Privacy Policy

1. Introduction

This Privacy Policy explains how OnFire ("OnFire," "Company," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use our mobile application, website, and related services (collectively, the "Service"). The company that operates OnFire and acts as data controller, together with its address, is identified in Section 16, Who We Are and How to Contact Us.

We are committed to protecting your privacy and being transparent about our data practices. By using OnFire, you consent to the practices described in this Privacy Policy.

1.1 Our Privacy Principles

2. Information We Collect

2.1 Information You Provide

2.2 Information Collected Automatically

2.3 Information from Third Parties

We may receive information from social sign-in providers, payment processors, partners and integrations, and other users (messages sent to you, tags, mentions, and contact uploads with your permission).

2.4 Drawings You Add During Calls

When you add a drawing during an OnFire call (our “Living Drawings” activity), we receive the photo you take. We use automated tools, including Google’s Gemini service under paid terms that do not allow Google to use it for training, to cut out the drawing and check that it is appropriate. The photo is then deleted within about a minute. If the automated check flags the photo as possibly inappropriate, it is kept for review by our safety team for up to 30 days and then deleted. The cut-out drawing and the nickname you choose are shown to people in the call and deleted from the call 7 days after it ends. A copy of the cut-out drawing is saved to the call host’s OnFire Files, where the host controls it. We remove location and device information from photos and never store it, and we keep a scrambled (hashed) form of your IP address for 24 hours to prevent abuse. Photos of people are rejected automatically.

2.5 Live Gigs (Live 1:1 Video Lessons)

Live Gigs connects a buyer with a tutor, teacher or coach (a "tutor") for a live 1:1 video lesson. Only adults can book. A parent or legal guardian can book a lesson for their child; the child never has an account. When you use Live Gigs we collect:

• • Your request: subject, level, languages, lesson length, budget and goal, and whether the lesson is for you or for a child.
• • For a child's lesson: the child's first name on the request, and your confirmation that you are the child's parent or legal guardian and will stay on camera for the whole session. The first name on a request is deleted 30 days after the request closes.
• • A child profile, if you choose to save one: see section 9.2.
• • Session recordings: every Live Gigs session, including the free trial and children's sessions, is recorded (video and audio of everyone on camera, which in a child's session includes the child and you). Recordings are private, opened only by authorized OnFire staff with each access logged, never shared with the buyer or the tutor, and deleted 30 days after the session unless a report, dispute or review about the session is open or the law requires us to keep them longer.
• • Session records: match and session times, who ended the session and why, skip reasons, reports, reviews and payment records.
• • Weekly series: if you book a weekly series, the tutor, the lesson days, times, time zone and length, the 4-week blocks, every charge, renewal, refund and cancellation (who cancelled and when), any withdrawal, the version of the Live Gigs Weekly Sessions Terms you accepted, and the automatic renewal terms you were shown and your consent to them, with the date and time. For a child's series, the child's first name is kept with the series while it runs and deleted 30 days after it ends; it is never put in an email.
• • Tutor availability: the weekly availability calendar a tutor attaches to their listing, and which of its times are booked, used to show the times a series can be booked at.
• • Ratings and problem reports: your star rating of a session; any private problem report you send about a session, whatever the rating (the reasons you pick, for example level not right, tutor late or unprepared, connection problems), which is never published or shown to the tutor; any service fee waiver you receive; if you rate a session 1 or 2 stars, a note that this tutor is not to be offered to you again; and your last search, so that you can repeat or change it. The reasons are used to improve your later matches. They are passed to the matching AI (Jev) only as fixed short sentences, never as free text and never with any data about a child.
• • Emails: the confirmations, lesson reminders, renewal notices, payment notices, receipts and cancellation confirmations we send about a series, sent to the email address on your account, and when they were sent. They are sent from our own mail server and never contain a child’s name.
• • Tutor verification: identity verification and payout details collected by Stripe, tax details and, for tutors who teach children, the result of a criminal background check, valid for 1 year.
• • Matching: matching may use an AI system ("Jev", provided by TypeSafe AI) that receives the request text (subject, level and goal) and listing text with names, account identifiers and contact details removed and, for a child's lesson, the child's age band and interests only. To improve later matches it may also receive fixed short sentences for the reasons you gave when skipping a tutor or reporting a problem with a session (for example “the level was not right”), never free text and never any data about a child. TypeSafe AI processes this data for us under a data processing agreement.

