Trust, safety and your choices
Privacy Policy
Last updated 4 October 2026 · I Can Wait (formerly Attune) is operated from South Australia.
Name changed 5 October 2026: Attune is now I Can Wait. Only the name and the words around it changed; your rights and our obligations did not.
I Can Wait asks you unusually personal questions, because that is how it matches people. This page is a plain account of what that means for your data. It is written against what the software actually does, not from a template.
Checking your launch location
I Can Wait is open in Greater Adelaide only, including Gawler and Mount Barker. Before the camera age check we may check where your connection is, each time you sign in until your camera check has passed, using Cloudflare's approximate location for your IP address. A passed check lasts 30 minutes. If that cannot confirm Greater Adelaide, we ask for your device's location, which your browser or phone only gives with your permission, when you press the button for it. If, in that check, your device's location is outside Greater Adelaide, you cannot continue for now. Your network location is also checked when you save Adelaide as your city and when you open the member area, and a clear mismatch prevents saving Adelaide. Unavailable data and uncertain boundary readings are not proof of a mismatch. Device and network locations can be inaccurate or altered; this check does not verify your home address.
When we check your location before the camera age check, we also check whether your connection looks like a VPN, a proxy or a hosting network, and I Can Wait does not allow sign-up over one. To spot one we use two signals: your network provider's name and number, compared with a list of hosting companies and VPN providers, and your browser's time zone, compared with the country your IP address is in. When this check is in use and either signal is raised, you cannot start the camera check, and confirming your device's location does not change that; checking again from a connection that raises neither does. While this check is in use, our server reads the provider from each request in the camera check. The time zone is whatever your browser reports, so it is only a hint. This is a hint, not proof, and it can be wrong: it can flag a workplace or shared network, or a device whose time zone is set by hand, and it misses many VPNs. If you are wrongly blocked, write to [email protected]. If you write to us because you were wrongly blocked, an administrator can let your account past the location check for 24 hours. We record that it was done, by which administrator and when. Two accounts, used only by app-store reviewers to test I Can Wait, are exempt from the location check and the VPN block. The exemption exists for app review only.
Your coordinates and their accuracy are processed for this check and are not stored. On the basics form, when a device check confirms Greater Adelaide, the app also uses them on your device to fill in the nearest suburb; that suburb is saved, like one you type, only if you save the form. Nor are your IP address or your network provider's name stored with it. What is kept on your account is the outcome, which check decided it (network or device), whether a VPN signal was raised and which one, and the time. Our administrators can see these; they are in your data copy and are deleted with your account. They are not shared with matches. The outcome and time are also kept in your sign-in session for up to 30 minutes and removed with that session. Location permission is asked for only when you press a button for it, never continuously in the background.
1. Who we are
I Can Wait (formerly Attune) is a service of Robert Weeks AI Systems, the registered business name of Robert Weeks (ABN 41 104 020 501), South Australia. The I Can Wait website is icanwait.com.au (formerly attunematchmaking.com). In this policy, "we", "us" and "our" mean Robert Weeks trading as Robert Weeks AI Systems. It is a small independent operation, not a company with a privacy team. Contact for anything on this page, including access, correction and complaints: [email protected]. A postal address for legal and privacy matters is available on request.
2. What we collect
Most of what I Can Wait holds comes from you: what you type and tap, your camera check, and the photos you add. Some comes from your device or connection (a location you choose to share, your browser's time zone, and Cloudflare's approximate location for your network), some from other members (messages they send you and reports about you), and some from Apple and RevenueCat (your membership status). Some is worked out from your answers by software, as Sections 3 and Decisions made by computer programs describe. We hold it with our hosting provider, Cloudflare, in its database and in private file stores for pictures, and in the backup copies described in Section 6.
| What | Why |
|---|---|
| If you turn on Face ID or fingerprint sign-in: a public key your device made, which device it is, and when it was last used | To let that device sign you in. The face or fingerprint check happens on your device: we never see it, never receive it and could not reproduce it. |
| Your email address | It is your login. We send a six-digit code to it; there is no password. |
| If you sign in on another device with your phone: the request's random id, a fingerprint (a hash) of a secret only that device holds, that device's browser and system, the city Cloudflare gives for its internet connection, when the request was made and when it expires, its status, a one-time passkey challenge, when it was approved or declined, and your member id while you approve | So your phone can show which device is asking (such as "Chrome on Windows"), "Near" that city or "Not known", and the time, before you approve with Face ID; and so only the device that showed the code can collect the sign-in. Never that device's internet address or a precise location. The city comes from its internet connection, so it can be wrong. Your member id is cleared if you press "This wasn't me". Each code works once and lasts 2 minutes. The request is deleted by a cleanup that runs every 15 minutes once it has expired, usually within about 17 minutes, and with your account. Counts of requests and approval tries are kept for an hour by a keyed fingerprint of the internet address, never the address. |
| A record that you accepted the Terms and this Privacy Policy: which version of each, and when | So we can show that you agreed, and ask you again when either changes. Every member is asked. No IP address or device detail is kept with it. It is in your data copy and is deleted with your account. |
| Your answer on "Before we ask about you": which wording you saw, whether you agreed or chose "Not now", and when | So we can show what you agreed to before we collected your answers or sent them to an AI service, and ask you again if the wording changes. No IP address is kept with it. If your latest answer is "Not now", you are left out of matching until you agree. It is in your data copy and is deleted with your account. |
