The matchmaker's privacy contract: why we don't show photos

There is a question that we asked, over and over, for almost a year:

If you wanted to look for a husband or wife online, what would stop you?

The answers were almost always the same. People did not say “the algorithms are bad.” They did not say “the questions are shallow.” They said, in different words: I don’t want to be seen.

Seen by an aunt who would call my mother. Seen by a colleague at a Monday standup. Seen by a former pastor. Seen by the man I turned down two years ago, who is still angry about it. Seen, full stop, by a community where being on a dating app means something specific that I do not want it to mean about me.

Photos were the load-bearing reason. Almost everything else can be worked around — you can skim a profile, you can write a sober bio. But a photograph is a recognition primitive. One picture, and the question stops being “is this person interesting” and becomes “wait, is that her?”

So the first decision we made about PotentialSpouse was a subtraction. No photos. Not at signup, not after mutual interest, not after fifty messages, not after a video call, not ever, on the public surface of the platform. If two people decide they want to share photos later, they can do that on their own, off our servers — but the product itself does not store, transmit, or display photographs at any stage.

Why this is harder than it sounds

The honest answer is: it costs us something. Photos are how every incumbent in this market generates the dopamine that keeps people swiping. Take them away and the engagement curve flattens. People read more carefully, write more carefully, and they spend less time on the app per session. That sounds bad until you remember who we are building for: people whose goal is not to spend more time on a dating app. Their goal is to find someone, leave the app, and never come back.

The other cost is trust. Some users land on the homepage, see “no photos,” and bounce — they assume we must be hiding something shameful, or that everyone here is. That is the price of being unusual. We accept it because the alternative is a product that the people we built this for cannot use at all.

The other things we removed

The “no photos” rule is the visible part of a wider posture. The quiet parts:

• Public identity is a codename, not your name. The system auto-generates one for you (six EFF wordlist words, joined by hyphens) and that is what the wall, your matches, and your chats display. Your real name is yours. We never ask for it, we never display it, and a leaked database would not contain it.

• Tags about location are clipped at the city level. If you try to tag a specific neighborhood, the moderation pass flags it for human review. Your zip code is a recognition primitive too.

• The reveal ladder is contractual. Every field on every page is on an explicit allowlist. The wall card shows roughly fifteen attributes — those are the ones you’ve agreed are safe to expose to a stranger. Everything else is gated behind mutual interest, then mutual accept, then conversation. There is a CI test that fails the build if a developer accidentally leaks a field upstream of where it belongs.

• Messages are not addressable by user. The schema does not have a recipient_id column on the messages table. The only way to read a chat is through the connection it belongs to. Even an internal query, written by a developer, cannot accidentally surface “all messages sent to this user.”

These are not features we ship in a release blog post. They are load-bearing parts of the product, the same way a brake is a load-bearing part of a car. You don’t notice them when they are working.

What we ask in return

If you use PotentialSpouse, the contract is straightforward:

• We will not show your face.
• We will not show your name.
• We will not show your neighborhood.
• We will not let any other user see anything about you that you have not agreed they should see.
• In return, we ask that you write honestly. Because nobody is looking at your photo, the only signal anyone can use to decide is what you have actually said about yourself.

This is the trade. It is a quieter way to look for a partner. It takes longer. It does not feel like a game.

That is the point.