Privacy
Last updated 6 September 2026
This app is two people playing a game with each other over twenty-one days. Almost everything it stores exists so that your partner can see it — and almost nothing exists so that we can.
There is no advertising, there are no trackers, and there are no third-party SDKs collecting anything. Nothing you write is sold, shared, or used to train anything. This is not a promise about intent; it is a description of what the app contains, which you can verify by the absence of any network traffic to anywhere but our own server.
The website — this page and the one that invited you here — counts one thing, and we would rather describe it exactly than claim a round number. It is set out under what the website counts, below.
Who we are
Love & Couples is operated from Belize. If you want to reach a person about anything on this page, write to privacy@loveandcouples.com.
What we store, and why
| What | Why | Kept |
|---|---|---|
| Email address | To sign you in, and to send password resets and the one verification message. | Until you delete your account |
| Password | Stored only as an Argon2id hash. We cannot read it, recover it, or tell you what it is. | Until you delete your account |
| Display name | What your partner sees. Required. | Until you delete your account |
| Pronouns | Optional, and shown only to your partner. Leave it blank and nothing breaks. | Until you delete or clear it |
| Date of birth | To check you are 18 or older. It is used once, at signup, and is never shown to anyone — not to your partner, and not back to you. | Until you delete your account |
| Profile photo | Optional. Only you and your partner can ever load it. Location and camera metadata are stripped before it is saved — see below. | Until you remove it or delete your account |
| What you play | Scores, predictions, notes, declarations, the sealed prize and penalty, your rankings. This is the game; it is stored so your partner can see it and so a season can be scored. | Until you delete your account |
| Signed-in devices | A device name you can recognise, the address it signed in from, and when it was last used — so you can see every device on your account and end any of them. Visible only to you, under Settings → Devices. | 30 days after last use, or until you sign that device out |
| Country you signed up from | Your address is looked up once, at signup, to work out which country you are in — and then the country is kept and the address is not. We use it to see where the app is being used. The lookup happens on our own server against a local database; your address is never sent to anyone. | Until you delete your account |
| Security events | Sign-ins, failed sign-ins, password changes, deletion requests, and the address each came from. This is how a break-in gets noticed at all. | 90 days |
| Rate-limit counters | To stop somebody guessing passwords. The address is stored only as a one-way hash — enough to count, not enough to identify. | 24 hours |
Your address, specifically
Knowing which countries an app is used in is ordinary and useful. Keeping a log of everyone's IP address in order to know it is not, so we do not.
The address is resolved to a two-letter country code at the moment you sign up, and only that code is stored against your account. The lookup runs against a database file on our own server — nothing is sent to a geolocation service, because that would mean handing your address to a stranger to find out something we can work out ourselves.
Your address does still appear in the security log described above, for 90 days, because noticing a break-in requires knowing where it came from. That is a different purpose with a different, shorter lifetime.
Your photo, specifically
A photo from a phone usually carries the GPS coordinates it was taken at, along with the camera, the lens and the exact time. When you upload one, the server re-encodes the image and keeps only the pixels. That metadata is not stripped on your device and trusted — it is discarded because the file we save was rebuilt from scratch without it.
Photos are stored outside the web root under random filenames and are served only to you and your partner. There is no public URL for your photo, so there is nothing to guess and nothing to share by accident.
What your partner can see
Your display name, your pronouns if you filled them in, your photo, and everything you play: the scores you give, your predictions, your notes and declarations. That is the game working as intended.
Two things they never see. Your date of birth, which exists only for the age check. And whether you bought a Read — a hint is private to whoever paid for it, because a partner learning you needed help undercuts the thing it helped you do.
Your spice level is not disclosed either. What the two of you see is the gentler of your two settings, which never reveals which of you set it.
What we never do
- We do not sell or share your data. There is nobody to sell it to; this app has no advertising business.
- We do not track you across apps or websites. There is no analytics SDK, no advertising identifier, no pixel. The website's daily counter is described above; it holds nothing that could identify a visit, let alone follow one somewhere else.
- We do not read your notes. They are stored so your partner can read them.
- We do not log passwords or tokens. The security log actively refuses to record anything credential-shaped, whatever it is labelled.
What the website counts
The landing page opens with a panel explaining the game. We wanted to know whether people close it immediately, so the page tells our own server one word when it opens and one word when it goes — whether it was closed, which of the four ways out was used, and whether it was up for under two seconds, under fifteen, or longer.
That word is added to a running total for the day, and the total is all that is kept. The table it goes into has three columns: a date, the name of the event, and a number. There is no column for an address, a session, a browser, a page, or where you came from — not left empty, but absent, so that nothing about a particular visit could be recovered from it by us or by anyone holding the whole database. It cannot tell us how many people saw the panel: someone who reloads the page counts twice, and nothing in it can tell the two apart.
No cookie is set for this, nothing is stored in your browser on our behalf, and it happens only on the website. The app does none of it.
Who else is involved
One party, for one purpose: our email provider delivers the verification and password-reset messages, and therefore handles your email address. Nothing else about you leaves our server.
There is no third-party analytics, crash reporting, advertising network, or cloud AI service in this app. The country lookup described above uses a database file stored on our own server, licensed from DB-IP under CC BY 4.0 — no request is made to them or to anyone else when you sign up.
Deleting your account
Settings → Delete account, in the app. No email, no form, no waiting on us.
Deletion is not instant, on purpose. There is a short grace window in which you can change your mind — a mis-tap should not cost somebody a season they were halfway through — and during it your account stops working entirely. After that window your personal details are irreversibly scrambled: your email, your display name, your photo and your date of birth are gone and cannot be recovered by us or by anybody else.
What survives, and why. Your partner's season is a shared record — their scores, their notes, their standing. Erasing your side of it would delete their game too. So the game rows stay, with nothing in them that identifies you. The security log also keeps a record that the deletion happened, because a deletion log that deletes itself cannot prove anything.
Your rights
You can see everything the app holds about you from inside it: your account, your devices, and your season. You can correct your display name and pronouns at any time, change your password, remove your photo, and delete the account outright.
If you want a copy of your data in a file, or you want something corrected that the app will not let you change, write to privacy@loveandcouples.com and a person will answer.
Age
This app is for adults. You must be 18 or older to create an account, and the signup asks for a date of birth to check. It is not intended for children and we do not knowingly hold data about anyone under 18. If you believe we do, write to us and we will remove it.
Security
Everything travels over HTTPS. Passwords are stored as Argon2id hashes and are never recoverable, including by us. Sign-in tokens are short-lived and rotate, so a stolen one stops working quickly — and, because they rotate, a stolen one that is reused ends the session it came from rather than sitting there unnoticed.
No system is perfect. If you find a problem, we would rather hear it from you than from somebody else: security@loveandcouples.com.
Changes
If this policy changes in a way that affects what we collect or who sees it, the app will tell you — not a silently updated date at the top of a page you have no reason to revisit.