Privacy & pilot participation

Before you join, here is how it works.

Deployment approval has not been checked. Review this notice before real enrollment.

Notice version: pilot-2026-09-ops-v7 · Updated September 28, 2026

About this pilot

Cerca is a private pilot operated in Honduras. Access can come through a personal invitation, and the operator may also open a limited paid founding-enrollment window. “Cerca” is the project’s name and does not currently identify an incorporated company. It is not a claim that registration is pending.

For support, reports and privacy questions, contact support@cercaclub.com. The project description is not a statement that the project is exempt from applicable responsibilities.

Participation and rules

Cerca tests meeting people through connections that members confirm. This pilot is for adults 18 or older. Each account has a personal invitation link that may be shared privately with people the account holder chooses to invite. Do not publish invitation links broadly, impersonate someone, harass anyone, publish third-party information without permission or use the platform unlawfully.

Dating discovery in this pilot is limited to men meeting women and women meeting men. The preference is fixed and shown before registration. A dating profile requires a declaration that you are single and available. Friend connections are separate from dating: confirmed friends of any supported profile setting can facilitate introductions. Connector-only members do not appear in dating discovery. A declaration is not verification of relationship status.

One required participation checkbox covers adulthood, the pilot rules and acknowledgment of this notice. Two optional signup choices cover introductions through friends and marketing emails. Neither optional choice is preselected. Photo sharing, friend confirmation, tagging and acceptance of an introduction remain separate actions.

Founding access and payments

Connector-only participation is free in this release, even when the founding payment step is required for dating members. Connector-only accounts remain outside dating discovery. Existing recorded payments are retained for reconciliation; this change does not automatically refund a previous charge. Ordinary participation and launch controls still apply.

During a limited founding-enrollment period, the operator may charge the one-time access fee, currency, capacity and dates displayed before checkout. Payment reserves founding access; it does not guarantee approval of a dating profile, a match, an introduction, a particular number of members, or a specific outcome. Dating profiles remain subject to the same adult, profile and photo-review requirements.

Card payment is completed on the PixelPay-hosted checkout linked from Cerca. In this implementation, Cerca does not collect or store your full card number. Cerca keeps the amount and currency offered, an internal reservation/order identifier, payment status, any payment reference you choose to submit, and administrator reconciliation timestamps. An administrator confirms access only after checking the transaction in the merchant's PixelPay account. The merchant name and refund/cancellation terms shown in the founding room must be reviewed before paying.

The public founding counter is calculated from actual confirmed or fee-waived founding accounts. The operator cannot enter a separate display count. Animated network nodes are decorative representations and are not counted as people. An approved cover photograph appears as a small pre-launch preview without the member’s name or profile link only when that member separately opts in; the teaser does not display the member's name or profile and can be turned off.

Before the announced launch date, a founding participant may create an account, prepare a profile and upload photos, but social discovery, connection inquiries and conversations remain gated. The current launch date and real remaining capacity are shown in the founding room. Administrative settings may change the fee or dates prospectively; a participant's founding-access record keeps the amount and currency reserved for that account.

Information and permission records

We store your email, password hash (not the readable password), profile name, private birth date, stated city, profile settings, biography, authorized photos, confirmed connections, interests, inquiries, messages, reports, your personal invitation identifier, which account invited you, founding-access/payment status and references when applicable, optional pre-launch teaser permission, and operating timestamps. Email and birth date are not shown to other members; age may be shown. We do not request your precise location, identity documents, Instagram password or banking information.

For permissions recorded by this release, we keep the purpose, yes/no decision, timestamp, language, wording shown, source of the action, notice version and a fingerprint of the public notice and deployment disclosures. Previous permission values are preserved without inventing detailed records for the past. Existing members review updated participation before new dating discovery; optional choices are not switched on automatically.

The app starts in English unless you have chosen Spanish. You can switch between English and Spanish. We do not automatically translate member-written profiles or messages. Historical permission wording remains in the language originally displayed.

