Privacy Policy

1. Controller

The company responsible for the app "Luvy – App for Couples" and the data collected therein ("Data Controller") is:

LoveCode UG (haftungsbeschränkt)
Hebbelstr. 15
25563 Wrist
Germany

E-Mail: support@lovecode.xyz

2. Scope

This Privacy Policy applies to the mobile application "Luvy – App for Couples" as well as all associated backend services and interfaces (APIs). It describes data processing in the Offline and Online Mode of the app.

The Privacy Policy can be accessed at any time within the app and online here.

3. Legal Basis for Processing

We process your personal data on the basis of the following legal grounds:

• Art. 6(1)(b) GDPR – Performance of a Contract: This is the basis for processing data necessary to provide you with the core functions of the app. This includes account creation, login, linking with your partner, using premium features, and synchronizing your data.
• Art. 6(1)(a) GDPR – Your Consent: In certain cases, we process data based on your voluntary consent. This applies, for example, to you contacting us, activating push notifications, or using optional synchronization functions. You have the right to withdraw your consent at any time with effect for the future.
• Art. 6(1)(f) GDPR – Legitimate Interests: We process data based on our legitimate interests to ensure the secure and functional operation of the app, to improve its security, and to prevent fraud. This also includes the analysis of anonymized usage data for the continuous optimization of the app. In doing so, we always weigh our interests against your interests and fundamental rights.

Your data is collected and processed in accordance with the provisions of the German Federal Data Protection Act (BDSG) and the General Data Protection Regulation (GDPR).

4. What Data We Collect and Why

a) Account Data

• Name, Partner's Name, Email Address, Apple or Google ID, Language, Platform (iOS/Android)
• Purpose: For unique account creation, login, linking with your partner's account, and for the use of premium features.

b) Subscription and Payment Data

• Purchase Token, Transaction IDs, Premium Type, and Expiration Date
• Purpose: For the technical verification and restoration of your premium purchases within the app.
• Important Note: Payment processing is handled exclusively through the respective app store (Apple App Store or Google Play Store). We only receive technical transaction information from these providers (e.g., Transaction ID, subscription status), but no direct payment data such as credit card numbers. The privacy policies of the respective platform providers apply.

c) App Content

• Timeline entries, partner quizzes, cards, bucket list entries, uploaded photos
• Purpose: This content is stored on our servers in Online Mode to enable secure synchronization with your partner's account and between your devices. In Offline Mode, this data remains exclusively stored locally on your device.

d) Device Data

• Device Token and Platform (e.g., iOS, Android)
• Purpose: Only in Online Mode and with your explicit consent for the delivery of push notifications (e.g., reminders, partner updates, or important app messages).

e) Contact

• Email address and the content of your message
• Purpose: When you contact us via email, we process your email address and message solely to handle your request and to communicate with you.

f) Location Data

• Location Coordinates (Latitude & Longitude)
• Purpose: We collect these coordinates to calculate the distance between you and your connected partner and to display your current location/city name to each other. This information is used exclusively to power the "Distance & Location Widget" on your home or lock screen.
• Background Collection: To ensure the widget remains accurate without requiring you to manually open the app, Luvy collects location data even when the app is closed or not in use. This data is only collected if you have explicitly granted background location permissions and have connected with a partner.

g) Anonymous Usage Data
To continuously improve the app, we also collect anonymous usage data. This data does not allow any conclusions to be drawn about you personally and contains no personal information. It serves exclusively for the analysis and optimization of app functions.

When using online functions, technical log data (e.g., IP address, time, device information) is collected to ensure system security and troubleshooting. This data is regularly deleted or anonymized.

For purchases or subscriptions via the App Store or Google Play, payment processing is handled exclusively by the respective provider. We only receive technical transaction information (e.g., transaction ID, subscription status), no payment data.

When using login services such as 'Sign in with Apple' or 'Sign in with Google,' the data required for registration (e.g., name, email address, user ID) is transmitted to us by these providers. Their respective privacy policies also apply.

5. Online and Offline Mode

Luvy gives you full control over your data by allowing you to choose your operating mode:

• All data you enter (e.g., names, photos, timeline entries, quizzes) remains exclusively stored locally on your device.
• No data is transmitted to our servers or to third parties.
• In Offline Mode, data storage and backup are entirely your responsibility.

• Your data can be synchronized with our servers in the European Union to create backups, share it between your devices, or synchronize it with your partner.
• The transmission is always encrypted (TLS) and occurs exclusively for the stated purposes.

6. Which Functions of Your Smartphone Does the App Use?

Luvy only requests permissions that are essential for the smooth use of the app – no unnecessary snooping. The following permissions may be requested:

• Storage/Gallery: When you add your own photos to timeline events, bucket list entries, or profiles. The images are stored locally or – in Online Mode – synchronized encrypted to our servers.
• Camera (optional): If you take a photo directly within the app instead of choosing one from the gallery.
• Internet: For Online Mode, synchronization of your data, premium purchases, push notifications, and login via Apple/Google.
• Push Notifications: If you activate them to receive, for example, reminders or partner updates.
• System Language & Device System: Only for automatic language selection and app optimization – no tracking, no device monitoring.
• Location: To use the Distance & Location Widget, the app collects your latitude and longitude coordinates. This data is used to calculate the distance between you and your partner and to display your current location/city name to each other. To ensure the widget stays up-to-date on your home or lock screen, Luvy collects this location data even when the app is closed or not in use. This feature is completely optional and only active if you and your partner explicitly choose to enable it.

In Offline Mode, you do not need an internet connection, no login, and none of your data leaves your device.

