Privacy Policy

Who we are: The Love Envelope is operated by Pioneer Digital Ventures LLC, an Arizona limited liability company ("we," "us"). Contact: support@theloveenvelope.net · Safety reports: safety@theloveenvelope.net

The Love Envelope is a private letters app for two paired partners, 18 or older, in the United States. You write each other letters with a scheduled opening time. Mutual letters require both partners to participate in opening; a surprise becomes available for its recipient to open after the server unlocks it. The date alone never opens a letter. This policy explains what we collect, why, how long we keep it, and the choices you have. It is written to match how the system actually works, including the parts that are unusual.

1. The one unusual thing to understand first

Sealing a letter counts as completed delivery. When you seal a letter, a delayed-access copy is delivered to your partner immediately; only its readability waits for the scheduled time and the opening rules for that letter type. Because the letter now belongs to your partner's experience of the service too:

Once sealed, a letter is delivered to the intended recipient and cannot ordinarily be retracted through the app, including after a breakup, block, or account deletion. Love Envelope may restrict, preserve, or remove content in limited safety, legal, account-security, or technical circumstances.

This is disclosed again at the moment you seal and at the moment you delete your account, and both require your explicit confirmation. Section 7 explains exactly what account deletion does and does not remove.

2. What we collect

What the mobile app does NOT collect: analytics or advertising identifiers, crash-report SDKs, device location, contacts, biometric data (Face ID/Touch ID runs on your device; we only learn whether it succeeded).

3. How we use information

Only to provide, secure, and support the service: delivering and revealing letters under their conditions, maintaining your shared plans, dates and memories and your writer-only notes, running notifications you choose, verifying age eligibility, preventing abuse and fraud, responding to reports and support requests, and meeting legal obligations. We do not sell personal information, do not share it for advertising, do not profile you, and do not routinely scan the contents of private letters.

4. How we protect your letters

"Sealed" describes the app's server-enforced access state; it does not mean end-to-end encryption. Data is encrypted in transit and at rest, but our infrastructure can technically access content, and personnel access is restricted to the support, safety, security, and legal circumstances described in this policy.

Sealed letters are isolated behind server-side access controls. Neither you nor your partner can read a sealed letter through ordinary app features before its opening rules are met, including when you wrote it. Exceptional personnel access uses a separate privileged process outside those app features. Such access is permitted only for specific content needed in the limited safety, legal, account-security, or technical circumstances described in our Terms, with a documented case and an access log. Staff are not authorized to browse unrelated letters.

5. Who we share information with

Our public website is hosted through OpenAI Sites using Cloudflare infrastructure. Those providers process website requests for delivery and security under their applicable terms. The website has no account, letter-upload or contact-submission form; email links open your own email application. See our Service Providers for the distinction between website hosting and the private mobile service.

• Your partner, by design: your display name and photo, the letters you seal for them (under their opening conditions), and the shared relationship records, plans, dates and memories under their visibility rules. Your private favorite-things notes are visible only to you through the app. Before a mutual letter opens, your partner can see its neutral category and any title you give it; the letter text and photos stay sealed. A surprise is completely invisible to its recipient until the server unlocks it; between unlock and opening, the recipient sees only a generic sealed-envelope summary, with no private title, letter text, style, or photo details.
• Service providers (processors), listed on our public subprocessor page (Service Providers): Supabase (database, authentication, storage and hosting, itself running on cloud infrastructure providers), Google Workspace (our support, privacy and safety correspondence, plus the custom SMTP service used by Supabase Auth to send verification, sign-in and recovery emails; authentication emails contain account information and codes or links, never letter content), Expo (notification registration and renewal using the device information in Section 2, and push relay with content-free notification payloads), and Apple (push delivery, App Store). We have no advertising or analytics providers.
• Safety and legal: when you submit a report, designated safety personnel may review the specific reported content as described in Section 8. We may preserve or disclose information when required by law or legal process, or where reasonably necessary to address a serious or credible threat to someone's safety. We require valid legal process for disclosure of content except in a genuine emergency involving a risk of death or serious physical harm.
• Business transfers: if we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction; we will continue to protect it under this policy and notify you of any change in control or of material changes to how it is handled.

Links to maps and other services

This version of the app does not offer place search. Some date ideas include a link that opens Google Maps or another provider, and a plan may keep a place saved earlier as a Google place identifier, which is shared with your partner under the same rules as your other plans. If you open such a link, your device contacts that external service, which handles the visit under its own terms and privacy policy.

6. How long we keep things (the honest schedule)

Full schedule: Data Retention. The essentials:

• Drafts you never sealed: yours to edit or delete; deleted 30 days after a breakup or account deletion.
• Sealed letters: kept until their conditions are met. That is the product. They survive breakups, blocking, and account deletion (Section 7).
• Opened letters: kept as your shared keepsake until you and your partner both agree to delete them (mutual deletion), subject to the limited exceptions described here. Clearing an eligible archived item removes only your access and presentation; it does not delete the shared content or your partner's copy.
• Ordinary shared history: either original partner may remove eligible shared plans or memories. Breakup, blocking or one account's deletion does not erase the surviving original's authorized history; a new partner cannot read a previous relationship's history. Removing an ordinary item does not delete a linked letter. Writer-private favorite-things notes are scrubbed when the writer's account permanently finalizes.
• If BOTH partners' accounts are permanently deleted: all associated letters become inaccessible immediately, are retained in an inaccessible state for one additional year (in case of legal holds or investigations), and are then deleted from our active systems.
• Reported-content evidence: ordinarily one year after the case closes; longer under a legal hold, law-enforcement request, or unresolved investigation.
• Empty inactive accounts: an account with no letters, no active relationship, no open reports and no holds may be deleted after 24 months of inactivity, after at least two warning emails. An account containing letters is never deleted just for inactivity.
• Backups: data removed from the active database expires from its encrypted daily backups within 7 days. Those database backups contain photo metadata, not the photo files in private Storage. Restoring a database backup does not restore a photo file already removed from Storage. This does not promise that every temporary delivery, provider, security or evidence copy disappears at that instant; any such copy follows its applicable retention period or legal hold. The full schedule distinguishes loss of access, queued physical removal and backup expiration.

