of the State of Georgia, United States, without regard to its conflict-of-laws rules and excluding the United Nations Convention on Contracts for the International Sale of Goods.

**If you are a consumer**, this choice does not deprive you of the protection of the mandatory provisions of the law of your country of residence.

**If you are not a consumer**, the courts of Cobb County, Georgia have exclusive jurisdiction, and you consent to that jurisdiction and venue.

26. Notices and electronic communications

You consent to receive communications from us electronically — in the service, by email to your registered address, or by push notification — and you agree that electronic communications satisfy any legal requirement that a communication be in writing.

A notice from us is effective when sent to your registered address or displayed in the service. A notice to us must go to legal@theoneapi.org and, where these Terms require it, also by post to Matriarch Solutions Inc, 8735 Dunwoody Place #4412, Atlanta, GA 30350, United States.

Keep your contact details current. A notice sent to an address you have abandoned is still a notice.

27. General

**Entire agreement.** These Terms, together with the documents they incorporate, are the entire agreement between us on this subject and supersede any prior understanding.

**Severability.** If a provision is held unenforceable, it is modified to the minimum extent necessary to make it enforceable, or severed, and the rest continues in force.

**No waiver.** Our failure to enforce a provision is not a waiver of it, and a waiver in one instance is not a waiver in another.

**Assignment.** You may not assign these Terms or any right under them. We may assign them to an affiliate or to a successor in connection with a merger, acquisition or sale of assets, on notice to you.

**No third-party beneficiaries.** Except as stated in §28, these Terms create no rights for anyone who is not a party.

**Force majeure.** Neither party is liable for a failure to perform caused by an event beyond its reasonable control, for as long as the event continues.

**Relationship.** Nothing here creates a partnership, agency, joint venture or employment relationship.

**Language.** These Terms may be translated. Where there is a conflict, the English version governs, except where local law requires otherwise.

**Headings.** Headings are for convenience and do not affect interpretation.

**Export and sanctions.** You represent that you are not located in, and not a national or resident of, a country subject to an embargo that would make providing the service to you unlawful, and that you are not on any restricted-party list.

28. Platform-specific terms

28.1 Apple

If you obtained the application from the Apple App Store, the following applies and, in case of conflict with the rest of these Terms, governs for that application:

• These Terms are between you and us only, not with Apple. **Apple is not responsible for the application or its content.**
• The licence in §5 is limited to use on Apple-branded devices you own or control, as permitted by the App Store Terms of Service.
• Apple has no obligation to provide maintenance or support.
• If the application fails to conform to any applicable warranty, you may notify Apple, and Apple will refund the purchase price. To the maximum extent permitted by law, Apple has no other warranty obligation.
• Apple is not responsible for addressing any claim relating to the application, including product liability, failure to conform to a legal requirement, or consumer protection claims.
• Apple is not responsible for a third-party claim that the application infringes intellectual property rights.
• You represent that you are not in an embargoed country and not on a US restricted-party list.
• **Apple and its subsidiaries are third-party beneficiaries of these Terms** and may enforce them against you.

28.2 Google

If you obtained the application from Google Play, your use is also subject to the Google Play Terms of Service, and refunds for purchases made there are handled under Google's policies.

29. Contact

This Part is binding on us. It states what we commit to, how to hold us to it, and what happens when we fall short.

1. Accessibility

1.1 Our commitment

We build the service to be usable by everyone, including people who use screen readers, magnification, voice control, switch devices, captions, or who navigate without a mouse.

We target conformance with **WCAG 2.2 Level AA** across the web platform and our mobile applications. Where a jurisdiction imposes a specific obligation — the European Accessibility Act and EN 301 549 in the EU, the Americans with Disabilities Act and, where applicable, Section 508 in the United States, and equivalent provisions elsewhere — we treat that obligation as a floor rather than a ceiling.

Accessibility is not a separate workstream that runs behind the product. A new feature is not considered finished until it has been checked against the criteria below.

1.2 What that means in practice

1.3 Assistive technology we test against

1.4 Known limitations

Claiming full conformance without exception would be a claim we could not support. Current known gaps are listed, with the target date for each, at https://theoneapi.org/accessibility. Two categories are structural and we state them here:

• **Member-generated content.** We cannot guarantee that another member has written alternative text for their photo or captioned their video. We prompt for it, we generate a description automatically where we can, and we let you report content that is inaccessible.
• **Third-party components.** Where a payment or verification step is rendered by a third party, its accessibility is theirs. We assess it before engaging them, we raise defects with them, and where a component cannot be made accessible we provide an alternative route through Support.

