Bifrost Privacy Policy

Introduction

Bifrost is a social and companionship service operated for U.S. users by Beijing Yanwan Technology Co., Ltd. (“Bifrost,” “we,” “us,” or “our”). Bifrost helps people create profiles, find people working toward compatible goals, build mutual connections, communicate, share content, and complete shared to-dos or check-ins.

This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information when you use the Bifrost mobile application, the U.S. portions of our website, or contact us about the U.S. service (collectively, the “Service”). Please read it together with the Bifrost Terms of Service.

Scope of This Privacy Policy

This Policy applies to people in the United States who use or interact with the Service. It covers information processed by Bifrost as the operator of the Service. It does not govern:

• the separate China-region version of Bifrost and its China-region legal documents;
• third-party websites, app stores, devices, or services that operate under their own privacy policies; or
• information handled by another user outside Bifrost, such as a copy that person independently saves or shares.

Some features are optional. If you do not provide information needed for an optional feature, you can continue using other available parts of the Service. Information needed to register, secure, and operate an account is required for those functions.

Information We Collect

We collect only the categories described below, based on the features you use and the choices you make.

Account information

Phone number, country calling code, SMS verification request and result, account identifier, login status, and account-security records.

Profile information

Nickname, profile image, gender, region, birthday or zodiac sign, MBTI type, time zone, biography, interests, goals, and other profile details you choose to add.

Content and communications

Posts or diary-style entries, comments, images, voice recordings, reactions, saved items, direct messages, and other material you submit. We treat voice recordings as content; we do not use them to create a voiceprint or for biometric identification.

Social and activity data

Matches, mutual “Light” connections, friends, companionship relationships, shared to-dos, check-ins, completion status, interaction history, blocks, and notification preferences.

Safety and support data

Reports, reported content, support communications, review decisions, account restrictions, and information reasonably needed to investigate abuse, fraud, or safety concerns.

Technical data

IP address, device and operating-system type, app version, language, time zone, approximate region inferred from IP address, app or push identifiers, network and crash information, timestamps, and security or activity logs.

The current U.S. Service does not request access to your device contacts or precise GPS location. We do not collect payment-card or physical-shipping information because paid services and physical products are not part of the current U.S. Service.

Information You Provide

Registration and account access

You provide a U.S. phone number to request a verification code and create or access an account. We use the phone number to authenticate you, maintain account security, and send service-related messages. We do not use verification messages for advertising.

Profile, goals, and matching

You decide what optional profile information and goals to add. Profile fields and goal choices may be used to suggest compatible people and to help other users decide whether to connect. Avoid placing highly sensitive information in a public profile.

User content and communications

We process the content you choose to publish or send so it can be stored, delivered, displayed to the audience you select, and reviewed for safety. Direct messages are delivered to their intended recipients. Public posts and comments can be viewed by other users and may be copied or reshared by them.

Device permissions

If you choose a feature that needs camera, photo-library, or microphone access, the app asks for the corresponding operating-system permission. Camera and photo access support profile images and image sharing. Microphone access supports voice messages or other audio you choose to create. You may change permissions in device settings, although the related feature may stop working.

Information Collected Automatically

When you use the Service, our systems receive technical and activity information needed to operate and secure it. This includes login and request times, IP address, device and app characteristics, language, time zone, approximate region derived from IP address, feature interactions, message-delivery status, push token, diagnostic events, and security logs.

We use this information to keep you signed in, route messages and notifications, diagnose failures, protect accounts, enforce usage limits, and investigate misuse. The current U.S. Service does not use third-party advertising trackers or enabled third-party analytics products.

Information Received From Third Parties

We may receive limited information from service providers that help us operate the Service:

• SMS delivery status and related technical records from Alibaba Cloud;
• push-notification delivery status and device push tokens used through Alibaba Cloud push services;
• hosting, network, storage, and security records from Tencent Cloud infrastructure in Virginia;
• content-safety review results from Alibaba Cloud content-moderation services; and
• installation, update, device, or diagnostic information made available by the app store or device platform you use.

We do not currently support third-party social-network login in the U.S. Service, and we do not obtain advertising profiles from data brokers.

