Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how GFBF ("GFBF", "we", "us") collects, uses, shares and protects personal information when you use our website and services (the "Service"). It applies to everyone who visits the Service, creates an account, or views a link, card or certificate created on it.

By creating an account you confirm that you have read this policy and our consent rules, and that you agree to them. If you do not agree, please do not use the Service.

2. What GFBF is, and what it is not

• A central relationship registry. Two identity-verified adults can register their relationship together, by mutual consent. While a relationship is active, neither person can register another one (the "exclusivity lock").
• Fun features. Some features, such as Fun Cards, the Daily Question and the Bond Quiz, are for entertainment. Fun Cards are always marked "Just for fun · Not verified".
• Not a legal record. A Status Certificate or Love Card shows only relationships registered on GFBF. It does not prove that someone is single, and it is not a government or legal marriage record.
• Not a dating or matchmaking service. We do not introduce people to each other, and there is no way to browse or search for people.

3. Who can use GFBF

You must be at least 18 years old. Each person may hold only one account, linked to their own verified identity. If we learn that an account belongs to someone under 18, or is fake or duplicated, we will close it and delete its data, except where the law requires us to keep it.

4. Information we collect

4.1 Information you give us

• Account: full name, username, email address, date of birth and password. Your password is stored only as a secure one-way hash; we can never see it.
• Optional profile: gender, city, short bio, profile photo or a gallery avatar, language preference and sharing settings.
• Email verification: a 6-digit code we email you. We store only a keyed hash of the code, and delete it as soon as it is used, replaced or expired.
• Identity verification: the type and issuing country of your ID document (NID, passport, national ID card or driving licence), the name and date of birth on it, photos of it, a selfie, and short images captured during the live face check. From your ID number we keep only the last four characters and a one-way keyed hash, which lets us stop the same NID from opening a second account. The full NID number is never stored.
• Relationship: who your partner is (only after they accept), status (dating, engaged, married, ended), dates, couple name, story, cover photo, memories and their photos, and the visibility you choose for each.
• Marriage and divorce records: registration number, registrar name, date and the document you upload, used to verify a marriage or divorce.
• Cards, certificates and activity: Love Cards, Fun Cards (the made-up names, emoji avatars and captions you type), Status Certificates, Bond Quiz and Daily Question answers, streaks and Love Points.
• Safety: status-check requests (including the email address you enter), reports, blocks, and messages you send to support.

4.2 Information created when you use the Service

• Safety signals: the number and timing of your past relationships and invitations, cool-down periods, and attempts to post words our content filter blocks. These are used to prevent abuse.
• Technical data: IP address, browser type (user agent), session data and the time of your requests. Admin actions and certain sensitive events are kept in an audit log that includes the IP address.
• Sign-in devices: for each browser you sign in from, a random device identifier kept in a cookie (we store only a keyed hash of it), the browser and device type, the IP address and the last sign-in time. We use this to warn you, in the app and by email, when your account is signed in from a new device.
• Ad clicks: when you click one of our own promotional ads, we count the click. This count is not linked to your account.

4.3 Information from others

Your partner may add shared memories or photos to your relationship. Another person may enter your email address in a status check, or report your account. Google may collect information through ads, as described in section 8.

Signing in with Google: if you choose this, Google tells us your name, email address, whether Google has confirmed that email, and your Google account ID. We use these only to sign you in and to fill in your name and email. We do not receive or store your Google password, access tokens, contacts or other Google data. You can disconnect Google in Settings at any time. Signing in this way does not replace identity verification.

5. How and why we use your information

• To provide the Service: create and secure your account, verify your email and identity, register relationships, enforce the exclusivity lock, and create cards, certificates and reminders.
• To keep people safe: stop duplicate and fake accounts, detect double-timing and harassment, apply cool-down rules, review reports and suspend accounts that break our rules.
• To communicate with you: verification codes, password resets, and in-app alerts about your relationship, invitations, reminders and safety.
• To run ads: show our own promotions and Google AdSense ads on selected pages (section 8).
• To meet legal obligations and to establish, exercise or defend legal claims.

We rely on your consent (which you can withdraw at any time), on the need to provide the Service you asked for, on our legitimate interest in keeping the platform safe and honest, and on legal obligations. We do not use your information for automated decisions that have legal effects on you; identity, marriage and divorce decisions are made by a person.

6. Who can see what

• Nobody can search for you by name, phone number, ID number or photo.
• Your partner sees the shared relationship, its memories and the information your sharing settings allow.
• Someone you invite, or who invites you, may see whether the other person recently ended a relationship and how many relationships they have registered, but never the names of past partners.
• Status Certificate viewers see your verified identity and current status, never your partner's identity. Certificates expire on their own, and you can revoke them at any time.
• Love Card viewers see only the fields the card's creator chose. Each partner's own sharing settings always override the card.
• Public couple profile (only if you turn it on): names, photos, status and the memories you mark as public. It is hidden from search engines.
• Status checks: when someone asks to see your status, you see their name and decide. If you approve, they get a link to your current status for 7 days. If you decline, they are told it was declined. Until you answer, they cannot tell whether the email address they typed belongs to an account.
• Admins see only what they need to review a request or report. Every time an admin opens an identity or legal document, it is recorded in the audit log.
• Double-timing reports: when a report is confirmed, an admin may alert the registered partner without revealing who made the report.