1.5 Alternative access

If any part of the service is not usable for you, we will provide the same outcome another way. Contact accessibility@theoneapi.org or https://support.theoneapi.org and we will complete the task with you directly — including account setup, purchases, cancellations, privacy requests and appeals. Using this route costs nothing extra and does not disadvantage you in any way.

1.6 Telling us about a barrier

Write to accessibility@theoneapi.org with what you were trying to do, what got in the way, and the assistive technology you were using if you know it. We acknowledge within 5 business days, tell you whether we can fix it and when, and give you a workaround in the meantime.

You can escalate to the enforcement body in your jurisdiction. Where the European Accessibility Act applies, that is the market surveillance authority in your member state; in the United States it may be the Department of Justice or your state's civil rights agency. We would rather fix it than be reported, but the route exists and we are not going to hide it.

1.7 Conformance documentation

An accessibility conformance report is available at https://theoneapi.org/accessibility/conformance-report, and on request from accessibility@theoneapi.org in an accessible format. This document itself is published in HTML that meets the same standard, and we will provide it in large print, plain text or another accessible format on request at no charge.

2. Non-discrimination

2.1 Equal access to the service

We do not deny access to the service, restrict features, degrade quality, or charge a different price on the basis of race, colour, ethnicity, national origin, ancestry, immigration status, religion or belief, sex, pregnancy, gender identity or expression, sexual orientation, marital or family status, age, disability, genetic information, veteran status, or any other characteristic protected by applicable law.

This applies to every decision we make about you: onboarding, verification, ranking, moderation, pricing, support, and enforcement.

2.2 What we require of members

Members must not discriminate against other members on any of the grounds above. Harassment or exclusion on the basis of a protected characteristic breaches Part B §6.1 and is enforced under Part B §8.

**A distinction worth drawing plainly.** Stating who you are looking for is a preference. Telling someone what they are, or that they do not belong, is harassment. A profile that says which genders you want to be shown is the first; a message attacking someone's ethnicity or disability is the second. We enforce against the second and never against the first.

2.3 Non-discrimination for exercising a privacy right

We will not, because you exercised a right under Part A §10:

• deny you goods or services;
• charge you a different price or rate, including by using a discount or penalty;
• provide you a different level or quality of service;
• suggest that you will receive any of the above; or
• retaliate in any other way, including through moderation or support treatment.

**Financial incentives.** We do not offer financial incentives, loyalty benefits or price differences in exchange for personal data. If we ever do, we will publish the material terms, the value of the data to us and how we calculated it, obtain your opt-in consent, and let you withdraw at any time — before the programme starts.

2.4 Pricing

Prices differ between countries because tax, purchasing power, payment costs and local law differ. Prices do **not** differ between individuals on the basis of profiling: we do not raise your price because your behaviour suggests you would pay more, and we do not raise it because you exercised a privacy right, use assistive technology, or belong to any group.

Promotional pricing is offered on stated, objective criteria — a launch, a first purchase, a bundle, a region — and the criteria are disclosed with the offer.

2.5 Fairness of automated systems

Our ranking, matching and safety systems do not take protected characteristics as inputs, and we test for the case where a permitted input acts as a proxy for one.

2.6 Listings, promotions and regulated categories

Where a surface carries listings that touch housing, employment, credit, insurance or education, neither we nor a member may target or exclude an audience on the basis of a protected characteristic, and listing content must not state a discriminatory preference. This applies whether or not the local law would treat the listing as regulated. We remove listings that breach it and we restrict repeat offenders.

2.7 Accommodations

If a disability affects your ability to meet a requirement of the service — completing a verification, meeting a deadline in an appeal, using a specific input method — tell us at accessibility@theoneapi.org and we will provide a reasonable accommodation. Requesting one is never held against you, and the fact of a request is treated as sensitive data under Part A and is not visible to other members.

Where enforcement is affected — for example where a rule was breached in a way connected to a disability or to a language barrier — the reviewer under Part B §8.4 is instructed to take that into account.

