Safety, designed in.

If you can see them, they can see you. The match calculation uses the smaller of the two DiscoveryRadius values, so you can't zoom out to watch someone who's set a tighter radius.

On most discovery products, visibility is asymmetric: a user with a wide setting can browse profiles whose owners set a narrow one. That creates a power gradient where the most exposed person doesn't know who's watching. Bingo computes the match window as min(yourRadius, theirRadius) and applies the same rule both ways. The relationship is either mutual or it doesn't exist.

Example
You set 5km; they set 200m. You only see each other if you're both within 200m.

Draw a 500m-radius circle around home. While you're inside it, Bingo doesn't broadcast your location at all — to everyone else, you simply appear offline.

The HomeZone is the most important location any user has. Bingo doesn't reveal a HomeZone's center or radius to anyone, and it doesn't emit a degraded signal while you're inside — there is no signal. You return to the map only after you cross the boundary on your way out.

Example
Studying at home, walking to the kitchen, going to bed — nobody on Bingo can tell.

Outside your HomeZone, the location Bingo broadcasts is your real position plus a per-user noise offset of up to 75 meters. The seed rotates daily so the offset isn't predictable.

Within any 24-hour window your offset is stable, so people see you in a consistent place if you stand still. The next day, your offset rotates — preventing an attacker from triangulating your exact address by watching you over time.

Some interests are nobody else's business. A tag marked private is shown only to a viewer who also holds that same tag. The check fails closed.

Bingo doesn't want to force anyone to publicly disclose sensitive interests — recovery, identity, mental health, faith, an activity you're not out about yet. Private tags still count toward matching, so they still find your people. But on a profile, a private tag renders only if the viewer holds it too. If the visibility check errors for any reason, the tag is hidden — the only fail mode is invisibility.

Example
If you mark `recovery meetings` private, only other users who also hold that tag will see it on your profile.

No one can DM you out of nowhere. To message you, someone has to send a MessageRequest and you have to accept. Requests expire after 7 days. Either party can block at any time.

Once accepted, a MessageChannel opens with text (up to 2,000 chars) and voice (up to 60s). There's no real-time calling. The Block button is reachable from every conversation view, every request, and every profile — never buried in a settings menu. Blocking closes the channel and prevents future requests.

Some tags are age-gated (18+, 21+). To use them, a third-party verification provider confirms your date of birth. Bingo stores the verified DOB only — never the document.

The provider verifies you and returns nothing but a boolean and a date. The image of your ID never reaches our system, never enters our logs, never sits in our database. If verification fails, you can retry after 24 hours; the rest of Bingo continues to work without the age-restricted tag.

Block is one tap from any conversation or profile. Report sends content for human review. Neither requires explaining yourself in a textarea before the action completes.

Reported items get held pending review. The reporter sees a confirmation; the reported user sees a generic outcome — Bingo doesn't coach bad actors on what they tripped. Bingo's moderation is imperfect by definition, but it errs on the side of the person who raised the flag.