| The result of your location check: the outcome, whether your network or your device decided it, whether a VPN signal was raised and which one, and when | I Can Wait is open in Greater Adelaide only, and while the location check is in use it does not allow sign-up over a VPN. Never your coordinates, your IP address or your provider's name. See "Checking your launch location" above. |
| Your first name | Shown on your match cards and in chats with people you have matched with. Your account name is not attached to interview requests; names typed in answers can be sent. |
| A creator's code, if you type one when you join | So we can pay the creator who introduced you. They are only told how many people used their code, never who. It is kept on your account, not in your profile, and is not sent to the AI companies. |
| Age, gender, who you are looking for, age range, city, distance, intent, whether you want children | The hard rules for matching. Who you are looking for can show your sexual orientation. Self-reported age does not verify adulthood; I Can Wait requires a separate age check: a qualifying AI estimate, or human review of qualifying camera pictures or photo ID. |
| Height, body figure (the drawing you pick as closest to your build), diet, faith, politics, smoking, vaping, cannabis, other drugs, gambling, alcohol; and your answer about smacking, only for the smacking filter you or another person switch on | For filters you or another person switch on. Never shown on a match card. Height and body figure are needed before you appear in matches. These answers are not sent to AI services to read your profile, but any filter you set yourself is described in the facts sent to the AI service that writes your private report (for example "No smokers at all", or "Same faith as you", which names your faith). Your faith is also used to suggest first messages, only when you and a match gave the same faith. |
| The body figures you would like to be matched with | A deal breaker you set: figures you leave untapped are not shown to you, and you are not shown to them. Never shown to anyone else. |
| The interests you pick under "What are you into?" and the topics you like talking about | Shown on a match card only where you both picked the same one. Shared interests add up to 9 points of 100 to a match score, and shared topics up to 6. Very common picks count for less. |
| Your interview answers, in full | The main basis of matching. Stored as written. Nothing is saved until you agree on "Before we ask about you". |
| Your relationship style: monogamous, open or non-monogamous | Required: you cannot finish your questions without it. Used for matching, as one part of the score, and named in the facts sent to the AI service that writes your private report. It is not sent with your other answers to read your profile, is never used to suggest first messages, and is never shown to matches. |
| A profile derived from those answers: traits scored 0 to 1 across energy, personality, attachment, communication, values, life direction, finances, relationship dynamics, parenting plans and desires, with short quotes from your answers as evidence | What the matching actually compares. Worked out by the AI services in Section 3, including things you did not tick, such as how important faith is to you. A firm "hard no" read from your answers can rule people out. See Decisions made by computer programs. |
| If you opt in: responses about upbringing and past relationship patterns | Used only to write your own private report. Separate consent, asked separately, and you can decline. Raw answers are stored in your interview and, while your opt-in stands, sent to the AI providers listed in Section 3 when your report is written. Since 30 September 2026, no traits are derived from them and they are not used for matching; traits derived before then are no longer used. Not shown to other members. Anything you write about your upbringing in other answers is treated like any other answer. |
| If you opt in: your answers in the intimacy section | Separate consent, asked separately, and you can decline. I Can Wait reads what you tap itself, without sending it to AI services, to work out how often and how important intimacy is to you and which dynamics you are into or open to. Those are kept in a separate private record and compared softly with other members'. Matches see only an overall level, such as "high" ("unknown" where either record dates from before 30 September 2026). Anything you type on these cards is saved for you and not read. If you write about intimacy in a correction to your report, that is sent to AI services like your other answers. Answers given before 30 September 2026 were sent to AI providers, as the earlier version of this page described. |
| That you ticked "I agree to the camera check as described above": the version of the notice and the time, kept with each camera attempt | So we can show you agreed before your camera started. The camera never starts without it. Replaced by your next attempt's record; in your data copy and deleted with your account. |
| Still photographs from your liveness check | Cloudflare Workers AI assesses the camera challenge and, unless you skip it, estimates your age range from one photograph. Passing camera attempts that require human age review store three photographs in a separate private file store, accessible through administrator review controls. Each time an administrator opens them is logged. We request deletion when the review is decided, when pictures are replaced or when the account is deleted. Undecided pictures are scheduled for removal after 14 days; failed cleanup is retried. An AI age pass or failed camera attempt does not save new pictures to our review store. Provider processing and retention are separate; see Sections 3, 4 and 6. |
| If your camera check passes: an AI estimate of your age range, made from one of those photographs, unless you skip it | You pass the age check without showing ID only if its lower end is 25 or more, its range is no wider than 15 years, and no writing, card, sign, paper or screen is visible in the picture it was made from; otherwise a person reviews your pictures and may check your photo ID. The estimated range is not kept once your age check is decided: if the estimate passes you, we keep only that you passed, the method and the date; otherwise the estimate is kept for the person who reviews your check and deleted once they decide it, or when you start a new check. Either way it is deleted with your account. |
| Human age review outcome, method, time and reviewer reference | When a person reviews your age check, they look at your camera pictures. They may approve from those alone only if you clearly look 25 or older and the AI's estimate of your age range reaches 25 at the top and 18 at the bottom; otherwise they check photo ID showing you are at least 18, live against the original or from a photo of your licence you upload when asked. The decision record contains the outcome, method, time and reviewer reference. An uploaded document is temporarily stored as described below; we do not extract its number or birth date into separate account fields. Do not email ID. When a person approves your check, asks for a photo of your licence or declines it, we email you to say so; we keep a record that such an email was sent and when, not who it went to. If your check is closed you cannot start a new one unless we reopen it. |
