Privacy Policy

Last updated on May 25, 2026

Luvset ("we", "us", or "our") operates the Luvset platform, including our website, mobile app, and all associated services (collectively, the "Service"). This policy explains what information we collect, how we use it, and your rights.

1. Who We Are

Luvset is a relationship growth platform. We help partners explore boundaries, agreements, goals, check-ins, and more in a safe, encrypted, ENM-first environment.

For all privacy enquiries, contact us at: privacy@luvset.com

2. Information We Collect

Account Information

When you create an account, we collect:

  • Email address, used for authentication and communications
  • Display name, chosen by you
  • Password, stored as a secure hash. We never store it in plaintext

Profile Data

You may optionally provide:

  • Pronouns and gender identity
  • Sexual orientation
  • Relationship structure (e.g. monogamous, ENM/CNM, solo poly)
  • Bio and birthday
  • Love languages
  • Communication preferences
  • ENM/CNM experience level

This information is used to personalise your experience. It is treated as sensitive information and encrypted with a key unique to your account (see Section 5).

Relationship Data

When you use the Service with partners, we store:

  • Check-in responses and history
  • Boundaries and boundary shares
  • Agreements and agreement revisions
  • Goals and goal progress
  • Journal entries (visible only to you, never to partners)

Usage Data

We collect anonymised analytics data including:

  • Pages and features visited
  • Device type and operating system
  • Session duration
  • Feature interaction events

We use PostHog and Google Analytics 4 for product and site analytics. In the EU, UK, and Canada these only load once you opt in via our consent banner. Elsewhere they load by default. You can clear your browser data for this site to opt out. We don't build individual behavioural profiles for advertising purposes.

Inferred Location

We derive your country and region from your IP address at the time of account creation and login. We don't collect or store your precise location.

3. How We Use Your Information

We use your information to:

  • Provide the Service: store and retrieve your data, enable collaboration with your partners, and deliver features
  • Personalise your experience: tailor prompts, suggestions, and defaults to your relationship structure and preferences
  • Generate AI-powered insights: using Anthropic Claude on our servers. For background reflection (check-in summaries, journal themes, mood patterns) we send only derived context (sentiment, themes, structure), never your raw responses. For AI tools you actively invoke (drafting, refining, extracting action items) the AI sees only the specific text you've asked it to work on. Anthropic does not train on this data, and we do not retain it for training. Each AI category can be turned off independently in AI Preferences
  • Send transactional emails: account verification, password reset, invitations, important service updates
  • Send marketing communications: updates, new features, and tips (you can unsubscribe at any time)
  • Monitor and improve the Service: error tracking, performance monitoring, and product analytics
  • Enforce our Terms of Use: detect and prevent abuse, fraud, or policy violations

We don't use your information for automated decision-making that produces legal or similarly significant effects on you.

4. Legal Basis for Processing

Depending on your location, we rely on the following legal bases:

  • Consent (EU/UK GDPR, Australian Privacy Act): for marketing communications, optional profile data you provide, and web analytics in regions where consent is required (EU, UK, Canada)
  • Contractual necessity: for account data and relationship data required to deliver the Service you signed up for
  • Legitimate interests: for aggregate analytics, error tracking, security monitoring, and product improvement, where these interests don't override your rights

You can withdraw consent at any time. Withdrawing consent for essential processing means we can no longer provide the Service.

5. Sensitive Information

Luvset is built for people exploring diverse relationship structures and identities. We handle sensitive data with extra care.

  • Application-level encryption: all user data is encrypted using AES-256-GCM before it reaches the database
  • Per-relationship encryption keys: data shared within a relationship is encrypted with a key unique to that relationship. Data from one relationship can't be read by members of another
  • Per-user encryption keys: your personal profile and journal data is encrypted with a key unique to your account
  • App-level encryption keys: system metadata and category labels are encrypted with a shared application key
  • Blind reveal: check-in responses are invisible to all members until every member has submitted. This is enforced at the database level, not just in the app
  • Journal privacy: personal journal entries are never visible to partners. This is enforced at the database level. Shared journal entries are visible only to the relationship members you create them in
  • AI safety: Anthropic does not train on data sent through our API, and we don't retain it for training either. For background reflection we send only derived context (sentiment, themes, structure). For AI tools you actively invoke (drafting, refining, extracting action items) the AI sees only the specific text you've asked it to work on. Each AI category can be turned off independently
  • Account deletion: on deletion, all your data is encrypted with a key given only to you. After 7 days, the key is destroyed and the data becomes permanently unrecoverable. We retain the encrypted rows for audit purposes only

6. Email Communications

We use Resend to send transactional and marketing emails. Your email address is stored on Resend's infrastructure in accordance with their privacy policy.

