← Back to home

Privacy Policy

Effective Date: August 25, 2026 · Last Updated: September 1, 2026

Bunk Labs, Inc.

1. Introduction

Bunk Labs, Inc. ("we," "us," "our," or "Company") operates Trick Dash, an LGBTQ+ social and dating application. We recognize the sensitive nature of our users' data and are deeply committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, your rights, and our safeguards.

2. Information We Collect

2.1 Information You Provide

When you create an account and use the App, you may provide:

2.2 Information Collected Automatically

The App automatically collects:

2.3 Information We Do NOT Collect

  • Email addresses in plain text (only SHA-256 hashes if provided)
  • Advertising identifiers, ad network trackers, or any cross site tracking of what you do outside Trick Dash
  • Facial recognition data or biometric information stored on our servers (optional age verification is processed by Didit; see §4.8)
  • Payment card information (handled by third-party processors)
  • Medical records, lab results, formal diagnoses, or any health information beyond the optional Sexual Health profile fields described in §2.1 and the general body metrics in your profile

To be precise about analytics: the Trick Dash app itself does not load Google Analytics or any other third party analytics or advertising software. Our marketing website at trickdash.com and our public events directory at trickdash.com/events do use Google Analytics 4 to count visits. What that measures, how long it is kept, and how to switch it off is set out in §5.

3. How We Use Your Information

4. Storage and Protection

4.1 Infrastructure

4.2 Location Privacy

We do not store or share your precise GPS coordinates with other users. Instead:

4.3 Message Retention

Our servers hold a message only long enough to deliver it. A message is kept for up to 30 days and is then permanently deleted from both our database and our storage, along with any photos attached to it. Deleted messages cannot be recovered and we do not keep backups of them. Cleanup runs when a conversation is opened and again in a nightly sweep, so messages in conversations nobody has opened are removed on the same schedule. The 30 days is the same for everyone and is not something you or the person you are talking to can change. Your own device keeps your copy of the conversation, so your history stays readable there after our copy is gone.

4.4 Photo Metadata

Photos uploaded to Trick Dash (profile photos, album photos, Flashes, and chat photos) are stripped of EXIF metadata before transmission to our servers. EXIF data on phone photos commonly includes precise GPS coordinates (often the user's home address), camera model and serial number, and capture timestamp. We re-encode every uploaded image client-side via canvas to produce a fresh JPEG with no metadata, ensuring this information is never transmitted to us or to other users.

4.5 Vanity Usernames

You may optionally choose a vanity username (e.g., trickdash.com/@yourname) to share your profile.Vanity usernames are public identifiers by design. Anyone with the URL can view the corresponding profile.

4.6 Account Inactivity

If you stop using Trick Dash, we wind your account down automatically. If you signed up on the web and never shared a location, your profile may be hidden from the map and from search after about two weeks without activity. For everyone, after about two months of inactivity your profile is hidden from the map and from search, while your data is kept in case you return. After about six months of inactivity your account and all associated data are permanently deleted from our database and storage and cannot be recovered. Simply opening the app resets the clock. You can also delete your account at any time from Settings or at trickdash.com/delete.

4.6a Automatic Safety Actions and Abusive Accounts

To keep the community safe, Trick Dash automatically contains accounts whose activity matches patterns we associate with bots or spam. A contained account is hidden from other members or is asked to complete a quick face check before messaging can continue, and stronger cases are suspended. Every automatic action is recorded, and every one can be appealed: pass the face check shown in the app, or contact support and a human will review the decision and restore the account if it was made in error.

An account that stays contained for 30 days without a successful appeal or a passed face check, and that shows no signs of genuine human use, may be permanently deleted along with all associated data, and the deletion cannot be undone. An appeal or a face check that succeeds at any point before deletion stops it entirely. Accounts that are simply inactive are never deleted on this schedule: ordinary inactivity follows the wind down described in Section 4.6.

4.7 Authentication Audit Log

Authentication events (successful logins, failed login attempts, passkey registration and revocation, and recovery code use) are recorded in an append-only audit log with the request IP and user agent. The log is retained for 12 months for security investigation, abuse detection, and SOC 2 audit-readiness purposes. The log cannot be edited or deleted by application code; integrity is enforced at the database layer.

4.8 Automated Processing and Third Parties

Several Trick Dash features rely on automated systems or third-party processors. This section names every external service that touches user content, what is sent to it, what is returned, and what is retained.

4.8.1 Chat Translation (powered by an AI language model)

The translate button on profiles, chats, shouts, and groups uses Cloudflare Workers AI running the @cf/google/gemma-4-26b-a4b-it open-source language model. When you tap translate, the source message text is sent to Cloudflare Workers AI; the translated text is returned and shown only to you (it is not stored as a separate message). Cloudflare processes the request entirely on Cloudflare's infrastructure under our existing Data Processing Agreement; no external LLM provider (OpenAI, Google, Anthropic, etc.) receives the message. Translation is optional and on-demand. Untranslated messages never pass through the model. Workers AI does not retain prompts or responses beyond the request lifecycle per Cloudflare's published policy.

4.8.2 Photo Moderation (Sightengine)

Every profile photo, album photo, and chat photo uploaded to Trick Dash is sent to Sightengine for automated moderation analysis (nudity classification, weapon detection, hate symbol detection, minor likeness detection). Photos are also checked automatically for signs of having been generated by artificial intelligence rather than taken with a camera. Sightengine returns a numeric score per category; we store the scores alongside the photo record and use them to flag the photo for human review or auto-block it. Sightengine processes the image and returns the result within seconds; per their DPA they do not retain the image beyond the processing window. Sightengine is a subprocessor under our Data Processing Agreements and is bound by applicable privacy commitments. You cannot opt out of moderation while using Trick Dash because moderation is a safety-essential feature, but you can decline to upload photos.

