StandIn
StandIn privacy
Status: exploring. Last checked 2026-10-21.
| Effective date | 2026-10-17, revised 2026-10-21. |
|---|---|
| Applies to | The StandIn headless dating API and the twin concept pages on dennery.ai. |
| Run by | Cazimedia LLC. Privacy contact: [email protected]. |
| Deployment state | Live at https://standin-api.cazimedia.workers.dev, with sandbox billing wired 2026-10-20. |
StandIn is a dating service where your trained twin meets other twins first. This policy names every kind of data the service stores, what your twin may share, and what deletion removes. It describes the live service as it runs today.
Wild experiments. They may break, and results may vary.
Data the service stores
| Account | Email, display name, verification state, account dates. Identity and abuse control. |
|---|---|
| Credentials | API key hash and verification token hash. The key is shown once at registration and never stored readable. The token hash is deleted after you verify. |
| Profile | Bio, birth date, location label. The label is free text you write. Contact details are rejected in bios, names, locations, and wants. |
| Twin training | Taught examples, turn ratings, rewrites, ranked wants, boundaries, visibility flags, and version history with change notes. |
| Vetting records | Pair sessions, turn text with per-turn reasons, twin verdicts with reasons, introduction gate states. |
| Safety records | Blocks, reports with reasons, and an audit log of actions on your account. |
| Plan and usage | Plan tier and monthly sweep and turn counters. Plus is $5 a month through Stripe test checkout. Card data goes to Stripe, never to StandIn. |
| Technical | Rate limit counters keyed by address and key, and idempotency records that replay write results without duplicating them. |
Data the service never collects
- Passwords. No password login exists; API keys take its place.
- Exact location. Only the label you type is stored.
- Contact details in bios. They are rejected before anything is saved.
- Photos. No photo upload exists in this release.
- Card numbers. Checkout runs on Stripe; numbers never reach StandIn.
What your twin shares
Your twin shows other twins a public card: your display name always, plus your bio, age, location label, and wants only where your visibility flags allow them. Your email stays sealed. Boundary checks read the other profile on the server before any dialogue starts. Both participants can read the full transcript and both verdicts. An introduction reveals only display name and email, and only after both twins recommend and both humans approve.
What deletion removes
Send POST /v1/account/delete with {"confirm": "delete"}. Deletion runs immediately and removes your email (scrubbed), display name (set to "Deleted user"), API key and verification token (revoked), profile, examples, feedback, version history, preferences, blocks, cached write replays, usage counters, and plan record. It pauses your twin, stops open sessions, and closes pending introductions.
What deletion keeps
Five things stay: the paused twin shell, session and introduction and verdict records, turn text with your name scrubbed, filed reports, and audit log entries. Audit entries expire after 90 days; cached write replays expire after 24 hours. The rest of the keeps list has no expiry; write to [email protected] if you want it gone. Deletion itself happens when you ask.
Your controls
- Read: GET /v1/me for the current state, GET /v1/export for a full JSON download of profile, training, transcripts, and decisions.
- Correct: patch your profile, delete single examples, rewrite turns, roll the twin back to an earlier version.
- Stop: pause or reset your twin, rotate your API key, block or report another user, delete your account.
- Ask: write to [email protected] for help with access, correction, or deletion.
Who else touches the data
Cloudflare hosts the API and the database, enforces rate limits, and provides the optional bot check where configured (it is not configured on this deployment). Stripe runs sandbox checkout and signs the billing webhooks the API verifies. Personal data is never sold. There is no advertising and no analytics on these pages. No other third party receives data.
Security, stated plainly
Keys are stored hashed. Every record read checks that the caller owns the record, so you can only read your own dialogues, transcripts, and introductions. Writes reject unknown fields and sit behind rate limits. Billing webhooks verify signatures before trusting a byte. The API is live at https://standin-api.cazimedia.workers.dev. Four outside adversarial reviews threw about 256 executed exploits at the preview and the live API; every confirmed finding was fixed with a regression test except documented residuals. The API ships with an 80-test suite run against the real migration SQL.
Age
StandIn is for adults 18 and over. Birth date is checked at entry, must show 18 or older on the day, and cannot be removed once set. No identity vendor checks documents.
Changes to this policy
Material changes get a dated entry here and a note on the lab pages. Past versions stay listed.
- 2026-10-17: first version, covers the local preview.
- 2026-10-21: second version, covers the live service, sandbox billing, retention windows, and the fourth review round.
These concept pages
The dennery.ai lab pages are static. They hold no accounts and run no trackers. Your theme choice lives in your browser only. The site-wide policy is at Privacy.