PRIVATEBOND

Privacy Policy

Last updated: October 18, 2026

Introduction

PrivateBond is a service for sharing private photos and videos with friends, partners and family, operated by Web3 Services, LLC, a Wyoming limited liability company. It is offered on privatebond.io and through the PrivateBond app for iPhone, including PrivateBond in Messages, in the United States. We are committed to protecting your privacy and providing transparency about our data practices. This Privacy Policy explains how we collect, use, store, disclose, and protect information when you interact with our website and services (collectively, the "Platform").

By accessing or using the Platform, you consent to the practices described in this Policy. If you do not agree, please do not use the Platform.

Information We Collect

Account Information

  • Phone number — if you sign in with your phone (see "PrivateBond app and PrivateBond in Messages" below)
  • Email address — if you sign in on privatebond.io with an email address, a password or a sign-in link
  • Password — stored as a salted cryptographic hash; we never store or have access to your plaintext password

IP Address and Device Information

  • IP address — recorded when you access content, with your explicit consent
  • Browser and device information — user agent, screen resolution, and similar technical data collected automatically
  • Consent timestamp — the date and time you agreed to IP collection

Identity Verification

Every account holder verifies who they are once before sharing or viewing. Verification is what ties each watermarked copy to a real person, so that a leaked copy can be traced to the viewer who received it.

  • How it works — verification is done by verifying your phone number, as described below. Each verified number can belong to only one account.
  • Payment-card verification, where offered — we may also offer verification by a small payment-card charge processed by Stripe and refunded on settlement. If you use it, Stripe collects your card details, cardholder name, billing address, and telephone number if you provide one, and we store the Stripe customer and payment identifiers and the date and time you were verified. Through Stripe we can retrieve the cardholder name, billing address, and telephone number associated with that record.
  • Why — to identify the person who controls an account, and for no advertising purpose

PrivateBond app and PrivateBond in Messages (iPhone)

The PrivateBond app lets you share a photo in a Messages conversation, or send photos and text messages inside the PrivateBond app, so that each person who opens a photo receives their own invisibly marked copy. Through the app we collect:

  • Phone number — to verify, you send one text message containing a one-time code to the PrivateBond number, and we record the number the text came from. If your carrier cannot deliver a text to our US number, you can instead enter your number and we text you a code (through Twilio). The number is attached to your account. We do not read your other text messages or your iMessage conversations.
  • Device token — the app creates a random token that identifies your installation to our servers. It is stored in your iPhone's keychain, and we store only a one-way hash of it.
  • Photos you share — the photo you choose is uploaded to us and stored so that a marked copy can be made for each person who opens it. Before it is stored it is screened automatically (see "Content screening" below).
  • Per-person copies — when someone taps your photo, we make a copy marked to their account and store it so it can be shown to them again. We record which account and which app installation received each copy, and when. The person who shared a photo can see the verified phone number of each person who received a copy and when, and can stop sharing a photo at any time (no new copies are made; copies already made stay with the people who have them). Viewers are not shown anything about other viewers.
  • Names from your contacts — if you allow it, the PrivateBond app on your phone matches viewers' numbers to your own contacts to show names. This happens on your phone only; your contacts' names are never sent to us.
  • Finding people you know on PrivateBond — if you allow access to your contacts, when you look for people to message the app turns each phone number in your contacts into a one-way code (a hash) on your phone and sends those codes to us, so we can tell you which of them belong to PrivateBond accounts. We compare them in memory and do not store them. Names and other contact details are not sent. This lookup is rate-limited.
  • Messages in the PrivateBond app — when you send a message in the app, we store its text or photo, who sent it, the conversation it belongs to and its members, and when it was delivered and read. Messages are shown only to the members of the conversation. If you unsend a message, it is hidden for everyone and an unsent photo makes no new copies, but the record and any copies already made are kept, as with every PrivateBond record. Messages from someone you have blocked are not delivered to you.
  • Push notifications — if you allow notifications, the app gives us a notification token from Apple, and we send notifications through Apple's push service. A notification says only "PrivateBond: New private message". It does not include the message, the photo or the sender's name or number.
  • Plan — whether you have PrivateBond Plus, and how many of your 5 free views you have used (see "Usage Data").
  • Reports and blocks — if you report a photo or block a sender, we record who reported or blocked whom, which photo, and any reason you give.
  • Sign-in records — each time a device or browser is added to your account, or an account merge happens, we record it. If a phone is already signed in to your account, it must approve any new phone that asks to join, and we record the approval or refusal. Your other devices show you a notice so you can sign the new one out if it wasn't you. If someone signed into privatebond.io with an email address asks to add your phone, the PrivateBond app asks you to confirm before anything is merged.
  • What the app does not collect — your name, your email address, your contacts' names or details, the content of your iMessage conversations, who else is in an iMessage conversation (beyond a count used to limit how many people can open a photo), or your location.