Who can see what

Approved members may see eligible dating profiles according to both people’s preferences. Your confirmed connections may access your card and approved photos even while you pause dating discovery. A connection path is displayed only when each person permits it and the relevant friendships have been confirmed by both sides. A path does not prove emotional closeness or guarantee safety.

Private interest is not published as a list of admirers. Mutual interest can open a conversation. Direct interest instead creates a request visible to its recipient. Asking a connection about someone creates a private conversation between you and that connection; it does not notify the person you are asking about. An introduction proposal shares a separate card and requires both people to accept before a new chat opens.

Photographs and tags

A cover photograph must show you individually. Before uploading a shared photograph, obtain permission from every visible adult for this use. Tags can be sent only to confirmed connections and require acceptance. Photographs are reviewed before display and processed to limit size and remove metadata.

Withdrawing a tag hides that photograph from other members. We do not perform facial recognition or infer relationships from comments. The fictional demonstration is separate from participant accounts and conversations.

Messages, support and discretion

Messages are stored on the server and are not end-to-end encrypted. The administrator interface does not provide general browsing of private chats. The server operator has technical database access and may handle incidents. Reports submitted in the app appear in the coordinator dashboard.

You may email support requests and reports at any time, including outside business hours. Support is handled personally by the pilot coordinator. Responses are not guaranteed immediately, and the service is not continuously monitored. Cerca does not provide emergency assistance.

A recipient can copy or share information they receive. We cannot guarantee absolute secrecy.

Hosting and essential security

The application is hosted on Railway. Its database and private image files use the service’s persistent storage. The current deployment-region disclosure is shown below. Hosting may involve processing outside Honduras.

A necessary session cookie authenticates you and protects actions. This page stores your EN/ES display choice locally when your browser permits it. There is no third-party advertising, third-party tracking script, data sale, or face-analysis service in this build.

Optional product research

Optional product research starts off for new members and is available in My profile. Basic events contain an action type, your internal member identifier and a timestamp, not message text, photographs, the identities of people viewed or finger movement.

You can choose whether to share selected basic actions—such as opening a gallery, opening connections, sending an inquiry or expressing interest—and trial feedback. These research events do not contain message text or your finger’s movement path. You can withdraw the option in your profile; the application then deletes your existing research events and feedback. Sending feedback has its own voluntary confirmation.

The maintenance command removes research events older than 30 days and audit records older than 90 days when it is run. This is not a claim that maintenance has been automatically scheduled.

Optional device notifications

Device notifications are off until you choose to enable them in Cerca and allow them in your browser or installed app. This is a separate service-notification choice, not marketing permission. Cerca may notify you about relevant connection requests, private connector inquiries addressed to you, proposed or accepted introductions, new messages, account review updates and the announced launch. A pending connector inquiry may receive one follow-up after 24 hours while it remains actionable and unviewed. Reminders are limited and cancelled when their underlying access or relevance no longer holds.

Cerca stores the browser-provided push endpoint and encryption keys, account/device association, current-session reference, permission time/language/wording, and limited notification event, queue and provider-response status records. Notifications use standards-based Web Push; delivery passes through the browser vendor's service, such as Apple, Google or Mozilla. Payloads are encrypted in transit to the browser. The notification text is intentionally generic: it does not contain member names, message bodies, photographs, inquiry targets or payment details. Cerca's own name may still be visible on the lock screen, and providers process technical routing metadata. Provider acceptance is not a guarantee that your device displayed a notification.

You may turn notifications off for one device or all your devices within Cerca, or revoke the permission in device/browser settings. Logging out removes that session's device subscriptions; password reset or access suspension removes account subscriptions. Enabling notifications again requires an affirmative action. Active delivery subscriptions are removed on withdrawal or when the service reports them expired. Queue and delivery-status records are pruned after 30 days by the running notification worker or scheduled maintenance; consent history follows the existing permission-record and backup controls. Restored backups require deletion and withdrawal reconciliation before notification delivery is re-enabled.

This release does not send automated WhatsApp messages, marketing push campaigns or message previews to the lock screen. User-initiated invitation sharing remains separate. Notification availability and presentation depend on the browser, installed-app support, connectivity and device settings.

