Your answers have a purpose and an end.

What is collected

If you join the launch waitlist, Naseeb records only the email address you enter, whether you confirmed or unsubscribed, the page source, relevant timestamps, and the version and digest of this notice. Confirmation and unsubscribe links are represented in the database only by one-way hashes; the link credentials themselves are sent by email and are not retained in readable form. Joining the waitlist does not create a matchmaking account or questionnaire profile.

The individual intake can include your name, email, date of birth, location, photographs, education and work, religion, denomination, community, ethnicity, health or disability information, family relationships and estrangement, finances, politics, sexual life, orientation and intimacy, relationship history, preferences, and free-text narratives.

The family intake can include a respondent’s email address and answers about religion, community, family expectations, work, living arrangements, marriage costs, politics, and related household views. If one person selects “Both parents, together,” that is recorded as one invited respondent’s description of a household view. It is not proof that a second adult separately consented.

Naseeb also creates operational data: a verified account and selected role, a candidate-authorized link to an invited parent, saved-draft answers and resume position, adult-eligibility state, matchmaker notes, compatibility categories, hard-filter outcomes, compliance review flags, introduction decisions, delivery state, security audit events, and keyed deletion receipts. A private Airtable base receives a limited operational mirror of new waitlist signups and currently consented accounts: opaque Naseeb identifiers, email, role, lifecycle and access state, parent-candidate link state, provider-neutral subscription state, timestamps, and counts. Airtable does not receive questionnaire or draft answers, photographs or photograph links, date of birth, location, private match or family notes, credentials, security logs, or Stripe identifiers. SQLite remains the source of truth. At the waitlist, public account, and family-access boundaries, Cloudflare Turnstile processes ordinary network, browser, and device signals and returns a short-lived security result used to distinguish people from automated abuse. Naseeb does not store the Turnstile response token or a Cloudflare device identifier.

For subscriptions, Naseeb records which verified account pays for which candidate, opaque Stripe customer, checkout and subscription references, subscription state, paid-through and cancellation dates, and bounded webhook-processing evidence. Payment card details are collected by Stripe’s hosted pages and are not stored in Naseeb’s database.

How it is used

• A waitlist email address is used only to confirm the request and send launch or availability updates. It is not used for matchmaking, a questionnaire, or targeted advertising.
• A human matchmaker reviews the private register and decides whether to make an introduction.
• Software compares structured answers, applies hard filters, calculates compatibility, and raises review flags. It does not make or send an introduction by itself.
• Email control and date of birth are checked before a new profile can become active.
• After email verification, an eligible candidate or invited family respondent can save and resume an incomplete form from their own account.
• A candidate or a verified, candidate-linked parent can fund the candidate’s single subscription. Payment never grants access to answers and does not stand in for matchmaking or family-processing consent.
• Security logs, delivery records, and a keyed external privacy-control ledger protect the service and prevent an old backup from silently restoring a deleted profile or withdrawn processing state.

Naseeb does not sell personal data and does not use it for targeted advertising.

Who receives what

Authorized matchmakers can read active, currently consented candidate and family answers. A candidate can see their own individual answers, never a family respondent’s answers. A family respondent can submit only through their own invitation and cannot see the candidate’s answers or another respondent’s answers.

An introduced person receives the introduction note and a compatibility reflection, not the other person’s raw questionnaire or grade. Photographs accompany the introduction itself, so the person deciding can see who they are deciding about; the other person's full name is withheld until both accept. If both people separately opt in, the private-question result is shown only as a broad compatibility line, never as the underlying answers. When both people accept, the matchmaker sends one introduction email addressed to both of you, and that message shows each of you the other's email address so the conversation can continue directly. Nothing else about either person is disclosed, and no address is shared before both have accepted.

Infrastructure providers may process limited data to operate the service: the hosting and network provider handles requests; Cloudflare processes Turnstile security-challenge signals to prevent automated abuse; the email provider receives waitlist and account destination addresses and message content; Airtable receives the limited private operational signup and account mirror described above; Stripe receives payer and payment information on its hosted payment and account-management pages; and Google Fonts can receive ordinary connection metadata when typography loads. Operators with filesystem access can access the application files as needed to run, secure, back up, and restore the service.

Naseeb measures how its pages are used with two tools. GoatCounter runs on Naseeb’s own server and records each page visit: which page, where the visitor came from, the browser, operating system, screen size and language, and the country, linked by a random visit code. Its records are deleted after a year. Cloudflare, the network provider, runs its Web Analytics service through a small script on every page, including this one, which reports page visits and how quickly pages load and respond; Cloudflare keeps those records under its own terms. Neither tool sets cookies, and neither is used for advertising or to follow you across other sites.

A parent-candidate account link proves only that a candidate invited that mailbox and the parent verified it. It does not reveal the candidate’s answers, another respondent’s answers, or authorize a future family instrument. Each family instrument still requires its own candidate-issued invitation.

How long it is kept

Your choices

Waitlist permission, the individual intake, the family respondent intake, and a candidate’s authorization of a family round are separate choices. Each is recorded separately against this notice. The optional private-compatibility switch is separate again and starts off. Paying for a subscription is a separate transaction; it never supplies or widens any of those permissions.

A waitlist request must be confirmed through the email sent by Naseeb. Every waitlist message includes an unsubscribe link. You can also ask [email protected] to remove the entry. Unsubscribing from the waitlist does not delete an independently created Naseeb account, and deleting an account does not silently subscribe or unsubscribe a separate waitlist entry.

A candidate can withdraw future matchmaking processing or permanently delete the profile from the Privacy tab. Deletion is refused while a subscription for the profile is live in any state — starting, active, ending, past due, suspended, paused or on hold — or while a checkout for it is unresolved. If your own account pays for a subscription, deletion also waits until that billing is settled. Cancel or settle first, then delete. A deletion requested while a private email for the profile is being delivered is refused for a moment and can be retried. Withdrawal stops new matching, compatibility disclosure, family processing, and unsent introductions. A message already accepted by or in flight with the email provider may still arrive, and a photograph already delivered cannot be recalled. The held profile remains available to its owner for review, reconsent, or deletion.

A family respondent can use the original emailed code on the family page to withdraw a completed response. One respondent’s withdrawal invalidates and erases the whole derived family version rather than silently treating it as a different household.

Security and files

The public service must use HTTPS, owner-only application files, restricted administration, expiring credentials, verified backups, and an external anti-rollback erasure ledger. The repository does not provide application-level encryption of SQLite, photographs, or JSON downloads. Device and backup encryption are deployment responsibilities. A downloaded intake backup is a plain JSON file; store or delete it accordingly.

To ask a privacy question or make a request you cannot complete in the site, write to [email protected].