Privacy Policy

This Privacy Policy explains what personal data LoveMemo processes when you use the LoveMemo app for iOS and Android, the website at lovememo.app and the surprise pages created with the app, why we process it and what rights you have. We wrote it to be read, not skimmed: if anything is unclear, write to us at [email protected].

Who we are

LoveMemo is created and operated by Jonatã Oliveira, based in Brazil, who is the controller of the personal data described here.

• General contact: [email protected]
• Data Protection Officer (Encarregado, under the Brazilian LGPD): [email protected]

The short version

• We only ask for what a surprise needs: names, a date, photos, a song, a message.
• A surprise can be opened by anyone who has its link or QR code, and by no one else. It is not listed anywhere and search engines are told not to index it.
• We don’t sell your data and we don’t show ads inside the app.
• Surprises are deleted automatically after they expire, and you can delete them, and your account, at any time.
• Analytics and advertising cookies on the website only run if you allow them.

What we collect

Data you give us when creating a surprise

• The names or nicknames of the couple, the occasion, the date the relationship started and the love message.
• The photos you choose to add. The app resizes and compresses them before uploading.
• The song: a YouTube link you choose. The song is played through YouTube’s privacy-enhanced mode (youtube-nocookie.com).
• The style and color theme you pick.

Account data

• When you start using the app, an anonymous account is created so your surprises belong to you. It has no name or e-mail.
• If you choose to sign in with Apple or Google, we receive an identifier and, if you allow it, your e-mail address and name from that provider. We use them only to let you recover your surprises on another device.

Purchases

• Payments are processed by Apple (App Store) or Google (Google Play) and managed through RevenueCat. We receive a transaction identifier, the product bought and the date. We never see or store your card details.

Usage and device data

• App: crash and error reports (Sentry) with technical data such as device model, operating system version and app version. On iOS, if you allow tracking through Apple’s prompt, and on Android, the TikTok Business SDK measures app installs and in-app events (for example, a completed purchase) so we can understand which campaigns work.
• Website: the pages you visit, approximate location derived from your IP address (country level, used to apply the right privacy defaults) and, only with your consent, Google Analytics and Google Ads cookies. See Cookies and local storage.
• Infrastructure: like any web service, our servers (Cloudflare) receive your IP address and request data in order to deliver the page and protect it from abuse.

Data about the person who receives the surprise

The person who opens a surprise doesn’t need an account. When they open it we process the technical data needed to deliver the page (IP address, browser) and, only if they accept cookies, analytics data. The content of the surprise (names, photos, message) is provided by its creator, who is responsible for having the right to share it.

Why we use it, and on what legal basis

We do not make decisions about you based solely on automated processing.

Who we share it with

We use carefully chosen service providers (sub-processors) that only process data on our behalf and under contract:

• Cloudflare: website and API hosting, content delivery, security, photo storage and image optimization.
• InstantDB: database and authentication.
• Cloudinary and ImageKit: storage and optimization of photos uploaded with earlier versions of the app.
• RevenueCat, Apple and Google: in-app purchases and sign-in.
• Sentry: error monitoring.
• TikTok: measurement of app campaigns (TikTok Business SDK).
• Google: Google Analytics and Google Ads on the website, only with consent; YouTube for playing the song.

We may also disclose data when required by law or a court order, or to protect the rights and safety of our users and of LoveMemo. We do not sell personal data.

International transfers

Some of these providers store or process data outside Brazil and outside the European Economic Area, mainly in the United States. When that happens we rely on the safeguards provided for by law, such as standard contractual clauses (LGPD art. 33 / GDPR art. 46).

How long we keep it

• Published surprises stay online for the period you bought (1, 2, 3, 6 or 12 months). After expiring, they are kept for up to 30 more days so you can renew them, and then the surprise and its photos are permanently deleted.
• Unpaid drafts are deleted 3 days after they were created.
• Photos that were uploaded but never attached to a surprise are deleted after 7 days.
• Accounts without any surprise are deleted 7 days after they were created.
• Transaction records are kept for as long as tax and consumer laws require.
• Error reports are kept by Sentry for up to 90 days.
• You can delete a surprise, or your whole account, earlier at any time (see below).

Your rights

Under the LGPD (art. 18) and, if you are in the European Economic Area or the UK, the GDPR, you have the right to:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of unnecessary or unlawfully processed data;
• data portability;
• delete data processed with your consent, and withdraw that consent at any time;
• information about the entities we share data with;
• object to processing based on legitimate interest;
• lodge a complaint with a supervisory authority: in Brazil, the ANPD (Autoridade Nacional de Proteção de Dados); in the EEA, your local data protection authority.

How to exercise them: in the app you can edit or delete your surprises, export your data and delete your account. For anything else, write to [email protected]. We answer within 15 days.

Cookies and local storage

The website uses the browser’s local storage for things that make it work, and cookies only for what you allow:

• Strictly necessary (always on): your cookie choices (lovememo_consent_v1) and your language (lovememo_lang).
• Analytics (optional): Google Analytics, to understand how the site is used.
• Advertising (optional): Google Ads, to measure our campaigns.

You can change your choice at any time with the Cookie settings link at the bottom of every page. Optional cookies never load before you accept them.

Security

All traffic is encrypted (HTTPS/TLS). Surprise links use long random identifiers that can’t be guessed, access to the database is restricted, and photos are only accepted from the account that uploaded them. No system is perfectly secure, but if an incident ever puts your data at risk we will notify you and the competent authorities as required by law.

Children

LoveMemo is not directed to children. You must be at least 13 years old (or the minimum age required in your country) to use the app; minors should use it with the consent of a parent or guardian. If we learn that we collected data from a child without that consent, we delete it. Parents can contact [email protected].

Changes to this policy

We may update this policy when the product or the law changes. The date at the top shows the latest version; if a change is significant, we will highlight it on this page.