Privacy Policy

1. Who we are

PairlyLife is operated by Nimavera Inc. (in formation)(“Nimavera”, “we”, “us”). For data-protection enquiries, contact privacy@pairlylife.com or support@pairlylife.com. A postal address for service of notice is available on request via those addresses.

If you are in the European Economic Area, the United Kingdom, or Switzerland, Nimavera Inc.acts as the data controller for the personal data you provide to the Service. If you are a California resident, Nimavera Inc. acts as the business that determines the purposes and means of processing your personal information under the California Consumer Privacy Act.

2. Categories of data we collect

Account data — email address, name, display name, hashed password (bcrypt — we never see the plaintext), role, and account creation/login timestamps.

Board & card content — boards (name, description, emoji), cards (title, description, type, status, priority, tags, target dates, ratings), checklist items, comments, media attachments (photos, videos, voice notes, and documents), and emoji reactions you create or upload.

Couple Pulse check-ins — daily mood, energy score (1–5), the “needs” chips you select, and any short note you write. Visible only to members of the boards you tagged the check-in to (you can submit without a board, in which case it is private to you).

Expenses — when you log a card expense: amount, currency, description, payer, occurrence date, and the split percentages between board members. We do not store any payment-card details for these — they are simply your record of who paid for what.

Location data — (a) approximate city/country derived from your IP address at sign-in or when you open nearby features on the web (via ipapi.co), used to show nearby ideas and events. Network location is approximate, refreshed on demand, and does not change your saved city; you can keep your saved area or use browser location with permission. It does not track you in the background; (b) precise latitude/longitude that you choose to attach to a card or your profile (e.g. for the map view), provided by your browser only with your permission; (c) nearby nudges (opt-in, Android app only) — if you switch on “Nudge me when I'm near something we'd love”, the PairlyLife Android app sends your phone's precise position to PairlyLife's own servers when you have moved about 150 metres, and only while the setting is on. We use it for one thing: to check whether an event happening today or a place on your boards is within a few hundred metres. The precise position is not stored, not logged and not shared with anyone; the event search we make with Ticketmaster uses it rounded to about a kilometre, the same as our other nearby-event lookups. We keep only a record that we nudged you about a particular venue or card, when, and whether you saved or dismissed it, for 30 days, so we don't repeat ourselves. It is off by default, Android asks for your permission first, and switching it off (in Settings or by revoking the app's location permission) stops it immediately. No location is collected while it is off.

Subscription and purchase data — your tier (Free / Plus / Premium, with legacy Lifetime holders), Stripe customer ID, subscription status, renewal/expiry dates, the currency you pay in, and a record of each one-time purchase (item, board and year where relevant, amount, date, and — for the Date Night pack, Trip pass and keepsake — the time you gave the consent described in Section 3.6 of the Terms). Payment-card details are processed by Stripe directly and never reach our servers.

Gifts — when you buy a gift: the gift tier, the recipient's email address and the date to send it (if you give them), your note (if any) and your name as the sender, which the recipient sees. We store the gift code only in hashed form. When a gift is redeemed we record which account redeemed it and when. The recipient's email address is used only to deliver that gift.

Notification preferences — your per-event email and push toggles, plus a record of any web-push subscriptions you have authorised (browser endpoint + cryptographic keys, no message contents).

Diagnostic data — basic server logs (request URL, status, timing) and, when configured, anonymised error reports via Sentry. We do not track you with analytics SDKs.

3. How we use your data and our legal bases (GDPR)

• To provide the Service (account creation, syncing your boards, powering invites, notifications, exports) — contractual necessity.
• To process payments and manage subscriptions via Stripe — contractual necessity.
• To send transactional emails (invite accepted, weekly summary, password reset, comment on your card) — contractual necessity; you can disable per-event email in Settings.
• To run AI features (Date Night Tonight, Memory Lane narrative, daily prompts, AI suggestions, AI itineraries, card enrichment) — contractual necessity when you ask for them; templates are served when the provider is unavailable or your monthly allowance is exhausted.
• To prevent abuse and enforce our Terms (rate limits, content moderation, the per-user daily AI call quota) — legitimate interests.
• To personalize the ideas we show you (For You, AI suggestions, Date Night, daily prompts, event picks) — legitimate interests, with your right to object built in: switch it off any time in Settings → “Personalize our ideas”, and the profile is deleted. We keep a taste profile for each person, learned from what you and your partner plan, complete, rate and say yes or no to (the kinds of things you enjoy, the places you return to, tags you rated down), optionally seeded by topics you pick. Once a week we may ask our AI provider to write that taste as two sentences; it receives only these aggregates and up to eight card titles — never your notes, comments, check-in text, addresses or coordinates — through the same no-data-retention routing as our other AI features. The profile and its summary are included in your data export and deleted with your account.
• To improve the product (bug-tracking, performance) — legitimate interests; no marketing analytics, and no profiling beyond the personalization above.
• To comply with legal obligations (e.g. tax records on payments) — legal obligation.

