Privacy policy

In short

Your answers, moments and notes belong to you. We do not sell data, we run no advertising, and there is no feature that would let other users see your content.

The application and the database run on a server in Germany. The database is reachable only locally on that server and not from the internet.

We set exactly one cookie: the login cookie. No tracking, no advertising IDs, no external scripts, no external fonts. Which is why there is no cookie banner here.

Controller

Traffic netWorks

Represented by: Martin Janosik

Speditionstraße 8, 40221 Düsseldorf, Germany

Email: support@lovejou.com

We have not appointed a data protection officer, as the statutory requirements for doing so are not met. Send data protection enquiries directly to the address above.

When you visit the website

When you visit, the web server processes technically necessary access data: IP address, time, requested address, status code, amount of data transferred, referrer and browser identification. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in secure and uninterrupted operation.

These server logs are deleted after 14 days at the latest and are not combined with other data.

Fonts are served from our own server. Loading a page opens no connection to Google Fonts or any other third-party provider.

Account and content

For an account we process: email address, first name, a password (stored as a bcrypt hash, never in clear text), the language, the time of the last login and the link to your shared account.

Content you create: answers to questions, responses to them, moments, chapters, milestones, life-area entries and the weekly check-ins. Only the two people of that couple account have access.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract). Content you write voluntarily may contain special categories of personal data under Art. 9 GDPR — for example about health or sex life. We process such data solely on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you give at registration and can withdraw at any time with effect for the future.

Uploaded photos are re-encoded on the server — metadata such as GPS coordinates is removed in the process — and stored outside the web directory. They are retrievable only through an authenticated address.

Cookies

We set a single cookie: "lovejou_session". It contains a signed login token, is httpOnly (not readable by JavaScript), Secure and SameSite=Lax, and expires after seven days. It is strictly necessary to operate the logged-in area and therefore requires no consent.

We use no analytics, marketing or third-party cookies, and we embed no tracking pixels. Because the login cookie is strictly necessary, a consent banner would not legally be required; we show a notice anyway, so that what is stored stays transparent and so that you can make a decision and change it at any time.

We also store your decision from that notice locally in your browser (localStorage, key "lovejou_consent"). That entry is never transmitted to us and only serves to remember the decision.

Contact form

Messages sent through the contact form are processed to answer your enquiry: name, email address, subject, message and a hash of your IP address for abuse prevention. The legal basis is Art. 6(1)(b) or (f) GDPR.

We delete enquiries once they are fully dealt with, and after twelve months at the latest — unless statutory retention periods apply.

Processors

Hosting: netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The server is located in Germany; processing takes place under a data processing agreement pursuant to Art. 28 GDPR.

Email delivery: ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. We send confirmation, invitation and contact emails through this provider, likewise under a data processing agreement.

We use no other service providers. In particular, no transfer to third countries outside the EU takes place, and we embed no services from Google, Meta or comparable providers.

Consent and withdrawal

We record which consent you gave, when, and under which version — at registration separately for the terms and for processing your texts, and for every decision in the cookie notice. The basis is the accountability requirement in Art. 7(1) GDPR.

Withdrawing is as easy as giving: change the cookie decision at any time via "Cookie settings" in the footer of every page. Withdraw the consent covering your texts with one click in your account settings. That removes the legal basis, and all answers, moments and check-ins are deleted immediately.

A withdrawal takes effect for the future. Processing that took place before it remains lawful.

Taking your data with you

In your account settings you can download a complete JSON file with all the data we hold about your account, at any time. That satisfies access (Art. 15) and portability (Art. 20) immediately, with no request and no waiting.

Shared content also concerns the connected person. It is included because it is your data too — authorship is noted on every entry, and of the other person's account the file contains only the first name.

Artificial intelligence

No AI processes your data inside the product. Your answers are not analysed, not scored, not sent to a model and not used for training. There is no automated decision-making within the meaning of Art. 22 GDPR and no profiling.

The images and videos on this website were generated with AI and show people who do not exist. This is labelled visibly on every image and additionally stored in machine-readable form inside the file. Details are in the AI transparency statement.

Retention

We store account data and content for as long as your account exists. If you delete the account in settings, all associated answers, moments, chapters, milestones, check-ins and photos are irreversibly removed within 30 days.

Server logs: 14 days at the latest. Contact enquiries: twelve months after completion at the latest. Security-relevant events in the audit log (such as failed logins, in each case without content and with a hashed IP address only): twelve months.

An account unused for 24 months is deleted after prior notice by email.

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Consent you have given can be withdrawn at any time with effect for the future.

Send requests to support@lovejou.com. We reply within one month.

One note on the particularity of a shared account: content in your couple area generally concerns both people. We handle erasure requests in a way that preserves the rights of the other person; where there is any doubt, we will contact you first.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Germany, phone +49 211 38424-0, email poststelle@ldi.nrw.de

Security

The connection is TLS-encrypted throughout. Passwords are stored as bcrypt hashes. Confirmation and reset links are stored only as SHA-256 hashes, so a database dump cannot yield working links.

The database accepts local connections on the server only, and the database port is blocked by the firewall. The browser receives a strict Content Security Policy that limits scripts to signed sources.

Changes to this policy

We update this policy when the processing changes. The version published here is the one that applies; the date above shows its status.