Content screening

Photos shared through the app are screened automatically before they are stored, to block explicit sexual content, sexual content involving minors, graphic violence and instructions for self-harm. Photos the screening rates as nudity or sexually suggestive, without being explicit, are stored but hidden by default (see below). Everyday photos of bodies, such as swimwear or beach photos, are not hidden. The photo is sent to OpenAI's moderation service, which returns category scores; OpenAI states that it does not use moderation requests for training. Photos that fail screening are not stored. We record whether each shared photo was rated explicit, and any correction made after a report. Photos and copies are delivered through Cloudflare, which checks served images against databases of known child sexual abuse imagery maintained by child-safety organizations.

Sensitive content setting and age check

Photos our screening rates as nudity or sexually suggestive are hidden by default: they are not shown to a viewer until that viewer turns on the sensitive content setting. The person who shared a photo can always see their own original. An adult can turn on the sensitive content setting only on privatebond.io, after a one-time identity check by Stripe Identity (a government ID document and a selfie, processed by Stripe under Stripe's Privacy Policy). We receive and store only whether you were confirmed to be 18 or older, the date, and Stripe's reference for the check. We do not store your ID document, your photo or your date of birth.

Payment Information

  • PrivateBond Plus — when you subscribe, you enter your payment details on a checkout page hosted by Stripe. Stripe receives your card number, expiry date and security code, the name on the card, your billing address or postal code, and the email address you enter, and processes them under Stripe's Privacy Policy.
  • What PrivateBond stores — the Stripe customer and subscription identifiers, the plan, whether the subscription is active, past due or cancelled, the date the current month ends, whether you have asked to cancel, the amounts and dates of charges, session and payment identifiers, and the email address you gave at checkout
  • We do NOT store credit card numbers, CVVs, or other sensitive payment details. All payment processing is handled by Stripe. See Stripe's Privacy Policy.

Usage Data

  • Content access logs (which content you viewed, when, and at what quality/priority)
  • Credit purchase and spending history
  • Watermark records linking your account to specific watermarked copies of content
  • Free views count — the number of new photos shared by others that have been delivered to you as a viewer, which we use to apply the 5 free views. Opening a photo you already received is not counted. The count is kept with your account and your verified telephone number so that it is not reset by deleting and re-creating an account.

Waitlist Information

  • Email address, whether you want to share or view, and any comment you provide when joining the waitlist

How We Use Your Information

We use collected information for the following purposes:

  • Account management — creating, authenticating, and maintaining your account
  • Service delivery — processing watermarking jobs, managing credit balances, and delivering content
  • Forensic watermarking — associating your account with uniquely watermarked content for leak detection purposes
  • Leak investigation — using IP addresses, account data, and watermark records to investigate unauthorized redistribution of content
  • Payment processing — processing payments and identity verification via Stripe
  • Subscriptions — applying the free views; starting, renewing and cancelling PrivateBond Plus; sending your subscription confirmation, receipts and notice of any price change; and keeping records of your subscription as the law requires
  • Messaging — delivering messages and notifications to the members of a conversation
  • Safety — screening photos, acting on reports and blocks, and meeting our legal duty to report child sexual abuse material
  • Security — detecting and preventing fraud, unauthorized access, and abuse
  • Legal compliance — responding to legal requests and complying with applicable laws
  • Service improvement — analyzing usage patterns to improve our platform

Forensic Watermarking and Data Linkage

This is central to how PrivateBond works. When you view content on our platform, the content is uniquely watermarked to your account. This means:

  • A permanent association is created between your account and the specific watermarked copy you received
  • If that watermarked copy is found outside of PrivateBond, we can determine which account viewed the content
  • Your IP address, Stripe payment records, and account information may be used in combination to identify you in a leak investigation
  • This information may be shared with the person who shared the content and, if applicable, law enforcement authorities

In the PrivateBond app and in Messages, each copy is linked to the verified phone number of the person who received it. The person who shared the photo can see which numbers received copies, and if a copy is found outside PrivateBond, which number received that copy.

By using our service, you acknowledge and consent to this forensic watermarking process and the potential use of your data in leak investigations.

