Privacy Policy

Last updated: 7 October 2026

1. Introduction

Welcome to Sundae, a product of WAAAVE, Inc., a Delaware corporation doing business as Sundae ("WAAAVE", "we", "us"), 1111B S Governors Ave STE 26419, Dover, DE 19904, USA — hello@sundae.fm. WAAAVE, Inc. is the controller of your personal data. We value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you use our app or visit our website (sundae.fm).

Sundae is a voice-first community for gay and queer men. We know that, for many of you, being seen on Sundae is not safe everywhere. This policy is written with that in mind: Section 4 explains how we treat what using Sundae can reveal about you.

When you sign up, the phone-number screen reads: "By continuing, you agree to our Terms of Use and confirm that you read our Privacy Policy." Please read this policy carefully. If you do not agree with it, please do not use Sundae.

2. Who can use Sundae

Sundae is for people aged 18 and over. You confirm your age during sign-up, and anyone under 18 is blocked from continuing. If we discover that a member is under 18, we delete their account and associated data, except what the law requires us to keep in order to report child-safety content to the authorities.

Sundae is members-only: you join through a member's invitation or by applying, and every application is reviewed by a person. Submitting an application does not guarantee access.

3. Information we collect

3.1 Information you give us

• Phone number — to create and secure your account (verified with a one-time code).
• First name and date of birth — your age is shown on your profile; your date of birth is not.
• Username.
• Photos — 4 photobooth shots taken during your application, which only our review team sees, and up to 6 profile photos, which other members see.
• Voice recordings and their transcripts — your voice intro, your answers to the questions you pick, the voice answers you send to other members, and the voice notes in your chats.
• Chat messages and chat photos.
• City and approximate location — the city you set as your base and, if you allow location access, your approximate position, used to suggest members near you. Our servers keep only an approximate position, rounded to about 1 km; we do not store your exact coordinates.
• Your favourite spot and any places you choose to add to your profile.
• Instagram handle (optional).
• Contact hashes (optional, see below).
• One song — the track you pick for your profile.
• Languages you speak, and the other profile details you choose to add (the questions you pick, your bio).
• Reports and blocks you make, and the messages you send us.

What we don't ask. Sundae asks no questions about your gender, your sexual orientation, your pronouns or your identity, at sign-up or later. You may choose to say things about yourself in your bio, your photos or your voice. That is up to you, and other members will see it. For technical reasons, our systems store the same fixed default value in a "gender" field for every account; it is never asked, is not shown on your profile and is not sent to our analytics.

Photobooth photos. During the application, you take 4 photos in the app. Our team reviews them to confirm that you're a real person. They are stored with your account and never shown to other members. We don't use facial recognition and never create biometric data from your photos. The on-device face detection that helps you frame your shots is not stored and never leaves your device. These photos are deleted with your account (see Section 7).

Contact sync. If you opt in, the app reads the phone numbers in your contacts and turns each one into a hash (SHA-256) on your device. Only these hashes are sent to our servers, never the numbers, the names or any other contact detail. We compare them with the hashes of members' phone numbers to find the members you have in common. Where the app shows you a mutual member's name, it looks that name up in your own address book on your phone. The number of members you have in common may be shown to our review team as part of your application. The hashes are stored with your account, replaced each time your contacts are synced, and deleted with your account.

Voice recordings. Your recordings are transcribed so they can be played with captions and moderated. Transcription runs on your device with Apple's speech recognition where your iPhone supports it; otherwise the recording is sent to our transcription provider, ElevenLabs. Voice recordings and transcripts are never used to train any AI model, ours or anyone else's. We will not use your recordings or transcripts for any other purpose, such as improving the suggestions we show you, without telling you in advance and asking for your consent.

3.2 Technical and usage information

We also collect:

• Device type and operating system
• Push notification tokens (Apple Push Notification service)
• A device identifier (Apple's "identifier for vendor"), used to enforce bans and prevent fraud
• IP address
• App usage data (analytics, see Section 5.2)
• General location data (see Section 3.1)

4. Your sexual orientation and other sensitive information

4.1 What using Sundae can reveal

Sundae is an app for gay and queer men. Joining and using it may reveal your sexual orientation, and your profile, photos, voice, answers and messages may reveal more about you, such as your sex life, your health, your beliefs or your ethnic origin. Under the GDPR (Article 9) and similar laws, these are "special categories" of personal data. Please think about what you share: other members will see your profile, and what you say in a voice answer or a chat reaches the person you send it to.

