About This Policy
This Privacy Policy explains how OnFire ("OnFire", "we", "us", "our") collects, uses, shares, and protects your personal data when you use the OnFire App and related services, including messaging, ride-hailing ("OnFire Rides"), delivery, e-vehicle rental, live 1:1 video lessons ("Live Gigs"), and business services (collectively, the "Services").
The company that operates OnFire and is the data controller responsible for your personal data, together with its registered office and the supervisory authority that oversees it, is identified in Section 15, Who We Are and How to Contact Us.
We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Act 2018, and all other applicable data protection legislation.
By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with how we process your personal data, please do not use our Services.
1. Data We Collect
We collect the following categories of personal data depending on how you interact with our Services:
1.1. Account Data
Information you provide when creating and maintaining your OnFire account:
- Full name
- Email address
- Mobile phone number
- Profile photo (optional)
- Date of birth (where required for age verification)
- Username or display name
- Country you declare on your profile (optional)
1.2. Payment Data
Information related to transactions made through the Services:
- Payment card details (collected and processed by our third-party payment processor; OnFire does not store full card numbers)
- Billing address
- Transaction history
- Bank account details (for drivers, couriers, and merchants receiving payouts)
1.3. Location Data
Information about your geographic position:
- Real-time GPS location (when using ride-hailing, delivery, or e-vehicle services)
- Trip and delivery route data
- Pick-up and drop-off locations
- Delivery addresses
- Approximate country derived from your IP address when you sign in or register (country only — never your city or precise location)
1.4. Communication Data
Information related to your communications through the Services:
- Message metadata (timestamps, sender, recipient, message type)
- Call metadata (duration, participants, timestamps)
- Content of messages that are not end-to-end encrypted
- Note: OnFire does not access the content of end-to-end encrypted messages
- Support inquiries and correspondence with OnFire
1.5. Usage Data
Information about how you interact with our Services:
- Features accessed and frequency of use
- App settings and preferences
- Search queries within the app
- In-app actions and interactions
- Referral and promotional code usage
- Ratings and reviews provided
1.6. Device Data
Technical information about the device you use:
- Device type, model, and manufacturer
- Operating system and version
- Unique device identifiers (e.g., advertising ID, device ID)
- IP address
- Mobile network information
- App version
- Language and timezone settings
- Crash logs and diagnostic data
1.7. Driver and Courier Data
Additional data collected from individuals who provide transportation or delivery services through OnFire:
- Driving licence details and validity
- Vehicle registration and insurance information
- Background check results and criminal record checks (where legally required)
- Earnings and tax-related information
- Performance ratings and feedback
- Working hours and availability
1.8. Merchant Data
Additional data collected from businesses that offer goods or services through OnFire:
- Business name and trading name
- Business registration details
- Business address and operating hours
- Food safety certifications and hygiene ratings (where applicable)
- Menu and product information
- Banking and payout details
1.9. Data from Third Parties
We may receive personal data from third parties, including:
- Identity verification providers
- Background check service providers
- Payment processors
- Social media platforms (if you choose to link your account)
- Publicly available sources (for fraud prevention)
1.10. Drawings You Add During Calls
When you add a drawing during an OnFire call (our “Living Drawings” activity), we receive the photo you take. We use automated tools, including Google’s Gemini service under paid terms that do not allow Google to use it for training, to cut out the drawing and check that it is appropriate. The photo is then deleted within about a minute. If the automated check flags the photo as possibly inappropriate, it is kept for review by our safety team for up to 30 days and then deleted. The cut-out drawing and the nickname you choose are shown to people in the call and deleted from the call 7 days after it ends. A copy of the cut-out drawing is saved to the call host’s OnFire Files, where the host controls it. We remove location and device information from photos and never store it, and we keep a scrambled (hashed) form of your IP address for 24 hours to prevent abuse. Photos of people are rejected automatically.
We process this data on the basis of our legitimate interests, and those of the call host, in running the activity (Article 6(1)(f)). Call hosts who use the activity with children are responsible for doing so appropriately.
