Privacy Policy

1. What we collect

We only collect data we need to run Loved:

• Account: name, email, hashed password (bcrypt), age, gender identity, orientation, city, approximate coordinates for distance filtering, profile photos, selfie for verification, prompts and bio.
• Activity: swipes, matches, messages you send on the platform, blocks, reports, and login timestamps.
• Billing: your Stripe customer ID and subscription status. We do not store card numbers, CVCs, or expiry dates — Stripe handles all of that under their own policy at stripe.com/privacy.
• Technical: IP address at signup and login (for rate-limiting and abuse detection), browser user-agent, and basic error logs.
• Google sign-in (optional): if you choose to sign in with Google, we receive your name, email, and profile picture from Google. We never receive your Google password.

2. Why we collect it

• To create and secure your account.
• To show you matches based on your preferences, distance, identity, and orientation.
• To let other members see your public profile.
• To generate icebreakers on new matches (see §5 — third parties).
• To bill your subscription and detect fraud.
• To respond to reports, keep the community safe, and enforce our Terms and Acceptable Use Policy.
• To send you transactional emails (password reset, match alerts, billing receipts). We do not send marketing email.

3. Who can see your profile

Your profile (name, age, photos, prompts, city, identity, orientation) is visible to other paying Loved members inside the app. It is not indexed by search engines, not shared with data brokers, not sold, and not used to train advertising models. Your selfie is visible only to the operator for verification review and is never shown to other members.

4. Cookies and similar technologies

Loved uses a small number of cookies and browser-storage keys strictly to run the service — no advertising cookies, no cross-site tracking pixels:

• session_token — httpOnly authentication cookie that keeps you signed in for 7 days.
• loved_token — browser localStorage fallback for the same auth token, used when third-party cookies are blocked.
• Stripe cookies — set by Stripe on their checkout pages for fraud prevention. These are governed by Stripe's policy.

You can clear these at any time from your browser; doing so will sign you out.

5. Third-party services

We share the minimum data required with a small number of processors: Stripe (payments), Google (if you choose Google sign-in), OpenAI (icebreaker text generation — only the two profile prompts of the matched pair are sent, never your messages or personal identifiers), and Emergent (hosting infrastructure). We do not sell, rent, or trade your personal data to anyone.

6. How long we keep your data

• Active account: as long as your account is active.
• Never-paid signups: automatically deleted 7 days after signup (including profile, photos, swipes, matches, messages).
• Cancelled or terminated accounts: deleted within 30 days of your final billing period, except records we are required by law to retain (billing invoices for tax purposes — typically 7 years).
• Password reset tokens: deleted 1 hour after issue.
• Backups: deleted within 30 days of scheduled rotation.

7. Your rights (GDPR, UK GDPR)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction that grants equivalent rights, you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify inaccurate data — you can edit most of it directly on your profile.
• Erase your account and personal data ("right to be forgotten").
• Restrict or object to certain processing.
• Port your data — receive it in a portable JSON export.
• Withdraw consent at any time for anything processed based on consent.
• Lodge a complaint with your local data-protection authority.

Legal basis: we process your data under contract (to provide the service you paid for), legitimate interests (fraud prevention, community safety), and consent (marketing — currently unused).

8. Your rights (California — CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect, use, and disclose — see §1, §2 and §5 above.
• Delete your personal information, subject to legal retention requirements.
• Correct inaccurate personal information.
• Opt out of sale or sharing — we do not sell or share your personal information as defined by the CCPA/CPRA, so there is nothing to opt out of.
• Non-discrimination — we will not deny service, charge different prices, or provide a different level of service because you exercised your rights.

To exercise any right listed above, email nelson3178@icloud.com from the email address on your Loved account. We verify requests by matching the email to the account and, if needed, a short confirmation exchange. We aim to respond within 30 days (GDPR) or 45 days (CCPA/CPRA).

9. Security

Passwords are hashed with bcrypt and never stored in plain text. Authentication tokens are transmitted over TLS. Payments are processed directly by Stripe over their PCI-compliant infrastructure — Loved never touches your card details. That said, no online service can guarantee perfect security; if we ever have a breach affecting your data, we will notify you as required by applicable law.

10. Children

Loved is strictly 18+. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has created an account, email nelson3178@icloud.com immediately and we will delete the account and any associated data.

11. International transfers

Loved is operated from the United States and stored on infrastructure located in the United States. If you use Loved from outside the US, your data will be transferred to and processed in the US, which may have different data-protection laws than your home country. By using Loved, you consent to that transfer.

12. Changes to this policy

If we materially change this policy we will update the effective date above and, for significant changes affecting how your data is used, notify you by email before the change takes effect. Continued use of Loved after a change means you accept the updated policy.

13. Contact

Privacy questions, data requests, or complaints: email nelson3178@icloud.com. We aim to respond within two business days.