Your privacy, plainly

ToLoveList is built for two people to share a private space. We collect only what's needed to run that space, and we never sell your data. This policy explains what we store and why.

1 · What we collect

Your email and password (encrypted), your love-language quiz results, the tasks and prizes you create, and basic usage analytics. Photos you attach as task proof are stored privately and shared only with your partner.

In more detail:

• Account: email address, display name, password hash, sign-in method and time zone.
• Profile: avatar, love-language results and the preferences you set.
• Your couple space: tasks, lists, points, streaks, badges, prizes, notes and the photos you attach.
• Device and usage: browser and device type, pages visited, errors and performance data, and an approximate location derived from your IP address (never precise location).

2 · How we use it

To run the core loop, sync between you and your partner, and improve the product. Under GDPR, our lawful basis is the contract you enter when you sign up.

We also rely on our legitimate interest to keep the service secure (for example, rate limiting and fraud detection) and on your consent for optional analytics, which you can turn off at any time from the cookie banner or Settings.

3 · Your rights

You can export or delete your data at any time from Settings. Deletion has a 14-day grace period, after which it is permanent.

You also have the right to access, correct, restrict or object to how we process your data, to withdraw consent, and to complain to your local data protection authority. Write to privacy@tolovelist.app and we will answer within 30 days.

4 · Your partner

ToLoveList is shared by design. Your partner sees the tasks, points, prizes, notes and photos you share in your couple space, and your love-language results if you choose to compare them. If you leave the couple, your shared history stays with the space you created together until one of you deletes it.

5 · Who we share it with

We never sell your personal data and we don't show ads. We use a small number of providers who process data on our behalf, under contract:

• Cloudflare: hosting, database, file storage, email delivery and security.
• Sentry: error reports, so we can find and fix crashes.

We may disclose data if the law requires it, and we will tell you unless we are legally prevented from doing so.

6 · How long we keep it

We keep your data while your account is active. When you delete your account, everything is removed after the 14-day grace period, except records we must keep by law. Server logs are kept for up to 30 days.

7 · Security

Data is encrypted in transit and at rest. Passwords are hashed and never stored in plain text. Sessions use secure, http-only cookies, and you can sign out other devices from Settings.

8 · Cookies

We use a session cookie to keep you signed in and local storage to remember preferences like your theme. Optional analytics only run if you agree to them. See the Cookie Policy for the full list.

9 · Children

ToLoveList is for adults. You must be 18 or older to create an account, and we do not knowingly collect data from anyone younger.

10 · International transfers

Our providers may process data outside your country, including outside the European Economic Area. When they do, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

11 · Changes to this policy

When we make a material change we will tell you in the app and by email before it takes effect. Each version is dated, and the version number appears at the top of this page.

12 · Who we are

ToLoveList is operated by Elmer Project, the data controller for your personal data. You can reach us, and our Data Protection Officer, at privacy@tolovelist.app.

Questions? Reach our Data Protection Officer at privacy@tolovelist.app.