| If a person asks for it: a photo of your licence | Only when the person reviewing your age check asks for it, to compare with your camera pictures and confirm you are 18 or older. Kept in a separate private file store, accessible through administrator review controls. We request deletion when the check is decided, when the picture is replaced or when the account is deleted. Undecided pictures are scheduled for removal after 14 days; failed cleanup is retried. The photograph contains whatever details you leave visible until removal. We do not extract licence numbers or birth dates into separate account fields; after review we retain the outcome, method, time and reviewer reference. See Section 6 for remaining retention limits. |
| If you press "I can't use the camera check": the option you choose, any note you add (up to 500 characters), and when | So a person can email you within 2 business days to arrange another way to check your age: in person, or on a live video call on Google Meet, where they look at your original photo ID and do not keep a copy. You don't need to tell us why. Only our admins, who check ages, see the option and the note. Both are deleted when a person decides your age check, when you start a camera check, or when you delete your account. They are in your data copy. As for any age check, the outcome, method, time and reviewer reference are kept. |
| Your optional introduction usefulness feedback | Helps evaluate introductions. It is private to us and is not shared with the other member. |
| Messages with people you have matched with | So the conversation exists. |
| Your private conversation read progress | To show your unread message count across devices. This progress is not shared with the other member and is removed when either account is deleted. |
| Reports and blocks you make or that are made about you | Moderation. |
| Our admin log: each time an admin opens age-check pictures (a licence photo included), the messages in a report, a reported member's photos or a hidden photo; each decision or change an admin makes, such as restoring a hidden photo; each photo the photo check hides (which photo and why) and each upload it refuses as nudity with a child; and each deletion of age-check pictures, and of photos by a clean-up, with how many and why | So there is a record of who looked at what, and when. Every view is logged before anything is shown; if it cannot be logged, nothing is shown. The log never holds a picture, an ID number or message text. The database refuses any change to a log entry, and any deletion other than these scheduled ones: the entries about an age check (who opened its pictures, and its decision) are deleted when the check is decided (the pictures and who opened them straight away, the decision's entry within a day), and the decision itself stays on your age-check record; every other entry is deleted 2 years after the end of the calendar year in which it was written. After you delete your account, entries name you only by an internal id. Only our admins can open the log. The entries about you are also in your data copy (Account), except entries about reports other people made, and you can ask us for them. |
| Safety-report submission counts linked to your account | Limit report flooding, with separate routine and urgent allowances. These counters contain your account reference, count and window start, not report text. They reset after an hour and expired counters are scheduled for cleanup every fifteen minutes; failures can delay cleanup. They are also removed with your account. |
| If you list an event or place: your name, email, organisation, and the listing's details | To check the listing before it appears and to contact you about it. Members see only the listing, never your name or email. |
| Listing-form counts, by a keyed fingerprint of your IP address (not the address itself) | Rate limiting, so the form cannot be used to flood us. The counters reset after an hour and expired ones are scheduled for cleanup every fifteen minutes; failures can delay cleanup. |
| Login-code request and passkey sign-in attempt counts, by email and by a keyed fingerprint of your IP address (not the address itself) | Rate limiting, so the login route cannot be used to send mail at strangers. The address counters reset after an hour and expired ones are scheduled for cleanup every fifteen minutes; failures can delay cleanup. |
| Event map requests, by a keyed fingerprint of your IP address (not the address itself) | Rate limiting, so the map's access key cannot be collected in bulk. The counters reset after an hour and expired ones are scheduled for cleanup every fifteen minutes; failures can delay cleanup. |
Launch waitlist
The launch waitlist asks you to confirm that you are 18 or over and to choose where you live (metro Adelaide, regional South Australia, or another Australian state or territory) before collecting your email address and a separate choice to receive launch emails. An accepted signup stores your email, where you live, signup source and time, and the consent notice version and time. We do not collect your exact birth date for the waitlist. Joining creates no account or paid subscription, and is not consent to general news, events or offers. To withdraw consent and request removal, contact [email protected]. Waitlist details are stored with our hosting provider, Cloudflare; they are not used for AI matching. If you have a member account with the same email, its export includes your waitlist consent receipts and account deletion removes those receipts and the waitlist entry. People without an account can contact us for access or removal.
New waitlist signups receive a private link on the confirmation screen to stop launch emails without signing in. Save that link; it only withdraws consent and does not show your email or account information. We store its random token and, if used, the withdrawal time. Submitting your email again does not reverse a withdrawal or reveal an existing private link. If you lose the link or joined earlier, contact us for help. Withdrawal stops launch emails; it does not itself delete the waitlist record. Account export includes the withdrawal time without the token, and account deletion removes this record. Waitlist-only removal is available through support.
The launch email is sent once, and only to waitlist entries in Metro Adelaide whose sign-up included "Email me when I Can Wait launches where I live", that have not withdrawn, and whose address does not belong to a member account that has turned optional emails off. It carries its own unsubscribe link.
