LUVAYNE Privacy Policy

Last updated: 2026-09-07

---

What LUVAYNE is

LUVAYNE is an iOS app for adults. You talk with a fictional companion. The companion is artificial intelligence. She is not a person, she is not a counsellor, and nothing she says is a human being speaking to you.

This policy explains what data the app collects, why, who else receives it, how long it is kept, and what you can do about it.

---

1. What we collect, and why

Your account

You sign in with Sign in with Apple. That is the only way to get an account. Apple gives us an account identifier and an email address — if you chose Apple's "Hide My Email", that address is Apple's relay address, not your real one. The sign-in request also asks Apple for your name; the app does not read or store it.

We store, against your account:

• that you confirmed you are 18 or over (a yes/no flag — we do not ask for or store your date of birth, and we do not verify your age),
• your conversation language and your time zone,
• whether your subscription is active, and your credit balances.

Your conversations

• The messages you send and the replies you receive.
• Memories: short notes (up to 500 characters each) that the companion keeps about you, with a category and an importance score.
• A rolling summary of the conversation. It is derived from your messages; your messages remain the authoritative record.
• Your relationship state: which companion, the chosen tone, the bond score, the stage, her current mood.

We collect this because it is the product. Without it there is no conversation and no continuity.

Photos, voice notes and calls

• We never accept photo uploads from you. There is no photo picker and no camera capture in the app. The camera button in the chat asks the companion for a picture of herself; the picture is generated.

• Generated images are checked automatically before they are shown, by a vision model at DeepInfra.

• Voice notes: the text of her reply is sent to ElevenLabs, which returns audio.

• Live voice calls: your spoken audio and her reply audio are carried by ElevenLabs' conversational voice service for the duration of the call. ElevenLabs turns your speech into text and asks our server for her answer; our server sends that text on to DeepInfra, together with the conversation summary and memories, and sends the answer back to be spoken. We do not store call audio or a transcript on our own servers. What we keep is the record of the call itself: which companion, when, how long, what it cost in Credits, and the provider's own call reference.

  What ElevenLabs keeps is a separate question and we do not yet state an answer here. Their service retains conversation data on its own schedule and can record audio unless configured otherwise; until we have confirmed our configuration and a data-processing agreement, this policy makes no promise about it, and our account-deletion flow does not today send a deletion instruction to them. Both are open items in this draft. (Corrected 2026-09-03 after a review read the earlier wording as promising that nobody stores call audio.)

Purchases

Purchases go through the App Store. Apple takes the payment; we never see your card. RevenueCat verifies the receipt and tells our server what you bought. We keep a ledger of credit purchases, grants, spends and refunds.

App activity (analytics)

We record a small, fixed list of event names — for example that onboarding started, that a character was selected, that a fifth message was sent, that a paywall was seen. Raw chat text, memory text, notification text and notification identifiers are rejected by the server and never stored as analytics. Identifiers that arrive with an event are replaced with a one-way SHA-256 value scoped to your account.

Notifications

If you turn on notifications, we store a push token for your device so Apple's and Expo's push services can deliver a message.

Crash reports

If the app crashes or hits an operational error, a report goes to Sentry. It carries a stable error code, a surface name, stack frames, the app release and build, and a short allowlist of runtime and device fields. A final scrubber removes user, request, extra and log payloads, breadcrumb text and data, unknown tags and contexts, and exception messages before the event leaves the device.

Safety statistics

When the safety guardrail has to replace a reply with a written crisis message, a counter for that UTC day is increased by one. That table holds a date and a number. It holds no user, no companion, no language, no message text and no time of the individual event.

---

2. Two separate permissions

These are two different decisions. You make each one separately, and each can be withdrawn separately.

AI processing — required for chat

Before your first reply, LUVAYNE asks for explicit permission to send conversation context to our AI provider so a reply can be generated. This permission is versioned. The server checks that an active, current-version permission exists immediately before each request to the provider. If it is missing or withdrawn, chat stops. Withdrawal is recorded as a revocation time.

Refusing this keeps chat locked. It does not lock you out of your account, your data export, or account deletion.

Keeping conversations to train our own model — optional, off by default

Separately, you may allow us to keep some conversations to improve LUVAYNE's own companion model. This is off unless you turn it on. Refusing it leaves the app fully usable. It cannot be turned on unless AI-processing permission is already given, and it stops automatically if you withdraw AI-processing permission.

If you turn it on:

• Kept turns go into private tables that no app client can read. They carry no account identifier. They are keyed by a pseudonym computed as HMAC-SHA-256 of your account id under a secret key. That key is held only in the server's secret store — never in the database, never in this repository. Someone who obtained a copy of these tables alone could not work out whose conversations they are.
• Some turns are never kept at all, whatever your setting: anything where the conversation suggests a minor, anything in a self-harm context, anything containing screened-sensitive content (credentials, card data, health disclosures, precise addresses, explicit sexual description), and anything you marked as a secret. These turns are skipped whole — not stripped and kept.
• Rolling summaries, stored memories, provider costs, push tokens, your account id, your email and your Apple identifier are never written to these tables.
• Withdrawing this permission erases what was already collected, not only what would be collected next. Clearing a conversation or resetting a relationship also erases the turns collected from it. Deleting your account erases everything before the account itself is removed.
• Per-message deletion erases the matching collected turn on a best-effort basis (it is matched by a salted hash of the message text). Clearing the conversation, resetting the relationship, or deleting the account are the paths that erase without that limitation.