2.8 Reporting discrimination

Report discriminatory conduct by another member through the in-product report control, choosing the discrimination or hate category. Report discriminatory treatment **by us** to fairness@theoneapi.org. We acknowledge within 5 business days, investigate independently of the team whose decision is complained about, and tell you the outcome and what we changed.

Nothing in this section limits your right to complain to a regulator or a court, and we will not treat a complaint as a breach of these Terms.

2.9 Governance

Staff who make moderation, support and pricing decisions are trained on this Part on joining and periodically afterwards. Complaints under §2.8 are logged, reviewed in aggregate, and reported to management on the same cadence as our transparency reporting. Records are retained for 3 years.

This Part explains the technologies we use to store and read information on your device, why we use them, and how you control them. It forms part of the Privacy Policy in Part A and uses the same definitions.

1. What these technologies are

**On fingerprinting.** We do not build a device fingerprint to identify or track you across sites for advertising. We do compute device and network signals for **security purposes only** — detecting account takeover, automated abuse and ban evasion — and those signals are not used for advertising, personalisation or measurement, and are not shared with advertisers.

2. Consent

Where the law requires consent, we ask before setting anything that is not strictly necessary. Specifically:

• consent is requested through our consent banner and preference centre on your first visit, and is **granular** — you can accept some categories and refuse others;
• refusing is as easy as accepting. There is no pre-ticked box, no dark pattern, and no button that is harder to find because it says no;
• **we do not operate a cookie wall.** Declining non-essential cookies does not reduce your access to the service or change its price;
• you can change or withdraw your choice at any time at https://theoneapi.org/settings/privacy, and withdrawal is as easy as consent was;
• we re-ask when our purposes change materially, and in any case no more often than every 12 months;
• we record what you consented to and when, and retain that record for 5 years as evidence of compliance.

Strictly necessary technologies do not require consent, because the service cannot function without them. We do not classify anything as strictly necessary merely because it is convenient for us.

3. Categories

4. Inventory

The full inventory, kept current with names, providers, purposes and durations, is published at https://theoneapi.org/legal/cookies/inventory. The representative entries below show the shape of it.

Durations are maximums. A cookie is deleted earlier when it is no longer needed, and clearing your browser deletes them all immediately.

5. Third parties

Where a third party sets a cookie or receives data through an SDK, it processes that data under our instructions as a processor, except where it is named as an independent controller in Part A §6. The current list of third parties that can set or read a cookie on our web platform, and the SDKs present in our mobile applications, is published in the inventory at https://theoneapi.org/legal/cookies/inventory and updated when it changes.

Embedded third-party content — a map, a video, a payment form — may set its own cookies when it loads. Where consent is required, we do not load that content until you have given it.

6. Mobile applications

Our mobile applications do not use browser cookies. They use local storage, operating-system identifiers, and SDKs.

• **On iOS**, we request App Tracking Transparency permission before any identifier could be used for tracking across apps or websites. If you decline, the identifier is unavailable to us and nothing else about the app changes. We currently do not track across apps, so this prompt is shown only where a feature would require it.
• **On Android**, you can reset or delete the advertising identifier and opt out of personalised advertising in your device settings, and we honour that setting.
• **Push tokens** are stored to deliver notifications you have asked for, and are deleted when you turn notifications off or delete the account.

7. How to control these technologies

Blocking strictly necessary cookies in your browser will prevent you from signing in. That is a consequence of how sessions work, not a penalty.

8. Global Privacy Control and Do Not Track

We honour the **Global Privacy Control** signal. Where your browser or extension sends it, we treat it as an opt-out of any sale, sharing or targeted advertising — none of which we currently do — and, where your law requires, as an objection to non-essential processing.

The older **Do Not Track** header has no agreed meaning and no consistent implementation, so we do not treat it as a valid opt-out. We say so because the law requires us to disclose our position rather than leave you guessing. Use the consent tool or GPC instead; both work.

9. Changes

We update this Part when we add, remove or change a technology. Material changes are notified as described in Part A §15, and a new consent is requested where the change requires one.

These supplements apply in addition to Parts A and B for residents of the jurisdictions named. Where a supplement conflicts with Part A, the supplement governs for those residents.