7. Account deletion: exactly what happens

You can delete your account in the app (Profile → Settings → Delete account). It works like this:

1. Immediately: your display name becomes "Deleted account" and your photo, email and profile details are hidden from your partner. Notifications tied to your account stop. Your partner is not sent a deletion notification.
2. 30-day recovery window: your original profile survives only in a protected recovery copy. You can restore your account by signing in, re-verifying your email, confirming with Face ID/Touch ID/passcode where available, and explicitly confirming reactivation.
3. After the recovery window: finalization ends account access, scrubs identifying profile information, and processes removal of credentials, sessions, the profile photo, push tokens and never-sealed editable drafts. Auth-account and photo-file removal use retryable background jobs; a queued removal is not a completed physical deletion. Applicable evidence holds and the backup periods in Section 6 still apply.
4. What remains: letters you already sealed and delivered to your partner remain in your partner's account, attributed to "Deleted account." A random internal identifier (with no profile information attached) persists so the letter's authorship and access rules keep working. This is profile scrubbing and pseudonymization, not anonymization: your partner will still know the letter came from you, and the letter's text is whatever you wrote.

Deleting your account is therefore not a way to retract delivered letters. That is disclosed before you seal and again before you delete. If both partners' accounts are permanently deleted, the one-year schedule in Section 6 applies.

8. Safety, reports, and staff access

You can block your partner, report a relationship, an opened letter or a profile photo in the app, clear an eligible visible archived letter from your own view, and reach a dedicated safety address (safety@theloveenvelope.net). We confirm receipt of every report. We do not routinely scan private letters; the safety system is report-driven.

By submitting a report, you authorize designated Love Envelope safety personnel to review this content and related account information as necessary to investigate and respond. Access is restricted and logged.

Staff are not authorized to browse unrelated letters; access is tied to an active investigation, logged, and ends when the case closes except where evidence must be preserved. Support can restrict, preserve, or remove a sealed letter only in the limited circumstances listed in our Terms (for example verified account compromise, credible safety threats, illegal content, or a court order), never for ordinary regret or a breakup.

9. Your rights and choices

• See and export your data: download a privacy-data export in the app (Settings → Export your data) (your account, profile, relationship metadata, dates and status history, consent records, deletion requests, and appropriate support/report metadata).
• Download your letters: separately, download opened letters you still have permission to access. The current letter-download feature does not include editable drafts. Still-sealed letters cannot be downloaded by anyone, including their author, until they open. A statutory request that seeks the text of a still-sealed letter is handled through the separate procedure described in our privacy-rights process, which balances your rights against the delivered recipient's and the letter's opening conditions.
• Correct your profile information in the app. Sealed letters are immutable by design, so a correction cannot change sealed content before it opens; a correction request that concerns sealed content is handled through our privacy-rights process.
• Delete: your account (Section 7); an eligible shared letter via mutual deletion (both partners agree); or an eligible visible archived item from your own view via clear. Either original partner may also remove eligible ordinary shared plans and memories; that removes the ordinary item for both without deleting a linked letter. Clearing is personal and irreversible from your view: it does not delete the other participant's copy, destroy shared content, or count as approval of mutual deletion. Mutual deletion is the only ordinary in-app process that destroys a delivered letter for both participants.
• Notifications: fully controllable in settings; the app works without push.
• How to exercise rights: support@theloveenvelope.net or privacy@theloveenvelope.net. We verify identity proportionally to the sensitivity of the request and, for U.S. privacy requests, aim to acknowledge promptly and respond within 45 days, extending by up to a further 45 days where permitted and telling you if we do. You will not be discriminated against for exercising your rights. If we deny a request, you may appeal by replying to our decision or writing to privacy@theloveenvelope.net with "Privacy appeal," and we will respond with the outcome and reasons. You may use an authorized agent where the law allows; we may ask the agent for proof of authorization and may ask you to verify your own identity. Notice about sensitive information: the contents of your letters are personal messages where we are not the intended recipient, which several U.S. state laws treat as sensitive personal information; we use letter content solely to provide the service you requested and for no other purpose, so no separate opt-out is needed.

10. Age

The Love Envelope is for adults 18 and older. We require an age confirmation before account creation and remove accounts discovered to belong to minors. We do not knowingly collect information from anyone under 18; if you believe a minor is using the service, contact safety@theloveenvelope.net.

11. Where the service is offered

The Love Envelope is offered in the United States only at launch. We do not offer the service to, or direct it at, people in the EU, EEA, or UK, and the app is not available on those storefronts. If you are outside the United States, please do not use the service.

12. Changes to this policy

We will post changes here with a new version number and effective date, and for material changes we will notify you in the app and ask for fresh acceptance where required. We will never retroactively weaken the promises this policy makes about content you already sealed without your consent.

13. Contact

Pioneer Digital Ventures LLC, operator of The Love Envelope · c/o Registered Agents Inc, 4539 N 22nd St Ste R, Phoenix, AZ 85016, United States · support@theloveenvelope.net · Safety: safety@theloveenvelope.net