---

3. What is actually sent to the AI provider

Your messages stay in our database. They are the authoritative record. What leaves for the provider on each turn is a bounded slice:

• the most recent 12 messages of that conversation (20 on the turn where the summary is refreshed),
• the current rolling summary, if there is one,
• up to 12 stored memories for that companion,
• the companion's persona and tone, the bond score and stage, your conversation language, your time zone and the current time,
• a per-account tag in the field the provider uses for abuse controls. It is written as luv_ followed by your account identifier with its hyphens removed, cut to 24 characters. It is not your email and not your name, and it is not the account identifier in its normal form, but it is derived from it and is the same on every request, used only so the provider can apply its own abuse controls consistently to your account.

The summary is checked before it is stored: an early, stale, oversized, instruction-bearing or secret-like summary is rejected, and any confirmed deletion of a turn invalidates the summary before another provider call can use it.

---

4. Who receives data

We use the following processors. Each receives only what its job needs.

We do not sell your data. We do not share it with advertisers or data brokers. Nothing in the app tracks you across other companies' apps or websites — the app contains no advertising SDK, no attribution SDK, and does not request the iOS tracking permission.

The training tables described in section 2 are exported only by an offline operator tool, run by hand, never by the app.

---

5. How long we keep things

Deleting your account removes your server-side data. Purchase history held by Apple and by RevenueCat stays under their own policies; we cannot delete it for you.

---

6. What you can do

All of these are in the app.

• Delete a single memory. The server must confirm the deletion before the screen changes.
• Delete a single conversation turn. Long-press either side of an exchange. This deletes both messages of that turn and any memory that came from it. The bond score is deliberately not changed.
• Clear a conversation and keep your memories.
• Reset a relationship — messages, memories and relationship state go together, in one operation.
• Delete your account permanently. Local data is erased only after the server confirms.
• Download your data. You get a JSON file with your profile, relationship, memories, conversations, privacy receipts, purchase records, preferences, device metadata without tokens, consent history, analytics metadata, usage and scheduled-notification metadata. It excludes push tokens, provider models and costs, webhook internals, delivery tickets and secrets. Preparation is asynchronous, and a partial file is never presented as complete.
• Turn notifications off — proactive messages, morning and night.
• Allow or withdraw AI-processing permission at any time in Settings. Withdrawal stops new provider requests after the server confirms; a request already in flight may finish.
• Allow or withdraw keeping conversations for training. Withdrawal erases what was collected.

Privacy receipts. Each of the deletion operations writes a receipt so you can see that it happened. A receipt holds an operation id, which action it was, how many items it affected, and when it finished. It holds no target identifiers and no conversation text. The last 20 are shown in Settings and all of them are in your export.

To exercise a right that is not in the app — for example a correction request — contact us at the address in section 10.

---

7. Children

LUVAYNE is for adults aged 18 and over. It is not for anyone under 18 and it is not directed at children. You confirm you are 18 or over before you can use it; we do not verify this and we do not collect a date of birth.

If a conversation gives any signal that we may be talking to a minor, the safety guardrail intervenes in the reply, and the turn is never kept for training.

If you believe a minor has an account, contact us (section 10) and we will delete it.

---

8. Security

What the code actually does:

• All traffic to our server and to every provider is over HTTPS.
• Sign in with Apple is the only identity accepted. The client, the database row-level security rules and the server functions each reject anything else before privileged work happens.
• Every database table that holds internal data (analytics aggregates, privacy receipts, training rows, safety counts) has all access revoked from the roles the app can use, and most additionally have row-level security enabled with no policy at all. They are reachable only by server-side functions running under a service role.
• Anything that changes authoritative state goes through an authenticated server function, not directly from the app.
• Destructive operations carry a client-generated operation id. The database serialises them per account, replays the same intent idempotently, refuses an id reused for a different intent, and refuses to run while AI work is in flight.
• Provider keys, service keys and the training pseudonym key live in server-side secret storage. The build fails if the pseudonym key ever appears in app source, assets or example environment files.
• The server's own security log contains only a fixed set of enumerated codes. It has no message field, no identifiers, no IP addresses, no request bodies and no conversation content.

No system is perfectly secure, and we do not claim ours is.

---

9. Changes to this policy

If we change this policy we will update the date at the top. If a change means we want to use your data for a new purpose, we will ask for a new permission rather than assume the old one covers it — for the training permission, that happens by way of a new policy version, which cancels every existing training permission until the user opts in again.

---

10. Contact

This application is published by İlkin Reha Öztürk.

• Post: Mansuroğlu Mahallesi, Ankara Caddesi No: 81, 35535 Bayraklı / İzmir, Türkiye
• Email: support@luvayne.com

Write to the email address for any request about your data — access, export, correction, deletion, or withdrawing a consent. The postal address is there so that a request can also be made in writing.