Privacy Policy

What Amber stores

• Account: your email address, name, age, optional city and bio, the illustrated avatar you chose, and your password. Passwords are stored only as a one-way hash by the sign-in system; Amber never stores them in readable form.
• Preferences: what you are looking for, your preferred age range and the interests you pick.
• Activity: who you liked or passed on, your matches, your messages, voice notes and emoji reactions, and when they were sent. Photos sent to you in chats (AI-generated) are saved with the chat.
• Consent: the date and version of these documents when you agreed to them at sign-up.
• Sign-in sessions: each session records the IP address and browser type it was created from. Sign-up and login rate limits use one-way hashes of your email and IP address.

You can't upload photos to chats or profiles. The only photos Amber accepts are the optional ID verification photos below. Amber does not collect your location from your device, your contacts, or your card details.

Optional ID verification

• If you choose to verify, you upload a photo of your ID and, optionally, a selfie (JPEG, PNG, HEIC or WebP). Amber first checks the file type, size, dimensions and that the image isn't blank, re-encodes each photo with its EXIF metadata (including any GPS location) removed, and stores it encrypted with AES-256-GCM in the database on the Doha machine.
• The ID image is processed by xAI Grok via Google Vertex AI to tell whether it is an ID document and to read your date of birth. Only the image is sent, with a fixed instruction; your name, email, profile and the selfie are not. The request goes to Google's global Vertex AI endpoint, so it may be processed outside Qatar, under Google Cloud's terms for partner models.
• Amber computes your age from that date. A clear ID that matches your profile age is approved automatically. Unclear results, and any difference from the age on your profile, go to a review queue where an Amber admin views the ID (and selfie, if added) on an admin-only page, confirms the date of birth and approves or rejects. An admin may correct your profile age to match the ID. If the ID shows you are under 18, the account is locked.
• The photos are deleted as soon as a decision is made, and in any case after 30 days. Encrypted copies can remain in nightly backups for up to 7 more days, and in pre-update disk snapshots until those are deleted.
• After the decision Amber keeps only your date of birth, the status (approved, rejected, under review or expired), what decided it (the model id or the reviewing admin), and the timestamps. Your profile shows a “Verified” badge if approved; your avatar stays your picture. Admins get an in-app notice and a short email (with no images or personal details) when a request needs review.

Where it is kept

Account data and messages are stored in a PostgreSQL database and a self-hosted Matrix (Synapse) chat server. Both run on one Google Cloud virtual machine in the me-central1 region (Doha, Qatar). The databases are not reachable from the public internet. Federation with other Matrix servers is turned off.

The web addresses amberly.online and amberline-three.vercel.app use a Vercel gateway that forwards your requests to that machine and is set not to cache pages. Nightly backups of the databases are kept on the same machine for 7 days. Disk snapshots are also taken before app updates.

Messages and encryption

Chats travel over encrypted connections and are relayed through Amber's own Matrix chat server in encrypted form.

Your messages are processed by automated systems to provide the service, including generating replies (see the Terms), so Amber's servers read your messages. Amber also saves the text of each message, plus a transcript of each voice note, in its database so it can show your history and give replies context. People who operate Amber can therefore access your chats. Please don't share anything you need to keep secret.

AI providers (Google Cloud and xAI via Vertex AI)

To generate chat replies, voice notes and photos, Amber uses Google Cloud:

• Google Gemini on Vertex AI writes chat replies. Each request includes the matched profile and your conversation history in that chat, including voice-note transcripts.
• Google Cloud Speech-to-Text (Chirp) transcribes the voice notes you send.
• Google Cloud Text-to-Speech (Chirp voices) creates voice notes sent to you in chats. Voice notes are only used when you ask for one or send one yourself.
• xAI Grok on Vertex AI reads the date of birth from an ID image you upload for verification (only the image is sent; see ID verification).
• Gemini 2.5 Flash Image on Vertex AI creates a profile's photo when you ask for one. Each request contains the profile's stored reference portrait and a fixed scene description. It does not include your messages, your profile or any photo of you. Profiles send at most a few photos per chat per day and decline revealing requests.

Google processes this data under its Google Cloud terms. With Amber's default settings these services run on Google's global and US endpoints, so this data may be processed outside Qatar.

Cookies and browser storage

Amber sets one sign-in session cookie (HTTP-only, valid for up to 14 days) and nothing else. There are no analytics, advertising or tracking cookies. The only third-party code is our payment provider's secure payment form on the payment page, which runs in its own frame.

Your browser also keeps some data locally: an unfinished sign-up form (never your password), unsent chat drafts, whether you dismissed the encryption notice, and the chat client's working cache.

Sharing

Amber does not sell or rent your data and does not share it with advertisers. It is only processed by the providers above (Google Cloud for hosting and AI, Vercel for the gateway), our payment provider for the one-time access payment, or disclosed if the law requires it. The payment provider handles your card and billing details; Amber only receives a payment confirmation (payment ID, plan, amount, status and the email used) and keeps the payment ID, amount and a one-way hash of that email to unlock your account. No other member can see your account. Matched profiles never see your email. Verification photos are only processed by xAI Grok via Google Vertex AI and seen by an Amber admin if a review is needed; they are never shown to other members.

Screen privacy

Amber blurs the app when you switch away, adds a faint watermark with your name and handle, and blocks saving images and copying chat text. These measures discourage casual capture. They cannot stop operating-system screenshots, screen recordings, or someone photographing the screen.

Your choices, access and deletion

• You can change your name, age, city, bio, avatar and preferences at any time on your Profile page. Once your ID is verified, your age follows your verified date of birth.
• To delete your account, ask for a copy of your data, or correct something, email support@amberly.online.
• Deletion removes your profile, sign-in record, preferences, likes, matches, messages, reactions, chat photos, verification photos and verification records from the database. It also deactivates and erases your chat account and removes your chat rooms. Copies in backups expire within 7 days. Copies in pre-update disk snapshots last until those snapshots are deleted.

Otherwise, data is kept for as long as your account exists.

18+ only

Amber is only for adults aged 18 and over. If an account appears to belong to someone younger, it will be deleted.

Changes and contact

If this policy changes, the “Last updated” date above will change too. For questions, email support@amberly.online.