Your story
stays yours.

See also our Terms of Service and Safety guide.

The short version. Vid8 is a video dating service. We collect what we need to run your account, show your profile and introduction video to other adults, connect 30-second Spark Meets, keep members safe, and bill Vid8+ if you choose it. We do not sell your information, do not show ads, do not use tracking or advertising cookies, do not record Spark Meets, do not create faceprints or voiceprints, and do not train general-purpose AI models on your photos, videos, or messages. Other members never see your email, exact birth date, coordinates, private roster labels, votes, passes, blocks, or reports. You can delete your account at any time.

1. Who is responsible for your information

Vid8 is operated by NorthLo Software Consulting (“Vid8,” “we,” “us,” or “our”), located in New Brunswick, Canada. NorthLo Software Consulting is responsible for personal information handled through the Vid8 mobile apps, the website at vid8app.com, our APIs, and related services (the “Service”), and is the data controller (or “organization”) where that concept applies.

Our privacy officer — the person in charge of the protection of personal information — can be reached at info@vid8app.com (subject line “Privacy”). This policy explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have. It does not cover third-party services you reach from Vid8, which have their own policies.

Vid8 is offered to adults in Canada and the United States. We do not currently market the Service to the European Economic Area, the United Kingdom, or Switzerland. If you use the Service from elsewhere, you do so on your own initiative. Rights described below apply to the extent the law of your place of residence gives them to you.

2. Notice at collection

If you live in California or another jurisdiction that requires a notice at collection, this is that notice. We collect the categories below for the purposes in Section 5, retain them for the periods in Section 10, and disclose them only as described in Section 7. We do not sell personal information and do not share it for cross-context behavioural advertising.

• Identifiers — email, account ID, hashed password, Google or Apple subject ID, IP address, session and device tokens.
• Personal records — first name, date of birth (to confirm you are 18 or older and to show age), city and region.
• Protected / sensitive characteristics you choose to provide — gender, relationship intent, interests, and anything your photos, video, or messages reveal.
• Commercial information — Vid8+ plan, trial and subscription status, invoice amounts and status, Stripe identifiers. We never receive your full card number.
• Internet or device activity — sign-in events, app or browser type, usage of Discover, roster, chat, and Spark Meets, and diagnostic logs.
• Geolocation — optional approximate (coarse) coordinates, only if you tap “Use my location,” used solely for distance filtering. Never shown to other members.
• Audio, visual, and similar — profile photos, your 30–60 second introduction video, and live camera and microphone during a Spark Meet (transmitted, not stored).
• Inferences — Discover ordering based on your stated preferences, distance, activity, and passes. We do not build advertising profiles.

We do not collect Social Security, Social Insurance, driver’s-licence, or other government ID numbers, precise background location, your contacts, your calendar, or your browsing activity on other sites.

3. Information we collect

Information you give us

• Account. Email address, a securely hashed password (we cannot read it), first name, date of birth, and account role and status. Date of birth is self-attested. We use it to confirm you are 18 or older and to display your age, not your birthday.
• Sign-in providers. If you use Google or Apple, the identity claims that provider sends us — a provider subject identifier and, where shared, your email. We never receive that provider’s password. We may still ask for your date of birth.
• Terms acceptance. The date, time, and version of the Terms and this policy you accepted.
• Profile. Gender, city and region, bio, relationship intent, prompt answers, interests, whether your profile is discoverable, discovery preferences (age range and distance), and chat preferences (who may open a chat with you).
• Photos and introduction video. Images and the 30–60 second video you record or upload, including your image, voice, surroundings, and anything else visible or audible in them. We may generate thumbnails and transcoded copies so other members can play them.
• Location (optional, approximate only). If you tap “Use my location” and allow access, the app reads a one-time coarse (low-accuracy) position and we store latitude and longitude on your profile so Discover can apply your distance filter. We do not track you in the background, do not request precise location, and do not show or return coordinates to anyone — including you — through our APIs. Other members see only the city and region you typed. You can withhold or revoke access in device settings; Discover then uses your typed city and region only.
• Activity on Vid8. Roster and Starter entries (and whether you opened a chat), passes, conversations and message text, read receipts, Spark Meet requests, acceptances, declines, readiness signals and timing, private “Still interested” or “Not now” votes, and notifications.
• Safety information. Blocks, reports you submit or that concern you (reason and description), moderation outcomes, and your correspondence with us.
• Billing. If you start a Vid8+ trial or subscription: plan, status, trial and renewal dates, cancellation state, invoice amounts and status, and Stripe customer, subscription, and invoice identifiers. Stripe collects card details on its own pages.