1. California privacy notice

This notice is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act, and its implementing regulations. It applies to California residents and supplements Part A. Terms defined in the CCPA — *personal information*, *sensitive personal information*, *sell*, *share*, *service provider*, *contractor*, *third party*, *business purpose* — carry their statutory meaning here.

1.1 Notice at collection

At or before the point we collect personal information, we must tell you the categories collected, the purposes, whether it is sold or shared, and how long we keep it. The table below is that notice.

We collected each of these categories in the preceding 12 months.

1.2 Sources

We collect personal information from: you directly, when you register, build a profile, post content, buy something or contact us; automatically, from your use of the service and the device you use; from other members, when they report or interact with you; and from the third-party categories listed in Part A §4.3 — payment and tax providers, authentication providers, app stores, infrastructure and security providers, communications providers, publicly available and licensed sources, and business partners.

1.3 Business and commercial purposes

We use personal information for the purposes in Part A §5, which correspond to the following statutory business purposes: performing services you request; providing customer service; verifying and maintaining the quality of our service; security and integrity, including detecting and prosecuting security incidents and protecting against fraudulent, malicious, deceptive or illegal activity; debugging and repairing errors; short-term transient use; internal research for technological development and demonstration; advertising and marketing our own service; and complying with law.

We do not use personal information for purposes that are incompatible with the purpose it was collected for, and we do not collect additional categories, or use it for additional purposes, without first providing notice.

1.4 Disclosures for a business purpose

In the preceding 12 months we disclosed each of the categories in §1.1 for a business purpose, to the following categories of recipient: service providers and contractors; other members, where the service is designed to display it; our affiliates; professional advisers; an entity involved in a corporate transaction; and law enforcement, courts and regulators where legally required.

Service providers and contractors are bound by written contracts that prohibit retaining, using or disclosing the information for any purpose other than performing the service, prohibit selling or sharing it, prohibit combining it with information from other sources except as permitted, and require them to notify us if they can no longer meet their obligations.

1.5 Sale and sharing

**We do not sell personal information. We do not share personal information for cross-context behavioural advertising.** We did neither in the preceding 12 months. We do not have actual knowledge of selling or sharing the personal information of any consumer under 16 years of age, and we would not do so without the opt-in the statute requires.

Because there is no sale and no sharing, there is nothing for a "Do Not Sell or Share My Personal Information" link to switch off. We nonetheless honour the Global Privacy Control signal, and we will publish an opt-out mechanism before any change to this position takes effect — not after.

1.6 Limits on our use of sensitive personal information

We use and disclose sensitive personal information only for the purposes permitted by §7027(m) of the CCPA regulations: performing the services you requested; preventing, detecting and investigating security incidents; resisting malicious, deceptive, fraudulent or illegal actions; ensuring the physical safety of individuals; short-term transient use; performing services on our behalf; and verifying or maintaining quality.

**We do not use sensitive personal information to infer characteristics about you.** Because our use is limited to the permitted purposes, the statutory right to limit its use does not restrict us further — but you may exercise it at privacy@theoneapi.org and we will confirm the limitation in writing.

1.7 Retention

We do not retain any category of personal information for longer than reasonably necessary for the purpose disclosed. The retention column in §1.1, read with the full schedule in Part A §9, states the criteria: the life of the account, plus the specific legal, safety and dispute periods set out there.

1.8 Your California rights

**How to submit a request.** Two methods, both free:

1. In the service: Settings → Privacy → Download, correct or delete your data.
2. By email to privacy@theoneapi.org, or by post to Matriarch Solutions Inc, 8735 Dunwoody Place #4412, Atlanta, GA 30350, United States.

**Verification.** We verify a request to a reasonable degree of certainty before acting on it, in proportion to its sensitivity. For a request for specific pieces of personal information or for deletion, we apply a *reasonably high* degree of certainty: being signed in to the account, plus confirmation from the registered email or telephone number, and where the account has little history we may ask you to match additional data points we already hold. We do not ask for a government identity document unless nothing else will verify the request, and we delete anything you send for verification once the request is closed.

**Response times.** We confirm receipt within 10 business days and respond substantively within 45 calendar days. Where reasonably necessary we may extend by a further 45 days and will tell you within the first period, with the reason. A right-to-know response covers the 12 months preceding the request, and, where you ask and it is not impossible or disproportionately difficult, a longer period.