How We Use Information

We use personal information for the following specific purposes:

• Provide the Service: register and authenticate accounts; maintain profiles; suggest matches; support connections, companionship, shared to-dos, check-ins, posts, comments, messaging, media sharing, and notifications.
• Personalize requested functions: use profile fields, stated goals, region, time zone, and activity choices to organize content and suggest relevant people or activities.
• Communicate: send verification codes, security alerts, service notices, message or activity notifications, and replies to support requests.
• Safety and integrity: detect spam, scams, harassment, illegal content, impersonation, account compromise, and other prohibited conduct; review reports; moderate content; block or restrict accounts; and preserve the reliability of the Service.
• Maintain and improve: troubleshoot, test, repair, and understand aggregate feature performance without using third-party advertising analytics.
• Comply with law: respond to valid legal process, protect legal rights, and meet applicable regulatory or safety obligations.

We do not use private messages, voice recordings, or profile information to train a generative AI model. The current U.S. Service does not offer AI chat or biometric identification.

How We Disclose Information

We disclose information only in the circumstances below:

• At your direction or to other users. Profile information, public posts, comments, and reactions are shown according to the feature’s audience. Messages and shared activities are disclosed to their participants.
• To service providers. Providers receive only information reasonably needed to perform hosting, storage, SMS, push, security, content moderation, app distribution, or support functions for us.
• For legal and safety reasons. We may disclose information when we reasonably believe disclosure is required by valid legal process or is necessary to protect a person, investigate fraud or abuse, enforce our terms, or protect the rights and security of Bifrost and its users.
• In a business transaction. Information may be disclosed to professional advisers and a potential or completed acquirer in connection with a merger, financing, reorganization, sale, or transfer, subject to confidentiality and applicable notice requirements.
• With your consent. We may make another disclosure when you give informed permission for that specific purpose.

Service Providers and Third-Party Services

These providers process information under their own legal obligations and our service arrangements. A link to or interaction with a separate third-party service is governed by that service’s own terms and privacy policy.

Advertising, Analytics, Sale, and Sharing

Bifrost does not sell personal information. We do not share personal information for cross-context behavioral advertising, use third-party advertising trackers, or serve targeted advertising in the current U.S. Service. We also do not provide personal information to data brokers.

We do not exchange personal information for money or another valuable benefit. Because these practices do not occur, there is no separate sale or targeted-advertising opt-out needed for the current U.S. Service. If our practices change, we will update this Policy and provide any legally required notice and choice before the new practice begins.

Cookies, SDKs, and Similar Technologies

The publicly accessible U.S. legal pages do not add analytics, advertising scripts, or other tracking technologies. The mobile app uses local storage, authentication identifiers, logs, and operational SDKs or interfaces to keep you signed in, remember settings, send SMS codes and push notifications, upload content, and protect the Service.

Operational components include Alibaba Cloud SMS, push, and content-moderation services and device/app-store interfaces. These technologies are used to provide requested features, not to build advertising profiles. Browser “Do Not Track” signals do not change our website behavior because the U.S. legal pages do not track visitors across third-party websites. Where applicable law requires recognition of a universal opt-out signal, we will treat it as an opt-out request; the current Service does not sell or share personal information for targeted advertising.

Data Retention

While your account is active, we keep account and profile information to operate it. We keep posts, comments, messages, media, social connections, shared to-dos, check-ins, and reports until you delete the relevant item where the feature permits, or until the account is deleted. Technical, delivery, moderation, and security records are kept only while the account remains active and they are needed to operate and protect the Service.

When account deletion completes, Bifrost deletes the account’s associated personal information from active systems and backups at the same time and does not retain a separate account copy. This includes account, profile, user-content, messaging, media, relationship, shared-activity, push, report, and log data held in Bifrost-controlled systems.

Deletion from Bifrost does not erase information another person independently copied, downloaded, or shared outside the Service before deletion.

Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These include account verification, access controls, network and system protections, monitoring, content-safety controls, and limiting service-provider access to operational needs.