1.11. Live Gigs (Live 1:1 Video Lessons)
Live Gigs connects a buyer with a tutor, teacher or coach (a "tutor") for a live 1:1 video lesson. Only adults can book. A parent or legal guardian can book a lesson for their child; the child never has an account. When you use Live Gigs we collect:
- Your request: subject, level, languages, lesson length, budget and goal, and whether the lesson is for you or for a child.
- For a child's lesson: the child's first name on the request, and your confirmation that you are the child's parent or legal guardian and will stay on camera for the whole session. The first name on a request is deleted 30 days after the request closes.
- A child profile, if you choose to save one: see section 9.2.
- Session recordings: every Live Gigs session, including the free trial and children's sessions, is recorded (video and audio of everyone on camera, which in a child's session includes the child and you).
- Session records: match and session times, who ended the session and why, skip reasons, reports, reviews and payment records.
- Weekly series: if you book a weekly series, the tutor, the lesson days, times, time zone and length, the 4-week blocks, every charge, renewal, refund and cancellation (who cancelled and when), any withdrawal, the version of the Live Gigs Weekly Sessions Terms you accepted, and the automatic renewal terms you were shown and your consent to them, with the date and time. For a child's series, the child's first name is kept with the series while it runs and deleted 30 days after it ends; it is never put in an email.
- Tutor availability: the weekly availability calendar a tutor attaches to their listing, and which of its times are booked, used to show the times a series can be booked at.
- Ratings and problem reports: your star rating of a session; any private problem report you send about a session, whatever the rating (the reasons you pick, for example level not right, tutor late or unprepared, connection problems), which is never published or shown to the tutor; any service fee waiver you receive; if you rate a session 1 or 2 stars, a note that this tutor is not to be offered to you again; and your last search, so that you can repeat or change it. The reasons are used to improve your later matches. They are passed to the matching AI (Jev) only as fixed short sentences, never as free text and never with any data about a child.
- Emails: the confirmations, lesson reminders, renewal notices, payment notices, receipts and cancellation confirmations we send about a series, sent to the email address on your account, and when they were sent. They are sent from our own mail server and never contain a child’s name.
- Tutor verification: identity verification and payout details collected by Stripe, tax details (legal name, tax identification number and address) and, for tutors who teach children, the result of a criminal-record background check (a DBS check or the national equivalent), which is valid for 1 year.
Recordings. Recordings are stored privately, never at a public address. Only authorised OnFire staff can open them, each access is logged, and they are not shared with the buyer or the tutor. They are used for safety, to handle reports and moderation, and to resolve payment disputes. They are deleted 30 days after the session, except that a recording is kept while a report, dispute or review about that session is open, or for longer where the law requires it. If recording fails, the session continues.
Matching. Matching may use an AI system ("Jev", provided by TypeSafe AI in the United States) to estimate how well a request fits a tutor's listing. It receives the request text (subject, level and goal) and the listing text, with account identifiers, names, email addresses, phone numbers and links removed. For a child's lesson it also receives the child's age band and the interests you picked from the child profile, and nothing else about the child. To improve later matches it may also receive fixed short sentences for the reasons you gave when skipping a tutor or reporting a problem with a session (for example “the level was not right”), never free text and never any data about a child. TypeSafe AI processes this data for us under a data processing agreement (Article 28 GDPR), and the transfer to the United States is covered by Standard Contractual Clauses.
The legal bases for this processing are set out in section 2.6.
