Legal

Privacy Policy

Last updated: 29 July 2026

IRL is operated by In Real Life (Thailand) Company Limited ("IRL", "we"), registered at 22 Soi Lasalle 46, Sukhumvit 105, Bangna, Bangkok 10260, Thailand. We are the data controller for the personal data described in this policy. This policy explains what we collect, why, who helps us process it, how long we keep it, and your rights. Questions or requests: hello@joinirl.app.

What we collect and why

• Account details. Your name, email, phone number and password (stored only as a secure hash). Used to run your account and, if you choose to use the IRL Concierge, to talk with you on WhatsApp.
• Identity verification. Everyone on IRL verifies a government ID with a quick selfie. Your documents go directly to our verification partner, Didit, and are never stored on IRL's systems in normal operation. We keep only your verified name, your verification status and date, and a reference number for the check. Didit automatically deletes your document images and selfie within 30 days. The one exception: if a serious incident is reported, we may preserve the specific verification records needed to investigate or assist authorities, stored securely and deleted when no longer required.
• Your profile. What you choose to share: photo, bio, location, interests, values, who you'd like to meet, social links, birthday (day and month only, never your year).
• How you use IRL. Your connections, messages, gatherings, introductions and reminders. This is the product: IRL exists to help you keep up with the people you care about, and that requires remembering who they are.
• Device information. A push notification token so we can notify you, and basic analytics (which screens are used, in aggregate) so we can improve the app. We use Mixpanel with data hosted in the EU. Crash reports go to Sentry.

AI features, stated plainly

Some features send limited text to AI providers (Anthropic and OpenAI) to do their job: the matchmaker reads profiles to suggest people, voice onboarding transcribes what you say to fill in your profile, and the assistant reads messages you send to it (only your own words, never the other person's) to capture things you asked it to remember. Under the commercial API terms we use, AI providers process this text only to provide the feature and do not use it to train their models. If you book a concierge call with the notetaker on, Recall.ai joins the call to produce your private recap; both participants can see the notetaker in the call.

Who processes data for us

We use a small number of service providers, each bound by data-processing terms: Didit (identity verification), Supabase (database, hosted in Singapore), Railway (application server), Expo (app delivery and push notifications), Google (sign-in, and calendar/Meet for concierge calls), Apple (sign-in), Twilio (WhatsApp and SMS), Anthropic and OpenAI (AI features), Recall.ai (call notetaker), Mixpanel (analytics, EU), Sentry (crash reports), Vercel (website). We never sell your data, to anyone. If we change a provider, we will update this list; replacements must offer equivalent protection.

How long we keep things

• ID documents and selfies: never held by IRL; deleted by Didit within 30 days of verification.
• Your account, profile, connections and messages: for as long as your account exists.
• If you delete your account: we immediately remove your name, email, phone number, photo and profile, delete your AI reports, call recaps, saved reminders and contact notes, and disconnect you from all members. Your past messages remain in recipients' conversations, attributed to "Former member". Some technical records (crash reports, aggregate analytics) age out on our providers' standard schedules. Email hello@joinirl.app if you want us to go further and erase specific content you wrote.
• If harm is reported: we may preserve the specific records needed to investigate or to assist authorities, for as long as legally required.

Your rights

You can ask us at any time to show you the data we hold about you, correct it, delete it, export it, object to or restrict a particular use, or withdraw a consent. Where we rely on your consent (for example the identity check or WhatsApp messages), you can withdraw it at any time, as easily as you gave it; withdrawal does not affect what was lawfully done before. Email hello@joinirl.app and we will respond within 30 days. Deleting your account is built into the app: Profile, then Delete Account. If you believe we have mishandled your data you may complain to Thailand's PDPC or your local data-protection authority.

Where data lives

Your data is processed outside Thailand (Singapore, the EU, the US). Where a country is not deemed adequate, we rely on contracts with each provider requiring protection equivalent to Thai law, consistent with PDPA section 28 and, where GDPR applies, standard contractual clauses.

Children

IRL is for adults 18 and over.

Changes

If this policy changes materially, we will tell you in the app before the change takes effect.