Privacy, in plain language

What we store today

Builder drafts stay in your browser on this device by default. Microphone access is requested only when you start recording. You can preview and discard a recording locally; it is attached for upload only when you choose Use recording. Photos and audio recordings you attach are uploaded only when the integrated app session is active, and are never written into draft JSON as filenames or raw bytes.

When you sign in and save to your account, Lovefully stores your account identity, gift content, uploaded media, ownership and hosting information, and necessary payment references. Access to account drafts and media follows ownership and recipient-access checks.

For customer support, our restricted owner dashboard can show account details, sign-in dates, saved gift status and order history. We may keep private support notes and account tags. These operational records are separate from optional browsing analytics; declining analytics does not remove records needed to manage your account or purchase. The customer list does not display private gift content. It can show non-content saved-progress indicators, such as how many letters have text or photos are attached, to help us understand unfinished gifts and provide support.

Camera hand tracking is included in every gift and is off by default. Camera access is requested only when you enable Hand tracking in gift Settings. Camera frames are processed on your device, never recorded or uploaded. Tracking libraries are downloaded when needed. Turn tracking off to release the camera; it also stops when you leave or hide the experience and does not restart automatically.

Gift links are unlisted, not listed in a public gallery. Anyone with the link can open an active gift unless passcode protection is enabled. Share the link and passcode only with people you trust.

Shared gift links and QR cards can include the recipient’s display name alongside a random gift ID. Anyone who sees the link can see that name. The name is not a password, does not replace passcode protection, and is not sent to our product analytics.

Policy details

Legal entity

Lovefully

Legal contact

support@lovefully.app

Retention period

Gift content is retained during paid hosting. After expiry, retained gift data is not automatically permanently deleted at launch. Later removal will follow a separately announced retention policy; indefinite storage is not promised. Necessary billing and security records may be retained.

Deletion period

Contact support@lovefully.app to request deletion. Requests are reviewed and handled through support; immediate automated deletion is not promised. Permanent deletion on hosting expiry is not automatic.

Effective date

2026-10-18

Policy version

2026.10.18.2

Examples on this site

Demo content is fictional. Do not treat sample names, letters, or media as real personal data.

Optional analytics

For basic site statistics, our server also keeps anonymous totals of public page requests by minute, public page, referring platform, approximate country and broad device class. These totals include visits that decline optional analytics and cannot identify or count unique people. Country is looked up locally from the connection address; this reporting does not store IP addresses, visitor identifiers, raw browser details, full referring URLs, query strings or private gift routes. Anonymous counters are kept for up to 90 days. Known bots and marked internal tests are excluded. This country lookup uses freely licensed country data from the ip-location-db project.

When analytics is enabled, you can choose whether to allow PostHog to measure visits, campaign sources, editor steps, sign-in, and checkout. Confirmed purchases, publication, renewals, refunds, and disputes can be measured for accounts that allow analytics. PostHog receives an opaque identifier rather than your name or email. When signed in and allowing analytics, your recorded browsing actions can be connected to your account in our restricted owner dashboard to show recent activity, returning visits and editor steps. Declining analytics leaves this individual browsing history unavailable. PostHog analytics data is processed in the United States and kept for up to one year. We retain your preference and minimal delivery records to honour your choice and prevent duplicate reporting.

With your analytics permission, we also measure numeric page-speed and responsiveness statistics on eligible pages. We send metric names and values, without element text, DOM selectors, network payloads or private URLs. Source labels use approved campaign tags or a recognised referring platform; missing referral information is reported as Direct / unknown.

We do not send gift text, recipient names, photos, audio, filenames, passcodes, sign-in codes, private gift links, or signed media links to PostHog. You can separately allow masked editor recordings so we can understand how the controls are used. Recordings show clicks, scrolling and editor layout; input values and personal text are hidden, and gift previews, images, audio, uploads and passcode dialogs are blocked. Recipient gift pages, sign-in, checkout and other account pages are not recorded. Console logs, network payloads and canvas recording are disabled. We sample eligible editor sessions and keep recordings for up to 30 days. Your recording choice is saved on this device; analytics consent alone does not enable recordings.

You can decline without affecting your gift, or change your choice using Analytics preferences. Recognised Do Not Track and Global Privacy Control signals disable browser collection. Withdrawing consent stops future collection; contact support to request deletion of previously collected analytics data.