2. Legal Bases for Processing
We process your personal data on the following legal bases under GDPR Article 6:
2.1. Performance of a Contract (Article 6(1)(b))
Processing necessary to fulfil our contractual obligations to you, including:
- Providing the Services (messaging, rides, deliveries, e-vehicle rentals)
- Processing payments and refunds
- Managing your account
- Communicating with you about your use of the Services
- Connecting passengers with drivers, or customers with couriers and merchants
2.2. Legitimate Interests (Article 6(1)(f))
Processing necessary for our legitimate interests, provided these are not overridden by your rights, including:
- Improving and developing our Services
- Detecting and preventing fraud, abuse, and security incidents
- Ensuring the safety of users, drivers, couriers, and the public
- Conducting analytics to understand usage patterns
- Providing creators with aggregated follower statistics by country that do not identify individual followers
- Enforcing our terms and conditions
- Protecting our legal rights and interests
2.3. Consent (Article 6(1)(a))
Processing based on your freely given, specific, informed consent, including:
- Sending marketing communications
- Processing precise location data outside of active service use
- Using cookies and similar technologies for non-essential purposes
- Sharing data with third-party advertising partners
You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
2.4. Legal Obligations (Article 6(1)(c))
Processing necessary to comply with legal obligations, including:
- Tax and accounting requirements
- Responding to valid legal requests from law enforcement or regulatory authorities
- Anti-money laundering and fraud prevention obligations
- Regulatory reporting requirements
2.5. Vital Interests (Article 6(1)(d))
In exceptional circumstances, processing necessary to protect the vital interests of any person, such as sharing location data with emergency services.
2.6. Live Gigs
| Purpose | Legal basis |
|---|---|
| Taking your request, matching you with a tutor, running the session, payments and refunds | Performance of a contract with you (Article 6(1)(b)) |
| Booking and running a weekly series: offering times from the tutor’s calendar, charging each 4-week block, automatic renewals, cancellations, refunds and withdrawals, and emailing you confirmations, lesson reminders, renewal notices, payment notices and receipts | Performance of a contract with you (Article 6(1)(b)) |
| Keeping a record of the automatic renewal terms you were shown, your consent to them, your request for lessons to start within the withdrawal period, and your cancellation and withdrawal requests | Compliance with consumer-protection law that requires us to confirm and be able to prove these (Article 6(1)(c)), and our legitimate interest in establishing and defending legal claims (Article 6(1)(f)) |
| Using the reasons in a problem report you send, and your choice not to be offered a tutor again, to improve your later matches; offering a service fee waiver | Our legitimate interest, and yours, in better matches and in putting a disappointing lesson right (Article 6(1)(f)). You can object (section 7.6). |
| The child’s first name and age band, used to give the lesson you booked | Performance of our contract with you (Article 6(1)(b)). This also covers your lesson request, and the child’s first name and age band on that request. |
| Saving a child profile, and its photo, gender, interests and note; showing it to the tutor you choose; reviewing the photo before a tutor sees it; sending the age band and interests to the matching AI | Consent given on the child’s behalf by the person with parental responsibility (Article 6(1)(a)), recorded with the version of the consent text and the date. You can withdraw it at any time by deleting the profile. Article 8 (a child’s own consent to online services) does not apply, because Live Gigs is offered to you, not to the child. |
| Recording sessions, including children's sessions, and keeping recordings for reports and disputes | Our legitimate interests, and those of buyers, tutors and children, in keeping sessions safe and resolving reports and disputes (Article 6(1)(f)). We have balanced these interests against the privacy of everyone on camera, and give children's interests particular weight. Recording is proportionate because it is the main way to check what happened in a one-to-one session with a child. The safeguards are what make it so: recordings are private, opened only by authorised staff, logged on every access, never shared with either side, and deleted after 30 days unless a case is open. Everyone is told before and during the session that it is recorded. You can object (section 7.6). Because recording is a safety condition of every session, we will then not be able to provide further sessions. |
| Review of child profile photos by our safety team, and preserving and reporting apparent child sexual abuse material | Our legitimate interest in protecting children (Article 6(1)(f)); compliance with legal obligations where reporting and preservation are required by law (Article 6(1)(c)) |