We do not sell, trade, or rent your personal data, and we do not use your data to train AI models.

4. Sub-processors and other recipients

Some data flows to third parties strictly to deliver the features you use. Where the data centre is outside the EEA/UK we rely on the provider's Standard Contractual Clauses or equivalent transfer mechanism.

• Stripe — payment processing and tax calculation for Plus and Premium subscriptions, one-time purchases (Date Night pack, Trip pass, “Our year” keepsake) and gifts, plus legacy Lifetime purchases.
• OpenRouter — when AI features run, the prompt and a small amount of contextual data (board name, card titles, your stated mood/budget for Date Night, etc.) are sent to OpenRouter, which routes the request to an underlying model provider (e.g. Anthropic, OpenAI, Google) depending on the model configured. Outputs are returned to you and stored on the relevant card or response. Community-content moderation has the separate consent and retention terms below; that exception does not apply to private couple content.
• Wikipedia, TMDB, Foursquare, Spotify, MusicBrainz, OpenStreetMap, RAWG, Unsplash — card-enrichment lookups when you click “Enrich” on a card. We send the title (and sometimes a short description) of the card.
• Ticketmaster — for the local-events feature: we send the latitude/longitude and date range you specified to retrieve nearby events.
• Official open-data event agendas (Ayuntamiento de Madrid, Generalitat de Catalunya, Gobierno Vasco, Institut Valencià de Cultura, Junta de Castilla y León, Ville de Paris, NYC Parks, Chicago Public Library, DataSF) — free and local events beside Ticketmaster's. We download each public agenda whole and filter it on our own servers: your location is never sent to these publishers. Each event shows its source, as the publisher's license requires.
• ipapi.co — approximate IP-based geolocation at sign-in and on demand for nearby web features.
• Sentry — anonymised error reports, when configured by the operator.
• PostHog (EU region) — aggregate product-funnel analytics (signup → first card → trial → paid). Only when you opt in via the cookie banner; declining keeps the entire pipeline off. We do not send IPs, payment data, or message content to PostHog.
• Hostinger — hosts the servers and database that run PairlyLife, where your account, boards, cards and uploaded media are stored.
• Resend — delivers our email (sign-in codes, invitations, receipts, summaries and reminders you turned on). We send your email address, your name and the content of that email.
• Google Sign-In — only if you choose “Continue with Google”: Google confirms your identity and shares your name, email address and profile picture with us.
• Mapillary — street-level photos for places without one: we send the place's coordinates, never who you are.
• Pexels and Open Library — cover pictures and book details for cards: we send the card's title or a search term, never who you are.
• Object storage (Cloudflare R2 / S3-compatible) or local disk — for storing the media you upload to cards (photos, videos, voice notes, and document attachments). These are served through short-lived signed links, not public URLs.
• Web Push services (Apple, Google, Mozilla) — only if you opt in to push notifications; we send the notification payload to the push endpoint your browser registered.
• Android app notifications — the PairlyLife Android app fetches its notifications directly from PairlyLife's servers; they do not pass through Google (no Firebase Cloud Messaging).

We may also share information when legally required (court order, lawful request) or to protect the rights, safety, or property of users or the public.

5. Sharing inside the Service

Boards are explicitly collaborative: when you invite a partner, they can read and edit cards, comments, photos, ratings, reactions, and expenses on that board. Cards you mark as “discoverable” appear, after a public-content review, in the public Discover feed visible to other PairlyLife users (typically other couples nearby), without your name unless you choose to attribute the card. Memberships and the public board slug appear in the URL for board pages you visit.

Public-content review

When you choose to share a card publicly, we review the exact public text and cover image before publication, including on public board links, community collections and maps. Private gallery photos, comments, notes and other couple-only media are not sent for routine external AI moderation. Moving a private photo into a public cover makes that cover subject to review. Replacing a cover or changing public content starts a new check.

For these checks, the public text and a reduced-size copy of the public cover are processed through OpenRouter by a strictly free vision model, only after you explicitly confirm the community review disclosure. The public cover and any distinct public thumbnail may be uploaded photos. These providers may retain submitted content and use it for training; these checks do not promise zero data retention. Private couple-only media is excluded. Existing community cards wait for your confirmation or human review. We do not enable search plugins. A second free model may check a borderline result; the current reviewers belong to the same model family. If an eligible provider is unavailable, the content remains pending rather than becoming public. These checks apply to every plan and do not consume your AI allowance.

