Legal

Privacy Policy

Last updated: 23 October 2026

IRL is operated by In Real Life (Thailand) Company Limited ("IRL", "we"), registered at 22 Soi Lasalle 46, Sukhumvit 105, Bangna, Bangkok 10260, Thailand. We are the data controller for the personal data described in this policy. This policy explains what we collect, why, who helps us process it, how long we keep it, and your rights. Questions or requests: hello@joinirl.app.

What we collect and why

• Account details. Your name, email, phone number and password (stored only as a secure hash). Used to run your account and, if you choose to use the IRL Concierge, to talk with you on WhatsApp.
• Identity verification. Everyone on IRL verifies a government ID with a quick selfie. Your documents go directly to our verification partner, Didit, and are never stored on IRL's systems in normal operation. We keep only your verified name, your verification status and date, and a reference number for the check. As soon as your check passes, we ask Didit to delete your document images, your selfie and the video of both. If a check needs a person to look at it, your documents stay with Didit until that decision is made, and are deleted when it is.
• Your profile. What you choose to share: photo, bio, location, interests, values, who you'd like to meet, social links, birthday (day and month only; the year is kept separately, see below).
• About you: birth year and gender. We ask everyone for their year of birth (or take it from your ID check) and their gender. We use them to suggest better introductions, to improve IRL for members, and to produce anonymous statistics. Your birth year is never shown to another member, a host or anyone else. Your gender is shown on your profile only if you switch that on. Both are optional, and you can see, change or delete them at any time in the app under "What IRL knows about me".
• Relationship status. Optional. It is shown on your profile only if you switch that on, and you can change or delete it at any time.
• Sexuality, your choice. Sexuality is sensitive personal data under Thailand's PDPA. Answering is optional, and by answering you agree to what this paragraph describes. If you answer, we keep it, and you decide two things separately: whether it shows on your profile, and whether IRL may use it to suggest people for friendship and work (never dating). Even when hidden, it may be used anonymously, in combined totals, for research and to improve IRL for members, never in a way that identifies you. Clear your answer or tap Forget on "What IRL knows about me", and we delete it.
• Interest in dating introductions. You can tick a box saying you would like dating introductions if IRL ever adds them. Nothing changes because of it. We only count how many members tick it, to plan what to build.
• After a gathering. After an event or dinner, IRL may ask how you found the people you met. Your answers are never shown to those people, to the host, or to anyone else. We use them, together with what other members say, to understand what each member is like in person, so we can make better introductions. Hosts see only combined, anonymous results, and only from groups of five or more people, so no single answer can be picked out.
• How you use IRL. Your connections, messages, gatherings, introductions and reminders. This is the product: IRL exists to help you keep up with the people you care about, and that requires remembering who they are.
• Device and usage information. A push notification token so we can notify you, and analytics about which screens and features you use (for example that you opened an event or sent an introduction, never what you wrote or who it was about), linked to your member id so we can see which features actually help people. We use Mixpanel with data hosted in the EU. Crash reports go to Sentry.
• Anonymous statistics. We may combine information across many members into anonymous statistics (for example, the age range or mix of people who go to dinners in a city) and share or sell those statistics, for example as trend reports. They never include anything that identifies a person: no names, no contact details, no birth years or answers tied to anyone, and no group small enough to point to an individual.

AI features, stated plainly

Some features send limited text to AI providers (Anthropic and OpenAI) to do their job: the matchmaker reads profiles to suggest people, voice onboarding transcribes what you say to fill in your profile, and the assistant reads messages you send to it (only your own words, never the other person's) to capture things you asked it to remember. Under the commercial API terms we use, AI providers process this text only to provide the feature and do not use it to train their models. If you book a concierge call with the notetaker on, Recall.ai joins the call to produce your private recap; both participants can see the notetaker in the call. IRL staff may review the introductions the AI suggests, to check their quality. Staff see what was suggested and why, never your private notes or messages.

Who processes data for us

We use a small number of service providers, each bound by data-processing terms: Didit (identity verification), Supabase (database, hosted in Singapore), Railway (application server), Expo (app delivery and push notifications), Google (sign-in, and calendar/Meet for concierge calls), Apple (sign-in), Twilio (WhatsApp and SMS), Anthropic and OpenAI (AI features), Recall.ai (call notetaker), Mixpanel (analytics, EU), Sentry (crash reports), Vercel (website). We never sell your personal data. We may share or sell anonymous, combined statistics that cannot identify anyone, such as trends across age groups or cities. If we change a provider, we will update this list; replacements must offer equivalent protection.

How long we keep things

• ID documents and selfies: never held by IRL; deleted at Didit as soon as your check passes, or as soon as it is decided if a person had to review it.
• Your account, profile, connections and messages: for as long as your account exists.
• If you delete your account: we immediately remove your name, email, phone number, photo and profile, delete your AI reports, call recaps, saved reminders and contact notes, and disconnect you from all members. Your past messages remain in recipients' conversations, attributed to "Former member". Some technical records (crash reports, aggregate analytics) age out on our providers' standard schedules. Email hello@joinirl.app if you want us to go further and erase specific content you wrote.
• If harm is reported: we may preserve the specific records needed to investigate or to assist authorities, for as long as legally required.

Your rights

You can ask us at any time to show you the data we hold about you, correct it, delete it, export it, object to or restrict a particular use, or withdraw a consent. Where we rely on your consent (for example the identity check or WhatsApp messages), you can withdraw it at any time, as easily as you gave it; withdrawal does not affect what was lawfully done before. Email hello@joinirl.app and we will respond within 30 days. Deleting your account is built into the app: Profile, then Delete Account. If you believe we have mishandled your data you may complain to Thailand's PDPC or your local data-protection authority.

Where data lives

Your data is processed outside Thailand (Singapore, the EU, the US). Where a country is not deemed adequate, we rely on contracts with each provider requiring protection equivalent to Thai law, consistent with PDPA section 28 and, where GDPR applies, standard contractual clauses.

Children

IRL is for adults 18 and over.

Changes

If this policy changes materially, we will tell you in the app before the change takes effect.