To limit repeated signup requests, the application converts the request's network address into a keyed fingerprint and keeps an attempt count for a one-hour window. It does not store the raw network address in that counter. Expired waitlist counters are scheduled for cleanup every fifteen minutes; an operational failure may delay cleanup. This does not describe separate infrastructure logs maintained by our hosting provider.
Sensitive information
Religion, political opinions, sexual orientation and practices, health-adjacent psychological material, and biometric information used for verification are all sensitive information under the Privacy Act, which needs your consent. The core questions collect some of it (who you want to meet, faith, politics, your relationship style, and habits like drinking or drugs), so "Before we ask about you" asks for your agreement before any of it is saved, and the camera check asks for its own "I agree" before your camera starts. Optional sections have separate consent controls and can be skipped or withdrawn in Account. Skipped information is treated as unknown, except that a blank answer counts against you for a few filters other people set (see Decisions made by computer programs); providing more information does not guarantee a better match.
What we deliberately do not collect
- No health or STI screening. We considered it and dropped it: excluding people on that basis is very likely unlawful under the Disability Discrimination Act 1992.
- No criminal-history, credit, or financial checks.
- No income, job, wealth, race or ethnicity as matching factors. The engine refuses these by name.
- No identity-document numbers extracted into account fields. A reviewer may sight your original document during a supervised check or review a licence photo uploaded when requested. Uploaded photographs are temporarily stored, with deletion requests and cleanup retries as described above. The decision record retains the outcome, method, time and reviewer reference.
- Browser storage and security services. I Can Wait stores a sign-in token in session storage, or local storage when you choose to remember the device. It also stores settings such as your camera choice and passkey prompt preference, and may cache public app files for loading. Sign out and clear site data on a shared device when finished.
Our application does not include advertising pixels or a third-party marketing analytics SDK. Our hosting provider, Cloudflare, adds security-challenge scripts and may use security cookies or browser signals to distinguish legitimate visits from automated abuse. This processing is separate from our sign-in storage. See Cloudflare's cookie information. A page that sets no cookie on its first response may still run security checks afterwards.
Cloudflare also counts visits to this website with Cloudflare Web Analytics. It sets no cookies and stores nothing in your browser. We see totals, such as page views and which pages were visited, not who visited.
3. Your interview answers go to AI companies overseas
This is the disclosure that matters most, and the one a generic policy would bury.
Before any of this happens, the card "Before we ask about you" explains it and asks you to agree. It comes after your age check and before the basics form; members who joined earlier see it at their next sign-in. Until you agree, I Can Wait saves no new answers of yours and sends none to an AI service. If you choose "Not now", that choice is recorded, you are left out of matching until you agree, and the card comes back when you open your questions or your report. Once you have agreed, the way to stop it is to delete your account in Account.
To read your answers and write your private report, I Can Wait sends them to whichever of these is available:
| Provider | Where |
|---|---|
| Groq | United States |
| Cerebras | United States |
| Mistral (supported in software; not currently configured) | France |
OpenRouter was previously configured as a fallback. That route is now disabled; a stored credential alone cannot enable it. This change does not delete any requests previously received by a provider.
What is sent, and when:
- While you answer your questions: nothing. There are no AI follow-up questions.
- When you finish your questions, edit a saved answer or send a correction: your answers with their questions, so they can be read into the profile in Section 2. Not sent: the basics form, your relationship style, the intimacy section, the "What shaped you" questions, the questions about raising children and the love-language card. Every correction you send is included, whatever it is about.
- Each time your private report is written (when you open it, at most four times an hour): a list of facts about you, such as your relationship goal, whether you want or have children, your relationship style, the filters you set and how important faith is to you as the AI read it; and your answers except the intimacy section, with the "What shaped you" answers only while you have opted in. What comes back is shown only to you.
- After you and a match both say yes, and only once you have both agreed to "Before we ask about you": your score, the things you both picked yourselves (faith only if you both gave the same faith on the basics form) and the two strongest areas of your match, to suggest first messages. Suggestions that mention politics, sex, relationship style, habits or health are dropped. Until you have both agreed, you see fixed suggestions instead.
We do not attach your account name, email or photos to these requests. Before any text is sent, I Can Wait takes out the email addresses, phone numbers, web links, social media handles, street addresses and ID-like numbers (such as licence or card numbers) it finds, and puts a word in brackets in their place, such as [email]. Your saved answers are not changed. It cannot find everything: names are not taken out, nor are details written in words ("bob at gmail dot com"), a handle without an @ or a label such as "insta:" before it, a street without a house number, or a number shorter than six digits. Your free-text answers can still identify you or another person. Avoid including names, addresses, contact details or document numbers.
We do not control how each provider logs or retains what it receives; that is governed by their own terms. Groq says it does not keep requests by default, but may keep them for up to 30 days to check for abuse and reliability. Cerebras says it does not keep what it receives. If your answers include something you would not want a third party to hold, do not write it.
Your liveness photographs are processed by Cloudflare Workers AI, not by the providers above, and so are the profile photos you add. Cloudflare publishes no retention period for Workers AI and says it does not use your content to train its models without your consent.