**Authorised agents.** An agent may submit a request with written permission signed by you, and we may require you to verify your own identity directly and to confirm the authorisation. An agent registered with the California Secretary of State may submit an opt-out request with valid proof of authority.

**Appeals.** If we deny a request in whole or in part, we will explain why and identify any statutory exception relied on. Write to privacy-appeals@theoneapi.org with the subject "Privacy Request Appeal" to have the decision reviewed by someone who was not involved in it. You may also complain to the California Privacy Protection Agency or the California Attorney General.

1.9 Non-discrimination and financial incentives

We do not deny goods or services, charge different prices, provide a different level or quality of service, or suggest that we will do any of those things, because you exercised a CCPA right. We do not currently offer any financial incentive or price difference in exchange for personal information. If we introduce one, we will publish the material terms, a good-faith estimate of the value of the data and the method used to calculate it, obtain opt-in consent, and allow withdrawal at any time.

1.10 Shine the Light

Under California Civil Code §1798.83, California residents may request information about disclosure of personal information to third parties for their **direct marketing purposes**. We do not make such disclosures. You may confirm that in writing at privacy@theoneapi.org, and we will respond within 30 days.

1.11 Minors

Under California Business and Professions Code §22581, a California resident under 18 who is a registered user may request removal of content they have posted. Requests go to privacy@theoneapi.org. Removal makes the content invisible on the service; it may not remove copies stored for legal compliance, copies another member lawfully received, or copies elsewhere on the internet.

Note that the Dating surface is restricted to people 18 and over in all circumstances.

1.12 Metrics

Where we meet the threshold that requires it, we publish annual metrics on requests received, complied with in whole or in part, denied, and median response time, at https://theoneapi.org/legal/ccpa-metrics.

1.13 Accessibility of this notice

This notice is published in a format that meets the accessibility standard in Part C §1.1. If you need it in an alternative format — large print, plain text, or read to you — contact accessibility@theoneapi.org and we will provide it at no charge.

2. Other US state privacy laws

This section applies to residents of states with comprehensive privacy laws in force, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Tennessee, Maryland, Rhode Island, Kentucky and Indiana.

• **We do not sell personal data** and **we do not process it for targeted advertising** as those terms are defined in these laws. We do not use it for profiling in furtherance of decisions producing legal or similarly significant effects, except as described in Part A §5.8, where a human decides or reviews.
• **Rights.** Confirmation and access; correction; deletion; a portable copy; opt-out of sale, targeted advertising and certain profiling; and, where the state provides it, the right to limit sensitive data.
• **Consent for sensitive data.** Where your state requires opt-in consent for sensitive data, we obtain it before processing, and you can withdraw it at any time.
• **Universal opt-out.** We honour the Global Privacy Control and equivalent browser signals.
• **Appeals.** If we refuse a request, appeal to privacy-appeals@theoneapi.org with the subject "Privacy Request Appeal", stating the state you are writing from. We will respond within the period your state's law provides. If you are dissatisfied with the outcome, you may complain to your state Attorney General.
• **Data protection assessments.** We conduct and document assessments for processing that presents a heightened risk of harm, as those laws require.

3. Consumer health data — Washington and Nevada

This section applies to Washington residents under the My Health My Data Act and to Nevada residents under SB 370.

We do not operate a health service and we do not seek health information. We may nonetheless hold data that these laws treat as consumer health data — for example, a health or disability detail you choose to put on a profile, or health information you mention in a support ticket.

• We collect it only where you provide it, and only with your **consent**, given separately from these Terms.
• We use it only to provide the feature you provided it for, and for safety and legal compliance.
• **We do not sell consumer health data.** No valid authorisation for a sale will be sought because no sale occurs.
• We do not use geofencing around any facility providing health services to collect data, deliver advertising, or track anyone.
• You may withdraw consent, request access, and request deletion at privacy@theoneapi.org. On a deletion request we notify our processors to delete it as well.
• Employees and contractors have access only where necessary to the purpose.

4. EEA, United Kingdom and Switzerland

The legal bases in Part A §5 and the rights in Part A §10 are stated in GDPR terms and apply directly.

**Automated decision-making.** Article 22 rights are described in Part A §5.8 and the appeal route is Part B §8.4.

**Objection.** You may object at any time to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise or defence of legal claims. An objection to direct marketing is honoured absolutely.

