Privacy Policy

1. Who we are

Tab for Two is an iPhone dating app for adults in the United States. This policy covers the app and this website. We do not currently offer the service outside the United States, and you must be 18 or older to use it.

Tab for Two is operated by a very small team. A single operator is responsible for security and privacy and handles privacy requests directly.

2. Account identity

We never receive or store a password for Tab for Two. Sign-in is handled entirely by Apple or Google.

3. Financial data from Plaid

Connecting a bank account is optional, and we use Plaid to do it. You can use the app without connecting a bank, though the personalized parts will stay empty until you do.

We never see or store your bank username, password, or MFA codes. You enter those directly into Plaid. Plaid returns an access token to us; that token is encrypted before it is stored, and our database has no column capable of holding it in plain text.

We do not collect your account balances, your full account number, or your routing number. These are not merely withheld from storage — we never ask your bank for them. We request transaction history only, and the code that writes account and transaction records rejects the entire request if any field outside the approved list appears.

4. Derived signals

These are what we compute from your transactions. They are the actual product, and they are deliberately coarse.

Three things here are enforced in our database rather than merely promised:

• We do not store how many times you went somewhere, when you went, the venue, the street address, or coordinates. The tables holding your neighborhood and brand suggestions have no columns for any of it, and automated tests assert their absence.
• A signal is private until you confirm it. Derived signals start in a privately suggested state, nothing reaches another member's screen until you approve it, and this fails closed — if we are unsure, we show nothing.
• Scoring and display are separate. To rank your daily candidates we compare your signals to theirs, including signals you have not yet confirmed. The result is a single number. The unconfirmed signals themselves are never displayed to anyone, and neither is the number.
• We exclude sensitive categories entirely. Political, religious, health, gambling, adult, and luxury or discount spending categories are blocked at the point a signal is derived. We do not infer or match on protected or sensitive characteristics.

5. Photos

Photos taken on a phone often carry embedded metadata, sometimes including the exact coordinates where the picture was taken. We keep that metadata on the private original, because stripping it would quietly destroy evidence we may need for a safety investigation. We remove it from the stylized version other people can see. The copy visible to another member carries no location metadata, and the copy that carries it is visible to no member.

Safety screening runs on your device before an image is published, and we do not use your photos to train any model.

6. Device, notifications, and diagnostics

Notification text comes from a fixed set of pre-approved templates. We never put a merchant name, an amount, a personal trait, a location, or the contents of a message into a notification, because a notification can appear on a locked screen.

We ask for your location once, during sign-up, and we keep your time zone — not your position. The app asks for “while using the app” location so it can work out which time zone you are in, because your daily candidates arrive on your local morning and we will not ask you to pick a time zone off a list. The coordinate is used inside a single reverse-geocode call and never leaves that step: it is not stored on your device, not sent to our servers, and not written to any log. What we store is a time zone name such as America/New_York, and nothing more precise. The neighborhood signal above is a separate thing and still comes from your transaction data, not from your phone.

Diagnostics are deliberately stripped. Our crash reporter is configured not to send personal information and to scrub request bodies, headers, and query strings; screenshots, view hierarchies, attachments, and session replay are off across the entire app. Our analytics never receives your email, gender, orientation, financial categories, or neighborhood. Financial, chat, photo, and report screens record only the route name.

7. What we do not do

This is a commitment, not a summary.

• We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We never have. Under California law you may opt out of sale or sharing; there is nothing to opt out of, because we do not do it.
• We do not show other members your merchants, amounts, balances, transaction history, or how often you go anywhere. Other members see confirmed coarse signals, never the underlying evidence.
• We do not send marketing email. The only email we send is a verification code when you connect a bank, plus essential account and security messages. Open and click tracking is turned off.
• We do not store your bank login credentials. We never receive them.
• We do not use the content of your messages for anything beyond delivering them. Chat content is not used to build your signals, is not used for matching, and is not sent to analytics.
• We do not put your personal data into AI or large language model systems. Raw transactions, photos, message content, and report evidence are prohibited from any such processing.
• We do not infer or match on sensitive or protected characteristics.
• We do not track you across other companies' apps and websites.

8. Third parties, and why each one exists

We use a small number of vendors, each because it does something we cannot responsibly build ourselves. None may use your data for their own advertising.

We may also disclose information where legally required, or where necessary to investigate a safety report, prevent fraud, or protect someone from harm. If we are ever part of a merger or acquisition, we will tell you before your information becomes subject to a different policy.