Information collected automatically

• Device and connection. IP address and approximate region derived from it, browser or app version, operating system, language, and timestamps.
• Security and usage records. Sign-in, sign-out, token refresh, password reset, and email verification events; active sessions; rate-limit counters; error and diagnostic logs; and an append-only audit log of security-relevant actions (for example account deletion or an administrator suspending an account), which may include the actor’s IP address.
• Media metadata. Duration, format, and moderation status of photos and video.
• Push tokens. If we offer push notifications and you enable them, a device token from Apple or Google so we can deliver them.

Information from others

Reports and blocks submitted by other members that concern you; messages other members send you; identity claims from Google or Apple; payment status from Stripe; and, where permitted, information from law enforcement or safety partners.

4. Sensitive information, video, and biometrics

Because Vid8 is a dating service, information you choose to add — gender, relationship intent, who you add to your roster, or what you say or show in your introduction video — may reveal or suggest sensitive characteristics, including sexual orientation, religion, ethnicity, or health. In some jurisdictions this is “special category” or “sensitive personal information.”

We process this information only to operate the dating features you ask us to provide and to keep members safe. Where the law requires explicit consent, you give it by choosing to submit the information. You can withdraw it by removing the information, hiding your profile, or deleting your account. Withdrawal does not affect processing that already took place.

Biometrics. Your photos and video contain your face and voice. We store and display them so other members can see and hear you. We do not use facial recognition, voice recognition, liveness detection that creates a template, or any technology that extracts a faceprint, voiceprint, or other biometric identifier. We do not create, buy, or sell biometric templates, and we do not use your media to identify you or anyone else against an identification database. If that ever changes, we will update this policy and obtain any consent the law requires — including under Illinois BIPA, Texas CUBI, and similar laws — before doing so.

Live video is not stored. A Spark Meet is transmitted in real time through our live-video provider so the other participant can see and hear you. Vid8 does not record, store, or play back Spark Meet audio or video. Brief technical logs (who joined, when the 30-second clock started and ended) are kept as described in Section 10.

Please do not put government identification numbers, health information, financial account numbers, or another person’s personal information in your profile, video, or messages.

5. Why we use information, and our legal bases

We use personal information to:

• create, secure, and administer your account; verify your email; confirm you are 18 or older;
• build and display your profile, photos, and introduction video to other members according to your settings;
• operate Discover (including age and distance filtering), rosters, Starters, chat, Spark Meets, votes, and notifications;
• process Vid8+ trials, subscriptions, invoices, and refunds, and apply free-tier and Vid8+ limits;
• respond to support requests and communicate about your account, safety, security, billing, and material changes;
• review reports, moderate content, detect and prevent fraud, spam, scams, underage use, and other abuse, and protect the safety of members and the public;
• maintain security, enforce rate limits, debug problems, and understand aggregate usage so we can improve the Service;
• comply with legal obligations, respond to lawful requests, report suspected child sexual exploitation as the law requires, and establish, exercise, or defend legal claims.

We do not use your photos, introduction video, messages, or Spark Meet media to train general-purpose artificial intelligence or machine-learning models, and we do not license that content to third parties for advertising or model training. Automated tools we use are limited to operating, securing, and moderating the Service.

In Canada, we rely on your meaningful consent as required by the Personal Information Protection and Electronic Documents Act and comparable provincial laws, together with the limited exceptions those laws allow (for example investigating a breach of an agreement or a contravention of law, preventing fraud, or responding to an emergency that threatens life, health, or security). Commercial electronic messages, if we ever send them, will comply with Canada’s Anti-Spam Legislation; today we send only transactional messages about your account, security, billing, and material changes.

Where the EU or UK GDPR applies despite Section 1, our legal bases are: performance of a contract (account, profile, discovery, chat, Spark Meets, subscriptions); legitimate interests (safety, moderation, fraud prevention, security, service improvement, and defending claims, balanced against your rights); legal obligation (tax and accounting records, responding to valid legal process, mandatory reporting); consent, including explicit consent (sensitive profile details, optional location, push notifications, any future marketing or non-essential cookies); and vital interests (rare cases involving a serious risk to someone’s safety).

We do not market to you without consent and we do not currently send marketing email. If we introduce optional marketing, each message will include an unsubscribe link.

6. Automated processing and moderation

We use automated rules to order Discover results using your stated preferences, location and distance settings, activity, and passes; to apply free-tier and Vid8+ limits; to hide people you have blocked or passed on; and to hold or flag photos, videos, or behaviour for review. We may use a third-party content-moderation service to screen photos and videos for nudity, violence, or other prohibited content before they are shown to other members.

Automated flagging supports human review. We do not make decisions with legal or similarly significant effects on you (such as a permanent ban) solely by automated means; a person reviews suspensions that involve judgment. You can ask us to review a moderation or account decision by emailing info@vid8app.com.

7. When we share information

We do not sell your personal information, and we do not share it for targeted or cross-context behavioural advertising. We share information only in these situations:

• With other members — your profile content, as described in Section 8, and the messages, Spark Meet requests, and live video you choose to send them.
• With service providers who act on our instructions and may use your information only to provide services to us: Microsoft Azure (application hosting and encrypted media storage, Canada Central region); Neon (PostgreSQL database hosting); Upstash or an equivalent Redis provider (short-lived operational state such as rate limits); LiveKit (real-time audio and video transport for Spark Meets — media passes through LiveKit’s servers in transit and is not stored by Vid8); Stripe (checkout, subscription billing, invoices, and the customer portal); Google Workspace or Resend (transactional email); Google and Apple (sign-in, when you choose it); Firebase Cloud Messaging and Apple Push Notification service (push notifications, if enabled); and a content-moderation provider (if configured). Each receives only what its function requires and is bound by contract to protect it.
• With our team. A small number of authorized administrators can access account records, reports, the moderation queue, billing mirrors, and — when investigating a report or legal request — content such as messages. Administrator access requires multi-factor authentication, and sensitive actions are recorded in an audit log. Administrators are never discoverable as dating profiles.
• For safety, legal, and compliance reasons — to protect the safety of members or the public; to investigate fraud, abuse, or illegal activity; to enforce our Terms; to respond to a valid subpoena, court order, search warrant, or other lawful demand from a competent authority; to preserve records when we receive a valid preservation request; or to report suspected child sexual exploitation material or related activity to the National Center for Missing & Exploited Children (NCMEC) CyberTipline, Canadian law enforcement, or other authorities as the law requires.
• In a corporate transaction — in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, subject to continued protection of your information and notice where required by law.
• With your direction — when you ask us to share information, for example with an authorized agent making a rights request.
• Aggregated or de-identified information that cannot reasonably be used to identify you, such as usage statistics. We will not attempt to re-identify it except to test our de-identification or as the law requires.

8. What other members can see, and what they never see

While your profile is discoverable, other members can see your first name, age (derived from your date of birth), gender, city and region, bio, relationship intent, prompt answers, interests, approved photos, and approved introduction video, plus whether you are open to chat with them. Members you message can see the messages you send them. During a Spark Meet the other participant sees and hears your live camera and microphone. When both participants vote “Still interested,” each sees a continuation message.

Other members are never shown: your email address, password, date of birth, coordinates, IP address, payment information, subscription status, whether you have labelled them Roster or Starter, your private Spark Meet vote, your passes, your blocks, or reports you have made. Releasing someone from your roster, downgrading a Starter, or voting “Not now” never sends a rejection notification.

Other members are people, not our service providers. Once you show or send something to another member — in your profile, video, a message, or a Spark Meet — we cannot control what they do with it. Vid8 does not record Spark Meets, but we cannot prevent a participant from using a screen or device recorder. Sharing another member’s content or a recording without consent violates our Terms and may be a crime; report it to us and, if appropriate, to the police.

9. Cookies, app permissions, and push notifications

We do not use advertising, analytics, or tracking cookies. The website uses only strictly necessary cookies:

• vid8_session — a short-lived (about 15 minutes), HTTP-only cookie holding your access token so you stay signed in.
• vid8_refresh — an HTTP-only cookie (up to 30 days) holding a rotating refresh token used to renew your session securely.
• vid8_csrf — a short-lived, readable token used to protect forms and API requests against cross-site request forgery.

Stripe sets its own cookies on Stripe-hosted checkout and portal pages under its privacy policy. The mobile app stores equivalent tokens in the device’s secure storage rather than in cookies. Because we do not track you across sites, browser “Do Not Track” and Global Privacy Control signals do not change how the Service works — we already do not sell or share for advertising. If we later add analytics or other non-essential technologies, we will describe them here and obtain consent where the law requires it. Blocking essential cookies prevents sign-in from working.

