Friendship app privacy: who can see you?

You want to meet someone without making your whole life visible to every member of an app. Before joining, separate five questions: who can discover you, which profile details they receive, when answers and photos appear, what activity is visible, and what the service itself can process. A private account is not the same as an invisible profile.

Start with the settings you would use today. Check discovery before opting in, remove identifying details from free text and photos, and find the block and deletion controls before you need them. You can compare different app formats in our friendship-app guide. The checklist here is about disclosure, not a ranking of which service is safest.

Who can see you?

For any friendship app, distinguish a logged-out visitor, a member seeing a suggestion, someone you have matched with, an established connection, and the operator. Ask about each type of viewer instead of relying on a single “private” label. In particular, check whether a discovery preview includes your city, activity or information derived from your answers.

ValuePair publishes this guide. The following matrix is our worked product example, covering optional Explore discovery where it is enabled. Explore is a limited signed-in suggestion view, not a public member directory. Being an eligible member alone does not give access to everybody: the person must currently be shown as a suggestion or be an eligible pending invitation counterpart.

The operator row describes technical processing, not a claim that staff routinely inspect conversations. See the privacy policy for processing purposes, recipients and retention. A person can also remember or capture something they were allowed to see; withdrawing access does not recall a screenshot.

Matching and optional discovery

Automatic matching and Explore visibility are separate choices. Joining automatic matching does not by itself put you into Explore. Saving common-ground sharing choices does not turn visibility on either. Explore visibility starts off and requires an explicit choice; it is not inferred from an existing profile.

When available and enabled by you, Explore can show up to three suggestions, plus eligible pending invitation counterparts. It checks reciprocal eligibility and current access when loading a profile or its blurred photo. A guessed profile address does not grant discovery access. An invitation starts the mutual introduction process; it does not open unrestricted chat.

Pausing Explore visibility removes access on subsequent discovery profile and photo reads and closes pending Explore invitations. It preserves your automatic-matching choice and existing conversations. If you want to pause automatic matching as well, manage that separately. “Hidden from new suggestions” and “no longer connected to someone” are different outcomes.

Before confirming discovery, read the visible-field explanation and preview any optional summaries. If you do not want those details shown to potential introductions, leave Explore off. The absence of an exact online timestamp does not make discovery anonymous.

Which details require consent?

There are several independent controls. Matching participation, Explore visibility, approved common-ground summaries, communication-preference sharing and photo reveal do not grant the same permission. Treat each confirmation as a choice about a particular use or audience.

Explore’s common-ground summaries require both people to approve the relevant supported summary. These choices start empty. They can describe an exact everyday preference, such as a shared daily rhythm, even though the underlying questionnaire is not displayed. Up to three approved summaries can appear. Do not interpret “no raw answers” as “nothing can be learned from my answers.”

You can withdraw individual summary approvals in Explore or Settings. Removing approval suppresses that summary on subsequent reads. If you change an answer, a different resulting summary is not automatically approved. Approval to share communication preferences is a separate setting for matches and connected people.

Withdrawing the required matching-data consent also prevents Explore eligibility. It does not clear the saved Explore visibility preference. If you later restore that consent, the saved preference can apply again. To keep Explore off, explicitly switch its visibility off rather than relying only on a different consent being withdrawn.

Photos and answers

Your raw onboarding questionnaire and importance ratings are not shown as an answer sheet to another member. Matching can produce broader alignment information, while Explore can disclose the exact optional summaries you approve. These are different from the answers you submit in a shared conversation.

In the structured conversation, each question reveals after both people have answered that question. You do not have to finish all fourteen before seeing any reveal. Consider any answer or optional note you submit as something the other person may later read. You can be specific about a preference without including an address, workplace, medical record or another person’s identifying story.

Explore serves a blurred photo, and an active introduction does not initially give clear-photo access. After the conversation is complete, clear photos can become visible through mutual photo-reveal consent. They also become visible when both people choose to go deeper and become connected. These are two routes to clear-photo access, not a promise that only the separate photo button can reveal a picture.

Photo uploads are re-encoded and hidden metadata such as EXIF location is stripped. Visible clues remain: a work badge, building number or recognizable home interior is still part of the picture. Preview the image itself before uploading. A blurred preview is also not a promise that someone who already knows you cannot recognize you.

Ending an ordinary discovery conversation does not immediately remove every shared answer view. Eligible ended matches can have a read-only recap for up to thirty days after ending, containing only already mutually revealed answers. Blocking, suspension and other eligibility rules can end access sooner. The recap does not provide a route back to the person’s profile or photos.

Location and activity

ValuePair uses location for matching preferences, including an optional distance limit. When you mark your location private, Explore and partner-facing profile views omit the location label; the service can still use location for matching. Hiding it from members is not the same as deleting it from the account.

Where available, Explore shows “Active today” or “Active in the last 7 days.” Today uses the Europe/Berlin calendar day. It does not show an exact last-seen time, a live online dot or a promised response time. No label is not proof that someone has abandoned the app. Connected chat separately shows an online indicator and a typing indicator; the asynchronous discovery conversation does not.

Decide whether even that coarse activity signal fits your boundaries. Avoid adding your daily route or regular workplace to conversation notes if you do not want a new contact to infer where to find you. A distance preference does not guarantee a nearby match or require you to agree to a meeting.

Blocking

Blocking and reporting serve different purposes. Blocking restricts further contact and access; reporting gives the service information to review. ValuePair checks blocks in either direction for Explore access and ended-match recaps. Turning Explore off is not a substitute for blocking a particular person, because existing conversations remain.

If you already exchanged contact details elsewhere, an in-app block cannot control those other services. Review their settings separately. A report may require retained evidence, so do not assume that blocking also erases the incident from the operator’s records. The privacy policy describes the service’s retention framework.

Encryption limits

ValuePair connected chat is not end-to-end encrypted. It supports encryption at rest using a server-held key; the server decrypts messages for product functions, exports and abuse handling. That is different from a design intended to prevent the provider from reading message content. It also does not mean every kind of answer or profile field has the same storage protection.

Hidden-until-both-answer is a disclosure rule between participants. It is not a promise that the service cannot access those answers. If your conversation requires provider-inaccessible content, this chat does not meet that requirement. Encryption also cannot stop an authorized recipient copying a revealed message.

Export and deletion

You can request an account data export or delete your account through Settings. Export first if you want a personal copy, and store it somewhere appropriate: downloaded data is no longer protected by the app’s sign-in boundary. Account deletion removes the account and uploaded photo files through the erasure process, while limited records may remain for security or legal purposes described in the privacy policy.

Deleting the account, pausing discovery, removing a photo and blocking someone are separate actions. Choose the one that matches what you want to stop. None can remove a screenshot, a forwarded message or a note another person already made outside the service.

If these boundaries fit your needs, you can try ValuePair. Core matching, getting to know someone and chat are forever free; Premium is optional. Start with information you are comfortable having the service process and the relevant member eventually see.

Editorial note: This guide describes ValuePair’s controls as a disclosed worked example, not a security-superiority claim. Consult the FAQ, the privacy policy and the actual choices shown in your account. A summary such as “no public directory” should never replace checking optional signed-in discovery and its separate sharing controls.