Privacy Policy
This notice describes information used by the currently published service, its visibility and the controls actually available. It distinguishes implemented behaviour from legal details awaiting confirmation.
Sign-in and account records
Clerk handles sign-in, including the email or external identity provider you choose, session information and the browser and network information needed for authentication. Eternal Pilgrim stores linked account identifiers, account creation and activity times and access state, with limited security records to enforce account deletion and prevent abuse.
Invitation attribution uses verified account and email information. Limited hashed identifiers and reward records help prevent duplicate participation and may survive account deletion. Hashing does not guarantee anonymity.
Profiles, photos and travel
Profile information can include your name, photograph, biography, languages, approximate area, availability and the offers or requests you choose to publish. Travel information can include cities, countries, dates and visibility choices. Avoid entering unnecessary sensitive information.
Eligible signed-in members can view shared profiles, travel information and references, subject to access and blocking checks. Private travel information is excluded from other members’ views. Locations are approximate, but dates, place names and free text can still reveal patterns. Approximate location is not anonymity.
Photos are processed before storage in Cloudflare R2 and the upload validator rejects embedded EXIF/XMP metadata. Active photos require authenticated account access. Pausing does not remove the stored image or recall copies held by other members. Downloaded copies cannot be recalled. Older external image URLs can send requests to their image host.
Contacts and previous Opens
Contact fields can contain phone or WhatsApp numbers, email addresses, or Telegram, Instagram, Facebook and WeChat details. They are stored separately from discovery profiles. After Open, the two participants can retrieve contacts each has currently marked to share. There is no separate approval for each earlier connection when you change that setting.
Contacts are read from current settings, not frozen at Open. Enabling or updating a shared contact can therefore expose it through an older Open link to a previous participant. Pausing does not close those Opens. Disabling sharing or removing the contact stops it being returned in subsequent contact requests, but does not erase copies or external messages. Blocking makes the Open inaccessible through the app while the block applies.
A connection may retain a snapshot of the participants’ profiles and its context. Editing a profile does not necessarily rewrite that snapshot. Avoid sensitive information in profile text, photographs, invitation notes or references.
Interactions, references and safety records
Interaction records include participants, invitation content, dates, status and connection context. Participants can see their own interactions. References contain the author, subject, experience, text and publication information. References are member-written accounts, not platform findings.
Reports store reporter and reported account identifiers, category, details, state and time. Blocks store the two accounts and time. Authorised administrators can view report details, involved profiles and related Knock/Open context, including notes. Reports are not displayed as public references. Do not assume the operator cannot identify a reporter.
Notifications, meeting confirmations and activity records support the community functions. Conversations through external services are processed by those services and are not an Eternal Pilgrim chat history.
Optional device-location verification
If both participants accept an optional in-person verification, your browser asks permission to send precise latitude, longitude, accuracy and time. These samples are compared to check device proximity during a limited request window. Participation is optional. This does not establish identity or safety.
Precise location samples are held temporarily in the verifier’s memory, not written to the application database or logged. They are cleared after comparison or expiry. The database retains the request and result. The other participant receives the result, not your raw coordinates.
Invitations, membership and partners
Invitation attribution records participation and qualifying outcomes. The inviter sees aggregate results. Limited duplicate-prevention and reward records may survive deletion, and deletion does not automatically reverse earlier outcomes.
Optional membership and community support records include status, applications, referral attribution and display preferences. Authorised administrators review applications. Relevant account holders can view their own program records and statistics.
Payment collection is currently disabled. If an authorised test flow is used, Stripe handles hosted payment and onboarding inputs; the app retains transaction and status records needed to operate and reconcile that flow. This notice does not assert that real payments are active.
Metrics and providers
First-party product metrics record account-linked activity types and times. They exclude contact values, report text and external conversation content. Administrators view aggregate metrics. Account-linked events are not anonymous simply because dashboards show totals.
Cloudflare delivers the site through Workers, stores application records in D1 and photos in R2, and supplies the location verifier and network security. The public site also loads Cloudflare Web Analytics for page/performance metrics. Requests expose information such as IP address and browser headers to the receiving service; provider operational logs and retention are separate from our database.
Clerk supplies authentication. City searches send search text and normal request information directly to Open-Meteo geocoding. The current public map configuration disables external tile loading. When configured, MapTiler or the OpenFreeMap fallback can receive tile requests and browser/network information. External sign-in, contact and advertised destinations handle visits under their own notices.
The public document identifies the AdSense publisher account without automatically loading Google advertising scripts. Locally hosted promotional images do not themselves require a request to the advertiser; clicking an advertised link visits that site. Non-essential advertising remains subject to appropriate consent controls.
Editing, pausing and deletion
Use profile and travel controls to update information and contact sharing. Settings supports pause, block management and account deletion. Pause hides discovery and stops new Knocks; it retains data and access to existing Opens.
Deletion removes the application account and linked profile, contacts, travel, Knocks/Opens, references, reports, blocks, notifications and account-linked product events through database deletion rules. Photo removal is attempted and failed storage cleanup is queued for retry. Observed sign-in sessions are revoked, then the interface attempts to delete your Clerk user. Clerk removal can fail independently; the interface attempts sign-out and provides a retry screen when it remains accessible. A fresh Clerk session may create a new account without restoring deleted data.
Minimal hashed deletion/session records and invitation duplicate-prevention records remain. Administrative audits can remain with deleted account links cleared. Membership and partner history can retain customer/program identifiers, partner application text, audit actor identifiers and financial records even when the account link is cleared. Clearing a link is not full anonymisation. Cancellation of an existing subscription must be confirmed before application deletion proceeds. Provider-held records, backups, operational logs and copies held by other members are not covered by an absolute deletion guarantee.
Retention, transfers and rights
Expiry of a Knock or temporary status does not itself erase its underlying record. Apart from short-lived precise-location samples and the cookie lifetimes in Cookies, a complete approved retention schedule for application data, antiabuse records, audits, provider logs and backups has not been supplied. No deletion deadlines are invented here.
The operator/data controller identity, contact address, purpose-by-purpose lawful bases, provider contractual roles, processing countries and international-transfer safeguards require confirmation and publication. Global providers can involve processing outside your country; no EU-only storage or approved transfer arrangement is asserted.
Where applicable law provides them, rights can include access, correction, erasure, restriction, portability, objection, withdrawal of consent for consent-based processing and complaint to a competent data protection authority. Scope depends on the processing and applicable law. Editing and deletion are available now; the site does not yet publish a confirmed privacy-rights contact or dedicated access/export request workflow. These gaps do not remove statutory rights. Browsing is not blanket consent to all processing.