Pilot Privacy Policy

This policy applies to the invitation-only pilot of The Love Envelope, operated by Pioneer Digital Ventures LLC, an Arizona limited liability company. The pilot is for two paired adults in the United States. It is separate from the planned public App Store launch. Our Pilot Terms describe the service.

Contact support@theloveenvelope.net for pilot privacy requests, account help or safety concerns. Please identify the kind of request and do not send passwords or unrelated private letters.

What we collect and why

• Account and sign-in information, including your email address, password hash, sessions and security records, to authenticate you and protect the account.
• Profile name and an optional profile photo, pairing records, relationship dates, birthdays or other dates you choose to remember, to run your shared space.
• Letters, photos, memories, shared plans and planning notes, and their status and timing, to provide the features you use. Notes about your partner's favorite things are private to the person who writes them.
• Confirmations and consent records, including age eligibility, sealing, opening and deletion choices, to apply the rules you agreed to.
• Device platform, notification tokens and delivery records when you enable notifications. Notification previews do not include letter bodies or hidden surprises. We do not receive your device's biometric data; device-owner authentication happens on your device.
• Your support messages and safety reports, plus relevant restricted audit, security and backup records, to help you, investigate reports and operate the service.
• Place/category search text when you explicitly submit a search, and an internal account identifier and request timing to authorize and limit Google usage.
• Public website connection information handled by our hosts, such as IP address, requested page, browser information and request time, to deliver and secure the site.

We do not sell your personal information, share it for advertising, profile you for advertising, or use letters or photos to train models. The pilot has no advertising or analytics SDK. It does not request GPS location or contacts.

What your partner can see

Your partner can see your profile and ordinary shared relationship items. Pre-opening letter visibility follows the letter's rules: mutual letters show only permitted metadata and any title you explicitly chose to share early; surprises are invisible to the recipient before their server unlock. A sealed body is unavailable even to its author until opening conditions are met.

Once sealed, a letter is delivered to the intended recipient and cannot ordinarily be retracted through the app, including after a breakup, block, or account deletion. Love Envelope may restrict, preserve, or remove content in limited safety, legal, account-security, or technical circumstances.

Ordinary shared plans and photos remain readable and removable by the original partners after the relationship ends. Private notes about your partner are not shown to them. A copy you deliberately download or share outside the app is no longer governed by its access controls.

Optional place searches and Google

Choosing Find places in Phoenix sends a predefined area search from our server to Google Maps. Typing a business or category and pressing Search sends the text you entered and the Phoenix search area. Typing alone does not submit a search. Do not enter personal or sensitive information in the search box.

We do not attach profile names, account identifiers, emails, private notes, letters or photos to Google requests. Anything you deliberately type into the search box is sent to Google; we do not claim to remove personal information from arbitrary search text. Google also receives technical request information from our server and handles it under its then-current Privacy Policy. Google Maps features and content are subject to its then-current Additional Terms.

Search results are temporary in the app. We do not save Google's returned business names, addresses, prices or coordinates into your plans. If you select a place, we save its Google place identifier alongside the plan title and notes you provide. Your plan is then shared with your partner like other bucket-list items. An initial editable title may come from your own submitted search text.

The internal usage record contains an account identifier and request timing, not your query or returned places. Records older than the rolling request-limit window are eligible for pruning during a later successful reservation; this is not a promise of deletion at an exact instant. Opening a Maps or provider link connects your device directly to that service. Saved-place Maps links send the place identifier with a generic query, without your private plan title or notes.

Providers and limited disclosures

Supabase hosts the pilot's database, sign-in, private file storage and server functions. Its primary project region is US East, Northern Virginia; that does not promise US-only processing by all support, edge or downstream services. Google Workspace handles service correspondence and sign-in email. Expo provides the app's build services and notification relay, and Apple provides iOS distribution and notification delivery. Notification payloads are content-free.

Google Maps is used for the optional searches described above and is separate from Google Workspace email. Our public website uses OpenAI Sites and Cloudflare infrastructure. The website does not connect to your private letter account or collect letter uploads. Providers handle relevant information under their applicable terms; we do not assert that every provider processes information only in the United States.

We may disclose specific information where legally required or necessary to address a substantiated safety, account-security or technical issue. Submitting a report authorizes designated personnel to review that reported content and relevant account information. Access is restricted and documented. Staff may not routinely browse unrelated private letters. Evidence may need to be preserved under an investigation or legal hold.

Protection and retention during the pilot

The service uses encryption in transit and at rest, and server-side access controls. It is not end-to-end encrypted. Our infrastructure can technically access content; personnel access is limited to the relevant support, safety, security and legal circumstances described above.

Your account, plans, memories and letters are held to provide the service until you use the applicable removal controls or a relevant retention rule applies. Sealed letters follow their special permanence rules. Clearing your own archive view does not delete shared content. Mutual deletion removes access for both partners and queues content removal. Queuing is not proof of completed physical deletion, and retries or applicable holds can delay removal.

Account deletion hides your profile from your partner and starts a 30-day recovery window. The app offers a verified recovery flow during that window. After it, finalization ends access and scrubs identifying profile data; sign-in credentials, photos and eligible never-sealed drafts are removed through background processing. Delivered sealed letters are not retracted and remain attributed to Deleted account. An internal identifier may remain to preserve authorship and access rules. This is pseudonymization, not anonymization: your partner may still recognize your words.

The planned automatic one-year cleanup after both accounts are permanently deleted, and deletion of empty accounts after 24 months of inactivity with warning emails, are not active in this limited pilot. We are not promising those automated deadlines here. You can contact us about retention or an applicable privacy request. Operational retention and delivery verification remain part of launch preparation.

Daily database backups have a seven-day retention window. They contain photo metadata, not the private photo files themselves; restoring a database backup does not restore a removed photo file. We do not promise that all provider, temporary delivery or evidence copies disappear at the same instant as an app removal, or assert that private-photo recovery has been verified.

Your choices and requests

You can edit permitted profile information, control notifications, decline place search, remove ordinary shared items, report concerns, block a partner, request mutual deletion, clear your own eligible archive view, and start account deletion. The app offers privacy-data export separately from downloads of opened letters you still have access to. Sealed letters, including your own, are excluded from ordinary letter downloads.

You may contact us to request access, correction or deletion, ask about retention, or appeal our handling of a request. We may need to verify your identity. We will handle requests under applicable law; shared letters, legal holds and other lawful exceptions can affect what we may remove or provide. Exercising privacy rights does not create a new way to open sealed content. We do not discriminate against you for exercising applicable privacy rights.

The pilot is for adults, not children. Tell us if you believe a minor has an account. We identify policy changes with an updated date and version and provide notice of material changes. Publication does not silently register new consent on your behalf.

You may also write to Pioneer Digital Ventures LLC, c/o Registered Agents Inc, 4539 N 22nd St Ste R, Phoenix, AZ 85016, United States.