| Background checks on tutors who teach children | Our legitimate interest in protecting children (Article 6(1)(f)). Criminal-record data is processed only as permitted under Article 10 GDPR and the law of the country where the check is made. Checks are arranged by OnFire support with the tutor. |
3. How We Use Your Data
We use your personal data for the following purposes:
3.1. Service Provision
- Enabling you to create and manage your account
- Matching passengers with drivers and customers with couriers
- Processing ride bookings, deliveries, and e-vehicle rentals
- Calculating and processing fares, fees, and payments
- Providing in-app messaging and communication features
- Enabling ratings and reviews
- Showing profile owners aggregated statistics about their followers, including how many followers are in each country
3.2. Safety and Security
- Verifying the identity of users, drivers, couriers, and merchants
- Conducting background checks on drivers and couriers
- Detecting and preventing fraud, abuse, and unauthorized access
- Monitoring compliance with our Acceptable Use Policy
- Investigating safety incidents and user reports
- Sharing trip information with emergency contacts (when enabled by the user)
3.3. Improvement and Development
- Analysing usage patterns to improve the Services
- Developing new features and functionality
- Conducting research and surveys (with appropriate safeguards)
- Training and improving algorithms (using anonymised or aggregated data)
- Testing and troubleshooting
3.4. Marketing and Communications
- Sending service-related notifications (e.g., ride updates, delivery status)
- Sending promotional offers and marketing communications (with your consent)
- Showing you content and recommendations (note: no feed, search result or listing on OnFire is personalised to you or based on profiling of you)
- Administering promotional campaigns, referral programmes, and loyalty schemes
3.5. Legal and Regulatory Compliance
- Complying with tax, accounting, and regulatory obligations
- Responding to legal requests and court orders
- Establishing, exercising, or defending legal claims
- Reporting to regulatory authorities as required by law
3.6. Advertising
We display ads. Ads are not targeted: the ad you see is selected at random from those currently running, and no interest, age, location or profiling data is used to choose it. Every ad is labelled “Sponsored” and shows who paid for it. We provide analytics to advertisers in aggregated form only. We do not sell your personal information to advertisers.
4. Data Sharing
We may share your personal data with the following categories of recipients:
4.1. Other Users of the Services
- Drivers and couriers receive your name, pick-up/drop-off location, and contact information necessary to fulfil a ride or delivery. They do not receive your full profile or payment details.
- Merchants receive order information, delivery address, and your name to fulfil orders.
- Passengers receive the driver's name, vehicle details, photo, and rating.
- Live Gigs tutors and buyers see each other's public profile, rating and reviews, the request or listing details needed for the lesson, and each other on camera during the session. For a child's lesson, the tutor you choose sees the child's first name and, if you saved a child profile, that profile, as described in section 9.2. Neither side receives the session recording.
Follower country statistics. If you follow someone, the owner of that profile can see aggregated statistics about their followers, including how many of their followers are in each country. Only the profile owner can see these statistics, and only for their own profile. To place you in a country we use the country you have declared on your profile; if you have not declared one, we use the approximate country derived from your IP address when you sign in or register. For these statistics we only ever use your country — never your city, and never your GPS or precise location. Creators only ever see totals per country; they cannot see which individual follower is in which country. Countries with fewer than 10 followers are grouped together as “Other”, so that small groups of followers cannot be singled out.
4.2. Service Providers
We engage third-party service providers who process data on our behalf, including:
- Payment processors (e.g., for card processing and payouts)
- Cloud hosting and infrastructure providers
- Customer support platforms
- Identity verification and background check providers
- Analytics and crash-reporting services
- Push notification services
- Email and SMS communication providers
- Mapping and geolocation providers
- AI processing providers (Google’s Gemini service, used to process photos of drawings added during calls; TypeSafe AI’s Jev, used for Live Gigs matching)
All service providers are bound by data processing agreements in accordance with GDPR Article 28.