4.2 Your consent

By choosing to sign up and use Sundae, you explicitly consent to us processing information that reveals or implies your sexual orientation, and any other sensitive information you choose to put in your profile, voice or messages, for the sole purpose of running the service as described in this policy (GDPR Article 9(2)(a)). Anything sensitive you add is optional, and you decide whether to share it.

Withdrawing consent. You can withdraw your consent at any time by deleting your account in the app (on your profile, tap Delete Account; while your application is under review, tap "delete my application") or by writing to hello@sundae.fm. Because Sundae cannot work without this processing, withdrawing consent means closing your account. Withdrawal does not affect processing that took place before it. The limited data we keep after deletion (Section 7) is kept for safety and legal reasons, not on the basis of your consent.

4.3 How we protect it

• We never sell your data, and we never share it for cross-context behavioural advertising.
• No ads, no ad targeting, no advertisers. Sundae shows no advertising, contains no advertising SDK, and never shares your data with advertisers, ad networks or data brokers.
• We never disclose a member's orientation, messages, photos or voice to anyone, including employers, family or governments, unless the law requires it (Section 6.3).
• We keep as little as we can: no identity questions (Section 3.1), no exact location, and data deleted 30 days after you delete your account (Section 7).
• Private voice and chat media: your voice answers, chat voice notes and chat photos are stored privately and can only be opened by the people they were sent to (Section 6.1).
• Discreet notifications: our push notifications and verification texts never mention your sexual orientation. You can also turn notifications off, or hide their previews on your lock screen, in your iPhone's settings.
• Analytics are linked to an internal account number, never to your phone number or name.

5. How we use your information

5.1 To provide and improve Sundae

• To review your application and decide on membership
• To enable voice interactions and share your content with other members
• To suggest members to you (see "How we suggest profiles" below)
• To personalise your experience based on how you use the app
• To keep Sundae safe and secure

No automated decisions. Every application is reviewed by a person. A helper score may be shown to the reviewer (for example, based on your optional Instagram handle and your mutual members); it never decides on its own.

How we suggest profiles. We choose and order the profiles you see automatically, based on your preferences and theirs, shared languages, distance and activity on Sundae (such as who was shown, revealed or answered). We never use the content of your voice notes, photos or messages for this. We do this to run and improve Sundae (our legitimate interest); it has no legal or similarly significant effect on you, and you can object at any time at hello@sundae.fm.

5.2 Speech recognition, AI and analytics

• We use speech recognition to transcribe recordings for captions and moderation: Apple's on-device speech recognition first, ElevenLabs as a fallback (Section 3.1).
• We use Anthropic (Claude) to generate example content for demo profiles. We do not send your recordings, transcripts, messages or profile to Anthropic.
• We use analytics (PostHog, hosted in the EU) to understand how the app is used and to fix problems. Analytics events are linked to an internal account number. The app you download from the App Store does not record your screen or sessions.

5.3 Communications

• To send you app-related updates, notifications and security alerts
• To answer your questions and support requests

5.4 SMS

The only SMS we send is the one-time code that verifies your phone number when you sign up or log in. We do not send application updates, marketing or promotional SMS, and we do not share your phone number with anyone for marketing purposes. Your phone number is shared only with our phone-verification provider (Prelude), to send that code. The decision on your application reaches you by push notification.

5.5 Safety and legal obligations

• To detect and prevent fraud, abuse and security threats, including enforcing bans
• To review reports and moderate content
• To comply with legal obligations and respond to lawful requests

5.6 Legal bases (EU, EEA and UK)

We process your personal data because it is necessary to provide the service you signed up for (performance of our contract with you); with your explicit consent for information that reveals your sexual orientation or other sensitive information (Section 4.2); on the basis of our legitimate interests in keeping Sundae safe, preventing fraud and improving the app; and to comply with our legal obligations.

6. Sharing your information

6.1 With other members

Your profile is shown to other members in the app.

Your public card. If your public card is on (it is by default), anyone who opens your link (sundae.fm/your-username) or scans your QR code sees your card: your photos, first name, age, city, your voice intro, your song and one of your questions. Turn it off anytime in Settings; your link then only shows a general invitation to Sundae, the same as for someone who isn't a member.

• Visible to members: your first name, age, username, city, profile photos, voice intro, the questions you picked and your answers, your song, languages, bio, your favourite spot, and your Instagram handle if you add it, along with any other profile details you choose to add.
• Visible only to the recipient: the voice answers you send to a member.
• Visible only to the two people in a conversation: chat messages, voice notes and chat photos.
• Never visible to members: your phone number, date of birth, location coordinates, photobooth photos, contact hashes, reports and blocks.

