Privacy Policy

LoveClock · Last updated 20 July 2026

            The short version: LoveClock keeps your relationship to yourself.
            Used solo, everything you enter stays on your device and nothing is sent anywhere.
            If you choose to pair with your partner, the data you share is end-to-end encrypted
            on your phone before it leaves, and our server only ever stores scrambled data it
            cannot read. There is no account, no analytics, no advertising, no tracking, and no
            location access.
        

Using LoveClock solo (the default)

LoveClock works fully without pairing. Your relationship start date, an optional wedding date, milestones, reunion countdowns, plans, and your theme preferences are stored locally on your iPhone or iPad using Apple's on-device storage. In solo use the app does not contact our server and nothing you enter leaves your device.

Pairing with your partner (optional)

You can optionally pair with one partner using a short code or invite link. Pairing is built so that we cannot read what you share:

The pairing code never leaves your phones. The encryption key is derived from it on your devices, and the server only sees a one-way fingerprint of the code used as a room address.
Everything you sync (dates, milestones, reunions, plans) is encrypted on your device before upload. The server stores only this ciphertext and has no way to decrypt it.
There are no accounts. Your devices authenticate with a random per-device secret; we never ask for a name, email address, or phone number.

What our server stores when you pair

When (and only when) you pair, our server holds three kinds of data:

A room record: the hashed room address, hashed device credentials, and a version counter. No readable content.
Your encrypted records: the end-to-end encrypted data described above, kept for up to 400 days after the last update. A room that is created but never joined is deleted after 15 minutes.
A push token: your device's Apple push notification token, used only to deliver sync updates and nudges, kept for up to 90 days. This is the only piece of server-side data that is not encrypted, because Apple needs it in readable form to route notifications.

Unpairing removes your device from the room, and the retention windows above age the rest out automatically.

Notifications and nudges

Anniversary and milestone reminders are scheduled locally on your device by iOS, with no server involved. When you are paired, sync updates arrive as silent pushes, and a partner's nudge shows a fixed, generic banner. The optional note attached to a nudge is end-to-end encrypted like everything else and is shown transiently on your partner's screen rather than stored.

What never syncs

Sharing is selective: reunions and plans you keep private stay on your phone even while paired. Your theme and animation preferences, your pinned widget choice, and your purchase receipts never leave your device. If you are paired, a single encrypted yes/no flag shares your Premium status with your partner so one subscription can cover you both; it reveals nothing else.

If you lose your devices

Because we never have your pairing code or encryption key, data on the server cannot be recovered without one of your paired devices. If both phones are lost, the encrypted data ages out unread. That is a deliberate trade: it is the property that keeps us unable to read your relationship.

Service providers

The sync server runs on Cloudflare (Workers, KV, and Durable Objects), which stores the ciphertext and push tokens described above on our behalf. Notifications are delivered through the Apple Push Notification service. Neither receives readable relationship data from us.

No account required

You can use every feature, including pairing, without creating an account, signing in, or giving us an email address. There is no login wall.

No analytics, ads, or third-party tracking

LoveClock contains no advertising, no analytics or telemetry SDKs, and no third-party tracking frameworks. We do not build a profile of you and we do not share data with advertisers or data brokers.

No location tracking

LoveClock never requests or uses your location. Reunion countdowns are time-zone aware, but that is calculated on your device from the dates and zones you choose. We do not track where you or your partner are.

Children

LoveClock is intended for a general audience and does not knowingly collect any personal information from anyone, including children.

Changes to this policy

If this policy changes, we'll update this page and revise the date above. Continued use of the app after an update means you accept the revised policy.

Contact

Questions about your privacy? Email pawels.apps@gmail.com.

← Back to LoveClock