Service providers used for Live Gigs:
| Provider | What it does | Data it receives | Location and safeguards |
|---|---|---|---|
| TypeSafe AI ("Jev") | AI fit score for matching | Request text (subject, level and goal) and listing text with identifiers removed; fixed short sentences for the reasons a buyer gave when skipping a tutor or reporting a problem; for a child's lesson, the age band and interests only — never the child's photo, name, gender or note | United States. Article 28 data processing agreement; Standard Contractual Clauses for the transfer. |
| Cloudflare (R2 storage) | Private storage of child profile photos and session recordings | Child profile photos; session recordings | United States (R2 region ENAM). Private storage, not reachable at a public address. Cloudflare data processing agreement, with Standard Contractual Clauses for the transfer. |
| LiveKit (video software) and our hosting provider | Carries the live video call and produces the recording | Live video and audio of the session | LiveKit is open-source software that we run on our own servers; it is not a separate company receiving your data. The servers are hosted by Hetzner Online GmbH in Germany (EU) under its data processing agreement. |
| Stripe | Card payments and refunds; tutor identity verification and payouts | Payment details; tutor identity documents and payout details | As described in our KYC Policy. |
| Our own mail server (Stalwart) and our hosting provider | Sends weekly-series confirmations, reminders, renewal notices and receipts | Your name, email address, the tutor’s display name, lesson times and amounts. Never a child’s name. | Germany (EU). Stalwart is open-source mail software that we run on our own servers; it is not a separate company receiving your data. The servers are hosted by Hetzner Online GmbH in Germany under its data processing agreement. |
| Background check provider | Criminal-record check for tutors who teach children | The tutor's identity details and check result | Arranged by OnFire support with the tutor, using a provider in the tutor's country; support will name the provider on request. |
4.3. Law Enforcement and Regulatory Authorities
We may disclose personal data to law enforcement, regulatory authorities, or other governmental bodies when:
- Required by applicable law, regulation, or court order
- Necessary to protect the safety of any person
- Needed to prevent, detect, or investigate criminal activity or fraud
- Required to comply with a valid legal process
4.4. OnFire Group Companies
We may share personal data with our affiliated companies and subsidiaries for the purposes described in this Privacy Policy, subject to appropriate safeguards.
4.5. Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the relevant third party, subject to this Privacy Policy.
4.6. No Sale of Personal Data
OnFire does not sell your personal data to third parties. We do not share personal data with third parties for their own direct marketing purposes without your explicit consent.
5. International Data Transfers
5.1. EU/EEA Storage
OnFire stores your personal data on servers located within the European Union and European Economic Area ("EU/EEA") wherever practicable.
5.2. Transfers Outside the EU/EEA
Where we transfer personal data outside the EU/EEA, we ensure that appropriate safeguards are in place, including:
- Adequacy decisions: Transfers to countries that the European Commission has determined provide an adequate level of data protection.
- Standard Contractual Clauses (SCCs): Transfers made subject to the European Commission's Standard Contractual Clauses.
- Additional safeguards: Where required, we implement supplementary measures (such as encryption and access controls) to ensure the protection of your data.
Live Gigs. Two Live Gigs transfers leave the EU/EEA, both to the United States under Standard Contractual Clauses. TypeSafe AI (Jev matching) receives request text, listings, fixed reason sentences and, for a child's lesson, the child's age band and interests. Cloudflare stores child profile photos and session recordings in its US R2 region. The live call itself runs on our servers in Germany.
5.3. Information on Safeguards
You may obtain further information about the safeguards applied to international transfers by contacting us at [email protected].
6. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:
| Data Category | Retention Period |
|---|---|
| Account data | Duration of account plus 3 years after deletion |
| Trip and delivery data | 3 years from the date of the trip or delivery |
| Payment and transaction records | 7 years (to comply with tax and accounting obligations) |
| Messages (non-encrypted) | As per your account settings; deleted upon account deletion |
| Driver and courier records | Duration of engagement plus 5 years |
| Merchant records | Duration of engagement plus 5 years |
| Location data (real-time) | Not retained after trip/delivery completion; route data retained for 3 years |
| Support correspondence | 3 years from resolution |
| Marketing consent records | Duration of consent plus 1 year |
| Photos of drawings added during calls | Deleted within about a minute of processing; photos flagged by automated safety checks are kept for human review for up to 30 days |
| Cut-out drawings and nicknames shown in calls | 7 days after the call ends (the copy saved to the call host’s Files is kept until the host deletes it) |
| Live Gigs session recordings | 30 days after the session; kept while a report, dispute or review about the session is open, or longer where the law requires it |
| Child's first name on a Live Gigs request | 30 days after the request closes |
| Child's first name on a Live Gigs weekly series | While the series runs, then 30 days after it ends |