How We Share Your Information

We may share your information with:

  • Stripe — for payment processing, PrivateBond Plus subscriptions and the optional age check. Stripe sends receipts for PrivateBond Plus to the email address you give at checkout. We send Stripe your account number with your subscription; we do not send Stripe your photos, anything about who shares with you, or anything about who you share with.
  • Apple — delivers push notifications to your iPhone, using the notification token described above. Notifications contain no message content.
  • Resend — for email delivery (sign-in links, and messages to our team about reports)
  • Twilio — receives the verification text you send to the PrivateBond number (your phone number and the code) and passes it to us; if we text you a code instead, Twilio sends it. Twilio keeps its own record of these messages under Twilio's Privacy Notice.
  • OpenAI — receives each photo shared through the PrivateBond app or in Messages for automatic content screening and returns a result. No phone number or account information is sent with it.
  • Cloud infrastructure providers — Railway for hosting and database, Cloudflare for network delivery and for file storage (Cloudflare R2), and GPU compute providers for watermark processing. Cloudflare's CSAM Scanning Tool checks photos as they are delivered against databases of known child sexual abuse imagery.
  • National Center for Missing & Exploited Children — if we learn of apparent child sexual abuse material, we report it to NCMEC's CyberTipline as federal law requires, with the information the law calls for, and preserve it as the law requires.
  • The person who shared the content — in the event of a leak investigation, limited account information may be shared with the person whose content was leaked
  • Google Ads — every page loads Google's advertising tag so we can tell whether a visit that began with one of our ads led to a sign-up or a purchase. Google sets cookies and receives your IP address, browser details, the page you are on, and, after a purchase, its amount and a transaction ID. We do not send Google your email address, your content, or anything about what you view.
  • Law enforcement — when required by law, subpoena, or court order, or when we have a good faith belief that disclosure is necessary to prevent harm or illegal activity

We do NOT sell your personal information to third parties. The only advertising use of your information is the Google Ads measurement described above. Your content, your viewing activity, and leak-investigation data are never used for advertising.

GPU Processing and Third-Party Compute

Content may be processed on third-party GPU infrastructure (including marketplace GPU providers) for watermarking. During processing:

  • Your content passes through third-party GPU instances in encrypted transit
  • Only your numeric account ID (not your email or personal details) is sent to GPU instances
  • No payment information, passwords, or session credentials are accessible to GPU operators
  • We use verified datacenter providers where possible to minimize exposure risk

Data Security

We implement reasonable security measures including: HMAC-signed session cookies; encrypted data in transit (HTTPS/TLS); salted password hashing; API key authentication between services; and rate limiting on sensitive endpoints. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

Data Retention

  • Account data — retained for the life of your account plus 30 days after deletion
  • Subscription records — kept for at least three years, or one year after your subscription ends, whichever is later, and in any case for as long as payment records are kept
  • Free views count — kept with your verified telephone number after you delete your account, so the free views are not reset
  • Messages in the PrivateBond app — kept after you unsend them or delete your account, with the record of who sent and received them, for the same reason as the photos below
  • Watermark records — retained indefinitely for forensic and leak detection purposes, including after you delete your account. For accounts that use the PrivateBond app this includes the verified phone number that received each copy, kept only for leak investigations.
  • Photos shared through the PrivateBond app or in Messages, and the copies made from them — kept after you delete your account, together with the record of which verified number and device received each copy. PrivateBond exists to show whose copy leaked, and that can only be done if the copies and records are kept. When you delete your account, your shared photos stop being available to anyone new; links already handed out expire within an hour.
  • Verification texts — the one-time code expires after 3 minutes. Twilio keeps its own record of the message (see above).
  • IP address logs — retained for 2 years
  • Payment records — retained as required by law (typically 7 years)
  • Magic link tokens — expire and are deleted after 6 hours

Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your account and associated data (subject to legal retention requirements and forensic record exceptions)
  • Object to certain processing activities
  • Request data portability

Note: Watermark records and forensic data may be exempt from deletion requests due to our legitimate interest in protecting the people who share content and complying with legal obligations.

You can delete your account at any time from the PrivateBond app on your home screen ("Delete my account"). This signs out every device, removes your phone number from your account and cancels PrivateBond Plus if you have it. Your shared photos, the copies made from them, your messages, and the record of who received each copy are kept for leak tracing, with your verified number held only in those records, as described in "Data Retention".

You can see your plan, your remaining free views and your renewal date, and cancel PrivateBond Plus, at any time at privatebond.io/plus or under Account in the PrivateBond app.

To exercise your rights, contact us at: home@privatebond.io

Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a minor, we will delete it promptly.

International Data Transfers

Your data may be processed in the United States, the European Union, and other jurisdictions where our infrastructure providers operate. By using our services, you consent to the transfer of your information to these jurisdictions.

Changes to This Policy

We may update this Privacy Policy at any time. We will notify you of material changes by posting the revised policy on our website. Your continued use of our services after changes are posted constitutes acceptance.

Contact

For questions about this Privacy Policy, contact us at: home@privatebond.io

Web3 Services, LLC — Wyoming, USA