Decisions made by computer programs
Some decisions about you are made by software alone, or mostly by software. This table lists each one, what it decides, the information it uses, and where a person comes in. To ask a person to look at any of them, write to [email protected] with "Review" in the subject, or use Complaints and appeals. A person reads every request and checks the records behind the decision. For matching, a person cannot make the software introduce you to someone, but can check that your answers and filters were read as you meant and help you correct them.
| Decision | What the software decides, what it uses, and where a person comes in |
|---|---|
| Who you are introduced to | Each night, it scores you against every other eligible member and introduces you to people who score 75 or more out of 100, best score first, up to 5 new people a day. Up to 15 of the points come from interests and topics you share. Nobody is introduced to you twice. Each person's introductions are chosen separately, so someone may be introduced to you without you being introduced to them. When you open your matches, an introduction you have not both accepted disappears if the score falls below 75, a deal breaker now rules it out, or either profile is no longer complete. Uses: Your profile as read from your answers (Section 2), your basics form, your relationship style, your intimacy taps if you opted in, and the interests and topics you picked; the same for the other person. A person: None. No person chooses or checks introductions. |
| Who is ruled out | It never introduces two people if either one's rules rule the other out: the gender each wants to meet, age range, relationship goal (serious and casual, or friendship and romance, are not matched), children (wanting them and not wanting them; "no children" and a parent), distance or city when neither will relocate, and any filter either person set: height, body figure, diet, a habit, faith, politics, partying, tattoos, piercings or smacking. A blank answer also rules you out of someone's filter on height, body figure, partying, a habit "at all", or smacking "never". Uses: Your basics form and deal breakers, and the other person's. A person: None. You can change your own deal breakers in Account at any time. |
| Hard nos read from your answers | If the AI reading finds a firm "hard no" in your answers (for example "no drugs at all, and that is firm"), it rules out anyone whose own answer matches it. If you say a behaviour would end things, such as the silent treatment or a raised voice, it rules out anyone whose own answers, as the AI read them, clearly show that behaviour. Job, money and race are never used this way. Uses: Your answers and the other person's, as read by the AI services in Section 3. A person: None. If one was read wrongly, edit your answer or send a correction, or write to us. |
| Whether you are in matching at all | You are matched only while your profile is complete, your age check has passed, your height and body figure are on file, you have a main photo others can see (one the photo check has not hidden), you have a membership (while I Can Wait requires one), you are not suspended or being deleted, and your latest answer on "Before we ask about you" is not "Not now". Uses: Your account and membership status, your age-check result, whether your main photo is there and not hidden, and your answer on the card. A person: A suspension is a person's decision. The rest is automatic. |
| Whether your profile is complete | Only when you have answered every required question, chosen a relationship style, and the AI reading found something usable in each of eight areas: energy, values, attachment, readiness for a relationship, communication, finances, relationship dynamics and desires. If not, you are asked to say more. Uses: Your answers as read by the AI services in Section 3. A person: None. |
| Your profile | The AI services read your answers and score traits from 0 to 1, with short quotes from your answers as evidence. The software then sets aside refusals and vague answers, and uses your taps instead of the AI's reading wherever you tapped. This includes things you did not tick, such as how important faith is to you. These scores are what matching compares. Uses: Your answers (Section 3 lists what is and is not sent). A person: None. You can read your private report, send a correction or edit your answers. A correction is read again by the AI, not by a person. |
| The camera check and the AI age estimate | It checks that the three camera pictures show a live person making the moves asked. A fail is decided by software alone; you can try again (up to 5 checks an hour) or press "I can't use the camera check". Unless you skip it, it also estimates your age range from one picture, and passes you without a person only if the range starts at 25 or more, is no wider than 15 years, and no writing, card, sign, paper or screen is visible in that picture. Uses: Three pictures of your face and the estimated age range. A person: Every check the estimate does not pass goes to a person, who can also revoke an AI pass. When a person reviews your pictures, they may approve from the pictures alone only if the AI's estimate reaches 25 at the top and 18 at the bottom; otherwise they check photo ID. |
| Where you are, and VPNs (while the location check is switched on) | It refuses the camera check unless your network's approximate location, or your device's if you share it, is in Greater Adelaide, and refuses it if your connection looks like a VPN, proxy or hosting network. Whether or not this check is on, the basics form refuses a city other than Adelaide, and refuses Adelaide when the location check found a clear mismatch. Uses: Your network's approximate location, your device's location if you share it, your network provider's name and number, and your browser's time zone. A person: If you are wrongly blocked, write to us: an admin can let your account past the location check for 24 hours. |
| Photos | Cloudflare Workers AI checks each photo before it is published, and refuses nudity or sexual images (swimwear at a beach or pool is fine, including men's bare chests), any child or young teenager anywhere in the photo, more than 3 people clearly in the photo (distant strangers in the background don't count), unclear photos, and a main photo without a clear face. If the check is unavailable, nothing is published. A refused photo is never stored by I Can Wait. Photos approved under earlier rules may be checked again by the same software when an admin runs the check. A photo that fails is hidden from other members and deleted 30 days later unless you replace or remove it; if it is your main photo, you are not introduced to anyone new until you add a new main photo that passes. A photo it reads as nudity with a child is hidden from everyone, you included, and held, and your account is suspended while a person reviews it (see Profile and lifestyle photos). Uses: The photo. A person: None when it decides. If you think a refusal is wrong, ask for a check through Complaints and appeals. A person can restore a hidden photo if you ask there, except one read as nudity with a child. |