7. Sharing with third parties

We do not sell or rent your personal information. We share it only:

• with service providers that run the Service on our behalf, such as hosting, storage and email delivery (for example Google's email service), under confidentiality and security obligations;
• with Google, for advertising, as described in section 8;
• with Google, only if you choose to sign in with Google, to confirm the sign-in (see 4.3);
• when the law requires it, for example a valid court order or a lawful request from a competent authority in Bangladesh. Where the law allows, we will tell you before we disclose;
• to protect someone's life or safety, to prevent fraud, or to protect the rights of GFBF and our users;
• as part of a merger or sale of the Service, in which case this policy continues to protect your information.

8. Cookies and advertising

• Essential cookies keep you signed in, protect forms against forgery (CSRF), remember your language and recognise your device so we can warn you about sign-ins from new devices. The Service cannot work without them.
• Google AdSense may show ads on some pages, such as the dashboard, Daily Question results, share pages and public card pages. Google and its partners may use cookies to show and measure ads, and, unless we choose non-personalised ads, to personalise them. You can manage personalised ads in Google's Ads Settings, and learn more in Google's advertising policy.
• Ads are never shown on sign-in, registration, password, email verification, identity verification, certificate, status-check, settings or admin pages.
• Our own promotional ads are labelled "Sponsored". Advertisers never receive your personal information from us.

9. How long we keep information

• ID photos, selfie and face-check images: deleted as soon as an admin approves or rejects your request.
• Last four characters of your ID number and keyed hash: kept while your account exists, to prevent duplicate accounts.
• Email verification codes: deleted when used or replaced, and invalid after 10 minutes.
• Marriage and divorce records: kept in private storage for as long as the registered record exists, because they are the basis of the registry entry.
• Certificates, status-check links and invitations: stop working when they expire or are revoked.
• Audit logs, reports and safety records: kept for as long as needed for safety, dispute resolution and legal obligations.
• Sign-in device records: kept while your account exists and deleted with it.
• Account data: kept until you delete your account (section 11).

10. How we protect your information

We use HTTPS encryption in transit, one-way hashing for passwords, keyed hashes for ID numbers and verification codes, private storage for identity and legal documents, role-based admin access, audit logging, rate limiting and automatic deletion of documents. No system is completely secure. If a breach affects your personal information, we will act quickly to contain it and notify you and the relevant authorities where required by law.

You are responsible for keeping your password and verification codes secret. We will never ask for your password or a verification code by phone, message or email.

11. Your rights and choices

• See and correct: view and edit your profile and sharing settings in Settings, or ask support for a copy of your information.
• Control sharing: choose how your name and photo appear, make your couple profile public or private, and revoke certificates, cards and public links at any time.
• Block and report: block invitations from a person, and report anything that feels wrong.
• Delete: delete your account from Settings. This ends your active relationship and removes your profile, photos, certificates, cards and alerts. A verified marriage must first be closed with a verified divorce record, so the registry stays honest. Some records may be kept where section 9 or the law requires.
• Withdraw consent: you may withdraw consent at any time, without affecting what was lawfully done before. Some features stop working without it.

To make a request, email support.gfbf@gmail.com from the address on your account. We may ask you to confirm your identity first, and we aim to reply within 30 days.

12. Content and conduct that is not allowed

GFBF is a respectful, safety-first space. You must not use it to post, upload or share:

• any adult or sexual content, nudity, or sexually suggestive images or text (18+ content), in any feature, including memories, photos, captions, stories, bios and Fun Cards;
• any content involving or sexualising a person under 18. We report such content to the authorities;
• another person's sensitive personal information, such as NID or passport numbers, phone numbers, home addresses, bank details, private messages or private photos, without their clear consent;
• a relationship that is not real or not consented to, or a Fun Card that uses a real person's name or likeness to mock, shame, harass or mislead;
• hate speech, threats, blackmail, stalking, impersonation, fraud, or anything illegal.

We may remove such content, block or suspend accounts, preserve evidence and report to law enforcement. Please also avoid sharing your own sensitive information in public parts of the Service.

13. Your responsibility and the limits of ours

• You are responsible for the content you post and for the accuracy of the information you give us. Giving false identity or marriage information is a breach of our rules and may be unlawful.
• We check identity documents and legal records with reasonable care, but we cannot guarantee that every piece of information a user provides is true.
• A person's status on GFBF reflects only what is registered here. Decisions you make about another person are your own responsibility; do not treat GFBF as proof of anyone's marital or relationship status outside the platform.
• We are not responsible for content posted by users, for how other people use links or cards you choose to share, or for third-party websites and ads. To the fullest extent permitted by law, GFBF is not liable for indirect or consequential loss arising from use of the Service. Nothing in this policy limits any right you have that cannot be limited by law.

14. Where your information is processed

Your information is stored on our servers and with our service providers. Some providers, such as Google, may process data outside Bangladesh. When this happens, we rely on their security and data-protection commitments.

15. Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version here with a new "Last updated" date. If the changes are significant, we will tell you in the app or by email before they take effect.

16. Contact and complaints

For questions, requests or complaints about privacy, email support.gfbf@gmail.com. If you are not satisfied with our answer, you may contact the relevant authority in Bangladesh. This policy is governed by the laws of Bangladesh.

This policy is available in Bangla and English. If the two versions differ, the Bangla version applies to users in Bangladesh.