5. Brazil

For residents of Brazil, processing is governed by the LGPD. The legal bases in Part A §5 map to the corresponding bases in Art. 7 and, for sensitive data, Art. 11.

Your rights include confirmation of processing, access, correction, anonymisation or deletion of unnecessary or excessive data, portability, information about sharing, information about the consequences of refusing consent, and withdrawal of consent.

You may also complain to the Autoridade Nacional de Proteção de Dados.

6. Canada

For residents of Canada, processing is governed by PIPEDA and applicable provincial legislation, including Quebec's Law 25.

We obtain consent appropriate to the sensitivity of the data — express consent for sensitive data, and implied consent where the purpose is obvious and the data is not sensitive. You may withdraw consent subject to legal and contractual restrictions, on reasonable notice.

You have the right to access your personal information and to challenge its accuracy. Where Quebec law applies, you also have rights to portability and to be informed about automated decisions, and you may ask for the reasons and the principal factors behind such a decision.

Complaints may be made to us at privacy@theoneapi.org, to the Office of the Privacy Commissioner of Canada, or to the Commission d'accès à l'information du Québec.

7. Japan

For residents of Japan, processing is governed by the Act on the Protection of Personal Information.

We identify the purpose of use as set out in Part A §5, and we do not use personal information beyond it without consent. Third-party provision is limited to the recipients in Part A §6. Where personal information is transferred outside Japan, we provide information about the destination country and the recipient's protection measures on request. You may request disclosure, correction, suspension of use, or deletion.

8. Biometric data notice

This section applies wherever biometric law imposes specific obligations, including Illinois (BIPA), Texas (CUBI) and Washington.

• Biometric data — face geometry — is derived **only** when you voluntarily start a verification that requires it.
• **Purpose:** to confirm that the person in the selfie is the person in the profile or the identity document, and for no other purpose.
• **Consent:** taken separately, in writing, before collection, with this notice presented at that point.
• **No sale.** We do not sell, lease, trade or otherwise profit from biometric data.
• **Disclosure:** only to the verification provider performing the check, as our processor, under a contract that forbids any other use and requires deletion on the same schedule.
• **Retention:** deleted immediately on completion of the check and in no case later than 30 days, or sooner if you withdraw consent. The *result* — verified or not — is retained with your account.
• **Storage:** encrypted at rest, with access restricted to the systems performing the check.

9. Additional country notices

Where local law requires a specific disclosure not covered above — for example a local representative, a registration number, or a specific retention rule — it is published at https://theoneapi.org/legal/country-notices and forms part of this policy for residents of that country.

1. Model withdrawal form

*(Complete and return this form only if you wish to withdraw from the contract. You may also tell us in any other clear statement.)*

The form is also available at https://theoneapi.org/legal/withdrawal.

2. Catalogue of paid products

The current catalogue, with prices in your local currency and tax treatment, is shown at checkout and at https://theoneapi.org/pricing. Prices there govern; this appendix describes the shape of each product, not its price.

3. Community Guidelines — summary

The full text is at https://theoneapi.org/legal/guidelines and governs. This is a summary for orientation.

• **Be real.** One account, your own photos, your actual age, no impersonation.
• **Be safe.** No threats, harassment, stalking or incitement. No promotion of self-harm.
• **Protect children.** Nothing sexualising anyone under 18, in any form. This is reported and terminated without exception.
• **Consent matters.** No intimate imagery of anyone who has not agreed to it being shared.
• **No exploitation.** No trafficking, no sexual services for payment, no coercion.
• **No fraud.** No romance fraud, no investment or crypto solicitation, no phishing.
• **No hate.** No attacks based on a protected characteristic.
• **No spam.** No bulk accounts, no engagement manipulation, no unsolicited commercial messaging.
• **Respect the rules of the surface.** What is welcome on Billboard is not necessarily welcome on Dating.
• **Report rather than retaliate.** Reporting is free, fast, and it protects people you will never meet.

4. Version history

Superseded versions are archived at https://theoneapi.org/legal/archive. A version remains available for as long as any user's acceptance is recorded against it.

5. Document control

Acceptance is recorded against the checksum in the generated metadata, not against the version string. When the text changes, the checksum changes, and members are re-prompted.