| Chat messages | It refuses to send a message containing a slur or certain abusive words, and does not store it. A message about money, gift cards, crypto or investments is delivered, and the person receiving it sees a tip about scams. Uses: The message. A person: None. |
| Reports | A report always closes the reporter's chat with that person. A report of a threat or violence, intimate images shared or threatened without consent, someone who appears to be under 18, or sexual content involving a child also blocks contact both ways straight away, before a person sees it. Uses: The kind of report chosen. A person: A person reviews every saved report and decides any action, such as a suspension. |
| The intimacy level a match sees | If you opted in, it works out from your taps an overall intimacy level (high, medium, low, or unknown for a record from before 30 September 2026) that a match sees, and uses it in the score. Uses: Your intimacy taps and the other person's. A person: None. |
| First-message suggestions | It drops any AI suggestion that mentions faith (unless you both gave the same faith), politics, sex, relationship style, habits or health, and uses fixed suggestions if none is left. Uses: The suggestions written by the AI services in Section 3. A person: None. |
| The founding rate | It gives the founding rate to the first 10,000 paid members, from one counter, in the order purchases are recorded. Uses: Your purchase and when it was recorded. A person: None. |
| Limits and other refusals | It refuses an age under 18, or an age range starting under 18, on the basics form; tries past a limit, such as 10 sign-in codes, 5 camera checks or 12 photo uploads an hour, or 30 chat messages a minute; and sign-in for an email address whose earlier account was suspended and then deleted, or deleted because its holder was under 18. Uses: Your answers, counts of your recent tries, and a one-way fingerprint of your email address. A person: The limits reset on their own. The email refusal follows a person's earlier decision; write to us if you think it is wrong. |
Optional relationship review and email choices
The additional relationship self-review stores your selected answers and any text you choose to enter, including optional past-hurt reflections, star sign and supplied Human Design type. It uses fixed rules, is private to you, is not sent to text-AI providers and does not change matching scores. You can skip questions, edit or clear answers, and turn off past-hurt reflection and save to remove those review answers. Separate optional interview answers are removed through Account. See how the review works.
Optional news, events and offers require a separate choice in Account, off by default. We record the choice, time, source and notice version. Each optional email has an unsubscribe link that works without signing in. Signing up or joining the waitlist does not opt you into marketing. Login codes and necessary account communications are separate. Email preference records are included in your export and removed with your account.
Necessary notices, such as notice of a change to the Terms, go to every member with an account, whatever their choice about optional emails. When I Can Wait sends one email to many people (a required notice, or the launch email to the waitlist), it keeps the subject and the words, and who it went to only as a keyed fingerprint of each address, never the address. Every email from I Can Wait names its sender: Robert Weeks AI Systems, the registered business name of Robert Weeks (ABN 41 104 020 501).
4. Who else touches your data
| Who | What they handle | Where |
|---|---|---|
| Cloudflare | Hosting, the database, private file storage for age-check pictures and profile photos, the liveness model, the AI age estimate, photo checks, and counting visits to the website (Web Analytics) | Global, including the United States |
| Groq and Cerebras | Reading your answers, writing your private report and suggesting first messages, as Section 3 describes | United States |
| Resend | Delivering email, including your address, login-code message, age check result emails and delivery metadata. Resend says it keeps emails and their logs for 30 days, and that one of its sub-processors checks a small sample of emails. | United States |
| Google (Gmail and Google Meet) | Our email address, [email protected], is a Gmail account, so Google holds the emails you send us and our replies. For an age check on a live video call, the call runs on Google Meet, from a link emailed to you from that address. The call is not recorded. | United States and other countries where Google operates |
| Apple | Processes iPhone membership payments under Apple's terms. I Can Wait receives purchase and renewal status, never your card details. | United States and other countries where Apple operates |
| Apple (Apple Maps) | Shows the events map. Your device asks Apple for the map directly, so Apple receives your IP address, the area of the map you look at, and normal browser request information. Our server gives your device a map access key that lasts 30 minutes, and sends Apple nothing about you. | United States and other countries where Apple operates |
| RevenueCat, Inc. | Keeps iPhone subscription records for I Can Wait. The iPhone app and I Can Wait identify you to RevenueCat only by a random app user ID that I Can Wait creates for you, never your name, email or I Can Wait member ID. RevenueCat receives your App Store purchases, renewals, cancellations and refunds, and notifies I Can Wait when they change. I Can Wait then reads your record by that ID: the product, the store, when it was first bought, when it ends or was refunded, whether renewal is switched off, whether it was a test (sandbox) purchase, and whether you bought it or have it through Family Sharing. I Can Wait keeps your membership's product and dates and does not store RevenueCat's notices; Apple's transaction reference and the notice's ID are kept only when a purchase needs the owner's attention. RevenueCat's software in the iPhone app also sends RevenueCat the technical details of each request, such as your device's IP address. Deleting your I Can Wait account deletes our link to that ID; it does not delete RevenueCat's or Apple's records, or cancel an Apple subscription. | United States |
We do not sell your data. We do not share it for advertising. There is no advertising.
Profile and lifestyle photos
You can have 3 photos in total: one main photo with your face clearly visible, plus up to two others. Cloudflare Workers AI checks each photo before it is published and refuses nudity or sexual images (swimwear at a beach or pool is fine), any child or young teenager anywhere in the photo, more than 3 people clearly in the photo, unclear photos, and a main photo without a clear face. If the check is unavailable, nothing is published. A refused photo is never stored by I Can Wait. Approved images are stored in a private Cloudflare R2 bucket, separately from verification images. Embedded photo metadata is removed. Eligible paying matches can see approved photos as soon as an introduction appears, before either person accepts. Authenticated moderators may view a reported account’s photos while reviewing an open report, and each view is logged. Photos are not publicly accessible and are not sent to the interview-writing providers.