| Live Gigs weekly series records (schedule, blocks, cancellations, refunds, withdrawals) | Charges and refunds: as payment and transaction records (7 years). Schedule, cancellation and withdrawal records: 3 years after the series ends |
| Automatic renewal terms shown, your consent, and requests to start within the withdrawal period | 3 years after the series ends |
| Problem-report reasons and service fee waivers | 2 years; your choice not to be offered a tutor again is kept for as long as your account exists |
| Emails about a weekly series (copies and delivery records) | 12 months after sending |
| Your last Live Gigs search | Until you make a new search or delete your account |
| Live Gigs child profile (first name, age band, photo, gender, interests, note) | Until the earliest of: you delete it; you delete or deactivate your account (immediately); it has not been used for 365 days; or the child turns 18 (three years after the age band was last set to 15–17). The photo is deleted from storage within minutes. Copies in our database backups are kept for up to 12 months and then overwritten. |
| Log of tutor and staff access to a child profile | 2 years |
| Child profile photos our safety team does not approve | 90 days, then deleted; apparent child sexual abuse material is preserved and reported to NCMEC and the authorities as the law requires (see section 10.4) |
| Tutor background-check approvals | Valid for 1 year; the record is kept for 1 year after the check expires or the tutor stops teaching children |
| Your guardian confirmation and consent records (Live Gigs) | For the life of the child profile plus 3 years, to show that consent was given |
Backups. Deleted data can remain in our database backups for up to 12 months (we keep 14 daily, 8 weekly and 12 monthly copies). Backups are encrypted, are used only to restore the service, and are then overwritten.
After the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you.
7. Your Rights Under GDPR
Under the GDPR, you have the following rights in relation to your personal data:
7.1. Right of Access (Article 15)
You have the right to obtain confirmation of whether we process your personal data and, if so, to request a copy of that data together with supplementary information about how it is processed.
7.2. Right to Rectification (Article 16)
You have the right to have inaccurate personal data corrected and incomplete data completed.
7.3. Right to Erasure (Article 17)
You have the right to request deletion of your personal data where:
- The data is no longer necessary for the purpose for which it was collected
- You withdraw consent and there is no other legal basis for processing
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
This right is subject to exceptions, including where retention is required for legal compliance or the establishment, exercise, or defence of legal claims.
7.4. Right to Restriction of Processing (Article 18)
You have the right to request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.
7.5. Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller, where processing is based on consent or contract and is carried out by automated means.
7.6. Right to Object (Article 21)
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
7.7. Right to Withdraw Consent
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
7.8. Rights Relating to Automated Decision-Making (Article 22)
You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, unless the decision is necessary for a contract, authorised by law, or based on your explicit consent.
7.9. Exercising Your Rights
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, we may extend this period by a further two months, and we will inform you of any such extension.
7.10. Your Child's Data on Live Gigs
If you are a parent or guardian, you can exercise the rights above for the data you have given us about your child. In Live Gigs you can see, edit and delete a child profile at any time; deleting it is how you withdraw your consent, and it removes the photo too. To ask for a copy of your child's data, the access log for their profile, or a recording of their session while it still exists, email [email protected]. A copy of a recording is provided with the tutor's face blurred.
7.11. Right to Lodge a Complaint
If you are not satisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the Irish Data Protection Commission:
Data Protection Commission 21 Fitzwilliam Square South Dublin 2, D02 RD28 Ireland Website: https://www.dataprotection.ie Email: [email protected] Phone: +353 (0)1 765 0100 / 1800 437 737
9. Children's Privacy
9.1. Accounts
Our Services are not directed at individuals under the age of 18, and children cannot hold a Live Gigs account or book a Live Gigs session. If we become aware that a child under 18 has given us personal data through their own account, we will take steps to delete that data as soon as practicable. If you believe that has happened, please contact us at [email protected].
The one place where we deliberately hold data about children is Live Gigs: an adult parent or guardian can book a lesson for their child and can give us limited information about the child. We collect it from the parent or guardian, not from the child, and we describe it below.
9.2. Live Gigs Lessons and Child Profiles
Booking for a child. To book a child's lesson you must be an adult and confirm that you are the child's parent or legal guardian and will stay on camera for the whole session. We record the child's first name on the request (deleted 30 days after the request closes). Every session is recorded, so the recording includes the child's image and voice (see section 1.11). Lessons for children are only matched with tutors who have passed identity verification and hold a current background check.