3. How We Use Your Information

4. How We Share Your Information

Service Providers Used for Live Gigs

5. Your Privacy Controls and Rights

6. Data Retention

We retain your information for as long as your account is active, as needed to provide our services, and as required by law or for legitimate business purposes.

After Account Deletion

Profile and content are removed within 90 days. Some data may persist in backups temporarily. Certain information is retained for legal compliance. Aggregated/anonymous data may be kept indefinitely.

Specific Retention Periods

7. Data Security

Security Measures

• • Encryption in transit (TLS/SSL)
• • Encryption at rest for sensitive data
• • End-to-end encryption for private messages (where enabled)
• • Secure authentication systems
• • Regular security audits and testing
• • Access controls and monitoring
• • Incident response procedures

Your Role in Security

Use a strong, unique password; enable two-factor authentication; do not share login credentials; report suspicious activity; keep your device and apps updated.

Data Breach Response

In the event of a data breach, we will notify affected users as required by law, take steps to mitigate harm, and cooperate with authorities as appropriate.

8. International Data Transfers

OnFire operates globally, and your information may be transferred to and processed in countries outside your residence. Where we transfer your information across borders, we apply appropriate safeguards as required by applicable law.

9. Children's Privacy

9.1 Accounts

OnFire accounts are not intended for children under 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect information from children below this age through their own accounts, and no child can hold a Live Gigs account or book a Live Gigs session. Live Gigs is the one place where we deliberately hold information about children: a parent or guardian can book a lesson for their child and give us limited information about the child (section 9.2).

Since October 12, 2026, adults can hold a date of birth on their account, and booking on Live Gigs requires one showing that you are an adult. Many accounts still have no date of birth, and outside Live Gigs we do not verify age, so we cannot identify which accounts belong to users aged 13 to 17. We therefore do not currently apply age-specific settings, feature restrictions, content filtering or consent requirements to those accounts. We would rather state this plainly than describe protections that are not in place. Children never have Live Gigs accounts.

Parents and guardians can request deletion of a child's account and contact us with concerns at [email protected]. Outside Live Gigs, OnFire does not currently offer parental controls, supervised accounts, or any facility for a parent to view or manage a child's account. If we learn we have collected information from a child without proper consent, we will delete it promptly.

Call hosts who use our Living Drawings activity with children are responsible for doing so appropriately. The activity only accepts photos of drawings: photos of people are rejected automatically, and photos are deleted within about a minute (see section 2.4).

9.2 Live Gigs Lessons and Child Profiles

Booking for a child. To book a child's lesson you must be an adult and confirm that you are the child's parent or legal guardian and will stay on camera for the whole session. We record the child's first name on the request (deleted 30 days after the request closes). Every session is recorded, so the recording includes the child's image and voice (section 2.5). Lessons for children are only matched with tutors who have passed identity verification and hold a current background check.

The child profile (optional). You can save a profile for your child. It holds:

• • first name;
• • age band (3–5, 6–8, 9–11, 12–14 or 15–17) — never an exact age or a date of birth;
• • an optional photo;
• • gender (boy, girl or prefer not to say);
• • interests, picked from a fixed list; and
• • an optional note of up to 300 characters. Contact details are not allowed in the note and are rejected. Please do not include health, medical or school details.

Who sees it.

• • You can see, edit and delete it at any time.
• • The tutor you choose sees it, including the photo and gender, from the countdown before the session until 15 minutes after it ends; then the tutor can no longer open it. Tutors who are offered your request but not yet chosen see only the age band (for example 6–8) and the interests — not the first name, photo, gender or note.
• • Every time a tutor opens it, we log it (who, which profile, when).
• • The matching AI (Jev) receives only the age band and interests, as text — never the photo, first name, gender or note.
• • OnFire staff can access it only for safety, moderation or support, and that access is logged too.