Photos approved before these rules may be checked again by the same software, when an admin runs the check. A photo that fails is hidden from other members and shown to you with the reason, and it is deleted 30 days after it was hidden unless you replace or remove it sooner. If you think the check got it wrong, ask through Complaints and appeals: a person can look at the photo and restore it. If your main photo is hidden or missing, you are not introduced to anyone new until you add a new main photo that passes the check. If you had more than 3 photos, other members now see only your main photo and the first two others in your order; you choose which to keep and the rest are deleted when you choose, and extras nobody chose are deleted 30 days after this change.
A photo the check reads as nudity with a child is handled differently. It is hidden from everyone, you included, and you see only that a photo was removed. Nobody can open or restore it in I Can Wait, admins included. Your account is suspended while a person reviews it, and our administrator is alerted to report it to the Australian Centre to Counter Child Exploitation (ACCCE) the same day, without the image. The photo is kept on a legal hold: no timer, change you make or account deletion removes it. It is deleted only when an admin releases the hold, for example once the police or the ACCCE say they do not need it. A new photo the check reads this way is refused and never stored, as for any refusal.
Our admin log records each photo the check hides (which photo and why), each time an admin opens or restores a hidden photo, and how many photos each clean-up deleted. It never holds an image.
You can replace or remove photos in Account. Active photo files are removed when you remove a photo or delete your account; temporary unpublished storage leftovers are retried through cleanup. Photo slot details, and for a hidden photo the reason and the date (a photo removed for nudity with a child is listed only as removed), are included in your account export; individual photo files can be saved from Account. Automated photo checks can make mistakes: if you think a refusal is wrong, ask for a check through Complaints and appeals. Report inappropriate images from the match or conversation.
5. What other people see
I Can Wait shows compatibility before it shows a person. A match card carries your first name, age, gender and city, a score, the reasons behind it, a note on what the score cannot predict, and any interests and topics you both picked. It does not carry your interview answers, your trait scores, your habits, your relationship style, or your verification photographs. Nothing on a card comes from the optional questions about your upbringing: those answers are not used for matching at all. Eligible paying matches can see approved profile and lifestyle photos as described above. Other members receive an intimacy compatibility label, such as "high", rather than intimate answers. This restriction does not prevent the AI processing described in Section 3.
Feedback and bug reports
When you use "Send feedback or report a bug" (in Account, in the app's menu, or "Feedback" at the foot of this website), we keep what it is about and what you write, the time, and an email address only if you leave one in the box. If you are signed in, the email box starts with your account’s email address, and you can change it or clear it before you send. The app adds the page you were on (its name or address, never anything after a question mark), the app version, whether you used the website, the iPhone or Android app, or the desktop app, and a rough description of your device: your browser and operating system, such as "Safari on iOS", never the full browser details. It also keeps your member ID if you were signed in. We do not keep your network address, your location or your answers with it. To stop the form being flooded, we count what is sent: if you are not signed in, from your connection for an hour, as a keyed fingerprint of its network address (for an IPv6 address, of its /64 network) rather than the address itself, and in one count of everything sent by people who are not signed in; if you are, from your account for a day.
To fix problems and improve I Can Wait: that is all we use it for. It is not used for matching, and it is not sent to any AI service. Only our administrators read it. A new report that something is not working also sends one administrator a short email notice through our email provider. If you were signed in, it quotes the first 200 characters of what you wrote; if you were not, it quotes none of it. The email address you give is used only to reply to you about what you sent. Feedback is deleted automatically one year after you send it. Deleting your account deletes the feedback you sent while signed in, and any that gives your account’s email to reply to, straight away. Feedback you sent while signed in is included in your data download.
6. How long we keep it
Deleting your account removes your user record, your record of accepting the Terms and this policy, your answer on "Before we ask about you", your location check result, profile, interview transcript, intimacy responses, match cards, messages, blocks, verification record and camera agreements, the camera pictures and any licence photo kept for an age check review, any request to check your age without the camera and its note, waitlist entry, report feedback, phone sign-in requests, rate-limit counters, payment entitlement, and the record that a required notice or the launch email was sent to your address, subject to these exceptions:
- Messages that are evidence in an open report survive your deletion and are removed when the report is resolved. Otherwise anyone could erase the proof of what they did by deleting their account.
- The record of a report is kept for 5 years from when it was made, even if either account is deleted, because Australia's online safety rules require it: what kind of report it was, its dates, what we did and the members' internal ids (the reporter's becomes "deleted" if they delete their account). While a report is open, we keep its words and the messages it points to so a person can review it. When we resolve it, its words are deleted; the record is then kept until 5 years after the report was made, with no messages.
- If your account was suspended, a one-way fingerprint of your email is kept so a suspended person cannot immediately return. It cannot be reversed into your address. The same fingerprint is kept when we delete an account because we learned its holder is under 18, so that address cannot be used to sign up again.
- If a person closed your age check and you then delete your account, a one-way fingerprint of your email is kept, so that an account made again with that address starts with its age check closed. It cannot be reversed into your address, it does not stop you signing in, and we remove it if we reopen the check.