The child profile (optional). You can save a profile for your child so that you do not need to re-enter it. It holds:
- first name;
- age band (3–5, 6–8, 9–11, 12–14 or 15–17) — never an exact age or a date of birth;
- an optional photo;
- gender (boy, girl or prefer not to say);
- interests, picked from a fixed list; and
- an optional note of up to 300 characters. Contact details are not allowed in the note and are rejected. Please do not include health, medical or school details.
Who sees it.
- You can see, edit and delete it at any time.
- The tutor you choose for a session sees it, including the photo and gender, from the countdown before the session until 15 minutes after it ends. After that, the tutor can no longer open it. Tutors who are offered your request but not yet chosen see only the age band (for example 6–8) and the interests — not the first name, photo, gender or note.
- Every time a tutor opens it, we log it (who, which profile, when).
- The matching AI (Jev) receives only the age band and interests, as text. It never receives the photo, first name, gender or note.
- OnFire staff can access it only for safety, moderation or support, and that access is logged too.
Photos. A photo is stored privately (Cloudflare R2), never at a public address. Before storing it, we re-encode it and remove its metadata, including location (GPS) and device information. Every photo is reviewed by our safety team before any tutor can see it, and stays hidden from tutors until then. We do not currently use an automated model or a database of known abuse images to check child photos. An approved photo is shown to the tutor through a private link that expires after 5 minutes. A photo that is not approved is not used and is deleted after 90 days. We do not use child photos for face recognition, advertising or training AI. Apparent child sexual abuse material is preserved and reported as the law requires (see section 10.4).
Legal basis and consent. We rely on your consent, as the person with parental responsibility, for the saved profile and its photo, gender, interests and note, and on our contract with you for the first name and age band needed to give the lesson you booked (section 2.6). You give consent when you save the profile, and you can withdraw it at any time by deleting the profile. Recording the session is not based on consent: it rests on our legitimate interest in safety and is a condition of every Live Gigs session (section 2.6).
When it is deleted. A child profile is deleted when you delete it or your account, when it has not been used for 365 days, or when the child turns 18 (three years after the age band was last set to 15–17), whichever comes first. Data we must keep as evidence of suspected child sexual abuse is kept as the law requires.
More detail, including what you agree to when you book, is in the Live Gigs Guardian Terms and our Child Safety Policy.
10. Child Safety Scanning & CSAM Protection
OnFire is committed to preventing child sexual exploitation and protecting minors from grooming and predatory behavior. We employ multiple layers of safety technology, including on-device artificial intelligence and server-side systems, to detect and respond to potential threats.
10.1 On-Device Safety Scanning
OnFire uses on-device AI classifiers to analyze conversation patterns for indicators of grooming behavior. This scanning occurs locally on your device, meaning conversation content is processed without being sent to our servers for this purpose. The AI model evaluates anonymized conversation metadata and patterns against known grooming indicators, including age probing, isolation tactics, secrecy requests, boundary testing, sexual escalation, and other recognized risk categories.
On-device scanning produces a risk assessment score. If the risk score falls below a safety threshold, no data leaves your device. Only when risk indicators exceed defined thresholds may limited safety event data (risk score, risk category, and conversation identifier — not the conversation content itself) be transmitted to our servers for review.
10.2 Server-Side Safety Systems
When on-device scanning identifies elevated risk, our server-side safety systems may perform additional analysis, including cloud-based AI confirmation of risk assessments. The capability to match uploaded images and video against known CSAM hash databases is built into OnFire but is not currently switched on, so uploads are not presently hash-matched. We describe it here because it exists and because we intend to enable it, not because it is running today. All safety processing is strictly limited to child safety purposes.
10.3 Safety Event Data
When safety systems detect potential risks, we may collect and process the following data:
- • Risk assessment scores and categories from on-device and cloud classifiers
- • Conversation identifiers (not message content) associated with safety events
- • Timestamps and metadata of safety events
- • Actions taken (e.g., conversation restrictions, review requests)
- • Evidence preserved for confirmed CSAM detections as required by law
Safety event data is retained for as long as necessary to fulfill legal obligations, complete investigations, and comply with reporting requirements. Evidence related to confirmed CSAM detections is retained in accordance with 18 U.S.C. § 2258A.