Photos. A photo is stored privately (Cloudflare R2), never at a public address. Before storing it we re-encode it and remove its metadata, including location (GPS) and device information. Every photo is reviewed by our safety team before any tutor can see it, and stays hidden from tutors until then. We do not currently use an automated model or a database of known abuse images to check child photos. An approved photo is shown to the tutor through a private link that expires after 5 minutes. A photo that is not approved is not used and is deleted after 90 days. We do not use child photos for face recognition, advertising or training AI. Apparent CSAM is preserved and reported to NCMEC as described in section 10.4.

When it is deleted. A child profile is deleted when you delete it or your account, when it has not been used for 365 days, or when the child turns 18 (three years after the age band was last set to 15–17), whichever comes first. Evidence of suspected child sexual abuse is kept as the law requires.

What you agree to when you book is in the Live Gigs Guardian Terms; our safeguards are in the Child Safety Policy.

9.3 Children Under 13: COPPA Notice for Live Gigs

This notice is given under the Children's Online Privacy Protection Act (COPPA). The operator is OnFire Messenger Inc., 254 Chapman Rd, Ste 209, Newark, DE 19702, [email protected]. Because we do not ask for a child's exact age, we apply this notice and the consent below to every child's lesson booked in the United States.

What we collect about your child, and how.

• • From you, the parent: the child's first name and, if you save a child profile, the age band, photo, gender, interests and note.
• • From the session itself: your child's image and voice in the live video and in the session recording.
• • We do not ask your child for any information, we do not collect your child's contact details, and we do not show your child advertising or use their information for advertising.

How we use it. To provide the lesson you booked, to match it with a suitable tutor (age band and interests only), and to keep sessions safe: recordings, reports and moderation, and checking photos for abuse.

Who we disclose it to. The tutor you choose (as described in section 9.2) and the service providers listed in section 4, who process it only for us. We do not sell or share your child's information, and we disclose it to authorities only where the law requires it, including reports of apparent CSAM to NCMEC. Showing the profile to the tutor you choose is part of the lesson you book.

How you give consent. The first time you book a lesson for a child in the United States, whatever the child's age band, we obtain verifiable parental consent before the first recorded session, using a card payment and a notice to you:

• • we show you this notice and the Live Gigs Guardian Terms;
• • you confirm that you are an adult and the child's parent or legal guardian;
• • you tick a consent box that names what we collect and who sees it;
• • we place a charge of $0.50 on the payment card saved on your account and refund it immediately; and
• • we send you this notice by email and with the receipt, so the card holder is told about the transaction.

Only once these steps are complete can your child's first session start.

Your rights as a parent. You can review your child's information, have it deleted, and refuse further collection or use. Delete the child profile in Live Gigs, or email [email protected] with "Parental Rights Request" in the subject. If you refuse further collection, your child cannot take part in further sessions, because every session is recorded. We will not ask your child for more information than a session needs.

Retention and security. We keep children's information only as long as section 6 sets out, then delete it. We protect it with private storage, access controls and access logs. The retention periods in section 6 are our written retention policy for children's information.

10. Child Safety Scanning & CSAM Protection

OnFire is committed to preventing child sexual exploitation and protecting minors from grooming and predatory behavior. We employ multiple layers of safety technology, including on-device artificial intelligence and server-side systems, to detect and respond to potential threats.

10.1 On-Device Safety Scanning

OnFire uses on-device AI classifiers to analyze conversation patterns for indicators of grooming behavior. This scanning occurs locally on your device, meaning conversation content is processed without being sent to our servers for this purpose. The AI model evaluates anonymized conversation metadata and patterns against known grooming indicators, including age probing, isolation tactics, secrecy requests, boundary testing, sexual escalation, and other recognized risk categories.

On-device scanning produces a risk assessment score. If the risk score falls below a safety threshold, no data leaves your device. Only when risk indicators exceed defined thresholds may limited safety event data (risk score, risk category, and conversation identifier — not the conversation content itself) be transmitted to our servers for review.

