Privacy and Security

Is my data stored securely and kept confidentially?

Absolutely. Everything is encrypted and we fully anonymize the data—even we do not know who is who. Our guiding principle is that we treat your data the same way we would want our own to be treated. We follow security best practices and consistently keep our systems up-to-date to deal with the latest threats. But all of that just does what we consider the bare minimum and doesn't prevent abuse or misuse of data. Because of our focus on this topic, we have a few core philosophies that we hold regarding data:

Always anonymous. We're a data-based product and company, and the value we provide to users is from that. But not everything provides you value—namely, personally-identifying information (PII). We always fully encrypt our databases, and go above and beyond in fully anonymizing our users, and studiously avoiding collecting PII unless necessary. This is because we realize something a lot of other companies don't. Collecting everything "just in case" rarely ever pays off... but always has a big cost in risk to your privacy. We don't play those games with your data.

Explicit, enthusiastic, informed consent. Related to understanding data is both value but also liability, we don't secretly trawl your entire life in the background. We strive in our design to always be clear what is being collected and, if not obvious, why. Our mindset is if we went through each piece of data we collect, the answer should be an enthusiastic answer yes to what is provided. In fact, we go so far as to build in explicitness even in our UI—your vibrator never sync or secretly sends anything. You MUST explicitly hit the sync button on the app for it to ever communicate. We're not fans of cloak and dagger, not with our intimate products.

Defense-in-depth, minimize attack surface. We're not an old traditional company trying to adapt to the new digital world. Our team are from some of the top technology companies in the world, and we understand the realities of security in this age of cyber threats. We build our systems like a medieval castle—layers upon layers. Although we don't expect it to happen, if our public endpoints are breached, they don't actually hold data. Even if our private networks are breached, our databases are encrypted, and hence gibberish without our private keys. Even if our databases are decrypted, all user data is one-way hashed, so it can't be backed out without a complete user list. But even if OUR servers are hacked, our authentication servers with user lists are NOT kept with us—they at one of the top authentication and security providers in the world. So the hackers now need to go breach them. And so on and so forth. We know being tested in security isn't matter of if, but when, and treat your data as we do our own.

So, what DO we do with the data? Well, with the anonymized data, we use it internally to learn new things, improve our app, and most importantly, further our knowledge of female sexuality. A lot of this requires volunteers where we can have known data points, and then extrapolate the benefits of that knowledge to the fully anonymized pool (and also be able to then do validation that what we're seeing is actually more broadly reflected in the female population). Our access to this kind of information is unprecedented, and we’re dedicated to using this for good.

For example, in our exploration of orgasm patterns, we were able to replicate some of the physiological studies last done in the 1980s (... with a sample size of 11), and find things that are suggestive that there's even more to uncover). As a part of our mission, we are eager to continue these kinds of advancements. 

In fact, we're working on partnerships with outside academic and medical researchers right now. However, in all of those cases, we will only share data if the user has specifically opted in—especially since academic research by its very nature requires FAR more identifying data than we've been comfortable collecting. (Our CTO lays out some of the differences between what we do and academic research here) As part of that, we're still figuring out the right balance. No matter what, though, we promise that it won't just "magically" happen in the background. Everything MUST be explicit and clear.

The way we see it, for some folks, privacy is freedom. For others, contributing and participating in science and research can be exciting and fulfilling. But whatever decision it is must be informed by direct, clear consent. We're not fans of the 10,000 word terms of services that bury this stuff and suddenly change where you stand without you knowing. If we're using the data for something that might risk unveiling you, we'll let you know and only do it if you consent.