Privacy Policy

Last updated: 2026

What we collect

• Your phone number, if you choose to link one — encrypted at rest, used to sign in and to send you one-time verification codes. It is never shown to other members; your username is your public identity. A phone number is never required to create or keep an account, only to sign in with a text-message code and to recover your account that way.
• A password (stored as a salted Argon2id hash — we never see or store your plaintext password), if you choose to set one. An account keeps at least one way to sign back in at all times: you can only remove a password once a verified phone number is linked, and only unlink a phone once a password is set.
• An optional recovery email, encrypted at rest, used only for account recovery.
• Profile information you choose to add.
• Photos you upload — automatically stripped of EXIF and GPS metadata before storage.
• Login and security telemetry: the outcome of each sign-in attempt, your IP address, an approximate location derived from it (country/region/city, from an offline lookup — we never query a third party for this; IP geolocation by DB-IP), and basic device information (browser, operating system, whether it's a phone/tablet/desktop). Collected for account security, fraud detection, and scam prevention. It is never shown to other members and is kept for 180 days, after which it is automatically deleted. Your IP address is also kept on your active session record (so we can show you your own sessions and flag an unfamiliar one) for as long as that session is active, up to 30 days, or until you sign out or revoke it from Settings → Sessions.

Server & traffic logs

Our web server records every request it handles — including your IP address, browser user agent, the page requested, and the referring page, if any — for security and for traffic statistics (for example, telling human visitors apart from search-engine and AI-assistant crawlers, and seeing which pages get read). These records are kept for 90 days and then automatically deleted, are visible only to site administrators, and are never sold or shared with anyone. Your IP address is stored in the clear both here and on the login/ session security records described above — not as a hash; every other record on hisdime that mentions an IP address stores only a one-way salted hash that rotates daily and cannot be reversed back to it.

What we don't do

• No third-party analytics, ad trackers, or fonts. Nothing you do on hisdime is shared with an ad network.
• No selling or renting of your data to anyone.
• No requirement to use your real name.

Who can see what

Your profile is visible to other members according to your own privacy settings (for example, blurring photos to non-members). Private messages are visible only to the sender and recipient, and to our moderation team if a message is reported or automatically flagged by our scam filter.

Retention

If you delete your account, we immediately erase your credentials, phone number, and photos. Messages you sent remain visible to the people you sent them to, the same way they would in any messaging product — deleting your account does not withdraw them from someone else's conversation history. Your username stays reserved (not reusable by anyone else) for 90 days before final removal, purely to prevent impersonation of a recently-deleted account. Login/security telemetry rows are deleted automatically after 180 days, regardless of whether the account itself is deleted.

Security

Passwords are hashed with Argon2id. Sessions use random, hashed tokens. All traffic is encrypted with HTTPS. We support optional two-factor authentication (TOTP) on every account.

Your choices

You can review and revoke active sessions, enable two-factor authentication, and delete your account at any time from Settings.

Contact

Privacy questions: see our Contact page.