- The email address you signed up with is kept as a one-way fingerprint for 2 years after you signed up, even if you delete your account, because the online safety standard for dating services requires it. It is kept only so the same address can be recognised in a safety investigation; nothing in I Can Wait checks new sign-ups against it, and it cannot be turned back into your address.
- A photo the photo check read as nudity with a child is kept on a legal hold, unopened, even if you delete your account, until an admin releases the hold (see Profile and lifestyle photos).
- Payment replay protection and unresolved payment issues may retain checkout, invoice or subscription references, event references, dates and fixed failure codes. These records omit your I Can Wait member ID and contact details, but a payment provider can link its references to its payment records.
- Provider/model/day AI usage totals and operational matching totals contain no interview text or member contact details. They are retained to understand reliability and costs. A matching job may temporarily retain an opaque cursor until the next run.
- Verification pictures are held separately from the database and removed after review, account deletion or the review-retention period. Failed cleanup is retried; a storage expiry rule provides a backstop. Database recovery history and provider logs can outlive active-record deletion. We have not established a single guaranteed deletion deadline across all provider logs and recovery copies. Contact us for the status of a specific deletion request. Recovery copies must not be used to restore withdrawn information to active service.
- A listing you send us is kept with your name and email whether or not it is approved: while it waits for review or is listed, and afterwards as the record of what was reviewed. Ask at [email protected] and we will remove your details.
- A passkey is deleted with your account, and the moment you remove that device under Account.
- Our admin log: the entries about an age check (who opened its pictures, and its decision) are deleted when the check is decided (the decision's entry within a day), and every other entry is deleted 2 years after the end of the calendar year in which it was written. After you delete your account it names you only by an internal id, and it never holds a picture, an ID number or message text.
- Cloudflare keeps 30 days of recovery history for the database. I Can Wait also makes an encrypted copy of the database outside Cloudflare, normally once a week, and deletes each copy after 23 days (at most 28 on a weekly routine); a synced folder's recycle bin can keep a deleted copy longer. While a copy is being made, an unencrypted copy is briefly on the operator's computer and is then deleted. Photos and age-check pictures are not in these copies.
7. Your rights
- Request account deletion — Account → Delete account. Successful deletion removes the active records listed above. If a payment, renewal cancellation or image cleanup cannot be confirmed, the account remains and the app asks you to retry; new payment pages are paused. Contact support if this persists.
- See or correct what we hold — use Account to request your data copy and review your profile. Saved answers can be edited and obsolete corrections removed. Review the resulting summary because AI can misinterpret even a direct correction. Contact [email protected] for help. If you ask us to correct something and we can't, we will tell you in writing why and how to complain, and on request we will keep a note of your view with the record.
- Withdraw optional consent in Account without deleting the rest of your account. This removes that section from saved interview and profile data and pauses new matching while the remaining answers are processed. It cannot recall earlier requests already sent to providers. Your agreement on "Before we ask about you" can be withdrawn only by deleting your account.
- Ask a person to look at a decision made by software: see Decisions made by computer programs.
- Complain — write to us first. If we do not resolve it, the Office of the Australian Information Commissioner takes complaints at oaic.gov.au.
Event maps use Apple Maps when it is available, and otherwise load map tiles from OpenStreetMap. Either way, loading the map shares your IP address, the area of the map you look at and normal browser request information with that service. Following an event, venue or directions link opens the destination provider's site under its own privacy practices. Event photos load directly from the organiser's or ticket seller's website (such as Ticketmaster), not from I Can Wait, so viewing events shares your IP address and normal browser request information with that website; when an event is added, our server reads the organiser's public page to find its photo and sends it nothing about you.
8. Security, honestly
Data is encrypted in transit and at rest by our hosting provider. Login is a one-time emailed code, so there is no password to steal. Sessions are signed and expire. Admin access is restricted, and every admin view of age-check pictures and report evidence is logged.
You can sign in on another device, such as a laptop, with your phone: the other device shows a code, and your phone, signed in to I Can Wait with a passkey (Face ID, a fingerprint or a PIN), approves it. That check stays on your phone. Each code works once and lasts 2 minutes. Only the device that showed the code can collect the sign-in, never someone with the link alone, and that device shows whose account it is before it continues. A sign-in made this way can never be used for administration. It is otherwise a normal sign-in: 30 days, or only this tab if you untick "Remember this device".
What we will not claim: that we are unbreachable, or that we have had a formal security audit. We have not. I Can Wait is a small operation and you should weigh that against how personal the questions are.
9. Children
I Can Wait is for adults. The minimum age is 18. I Can Wait requires an age check before introductions: the camera check with a qualifying AI estimate, or human review of qualifying camera pictures or photo ID; or, if you can't use the camera check, a person checking your original photo ID in person or on a live video call on Google Meet. See the age-check process and alternatives. These checks can make mistakes and are not a safety guarantee. If we learn someone under 18 has an account, we close it straight away. Where there are signs that an adult sought sexual contact with them, we first keep what police or eSafety may need, and only until they no longer need it. Tell us at [email protected] if you believe that has happened.
For complaint steps, review targets and external options, see Complaints and appeals.
10. Changes
If we change something that materially affects you, we will say so by email rather than quietly editing this page and changing the date, and ask you to agree again at your next sign-in.