A flag can hide content from public spaces, but does not automatically ban your account. You can see the reason on your card and request a human review. We record the content version, checks, decisions and appeals to prevent stale approvals and support review. We do not keep an extra moderation copy of your photo. Access to sensitive cases is restricted to authorized reviewers. Suspected child exploitation requires a separate human safety process; a general AI verdict is not proof.

Public-review text snapshots, appeal text and detailed model results are removed 90 days after a case closes, unless an appeal remains open or a legal hold applies. Minimal version identifiers, content hashes and decision audit records remain for moderation accountability; uploaded photos follow the ordinary card and account retention rules below.

6. Retention

We keep your data for as long as your account is active. Cards you delete are immediately hidden from your view and from any shared boards, but the underlying record is kept in a soft-deleted state and can be restored from the trash view at any time — there is no automatic purge window. Photos and uploads are kept with the soft-deleted card so a restore brings everything back. Reports of community content (CardReport rows) are retained indefinitely for moderation history. Stripe transaction records are kept as long as required for tax and accounting law (typically 6–10 years depending on jurisdiction). Activity logs are automatically deleted after 90 days; login IP addresses are nullified 30 days after your last sign-in. Notifications waiting for the Android app are deleted after 7 days, and the record of a nearby nudge (venue or card, time, your answer — never your position) after 30 days.

When you delete your account, your personal information (name, email, avatar, location, last-login IP) is cleared immediately and your account is deactivated. The deactivated record is retained so shared boards and partner-side history remain coherent. If you want the remaining record permanently removed beyond the immediate PII clearance described above, email us at support@pairlylife.com and we will action the request manually.

7. Security

We use industry-standard practices including TLS in transit, bcrypt password hashing, JSON Web Token authentication, account lockout after repeated failed logins, security headers, and row-level access checks on every API endpoint. Despite this, no system is impossible to breach; please use a strong, unique password and report suspicious activity to support@pairlylife.com.

Data-breach notification. If we become aware of a personal-data breach that is likely to affect you, we will notify affected users and, where legally required, the relevant supervisory authority without undue delay and consistent with applicable law (including, where it applies to you, the GDPR and U.S. state breach-notification laws). The notice will describe, as far as we can, what happened, the data involved, and the steps you can take.

8. Your rights

Subject to local law, you may:

• Access the personal data we hold about you (use the in-app data export).
• Rectify inaccurate data via Settings → Profile.
• Erase your account and associated data (Settings → Account → Delete account).
• Export your data in a portable JSON format (Settings → Export, or /export/board/{id}).
• Object to or restrict processing based on legitimate interests.
• Withdraw consent for optional features (push notifications, location).
• Lodge a complaint with your supervisory authority (e.g. your national data-protection regulator in the EU).

9. Children

The Service is intended for users aged 16 or over. We do not knowingly collect personal information from children under 13 years of age (as defined by the U.S. Children's Online Privacy Protection Act, “COPPA”). If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly.

Users between 13 and 15 years old may use the Service only with verifiable consent from a parent or legal guardian, and only where permitted by their local law. Some jurisdictions (including parts of the EU) require users to be 16 or older to consent on their own to the processing of personal data; in those jurisdictions we apply that higher age. If you believe a child has created an account in violation of these rules, please contact privacy@pairlylife.com and we will delete the account and associated data.

10. International transfers

Nimavera Inc. (in formation) is based in the United States. Our application infrastructure is hosted in the United States and, where required to serve EU users, the European Union. Several sub-processors (Stripe, OpenRouter — and the underlying model providers it routes AI requests to — and Sentry) are headquartered in the United States. For transfers of personal data from the EEA, the United Kingdom, or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK Addendum, and the EU-U.S. Data Privacy Framework (where the sub-processor is certified), supplemented by appropriate technical and organisational safeguards.

11. Cookies and local storage

See our separate Cookie Policy for the full list of what we store in your browser and why.

Price test. While paid plans are not on sale yet, we are testing which Premium yearly price feels right. If you accept analytics in the cookie banner, your browser keeps a random identifier (pl_vid, in local storage and a first-party cookie) so you see the same price every time; if you don't, you see the standard price and are not counted. When you are signed in, your account keeps one price on every device (stored on our servers, not on your device). We count, on our own servers only, how many visitors saw each price, switched between monthly and yearly, and asked to be told when Plus opens (the price you saw is stored with your waitlist request). We keep only a scrambled (hashed) form of the identifier next to those counts. No third-party analytics are involved, nothing is charged, and clearing your site data resets it.

12. Changes to this policy

We may update this Privacy Policy. Material changes (e.g. a new sub-processor or new data category) will be notified via email or an in-app banner. The “Last updated” date at the top always reflects the current revision.