9. Your rights

If you live in California, the CCPA and CPRA give you the rights below. We extend the same rights to everyone using Tab for Two, anywhere in the United States. We will not discriminate against you for exercising them — using these rights will never degrade your matches, your visibility, or your subscription.

In the app: most of these are settings, not requests. You can edit your profile, identity, and preferences, add or remove photos, and disconnect a bank at any time. Deletion and export are both there too, under Account on your own tab, and both ask you to prove it is you first — we email you a code and you enter it, and that permission is good for that one request only.

By email: you can always write to jay.jung@nubeem.com and ask. We will verify the request genuinely comes from you — normally by confirming you control the account's sign-in — before acting, because acting on an unverified deletion or export request would itself be a privacy failure. We respond within 45 days, and will tell you if we need the extension the law allows.

When you delete your account, your account is disabled and your profile stops being shown immediately; your bank connection is revoked at Plaid; and your raw transactions, encrypted provider archive, derived signals, photos, and profile are permanently deleted seven days after you ask. This is a physical deletion, not a flag, and it includes the image files behind your photos, not only the database rows that pointed at them. Encrypted backups age out within 30 days. In any conversation you were part of, you appear to the other person as a deleted member.

We do not keep a copy of your data under a different identifier so it can be reattached to you later. That is prohibited outright. Three narrow exceptions, stated honestly:

• We may retain the minimum evidence needed for an open safety or fraud investigation, kept separately with its own purpose and expiry.
• We retain aggregate statistics that cannot be traced back to any individual.
• Our servers keep short-lived technical receipts confirming that your bank notified us of an update, deleted within 30 days once handled and within 90 days otherwise. They record that an event happened for a bank connection, and contain no name, email, merchant, amount, or transaction.

10. Security

We do not treat encryption in transit and at rest as a complete answer, so here is what we actually do.

• Encryption in transit and at rest. All traffic uses TLS, and our database and file storage are encrypted at rest by our infrastructure provider.
• Envelope encryption for financial data specifically. Your Plaid access token and the complete provider payload are encrypted with AES-256-GCM before being written, bound to your specific environment, bank item, and sync cursor. Our schema physically cannot hold a plaintext access token — the column does not exist, and an automated test proves both that it does not exist and that a plaintext token is rejected.
• Default-deny database access. Every server-side table has row level security enabled and forced with no access policies at all, which denies every role including the table owner. Your own tables let you read only your own rows. No permission of any kind is granted to anonymous or public database roles. More than a thousand automated assertions switch to a real user role and prove another user's data is unreachable.
• A verification step before bank linking. Before you can connect or reconnect a bank we send a six-digit code to your verified sign-in email and require it. The code expires in five minutes, is single-use, is rate limited, and is never stored in readable form — only a keyed digest is kept for comparison. You cannot supply your own destination address; the server resolves it.
• Amounts are reduced before they are used. The process that derives your lifestyle signals never receives the amount itself, only whether it was money in or money out. The exact figure stays inside the database.
• Separation, not just encryption. Raw provider payloads live in a different table from the approved fields we use, so isolated data — original descriptions, exact locations, account and routing details — cannot exist as readable columns in the path everyday queries touch.
• Sessions stay on your device. Your session is stored in the iOS Keychain in a way that does not sync to iCloud and does not travel to another device through a backup.
• A minimal supply chain. Our server functions have zero third-party imports, and every dependency the app uses is pinned to an exact version.

No system is perfectly secure and we will not claim otherwise. If you find a security problem, please email jay.jung@nubeem.com.

Routine access to your raw financial data, photos, and messages is not available to anyone through a normal administrative screen. There is no administrative export of your transactions — the only way raw transaction data leaves our systems is when you export it yourself.

11. Children

Tab for Two is for adults aged 18 and over. It is a dating service and is not directed to children. We ask for your date of birth during sign-up and reject any date that would make you under 18; this check is enforced by the database itself, not only by the app.

We do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has created an account, we will terminate it and delete the data. If you believe a minor is using Tab for Two, email jay.jung@nubeem.com and we will act.

12. Changes and contact

If we change this policy in a way that materially affects you, we will update the date at the top of this page and notify you in the app before the change takes effect. We will not apply a materially different use to data we already collected from you without asking you first.

For privacy questions and requests, email jay.jung@nubeem.com, or write to NUBEEM, Inc., 103 Ames Ave, Leonia, NJ 07605.