4.8.3 Age Verification (Didit, optional)

If you opt into biometric age verification, Didit (operated by Didit GmbH) processes your government ID photo and a live selfie to confirm you are 18 or older. Didit returns only a verified/not-verified verdict and an estimated age range; we never receive, see, or store the underlying biometric template, the ID image, or the selfie. Didit retains its processing artifacts per its own privacy policy and applicable regulation. Age verification is optional in most places; users may instead rely on self-attestation at signup, and declining does not restrict access to the app's core features. In jurisdictions whose laws require age or identity verification for apps like ours (for example Arkansas under Act 612), completing verification through Didit is required before the app can be used there, and the verification method offered follows the standard the local law requires, up to a government ID check with a matching live selfie. In every case we receive only the pass or fail outcome.

4.8.3a Spam Verification (Didit)

If account activity matches patterns we associate with spam, such as sending obfuscated links or messaging many people in a short burst, we may ask for a quick face check through Didit before messaging can continue. The check confirms a live, real person. As with age verification, Didit processes the selfie and we receive only the pass or fail result; we never receive, see, or store the photo or any biometric data. An account owner who believes the check was triggered in error can contact support and a human will review it.

4.8.3b AI Generated Content and Automated Processing

Some of what you read on our public pages, and some of the checks that run in the background, are produced by artificial intelligence models rather than by a person. Here is the full list, what each one reads, and what it produces:

Two commitments go with this:

Automated decisions that materially affect you have a human review path. If an age check does not pass, if a hold is placed on your messaging by our spam checks, or if a photo is rejected by moderation, write to [email protected] and a person will review the decision. No account is permanently closed by an automated system without that review being available to you.

4.8.4 Automated Safety Scoring (internal)

Independent of Sightengine, every account carries an internal trust score derived from account age, verification status, report-free streak, and moderation history. This scoring runs on our own infrastructure and is not sent to any third party. The score influences how aggressively automated safety actions are applied (e.g., a brand-new account hits stricter rate limits than an established one). Users may request their current trust score via a Data Subject Access Request (§7).

4.9 Screenshot Protection on Sensitive Surfaces

In the installed Android app, Trick Dash asks the operating system to shield certain screens from capture: any open conversation, your private albums, and albums you have received. While one of these screens is open, Android prevents the content from being screenshotted, screen recorded, or shown in the recent apps preview. Because this also prevents screenshotting the text of a chat, we give you a copy option instead: press and hold any message to copy it, or use Copy conversation in the chat menu to copy the whole thread.

On Apple devices and when you use Trick Dash in a web browser, this capture blocking is not available: Apple does not provide a way for apps to block screenshots, and browsers give apps no control over screen capture. On those platforms, please assume that anything shown on your screen can be captured. And on every platform, no app can stop someone from photographing their screen with a separate device. For all of these reasons, treat screenshot protection as a deterrent, not a guarantee, and only share content with people you trust.

5. Website Analytics (Google Analytics)

Our marketing website at trickdash.com, including the language versions of the home page, and our public events directory at trickdash.com/events use Google Analytics 4, a measurement service provided by Google LLC. The Trick Dash app does not load Google Analytics. Signing in, browsing profiles, and messaging happen entirely outside this measurement.

How to switch it off. You can install Google's own opt out add on for your browser at tools.google.com/dlpage/gaoptout, or block cookies for trickdash.com in your browser settings, or use a browser or extension that blocks analytics scripts. Blocking it changes nothing about how the website or the app works for you. Google explains its own handling of this data at policies.google.com/privacy.

If you are in the European Economic Area, the United Kingdom, or Quebec. We rely on our legitimate interest in understanding how many people visit our marketing pages and which pages are useful, under Article 6(1)(f) of the GDPR. Under Quebec Law 25 this is measurement of use, not profiling: it is not used to build a profile of you, to target advertising, or to make any decision about you, and it never touches the app itself. You may object at any time by using any of the methods above or by writing to [email protected].

6. Information Sharing

We do not sell user data to advertisers. Information is shared only in these cases:

7. Your Rights

7.1 All Users

7.2 European Union (GDPR)

If you are in the EEA, you have additional rights:

Legal Basis: We process data based on contract (core features), legitimate interests (fraud prevention, safety), and consent (optional features).

7.3 California (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act:

8. Children's Privacy

The App is intended for users 18 and older. We do not knowingly collect data from children under 18. If we discover a user is under 18, we immediately terminate the account and delete all associated data. If you are aware of a minor using the App, please report to [email protected] immediately.

9. International Data Transfers

Your data is processed and stored in the United States (AWS us-east-1). If you are outside the United States, your data will be transferred to the U.S. for processing. We comply with GDPR and other laws through Standard Contractual Clauses where applicable.

10. Data Breach Notification

In the unlikely event of a data breach, we will notify affected users within 72 hours and notify relevant data protection authorities as required by law. Notifications will include details of the breach, affected data, and recommended actions.

11. Changes to This Policy

We may update this Privacy Policy at any time. Material changes will be notified through the App or email. Your continued use after notification constitutes acceptance of updated terms.

12. Contact

For privacy questions, data subject requests, or concerns:

Privacy Contact: [email protected]
Data Protection Officer: [email protected]
Mailing Address: Bunk Labs, Inc., 111B S Governors Ave, #81507, Dover, DE 19904, United States

For copyright complaints, our designated agent under the Digital Millennium Copyright Act is Dean Malka at [email protected], reachable at the mailing address above and by phone at +1 917 277 3222. The full notice and counter notice procedure is in our Copyright and DMCA policy.