Privacy Policy

Overview

Jilo (“Jilo,” “we,” “us,” or “our”) operates the Jilo mobile application and the website at jilo.app (together, the “Service”), a roommate-matching platform for the New York City metro area, including nearby New Jersey. This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Service. By creating an account or using Jilo, you agree to this policy. Jilo is intended only for people 18 and older.

Information we collect

Information you give us

• Account information: your phone number, and the verification code we send to it.
• Profile information: your name, date of birth and age, pronouns, occupation and employer (optional), languages, bio, prompt answers, and photos.
• Roommate and housing preferences: budget, target neighborhoods, move-in timing, room and lease preferences, lifestyle details (such as sleep schedule, cleanliness, daytime and late-night noise, guests, pets, smoking, and substance preferences), home habits (such as dishes, chores, conflict style, and home temperature), and your deal-breakers, collected through our onboarding questionnaire and editable in your profile.
• App settings: preferences you set in the app, such as appearance (light/dark), privacy toggles, and notification choices, so they follow your account across devices.
• Listings: if you post an open room, the details, photos, and location you provide.
• Communications: messages you send to other members and to us, including support and safety reports.
• Email address: if you join our waitlist on jilo.app or choose to receive email updates, we collect your email address so we can send you confirmations and updates.

Optional social account connections

You can optionally connect a LinkedIn or Instagram account to build your Jilo profile faster. Connecting is always your choice, started by you, and never required; the manual path offers everything the import does. When you connect:

• LinkedIn(via “Sign In with LinkedIn” using OpenID Connect): we receive your name, email address, and profile photo, and use them only to prefill your Jilo profile. You can edit or remove anything prefilled.
• Instagram(via Meta’s Instagram API with Instagram Login, available for professional accounts): we receive your username, bio, and a list of your recent photos. Nothing is imported automatically. Only the specific photos you select are copied to your profile, and your bio is offered as an editable draft.

Photos you import are stored with our media provider (Cloudflare R2) and screened by the same automated photo-safety checks as any photo you upload. The access tokens these connections use are encrypted and kept only on our servers, never on your device, and are used solely to fetch the content you ask us to import. Jilo never posts to your social accounts, never reads your messages or followers, and never uses these connections for advertising. You can disconnect either account at any time in Settings, which deletes the connection and its tokens; photos you already imported stay on your profile until you remove them. Deleting your Jilo account deletes your connections as well. LinkedIn’s and Meta’s own handling of your data is governed by their respective privacy policies.

Identity and verification information

• Phone verification: we verify your phone number by SMS one-time passcode through our authentication provider (Supabase Auth and its SMS carrier).
• Government ID and selfie:identity verification is performed by Stripe Identity. When you verify, Stripe collects your government-issued ID and a selfie (which may include biometric data used to confirm the ID matches you) and returns to us the verification result and limited details such as verified status. We use this only to confirm you are a real, unique person and to keep the community safe. See “Identity and sensitive data” below.
• Photo screening: profile photos may be screened by an automated image-safety service (such as Google Vision) to detect prohibited or non-compliant images.

Information collected automatically

• Device and app data: device type, operating system, app version, and a push notification token if you enable notifications.
• Usage and diagnostics: how you interact with the Service, and crash and error reports (via Sentry) and aggregate analytics used to operate and improve the app. If the app hits a fatal error, a technical error record may also be kept locally on your device so the app can recover and show you what went wrong; it stays on your device unless crash reporting sends it to us.
• Approximate location: we may infer a general region from your IP address for security and fraud prevention. Jilo does not collect precise GPS location. The neighborhoods on your profile are the ones you choose.

How we use your information

• Create and manage your account and authenticate you by phone.
• Build your profile, calculate compatibility, and surface and rank matches.
• Verify identity and screen photos to keep the marketplace real and safe.
• Power messaging between members you connect with.
• Send service communications and, if enabled, push notifications about matches, messages, and listings.
• Send transactional and update emails to the address you provide, such as waitlist confirmations and account or product updates.
• Detect, prevent, and respond to fraud, abuse, harassment, and policy violations.
• Provide support and respond to your requests and reports.
• Operate, analyze, and improve the Service.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

How we share information

With other members

Your profile (photos, name, age, neighborhoods, budget, preferences, prompts, and verification badges) is visible to other members in Discover and to people you connect with. Messages are shared with the member you send them to. You can limit visibility using incognito mode, by turning off “appear in Discover,” and by blocking members.

With service providers

We share information with vendors that process data on our behalf under contracts that limit their use of it, including:

• Supabase: authentication, database, and realtime messaging infrastructure.
• Railway: hosting and infrastructure for our application servers.
• Vercel: hosting for our website and waitlist sign-up.
• Stripe Identity: government ID and selfie verification.
• Cloudflare R2: photo and media storage.
• Google Vision: automated photo safety screening.
• Expo: push notification delivery.
• Resend: transactional and waitlist email delivery.
• Sentry and our analytics provider: crash reporting and product analytics.

If you connect a social account, we also exchange the data described under “Optional social account connections” with LinkedIn or Meta (Instagram). Those are connections you initiate, not vendors processing data on our behalf.

For legal and safety reasons

We may disclose information when we believe in good faith it is necessary to comply with the law or legal process, to enforce our terms, or to protect the rights, safety, and property of our members, the public, or Jilo.

Business transfers

If Jilo is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction.

Identity and sensitive data

Government ID images and any biometric data used for selfie matching are collected and processed by Stripe Identity as part of verification; Jilo’s systems primarily receive the verification outcome and limited identity details rather than your raw ID images. We use verification data solely to confirm identity and protect the community, not for advertising, and we retain it only as long as needed for those purposes and to meet legal obligations. Stripe’s handling of this data is governed by Stripe’s privacy policy.

Your choices and rights

• Access and export: you can export your profile data from within the app.
• Deletion: you can delete your account in Settings, which removes your profile, listings, connections, and messages. Safety reports may be retained without your account attached, as described below.
• Visibility: use incognito mode and the “appear in Discover” toggle to control who can find you, and block any member.
• Social connections: disconnect LinkedIn or Instagram anytime in Settings; disconnecting deletes the connection and its access tokens from our servers.
• Notifications: manage push notifications in the app and in your device settings.
• State privacy rights: depending on where you live (for example, California, Colorado, Virginia, and other states), you may have rights to access, correct, delete, or restrict certain uses of your information, and to appeal a decision. We do not sell personal information or use it for targeted advertising.

To exercise a right or ask a question, email parth@jilo.app. We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.

Data retention

We keep your information while your account is active. When you delete your account, we remove your profile, listings, connections, messages, and any social account connections (including their access tokens). We may retain certain records longer when needed to comply with legal obligations, resolve disputes, prevent abuse, or enforce our terms, for example, safety and support reports are retained for trust-and-safety purposes without your account attached.

Security

We use technical and organizational safeguards to protect your information, including encrypted transport, access controls, database-level security policies, and encryption at rest for social-connection access tokens. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond promptly to any incident.

Children

Jilo is only for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has used Jilo, contact us and we will remove the account.

International users

Jilo is operated from the United States and intended for use in the New York City metro area, including nearby New Jersey. If you access the Service from outside the United States, your information will be processed in the United States, where privacy laws may differ from those in your location.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you in the app. Your continued use of the Service after an update means you accept the revised policy.

Contact

Questions about your privacy or this policy? Email parth@jilo.app. Jilo is based in New York, New York.