All marketing emails include an unsubscribe link. You can also manage your email preferences in the app at any time. Unsubscribing from marketing doesn't affect transactional emails required to operate your account.

7. Data Sharing

We don't sell your personal information. We share data only with the following service providers, each bound by data processing agreements:

  • Supabase: database, authentication, and real-time infrastructure
  • Vercel: web hosting and edge functions
  • Resend: transactional and marketing email delivery
  • Qonversion: subscription management and billing
  • PostHog: product analytics (anonymised events)
  • Sentry: error tracking and performance monitoring
  • Anthropic: AI-powered insights (server-side only). Background reflection is built from derived context only. AI tools you actively invoke see only the specific text you've asked them to work on. Anthropic does not train on this data
  • Google: Google Analytics 4 for aggregate site analytics. Consent-gated in EU, UK, and Canada

We will disclose data to law enforcement or regulators where required by law, or to protect the safety of our users or the public.

8. Data Retention

  • Active account data is retained for as long as your account exists
  • Deleted account data is encrypted on deletion and destroyed within 7 days
  • Check-in history is retained per your in-app preferences
  • Analytics data is retained in anonymised, aggregated form for up to 24 months

9. Your Rights

Depending on your location, you have the right to:

Australia (Privacy Act 1988)

  • Access and correct your personal information
  • Complain to the Office of the Australian Information Commissioner (OAIC)

EU/UK (GDPR / UK GDPR)

  • Access, rectify, or erase your data
  • Restrict or object to processing
  • Data portability
  • Lodge a complaint with your local supervisory authority

United States (CCPA/CPRA, California residents)

  • Know what personal information is collected and how it is used
  • Delete your personal information
  • Opt out of sale (we don't sell data)
  • Non-discrimination for exercising your rights

To exercise any of these rights, email us at privacy@luvset.com.

10. Cookies & Tracking

We use a small number of cookies, grouped by purpose.

Strictly necessary

These are required for the Service to function. They don't need consent under EU GDPR/ePrivacy.

  • Authentication cookies (Supabase): keep you signed in.
  • Security cookies (app lock): a short-lived, signed, HTTP-only cookie that records when you've unlocked the app on this device. Only present when PIN lock is enabled.
  • ph-consent: records your analytics consent choice for one year, so we don't ask again on every visit.
  • ph-region: set by our edge based on your IP, so we know whether to show the analytics consent banner. Values are eu or other, nothing identifying.

Analytics: consent-gated in the EU, UK, and Canada

These only load if you've accepted the analytics banner. They don't run otherwise.

  • Google Analytics 4 (_ga, _ga_<container-id>): aggregate site analytics like page views, device type, and session duration. No advertising signals enabled.
  • PostHog (first-party cookie + localStorage): product analytics and feature use, anonymised.

Analytics: auto-enabled elsewhere

Outside the EU, UK, and Canada we load the analytics above by default without a consent prompt, in line with local law. You can opt out at any time by clearing your browser data for this site.

What we don't use

We don't use advertising trackers, retargeting pixels, third-party cookies for commercial profiling, or session-replay tools. We never sell your data.

Revoking consent

You can change your mind at any time. Clear cookies and site data for luvset.com in your browser to be re-prompted, or email us at privacy@luvset.com to make a formal request.

11. International Data Transfers

Your data is processed in countries outside your own, including the United States, where our service providers operate. Where required by law (e.g. EU GDPR), we ensure appropriate safeguards are in place, including Standard Contractual Clauses.

12. Children

The Service is not directed at anyone under the age of 18. We don't knowingly collect data from minors. If you believe we have inadvertently collected data from a minor, please contact us at privacy@luvset.com.

13. Changes to This Policy

We'll update this policy when needed. We'll update the "Last updated" date at the top of this page. For material changes, we'll notify you by email or via an in-app notice.

14. Contact

For any privacy-related questions or requests:

Email: privacy@luvset.com