7. How Long Is Personal Data Stored?

The retention period of your personal data depends on how you use Luvy and for what purpose the data was collected:

• Offline Mode: All data (texts, photos, events, etc.) remains exclusively on your device and is deleted as soon as you uninstall the app or manually remove the data.
• Online Mode:
  • Account and Profile Data remains stored as long as your user account is active.
  • Location Data (Latitude & Longitude): To protect your privacy, we only store the most recently updated coordinates required for the Distance & Location Widget. Each new location update overwrites the previous data point. We do not maintain a historical movement log or location history on our servers.
  • Synchronized Content (Timeline, Bucket List, Partner Quizzes, etc.) is stored on our servers until you delete it or delete your account.
  • Premium/Purchase Data is kept as long as necessary for billing and record-keeping purposes (usually up to 10 years).
  • Refresh and Access Tokens expire automatically and are regularly deleted or invalidated.
  • Contact Requests are deleted as soon as your inquiry is resolved, at the latest after 6 months.

If you delete your account or request us to delete it, we will completely remove your personal data from our active systems. Backups may still exist for a short time but will be automatically deleted or anonymized after the technical deadlines have passed.

8. How Is Your Personal Data Protected?

We take appropriate technical and organizational measures to protect your personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. Our security measures are continuously improved and adapted to the state of the art.

• Storage Location: All personal data is stored exclusively on servers within the European Union.
• Encryption: Your data is encrypted during transmission (TLS/SSL) and during storage on our servers.
• Access Control: Access to personal data is restricted to authorized persons who need this information to perform their duties.
• Separation of Operating Modes: In Offline Mode, all data remains exclusively on your device. Only in Online Mode is data securely transmitted to and stored on our servers.
• Security Management: Our systems are regularly maintained, updated, and monitored to minimize security risks and comply with applicable data protection standards.
• Incident Management: Should a security incident occur despite all precautions, we will inform you immediately in accordance with Art. 34 GDPR about the nature, scope, and possible consequences of the incident.

9. No Sale of Your Data

We want to explicitly state that we do not sell, market, or otherwise transfer your personal data to third parties for promotional purposes. Your privacy is our highest priority and is not treated as a commodity. Data is only shared as described in this Privacy Policy to ensure the functionality of the app or to comply with legal obligations.

10. Engagement of Service Providers (Data Processors)

To provide our services and maintain the app's functionality, we work with selected external service providers who process data on our behalf and according to our instructions (so-called data processors). These service providers are carefully selected and are contractually bound to comply with strict data protection standards.

These may include service providers in the following categories:

• Hosting Service Providers: For the storage and provision of our server infrastructure, exclusively within the European Union.
• Communication Service Providers: For sending emails (e.g., support requests) and delivering push notifications.
• Analysis Tools: For the anonymized analysis of app usage to improve our services.

We enter into corresponding data processing agreements with all data processors to ensure that your data is protected and processed only for the purposes we have specified. Any transfer of your data beyond what is necessary for service provision or for marketing purposes by these service providers is excluded.

11. Children's Data Protection

Our services are not directed at children and adolescents under the age of 16. We do not knowingly collect personal data from persons under 16 years of age. If we learn that we have unintentionally collected personal data from a child under 16, we will take immediate steps to delete this data.

Parents or legal guardians who suspect that their child under 16 has submitted personal data to us can contact us at support@lovecode.xyz to request the deletion of this data.

12. Your Rights as a User (Withdrawal, Access, and Erasure)

Under the GDPR, you are granted the following comprehensive rights regarding the processing of your personal data:

• Right of Withdrawal (Art. 7(3) GDPR): You have the right to withdraw your previously given consent for the processing of your personal data at any time with effect for the future. The lawfulness of the processing carried out based on the consent until the withdrawal is not affected by this. For more detailed information, please see 13. Right of Withdrawal.
• Right of Access (Art. 15 GDPR): You have the right to request confirmation from us as to whether we are processing personal data concerning you. If this is the case, you have the right to access this personal data and a copy thereof. Furthermore, you have the right to access more detailed information about the data processing, such as purposes of processing, data categories, recipients, and storage period.
• Right to Rectification (Art. 16 GDPR): You have the right to request the immediate correction of inaccurate or the completion of incomplete personal data concerning you. You can adjust much of your data directly in the app settings.
• Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR): You have the right to request that we delete your personal data without undue delay, provided certain grounds apply (e.g., the data is no longer necessary for the purposes for which it was collected; you withdraw your consent, and there is no other legal ground for the processing). You can delete your account directly in the app (Settings → Delete Account/Data).
• Right to Restriction of Processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your data from us if certain conditions are met (e.g., you contest the accuracy of the data, or the processing is unlawful and you oppose the erasure).
• Right to Data Portability (Art. 20 GDPR): You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, provided the processing is based on consent or a contract and is carried out by automated means.
• Right to Object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (legitimate interests). We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
• Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR): You have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data violates the GDPR.

To exercise your rights, you can contact us at any time using the contact details provided in Section 15. We will process your requests promptly and may carry out an identity check to ensure the security of your data.

13. Right of Withdrawal

You can decide at any time to withdraw your consent to the storage of your personal data (according to Article 6 GDPR). Should you decide to withdraw your consent, we will delete all your data stored with us.

You can execute the withdrawal by contacting us directly with your request at support@lovecode.xyz.

14. Changes to the Privacy Policy

We reserve the right to adapt this Privacy Policy to always reflect the current legal situation and to incorporate new features into our products. The most current version will always be published in the app and on our website here. We recommend that you review this Privacy Policy regularly.