Privacy Policy

lovnote is operated by Bruno Giovani Carpinelli Pinheiro, an individual resident in Brazil, acting as the controller of the personal data processed in the service.

For any request about your data, write to hello@lovnote.app. We reply within 15 days.

Account data: your display name, email, preferred language and, if you add one, your profile photo. If you sign in with Google, we receive your name, email and profile photo from Google.

Invitation: the email of the person you invite to the diary, used to send the invitation.

What you write: diary entries, photos, places and dates, answers to the daily question, likes, letters kept in the time capsule, important dates and savings goals.

Places and photos: the place of an entry is the name you type; lovnote does not access your device's location. In the app, the camera and the photo library only open when you choose to take or attach a photo, and only the photo you choose is uploaded.

Payment data: on the website, only the customer identifier and the subscription status; card details stay with Stripe and never reach us. In the app, the purchase is made through the App Store or Google Play, and we receive, through RevenueCat, the product, status, dates, currency and amount of the subscription — never your card or payment method.

Usage data: on the website, which screens are opened, which actions are completed and technical error reports, so we can understand what works. The app has no measurement tool; PostHog only receives from it events that our server records, such as the start of a subscription.

Notifications: if you turn them on in the browser, we store the technical endpoint it generates to receive them. In the app, the device token is kept by OneSignal, linked to your account identifier, to deliver them. In Settings you choose which kinds you want: question of the day, new moments, likes, important dates and forgotten memories.

To run the diary: store what you write, show it back, remind you of dates and bring old memories back.

To charge the subscription and keep access active.

To send the only three emails the product sends: sign-up confirmation, password recovery and partner invitation. We send no marketing email.

To improve the product, from aggregated usage data.

To measure our ads on Facebook and Instagram, only on the public pages of the website (see Cookies).

We do not sell your data, and we never use your diary content for advertising or to train any model.

With the providers below, each one only for what is described:

Supabase — database, authentication and photo storage. Servers in the United States (us-east-1).

Vercel — hosting and application runtime. Servers in the United States.

Stripe — processing of payments made on the website (subscription and credits). Your card details are collected and stored by Stripe; we never receive or store them.

Apple (App Store) and Google (Google Play) — processing of the payment for a subscription bought in the app. The store charges you, on your store account; we never see your card or payment method.

RevenueCat — record of subscriptions bought in the app. It receives your account identifier and the purchase details (product, status, dates, currency and amount) and tells us about every change.

OneSignal — delivery of notifications in the app. It receives your account identifier, the device token and the text of each notification.

PostHog — product usage measurement on the website (which screens are opened, which actions are completed) and technical error reports.

Resend — delivery of sign-up confirmation, password recovery and invitation emails.

Meta (Facebook and Instagram) — measurement of our ads. The Meta Pixel runs only on the public pages of the website (home page, sign-up, blog and free tools) and records the visit and the sign-up, with what your browser sends: IP address, browser, page visited and Meta cookies. It never loads inside the diary and never receives what you write.

Google (Gemini API) — the AI Lab's language and image models. It receives text or a photo only at the moment you request a creation.

The servers holding your data are in the United States. If you are in the European Economic Area or the United Kingdom, this means your data is transferred outside that area.

The transfer relies on the contractual safeguards offered by each provider listed above, including the European Commission's Standard Contractual Clauses where applicable.

No AI creation happens on its own. It runs only when someone asks for it, and only after both people in the diary have authorised it, separately. Sending a photo requires its own authorisation, also from both.

When a creation is requested, the necessary text is sent to Google (Gemini API) at that moment and only for that purpose. We use the paid service, whose terms do not allow Google to use this content to train models; Google may keep it for a limited time solely to detect abuse.

Photos are never sent in bulk: only the one you choose, one at a time, and only for the requested creation.

Until both people authorise, nothing is sent.

Nothing in the diary is public by default. There is no feed and there are no followers. Likes exist only between the two of you: your partner can like one of your entries or answers, and no one outside sees it.

Couples ranking: each person decides for themselves, and the authorisation starts off. The couple only appears once both people in the diary have authorised it; whoever joins by invitation starts without authorising, and if either of you withdraws the authorisation, the couple leaves the ranking. It shows the diary's name, each first name and numbers: days together, consecutive days writing and number of entries. Never the content.

Year in review: the cards you can download and share show the diary's name, numbers and highlights of the year, such as the most recorded place, and only show photos if you choose them (four at most). The text of your entries never appears on them.

Public link to the review: off by default. If you create one, whoever has the address sees each first name and the same numbers as the cards. Turning it off stops access immediately, and creating it again gives a different address — the old one never works again.

Diary photos are kept in private storage and delivered through signed links valid for one hour. There is no open address for a diary photo. The exception is your profile photo, if you add one: it sits at a public address, so it can appear next to your name.

Isolation between diaries is enforced by the database, not by the application screen — which means it holds even for someone trying to reach the data outside the interface.

The answer to the daily question is only revealed after you write your own, and that rule is enforced by the database too.

No system is immune to incidents. If one occurs that may create a relevant risk to you, we will notify you and the competent authority.

You may confirm processing, access, correct, delete, port your data and withdraw consent.

Some are already built in, with nothing to request: on the website, Settings → Your data downloads everything you wrote in a single file; and Settings, on the website or in the app, lets you leave the diary, permanently delete it or delete your account.

How to delete your account: in the app, go to Settings → Careful → Delete my account; on the website, go to Settings or straight to https://lovnote.app/en/account/delete, which works even if you have no diary or subscription yet. To confirm, you type the account's email.

What happens to the diary: your account, your profile, your profile photo and the likes you gave are deleted. If the diary has another person, it stays with them, and what you wrote and the photos you uploaded remain there, without your name, as “Deleted account” — so your partner does not lose your part of your story. If you were the only person in the diary, it is deleted entirely, with all entries and photos.

What happens to the subscription: if it was bought on the website and the diary stays with your partner, automatic renewal is turned off and saved cards are removed, unless the charge is on your partner's card; your partner keeps access until the end of the period already paid for. If the diary is deleted too, the website subscription is cancelled immediately, with no pro-rata refund. A subscription bought through the App Store or Google Play cannot be cancelled by us: cancel it in your store account's subscriptions before deleting your account, or the store will keep charging.

For the other rights, write to hello@lovnote.app.

For as long as the account exists. Deleting the diary removes the content and the photos. Deleting the account works as described in “Your rights”. What is deleted may still remain for a limited period in the database backups, until they are replaced.

Records required by law — billing records, for instance — are kept for the corresponding legal periods, even after the account is deleted: Stripe keeps the account's email and the diary's name; the App Store, Google Play and RevenueCat keep the purchase history.

Usage data in PostHog and the device record in OneSignal are linked only to an internal identifier, with no name or email, and are not deleted automatically with the account. If you want them deleted too, ask at hello@lovnote.app.

We use strictly necessary cookies to keep you signed in. Without them the app does not work.

On the website, we also measure product usage (PostHog).

On the public pages of the website, we use the Meta Pixel to measure our ads on Facebook and Instagram, and it stores Meta cookies in your browser. It never loads inside the diary and does not run for visitors from the European Economic Area, the United Kingdom or Switzerland; to know that, we keep the country you are visiting from in a cookie.

To limit how this data is used for ads, adjust the ad preferences in your Meta account or block third-party cookies in your browser.

lovnote is for people aged 18 or over. We do not knowingly collect data from children. If we learn of such an account, it will be removed.

If we change something relevant, we will tell you in the app or by email before it takes effect. The date of the last revision is at the top of this page.