What's kept, where, and by whom.

1. What you keep, and where it lives

Most tools here — the journal, Love Map, Consent Keyrings, Kinship Map, Metamour Nexus, Compersion Coach, Appreciation Jar, saved paths and quiz results — keep what you write in this browser and, when you're signed in, securely store a copy in the cloud (a Postgres database hosted by Supabase in the EU, encrypted in transit and at rest), so your keeps and progress follow you to any device. The tools keep working offline: the browser holds the working copy, and changes sync quietly when a connection returns.

Be aware of one thing. That cloud copy is not end-to-end encrypted during this closed beta: the operator of this site can technically read it, exactly like the shared features below. End-to-end encryption for the most sensitive stores is the next milestone — until it ships, please treat the cloud copy the way you'd treat anything stored on someone else's server.

The Vault is the exception, and always will be: it encrypts each entry with a passphrase only you know (PBKDF2 → AES-GCM-256) before anything is stored. What's stored — in the browser and in the cloud alike — is ciphertext; without your passphrase it cannot be opened by us or anyone else.

A few small things never leave this browser at all: the Living Room's throwaway seating, per-device reminder preferences, a cached copy of your name and role (so the header can greet you at once), and the bookkeeping that tracks what still needs to sync.

You can see the full inventory, export it as one file, or erase it — this browser and the cloud copy together — at any time on Your data.

2. What is stored on a server

Some features involve a server by design. Three of them exist so that two people can share something; the fourth composes Ariadne's answers.

• Your account — your email address, a display name, your role (member or admin), and, for each device you are signed in on, a session record: when it started and was last used, the browser user-agent string, and the IP address it connected from. If you sign in with Google, Google tells us your name, email address and profile picture; we never receive your Google password.
• Live Rooms — the messages and appreciations you post, with the name you posted under.
• The Guardian (date safety) — the close contacts you add (including another person's name and phone number or email), your date plans, your safe word and duress word, and any alert records.
• The Compatibility Questionnaire — your answers, who you shared the questionnaire with, and its status.
• Asking Ariadne — stored nowhere. When you send Ariadne a message and the server is reachable, the message text travels to our server to find the relevant library pages and compose a grounded reply, and is passed to the AI model this site is configured with (currently a model running on our own server). It is not saved, not logged, not linked to your account, and not used to train anything — the text exists only for the moments it takes to answer you.
• An audit log of actions taken on your account, for security and debugging.

This data is held in a Postgres database hosted by Supabase in the EU (Ireland). It is not end-to-end encrypted: it is encrypted in transit and at rest by the hosting provider, but the operator of this site can technically read it. Please do not put anything in the shared features that you could not bear to have read.

If you add someone else's contact details to the Guardian, please make sure they're content to be listed.

3. What we don't do

• No advertising, and no advertising or tracking pixels.
• No analytics product, no behavioural profiling, no session recording.
• No cookies used for tracking. Signing in sets exactly one first-party cookie, your session (pil.session_token): it is how the site knows it is you, page scripts cannot read it, and it is removed when you sign out. Signed out, no cookie is set.
• Your data is never sold, rented, or shared for marketing.

4. Third parties

• Google Fonts — typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com, which means Google receives your IP address and user-agent when a page loads.
• Supabase — hosts the database behind the shared features described above. It stores data only: sign-in itself is run by this site, not by Supabase.
• Google — only if you choose Continue with Google, in which case Google handles that sign-in and tells us who you are.
• Our email delivery service — only if you ask for a sign-in link by email: it carries that one message, so it sees your email address and the link.
• jsDelivr / esm.sh — if, and only if, you use the optional voice answering on the Compatibility Questionnaire, a speech-recognition model is downloaded from one of these public CDNs. Your audio is processed on the spot — the transcription runs entirely in your browser, the recording is discarded immediately afterwards, and only the text you keep is stored.

5. Your choices

• See and export everything — Your data.
• Erase everything — this browser and the cloud copy together — same page, one button. It is immediate and permanent.
• Erase your server-side data — sign in and use Erase my data; this deletes your account, sessions, contacts, plans, alerts, questionnaire answers and personas.
• If you're in the UK/EU you have rights of access, correction, erasure, portability and objection under the UK GDPR / GDPR. The tools above cover most of these directly; for anything else, write to us.

6. Children

This site discusses adult relationships, intimacy and sexual health. It is not intended for anyone under 18, and we do not knowingly collect data from under-18s.

7. Changes and contact

If this policy changes materially, the date at the top will change and the change will be noted here. Questions, or a data request: privacy@partnersin.love.