10.4 NCMEC Reporting
As a U.S. electronic service provider, OnFire is legally required under 18 U.S.C. § 2258A to report apparent child sexual abuse material (CSAM) to the National Center for Missing & Exploited Children (NCMEC) via the CyberTipline. When our systems detect confirmed or highly likely CSAM, we will:
- • Preserve evidence as required by law
- • Submit a CyberTipline report to NCMEC as soon as reasonably possible, as required by 18 U.S.C. § 2258A
- • Restrict the associated accounts and conversations
- • Cooperate with NCMEC, law enforcement, and other authorities as required
We are prohibited by law from notifying users when a CyberTipline report has been filed regarding their account.
10.5 Escalation and Conversation Restrictions
Our safety systems employ a tiered escalation model based on risk severity:
- • Low risk: Events are logged locally for pattern monitoring. No user-facing action is taken.
- • Elevated risk: Safety events are reported to our review team. Conversations may be placed under enhanced monitoring.
- • High risk: Both participants may be asked to complete age verification. The conversation may be temporarily paused pending verification.
- • Critical risk: The conversation is immediately locked for both participants. Our review team is notified with priority, and mandatory reporting obligations may be triggered.
Conversation restrictions are applied bilaterally to both participants in a flagged conversation. Users may request a review of safety restrictions through our support channels.
10.6 Apple Sensitive Content Analysis
OnFire supports Apple's Sensitive Content Analysis framework on supported Apple devices (iOS 17+), which detects potentially explicit images and video entirely on your own device using Apple's built-in technology. This integration is built but is not currently enabled, so it is not analysing content today. Where it is enabled, OnFire does not receive or process the content of images analysed by the framework; sensitive content is blurred and you are warned before choosing whether to view it.
Your Privacy: On-device safety scanning is designed to protect your privacy. Conversation content is analyzed locally and is not transmitted to our servers unless critical safety thresholds are exceeded. We do not use safety scanning data for advertising, profiling, or any purpose other than child protection and legal compliance.
11. Special Categories of Data
We may process certain sensitive information only with your explicit consent or as permitted by law, including biometric data (face recognition for verification), health information, religious or political views, and sexual orientation (only if you choose to include these in your profile).
You control whether to share sensitive information. Such data is processed only for the specific purposes you authorize.
12. Third-Party Services
OnFire may integrate with third-party services including payment processors, maps and location services, analytics providers, and communication APIs.
Our Service may contain links to external websites. We are not responsible for the privacy practices of third parties. We encourage you to review their privacy policies.
Note: If you interact with bots or third-party integrations, they may receive information you share with them. Their data practices are governed by their own policies. Use caution when sharing sensitive information.
13. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:
- Encryption of data in transit (TLS) and at rest
- Access controls and authentication mechanisms
- Regular security audits and vulnerability assessments
- Employee training on data protection and security
- Incident response and breach notification procedures
- Pseudonymisation and anonymisation where appropriate
While we take all reasonable precautions, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your data.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Services.
Where changes are material, we will notify you by:
- Sending a notification to the email address associated with your account
- Displaying a prominent notice within the OnFire App
- Posting the updated Privacy Policy on our website
Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should stop using the Services and contact us to delete your account.
15. Who We Are and How to Contact Us
OnFire is operated by OnFire Messenger Ltd., registered in Ireland under company number 796932, which is the data controller responsible for your personal data. If you have any questions about this Privacy Policy, or if you wish to exercise your data protection rights, please contact us:
OnFire Messenger Ltd. Registered Office: 77 Camden Street Lower, Dublin, D02 XE80, Ireland Email: [email protected] Website: https://onfire.so
Data Protection Officer (if applicable): Email: [email protected]
Supervisory Authority: Data Protection Commission 21 Fitzwilliam Square South Dublin 2, D02 RD28, Ireland https://www.dataprotection.ie
This Privacy Policy was last updated on 19 October 2026.