Not every recurring location is an interest.
Some places are private.
Some are sensitive.
Some can expose information that another person has no right to know.
A home address is not a dating signal.
A workplace is not a dating signal.
A medical facility, shelter, treatment center, school, place of worship, or legal-services office is not a dating signal.
A privacy-first location product must recognize that distinction before a place is ever shown to a user.
Usual is designed around multiple layers of protection.
First, certain categories are excluded automatically.
A user should not be asked whether a medical clinic or residential address belongs in their dating profile.
It should never become a place candidate.
Second, users review places privately.
A detected gym, café, restaurant, park, venue, or neighborhood is not used until the user approves it.
Third, other users do not see location history.
They do not see the date, time, frequency, or pattern associated with an approved place.
Fourth, users cannot search venues to identify people.
There is no directory of everyone who visits a particular gym or coffee shop.
Fifth, exact venue names are not required for matching.
Usual can show that two people both frequent climbing gyms or independent coffee shops without identifying the business.
After a mutual match, a shared venue name can be revealed only when both people permit it.
Finally, control must remain available after approval.
A user can hide a place, remove it, stop using place-based matching, disable location permission, or delete the account.
Privacy is not a single permission screen.
It is the set of limits that remain in place after permission is granted.