Device permissions. The mobile app asks for access only when a feature needs it, and you can refuse or later revoke each permission in your device settings:

• Camera and microphone — to record your introduction and to join a Spark Meet. Refusing them means you cannot record video or join a live meet.
• Photo library — to choose profile photos. We receive only the images you pick.
• Approximate location (when in use) — optional, for distance filtering only. We never request precise or background location.
• Notifications — optional. You can turn them off at any time; we will stop using the device token when you do or when you sign out.

10. How long we keep information

We keep personal information only as long as we need it for the purposes above, then delete or de-identify it. Typical periods are:

• Account, profile, photos, video, preferences, roster, and interests — while your account is open.
• Email verification links — 24 hours. Password reset links — 30 minutes. Both are single-use.
• Sign-in sessions and refresh tokens — up to 30 days of inactivity, rotated on use, and revoked when you sign out, change your password, or delete your account.
• Passes — about 30 days, after which the person may appear in Discover again.
• Spark Meet requests — expire 10 minutes after being sent if not accepted. Votes — may be cast for 24 hours after a meet ends. Meet records (participants, timing, status) are kept while your account is open. Live Spark Meet media is not retained.
• Messages and conversations — while the conversation exists. Closing a conversation (for example after a block) preserves it for safety review but stops further messages.
• Reports, blocks, moderation records, and administrative audit logs — up to 24 months after the account they concern is closed, or longer where needed for an ongoing investigation, legal claim, legal hold, or to prevent a banned person from returning.
• Security, access, and diagnostic logs — generally up to 12 months.
• Billing, invoice, and tax records — up to seven years after the transaction, as required by Canadian tax and accounting rules.
• Terms acceptance records — for as long as we may need to demonstrate the agreement, generally the life of the account plus the applicable limitation period.

What happens when you delete your account. You can delete your account in the app (Account → Delete my account), on the website (Account → Security), or by using our public account deletion page (including by email if you no longer have the app). When you do, we immediately: remove your profile from discovery; delete your profile details, prompts, interests, preferences, roster entries (yours and others’ entries pointing at you), passes, votes, and notifications; revoke all sessions and sign-in links; unlink Google or Apple identities; cancel any pending or live Spark Meets; close your conversations; and replace your email address, password hash, and date of birth on the account record with placeholders so the record can no longer identify you. Your photos and introduction video are removed from our storage systems within 30 days. We retain: blocks and reports (so a deleted account cannot erase a safety record), messages you already sent (which remain in the closed conversation and in the recipient’s history), invoices and subscription records needed for tax and accounting, audit logs, and an internal account identifier so we can honour blocks and prevent a banned person from returning. Where we must keep information, we keep only what the purpose requires.

Deleting your account cancels a Stripe subscription at the end of the current billing period. If you subscribed through an app store, you must also cancel there.

11. How we protect information

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including: encryption in transit (TLS) for all traffic, including Spark Meet media; encryption at rest for stored media and databases by our cloud providers; private media storage accessed only through short-lived signed URLs; Argon2id password hashing; short-lived access tokens with rotating, hashed refresh tokens and reuse detection; secure HTTP-only cookies and CSRF protection; rate limiting; object-level authorization on every request; least-privilege access for staff; mandatory multi-factor authentication and step-up confirmation for administrators; redaction of tokens, passwords, and message bodies from logs; and append-only audit logging of sensitive administrative actions.

No service can be perfectly secure, and you also play a role: use a strong, unique password, keep your devices updated, and sign out of shared devices. If a confidentiality incident involving your personal information creates a real risk of significant harm, we will notify you and the appropriate regulators as applicable law requires — including, where they apply, PIPEDA, Quebec’s Act respecting the protection of personal information in the private sector (we also keep the incident register that law requires), and the GDPR’s 72-hour regulator-notification rule — describe what happened, and tell you what you can do. Report a suspected vulnerability or account compromise to info@vid8app.com.

12. Where information is processed

Vid8 is operated from Canada. Application servers and media storage are in Microsoft Azure’s Canada Central region. Some providers — including our database host, live-video provider, payment processor, email providers, push notification services, and sign-in providers — process information in the United States or other countries. That means your information may be subject to the laws of those countries and may be accessible to their courts, law enforcement, and national security authorities in accordance with local law.

Where required, we use appropriate safeguards for international transfers, such as the European Commission’s standard contractual clauses (and the UK addendum), reliance on an adequacy decision (Canada is currently recognized as adequate for certain EU transfers), or provider certifications, and we choose providers that commit by contract to protect personal information to a comparable standard. You can ask us for more information about these safeguards. We have not appointed a separate EU or UK representative because we do not currently target those markets.