10.2 Server-Side Safety Systems

When on-device scanning identifies elevated risk, our server-side safety systems may perform additional analysis, including cloud-based AI confirmation of risk assessments. The capability to match uploaded images and video against known CSAM hash databases is built into OnFire but is not currently switched on, so uploads are not presently hash-matched. We describe it here because it exists and because we intend to enable it, not because it is running today. All safety processing is strictly limited to child safety purposes.

10.3 Safety Event Data

When safety systems detect potential risks, we may collect and process the following data:

• • Risk assessment scores and categories from on-device and cloud classifiers
• • Conversation identifiers (not message content) associated with safety events
• • Timestamps and metadata of safety events
• • Actions taken (e.g., conversation restrictions, review requests)
• • Evidence preserved for confirmed CSAM detections as required by law

Safety event data is retained for as long as necessary to fulfill legal obligations, complete investigations, and comply with reporting requirements. Evidence related to confirmed CSAM detections is retained in accordance with 18 U.S.C. § 2258A.

10.4 NCMEC Reporting

As a U.S. electronic service provider, OnFire is legally required under 18 U.S.C. § 2258A to report apparent child sexual abuse material (CSAM) to the National Center for Missing & Exploited Children (NCMEC) via the CyberTipline. When our systems detect confirmed or highly likely CSAM, we will:

• • Preserve evidence as required by law
• • Submit a CyberTipline report to NCMEC as soon as reasonably possible, as required by 18 U.S.C. § 2258A
• • Restrict the associated accounts and conversations
• • Cooperate with NCMEC, law enforcement, and other authorities as required

We are prohibited by law from notifying users when a CyberTipline report has been filed regarding their account.

10.5 Escalation and Conversation Restrictions

Our safety systems employ a tiered escalation model based on risk severity:

• • Low risk: Events are logged locally for pattern monitoring. No user-facing action is taken.
• • Elevated risk: Safety events are reported to our review team. Conversations may be placed under enhanced monitoring.
• • High risk: Both participants may be asked to complete age verification. The conversation may be temporarily paused pending verification.
• • Critical risk: The conversation is immediately locked for both participants. Our review team is notified with priority, and mandatory reporting obligations may be triggered.

Conversation restrictions are applied bilaterally to both participants in a flagged conversation. Users may request a review of safety restrictions through our support channels.

10.6 Apple Sensitive Content Analysis

OnFire supports Apple's Sensitive Content Analysis framework on supported Apple devices (iOS 17+), which detects potentially explicit images and video entirely on your own device using Apple's built-in technology. This integration is built but is not currently enabled, so it is not analysing content today. Where it is enabled, OnFire does not receive or process the content of images analysed by the framework; sensitive content is blurred and you are warned before choosing whether to view it.

11. Special Categories of Data

We may process certain sensitive information only with your explicit consent or as permitted by law, including biometric data (face recognition for verification), health information, religious or political views, and sexual orientation (only if you choose to include these in your profile).

You control whether to share sensitive information. Such data is processed only for the specific purposes you authorize.

12. Third-Party Services

OnFire may integrate with third-party services including payment processors, maps and location services, analytics providers, and communication APIs.

Our Service may contain links to external websites. We are not responsible for the privacy practices of third parties. We encourage you to review their privacy policies.

13. Cookies and Tracking Technologies

You can control cookies through browser settings, device settings, and our cookie preference center on the web. Note that disabling certain cookies may affect functionality.

14. California Privacy Rights (CCPA/CPRA)

California residents have additional rights:

To exercise these rights, contact us at [email protected] or through app settings.

15. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notice, update the "Last Updated" date, and provide at least 30 days notice before significant changes take effect. Your continued use after changes constitutes acceptance of the updated policy.

16. Who We Are and How to Contact Us

OnFire is operated by OnFire Messenger Inc., a Delaware corporation, which is the data controller for the information described in this Policy. For questions, concerns, or to exercise your rights: