Privacy notice

Who can use this app

You sign in with your Google account, or with your email and a password. Only email addresses the administrator has approved can sign in; nobody can create an account here by themselves.

What we store

• Your email address, display name (initially your Google name or the name the administrator gave you) and optional bio. We never receive your Google password. If you use a password here, only a one-way (bcrypt) hash of it is stored, never the password itself.
• Your conversations, messages, attachments, and when messages were delivered and read.
• If you use them: special dates, your shared list, love notes waiting to be sent (only you can see those until they're delivered) and your chat wallpaper and colour. View-once photos are deleted after they're opened. The app lock PIN never leaves your device. Your answer to the question of the day is shown to the other person only after they've answered too; your mood is shown for 24 hours. GIFs come from GIPHY, which sees GIF searches (made by our server) and loads the pictures. Date plans, journal entries and bucket-list photos are visible to the members of that chat. To show link previews, our server opens the links you send.
• Security logs: sign-ins, sign-outs, access changes and administrator actions. Email addresses in logs are partially masked. Message content and verification codes are never logged.

How it is protected

• In transit: all traffic uses HTTPS/TLS (and WSS for real-time updates).
• At rest: the database and file storage are hosted by Supabase, which encrypts stored data at rest (AES-256) at the infrastructure level.
• Access control: database rules ensure only the members of a conversation can read or send its messages and files. Revoked members lose access immediately.
• Not end-to-end encrypted: messages are stored on the server in a form the server can read. They are not end-to-end encrypted.

Administrator access to messages

By default administrators cannot read message content through the app; they see only metadata such as message counts. An administrator can enable message access as an explicit policy. When it is enabled, every member sees a notice in the app, and every time an administrator views a conversation it is recorded in the audit log. People with direct access to the hosting infrastructure (the database owner) can technically access stored data.

How long data is kept

Messages are kept until you delete them, unless the administrator configures a retention period, in which case older messages are deleted automatically. Security logs are kept for a limited period configured by the administrator (default 365 days).

Deleting your data

• You can delete any message you sent at any time; it is removed for everyone.
• To delete your whole account, ask the administrator. Account deletion permanently removes your profile, the messages and files you sent, and your sign-in record.
• Database backups kept by the hosting provider expire according to their backup schedule.