No service can guarantee absolute security. Protect your device and verification codes, use device access controls, and notify us promptly if you believe your account or phone number has been compromised. We will provide legally required notices if a qualifying security incident affects your personal information.

Account Deletion and Data Deletion

You can request deletion from the account-deletion option in Bifrost Settings. Follow the in-app confirmation steps so we can verify that the request comes from the account holder. You may also email thebifrost@126.com if you cannot access the account.

Account deletion is irreversible. When deletion completes, your access ends and Bifrost deletes the associated personal information from its active systems and backups as described in Data Retention. Content that another person retained outside Bifrost is not under our control.

User Privacy Rights

Depending on where you live and the law that applies, you may have the right to:

• confirm whether we process personal information about you and access that information;
• correct inaccurate personal information;
• delete personal information;
• obtain a portable copy of information you provided where required;
• receive information about categories of information, purposes, and recipients;
• opt out of sale, targeted advertising, or certain profiling if such processing occurs;
• limit or withdraw consent for certain sensitive-information processing where applicable;
• appeal a denial of a request where state law provides an appeal; and
• exercise rights without unlawful discrimination.

Use available account controls or email thebifrost@126.com with the subject “U.S. Privacy Request.” Describe the right you want to exercise and the account phone number’s country code and last four digits. Do not email a verification code or password. We may ask for information reasonably necessary to verify the request. An authorized agent may submit a request where state law permits, but we may require proof of authorization and direct identity confirmation.

U.S. State-Specific Privacy Rights

State privacy laws differ in scope and may apply only when statutory thresholds or other conditions are met. If a state privacy law applies to our processing of your information, we will honor the rights it grants. These may include access, correction, deletion, portability, a list of categories or specific third parties receiving information, and opt-out rights relating to sale, targeted advertising, or certain profiling.

Residents of states that provide an appeal may reply to our decision email with the subject “Privacy Appeal” and explain why the decision should be reconsidered. We will respond within the period required by applicable law and provide information about any regulator contact available to you.

Bifrost does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We use information that may be treated as sensitive only to provide user-requested features, secure the Service, comply with law, and perform safety functions. We do not use sensitive information to infer new characteristics for advertising.

California Privacy Notice

This section supplements the rest of the Policy for California residents. It provides notice of the categories of personal information used by the U.S. Service. Rights under the California Consumer Privacy Act apply when the statute covers the relevant business and processing.

We collect these categories from you, your device and use of the Service, other users who interact with you, and the providers described above. We disclose them for the business purposes identified in this Policy. We do not sell these categories or share them for cross-context behavioral advertising, including personal information of users we know are under 16.

California residents may submit requests to know, access, correct, or delete information, and may use an authorized agent, as described in User Privacy Rights. We will not unlawfully discriminate because you exercised a privacy right.

Children’s Privacy

The U.S. Service is not directed to children under 13, and Bifrost does not knowingly permit a child under 13 to create an account or knowingly collect personal information from a child under 13. If we learn that this occurred, we will disable the account and delete the associated information.

Users who are at least 13 but below the age of legal majority where they live should use Bifrost only with the permission and supervision of a parent or legal guardian. A parent or guardian who believes a young person has used Bifrost contrary to this section may contact thebifrost@126.com.

International Data Transfers

Primary application data for U.S. users is stored on Tencent Cloud infrastructure in Virginia, United States. Limited information is transmitted to Alibaba Cloud services as needed to send verification codes and push notifications and to perform content-safety review. Bifrost is operated by a company in China, so authorized personnel may access information from China when necessary for support, security, safety review, or service operations.

Privacy and data-protection laws outside your state or country may differ from those where you live. We apply contractual, access-control, security, and provider-management measures designed to protect information handled across borders.

Changes to This Privacy Policy

We may update this Policy when the Service, our practices, or applicable law changes. We will post the revised Policy at this address and change the “Last Updated” date. If a change materially expands how we use or disclose personal information, we will provide additional notice and request consent where required before applying the change to previously collected information.

Contact Us

Questions, privacy requests, and legal notices about the U.S. Service may be sent to:

For a privacy request, use the subject “U.S. Privacy Request.” For a legal notice, use the subject “U.S. Legal Notice.”