13. Your rights and choices

Controls you have right now. In the app and on the website you can edit your profile, photos, and video; hide your profile from discovery; adjust discovery and chat preferences; grant or revoke camera, microphone, photo, location, and notification permissions in your device settings; review and revoke active sessions; block or report members; manage or cancel Vid8+; and delete your account.

Rights under applicable law. Depending on where you live, you may have the right to: access the personal information we hold about you and learn how it is used and disclosed; correct inaccurate or incomplete information; request deletion; receive a copy in a structured, machine-readable format and have it transmitted to another organization where technically feasible; object to or ask us to restrict certain processing; withdraw consent (without affecting prior processing); ask about, and challenge, our compliance with privacy law; not be subject to certain solely automated decisions; and not be discriminated against for exercising your rights.

• Canada. Residents of Canada may access and correct their information and challenge our compliance under PIPEDA and applicable provincial laws. Residents of Quebec also have the rights, under the Act respecting the protection of personal information in the private sector, to request de-indexing or cessation of dissemination in certain cases, to receive computerized information in a structured, commonly used format, and to be informed about decisions based exclusively on automated processing. Our person in charge of the protection of personal information is reachable at info@vid8app.com.
• United States. If you live in California, Colorado, Connecticut, Virginia, Texas, Oregon, or another state with a comprehensive privacy law, you have the rights described above to the extent that law provides. The categories of personal information we collect and the purposes are described in Sections 2, 3, and 5; the categories we disclose to service providers for business purposes are described in Section 7. We do not sell personal information, do not share it for cross-context behavioural advertising, do not use or disclose sensitive personal information for purposes other than providing the Service and keeping it safe, and have not done so in the preceding 12 months. You may appeal a decision we make about your request by replying to our response, and you may designate an authorized agent to submit a request on your behalf. California residents may also request, once per year, information about personal information disclosed to third parties for those parties’ direct marketing (Shine the Light); we do not make such disclosures.
• EEA, UK, and Switzerland. If those laws apply to you, you have the rights described above under the GDPR, UK GDPR, or Swiss law, and the right to lodge a complaint with your local supervisory authority, including the UK Information Commissioner’s Office.

How to exercise your rights. To delete your account, use the account deletion page. To request deletion of associated personal data, use the data deletion page. You can also use the in-app or website delete controls, or email info@vid8app.com from the address on your account with “Delete my Vid8 account” or “Delete my Vid8 data” in the subject line. For other privacy requests, email us with “Privacy request” in the subject line, or use the controls in the Service. To protect you, we will verify your identity — usually by confirming control of your account email — before acting, and we may ask for more information. We respond within 30 days (or the period your law requires, such as 45 days under some US state laws with one permitted extension), and we do not charge a fee unless the law allows it for excessive requests. We may decline part of a request where a legal exception applies — for example, to protect another member’s information, to preserve safety records, or to meet a legal obligation — and we will explain why.

Complaints. If you are not satisfied with our response, you may complain to your regulator: in Canada, the Office of the Privacy Commissioner of Canada or your provincial commissioner (including the Commission d’accès à l’information du Québec); in the US, your state attorney general; in the EEA, your national supervisory authority; in the UK, the Information Commissioner’s Office.

14. Children

Vid8 is strictly for adults 18 and over. We do not knowingly collect personal information from anyone under 18, and we will close an account and delete its information promptly if we learn that the person is under 18, except for records we must keep to report the activity, prevent the person from returning, or comply with law. If you believe a minor is using Vid8, report the profile in the app or email info@vid8app.com immediately. Please do not attach images or other unnecessary personal information about the minor to your report.

15. Third-party links, sign-in providers, and app stores

The Service may link to third-party websites or services. Google and Apple sign-in, Stripe checkout, LiveKit sessions, and app store purchases are governed by those companies’ terms and privacy policies, and the app stores may collect information about your downloads and purchases independently of us. We are not responsible for the privacy practices of parties we do not control. Review their policies before providing information.

16. Changes to this policy

We may update this policy as the Service, our providers, or the law change. We will post the updated policy with a new effective date and version. For material changes we will give you notice through the Service or by email before the change takes effect, and where the change requires your consent, we will ask for it. Continued use of the Service after a change takes effect means the updated policy applies, except where consent is required.

17. Contact and complaints

NorthLo Software Consulting, New Brunswick, Canada. For privacy questions, rights requests, security reports, or complaints, contact our privacy officer at info@vid8app.com. We will acknowledge your message and work with you to resolve the issue. Please do not email passwords, payment card numbers, or other unnecessary sensitive information.