The service enforces adult, unique-person, and valid-account claims. It does not accept birth date or legal identity. Relationship edges require the invitee; hidden interests return only counts until bilateral reveal. Blocking removes matches and conversation visibility; reports remain free. Helmet, rate limiting, body validation, object ownership checks, and audit events are enabled.

Production still requires durable repositories, session expiry, CSRF for cookies, media scanning, encrypted messaging/storage, abuse classifiers with human appeal, moderator MFA, regional safety escalation, and independent penetration testing. The prohibited-content policy includes minors, coercion, trafficking, non-consensual imagery, threats, extortion, and harassment.