Optional marketing emails

You may separately opt in to email news, event invitations and offers from Cerca. This starts unchecked at signup. Joining the pilot, an introduction request, profile sharing or research participation does not enroll you in marketing. You can join and use the pilot without accepting marketing emails.

You can unsubscribe in My profile or by emailing support@cercaclub.com. Verified support requests can also be recorded by the administrator. After withdrawal you are excluded from subsequent marketing exports. The coordinator must also remove withdrawn contacts from any previously exported mailing list before sending another campaign.

The administrator can export approved members with a current, recorded marketing-email opt-in. The export contains contact and consent evidence, not photos, private messages, birth dates or dating preferences. This release does not send email automatically or synchronize a third-party email platform. Any sending process must provide an effective unsubscribe route and honor current permissions. Contacts are not sold or enrolled in third-party advertising audiences by this application.

Your controls, export and deletion

You can pause discovery, withdraw connections and tags, block people, close conversations, export your account data and messages you authored, or delete your account. Account deletion removes your records from the active system and removes other people’s photographs in which you were tagged from circulation. Those photographs remain subject to the uploader’s control and the review process.

Information already shared outside Cerca cannot automatically be recalled. Deleting an active account does not instantly erase every older recovery copy; the backup treatment below applies. Blocks and withdrawn permissions must not be bypassed during a transition or restoration.

Pilot dates and continuation

The participant pilot begins when enrollment opens to the invited group and is planned to end on September 30, 2026, at 11:59 p.m. Honduras time (UTC−06:00). The earlier technical rehearsal is separate.

We plan to invite pilot members to continue using Cerca. There is no planned blanket account reset. For people who choose to continue, authorized profile information, confirmed connections and accepted matches are intended to remain available, subject to each person’s current permissions, blocks, deletion requests and the continuation terms explained before the decision.

Continuation, any early-member benefit and treatment of members who do not continue will be communicated before the transition. No specific benefit is promised by this notice. The coordinator must manage that transition; this notice does not itself migrate, pause or delete accounts or reopen chats automatically. You may decline continuation and request account deletion through the account controls or support.

Recovery backups and retention

The selected recovery policy is Railway Monthly: a scheduled volume backup every 30 days, retained for 89 days from creation. It covers the database and photographs present on the attached volume at the backup time—not changes made afterward.

Configuration has not yet been confirmed. Selecting a policy or publishing this page does not enable a backup schedule.

Recovery copies are restricted to recovery work, not marketing or routine member access. Deleted data may remain in a restricted copy until its scheduled expiry. Before restored data returns to use, the coordinator must reapply subsequent account deletions, blocks and withdrawn permissions. This reconciliation must be performed and tested; it is not automated by this page.

The 89-day period applies to scheduled monthly copies. Any additional manual or exported copy needs a recorded expiry and deletion process. We do not extend the active account’s lifetime merely because a backup exists. Monthly backups can leave almost 30 days of intervening changes unrecoverable, and provider-volume backups are not a guarantee of an independent off-host copy or loss-free restoration.

Notice updates and questions

This notice describes the stated pilot arrangements and the capabilities of the current build. Material changes will be communicated before applying a new use of participant information. Updating this file does not retroactively record new permission from existing members. Requests involving your account may require a proportionate check that you control the account.

For questions, requests or reports, contact support@cercaclub.com. The public project label is not a substitute for any operator-identification information that applicable requirements may require us to provide.

Profile review and account actions

Authorized administrators review profiles, photographs, member roles, submitted reports and permission history. For operating the pilot, they may see the identities, type, creation date and status of confirmed connections, mutually opened matches and introduction requests. This workspace does not provide general access to message content or one-sided private interest. A submitted report may include the content the reporter deliberately shares.

Administrators can ask you to update your profile, suspend access or permanently delete an account. A request for changes appears inside your profile; it does not send an automatic email. Suspension blocks access while retaining the account. Permanent deletion removes the active account, its uploaded photos and related conversation records; it does not erase backup copies or copies held outside Cerca. Review actions are recorded for accountability; the maintenance process prunes review-action history older than 90 days. Backups follow the separate recovery schedule below.