Voice answers, voice notes and chat photos are kept in private storage and opened through links that are issued only to the people allowed to see them and that expire after a few hours.

6.2 With service providers

We share only the data each provider needs to do its job for us:

Our providers process data on our instructions and only for the purposes described here.

6.3 Legal requirements

We may disclose data when required by law or a court order, or to protect Sundae and its members from fraudulent or harmful activity, for example when reporting child-safety content to NCMEC or another competent authority. When we receive a legal request, we check it and disclose only what we are required to.

We do not share your data with third parties for research.

7. Data retention

• We keep your personal data as long as your account is active.
• Applications abandoned before submission are deleted automatically after about 24 hours. Declined applications are deleted after 30 days.
• If you delete your account, your profile is hidden immediately. You can reactivate it within 30 days by logging back in. After 30 days, your account and its data are permanently deleted.
• During those 30 days, we also keep what is needed to investigate unlawful or harmful conduct.
• If an account is banned, we may keep limited data (such as the phone number in hashed form, the device identifier and the reported content) for up to two years for legal and security reasons, including preventing banned users from coming back.
• Where the law requires us to keep specific data for longer (for example, content reported to child-safety authorities), we keep it only for as long as required.
• Deleted data may remain in our backups for a limited period, until those backups are overwritten in the normal course.

8. Your rights

• Access and update: update your profile in the app, and ask us for a copy of the data we hold about you.
• Deletion: delete your account in the app, or ask us to delete your data by writing to hello@sundae.fm.
• Withdraw consent: see Section 4.2.
• Object or restrict: object to our processing, or ask us to restrict it.
• Portability: ask for a copy of your data in a structured, commonly used format.
• Marketing: Sundae does not send marketing messages. If it ever does, you will be able to opt out at any time.

EU, EEA and UK. You have the rights above under the GDPR and the UK GDPR. You can also lodge a complaint with the data protection authority of the country where you live or work, or where you believe your rights were infringed (in France, the CNIL; in the UK, the ICO).

United States. Depending on the state where you live (for example, California), you may have rights to know, access, correct and delete your personal information, and to limit the use of sensitive personal information. We do not sell or share your personal information, and we use sensitive personal information only to provide Sundae. We will not treat you differently for exercising your rights.

Latin America. If you live in Latin America, you have the rights given by your local data protection law. In Brazil, under the LGPD, you can ask us to confirm whether we process your data, access, correct, anonymise, block or delete it, port it, learn with whom we share it, and withdraw your consent; you can also complain to the national authority (ANPD). In Mexico, you can exercise your rights of access, rectification, cancellation and opposition (ARCO rights). In every country, you can exercise your rights by writing to hello@sundae.fm.

We answer requests within one month. We may ask you to confirm your identity (for example, through your phone number) before acting on a request.

9. Cookies and tracking

• The Sundae app does not use the advertising identifier (IDFA) and does not track you across other companies' apps or websites.
• Our website (sundae.fm) does not use advertising or tracking cookies. If it uses cookies, they are only those strictly needed for it to work. You can manage cookies in your browser settings.

10. International data transfers

• Your account data is stored in the European Union (Supabase, Ireland). Some of our service providers (Section 6.2) process data in other countries, including the United States, and WAAAVE, Inc. is a U.S. company.
• When data leaves the EU/EEA or the UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where the provider is certified.

11. Children's privacy

• Sundae is not intended for anyone under 18.
• We do not knowingly collect data from anyone under 18.
• If we learn that we have, we delete that data promptly (see Section 2).

12. Security

• We use technical and organisational measures to protect your data from unauthorised access, loss or misuse, including encryption in transit, private storage for voice and chat media with short-lived access links, access controls on every database table, and limited staff access.
• If a data breach is likely to put you at high risk, we will tell you without undue delay.
• No security system is impenetrable, and we cannot guarantee absolute security.
• Some content is protected against screenshots and screen recording (for example, photos in private chats). We cannot fully prevent another member from keeping what you share with them — for instance by photographing their screen with another device. Share with that in mind, and report any member who captures or shares your content: it is a serious violation of our Terms and can lead to a permanent ban.

13. Changes to this policy

• We may update this policy from time to time.
• We will give advance notice of significant changes and ask for your consent where required, in particular before any new use of your sensitive information.
• The date at the top of this page shows when this policy was last updated.

14. Contact us

If you have any questions or concerns about this Privacy Policy, or want to exercise your rights, contact us:

• Email: hello@sundae.fm
• Address: WAAAVE, Inc., 1111B S Governors Ave STE 26419, Dover, DE 19904, USA