Privacy
Not a policy we promise to follow. An architecture that can't do otherwise.
Your most private life currently lives on services that can read it — and several of them make their money doing exactly that. A promise not to look is worth whatever the company is worth on the day somebody makes an offer for it. We would rather not be able to look.
Everything on this page is a thing the code does, not a thing we promise.
Every private field is sealed before it leaves your phone, with a fresh random 96-bit nonce on every single write — never reused, never derived from anything guessable. What reaches our servers is ciphertext and an initialisation vector. It is never the words.
The couple's shared key is wrapped to each partner's public key with SHA-256, so it crosses between your two phones without ever existing on a server in a form anyone could use.
Your recovery phrase is stretched with SHA-256 a hundred thousand times before it becomes a key — so guessing at it costs real time, not milliseconds.
It is generated on your device and stored in that device's own database. When you move to a new phone or write down a recovery phrase, a copy leaves wrapped under a secret we never see. We could not hand it over if somebody asked us to.
Not “falls back to plaintext”. Refuses, loudly. The one failure mode that would quietly undo all of this is the one the code will not do.
Fonts, icons and every asset are served by us. Opening the app does not announce itself to an analytics service, a CDN, or an ad network. It talks to one backend — ours, hosted on Google's Firebase — and that is all.
No analytics, no measurement IDs, no advertising SDKs, no third-party telemetry anywhere in the app. Not throttled — absent.
When your key unlocks, the app prints its fingerprint — six characters derived from the key itself. If yours and your partner's match, you are provably in the same box. If they ever stopped matching, you would see it before we did.
Timestamps, ids and status flags stay in the clear, because otherwise the app could not sort or find anything at all. The words, the photos, the video, the voice notes and the sessions are the encrypted half — which is the half that would matter if anybody ever got in.
Photos and video record inside the app. They do not land in your camera roll, and they do not land in your photo library's cloud sync.
Closing your account sweeps the stored files too, rather than orphaning them in a bucket. Expiring flirts are deleted on a schedule — gone, not hidden.
A one-time sync code moves your keys between your own devices — wrapped under that code, relayed for minutes, then purged. A recovery phrase covers the day both phones are gone.
Cryptography only holds if the ordinary parts of the app agree with it.
When you set up, your device generates its own key pair. The private half never travels in the open. Pairing with your partner derives a shared key strictly between your two devices.
Photos and video record inside the app and never land in your camera roll. Shared links open in the Lock Box — a private viewer that keeps no history.
Feature toggles remove entire sections — Date Night, Discussions, the daily question — for your account. Your experience, your call.
The guides work with what you've chosen to share, inside your account — your words don't train outside models, and your relationship doesn't feed a profile that follows you around the internet.
Where privacy has limits
Your network can still see which sites and services you connect to — that's true of every app, and no marketing page should tell you otherwise. Anyone holding your unlocked phone can read what's on its screen. Encryption protects the content of what you share with each other; it can't protect a password taped to the fridge. Honest edges, stated plainly.
This website is not the app
Inside the app, nothing watches you. No behavioural tracking, no measurement IDs, no advertising SDKs, no third-party telemetry — your content is encrypted before it leaves your phone and we could not read it if we wanted to. That is the architecture, and it does not change.
This marketing website is a different thing. It is how people find us, and if we buy an advert we need to know whether it worked. So these pages can use standard advertising measurement — the same pixels every business uses — and only after you say yes. Decline and you lose nothing; the site works identically. Nothing measured here ever reaches your account, and nothing from inside the app is ever sent out here.