Privacy Policy

For Us ("the app", "we", "us") is developed by an independent developer and published under the GlitGrace name. This policy explains what the app collects, why, where it is stored, who can see it, how long we keep it, and the rights you have. It is written to meet the main privacy laws where the app is used, including India's Digital Personal Data Protection Act 2023, the EU/UK GDPR, and California's CCPA/CPRA. Where a right below is not legally required where you live, we still honour it.

What we collect

1. Your account

You sign in with your Google Account. Google shares your name, email address, profile picture link and a unique account ID with Firebase Authentication, which we use to keep you signed in and to link you to your partner. We never receive your Google password.

2. Your profile (end-to-end encrypted)

• The name you choose and your date of birth (used only to confirm you are 18 or older).
• The date your relationship started, and the mood you share with your partner.
• Your profile photo, if you add one.

3. What you and your partner create (end-to-end encrypted)

• Answers to the daily question, game and quiz answers, and question-library answers.
• Journal memories (text and photos), special days and their background photos.
• Your shared note, doodles, live drawings and the photos you send to your partner's home-screen widget.

4. Approximate location (optional, end-to-end encrypted)

If you turn on Distance, the app reads your approximate location (not precise GPS) to show how far apart you and your partner are. It is encrypted before upload and only your partner can see it. You can turn it off at any time, and the app never asks for it unless you switch Distance on.

5. Information we need to run the service (not end-to-end encrypted)

Some information has to stay readable to our servers so the app can work. None of it includes the content of what you write or the photos you share:

• Your account ID, who you are paired with, and when you paired or unpaired.
• Your time zone, used to start each day's question and send reminders at the right local time.
• Whether each of you has answered today (not what you answered), your shared streak count, and which games you have played.
• Notification tokens for your devices, so we can send reminders and partner nudges.
• Your public encryption key, which lets your partner's phone share the couple key with yours.
• Premium status and Google Play purchase records (see Payments).

What we do not collect

No advertising ID, no ads, no analytics or tracking SDKs, no contacts, no messages, no precise location, no microphone recordings. Photos are only those you choose to add, and the app removes location (EXIF) data when it shrinks them before upload.

How end-to-end encryption works

• Your phone creates its own encryption keys. Profile and couple content are encrypted on the device with AES-256-GCM before anything is sent.
• When you pair, the keys are shared with your partner's phone, sealed so that only their phone can open them. Our servers only ever hold the encrypted versions.
• Keys are kept in a part of your phone's storage that Android never backs up. If you reinstall or move to a new phone, your partner's app shares the keys with you again automatically.
• If both of you lose your keys (for example, both reinstall at the same time), the encrypted content cannot be recovered, by you or by us. We do not hold a copy of your keys.

How we use information

• To provide the app: pairing, daily questions, games, journal, widgets, streaks and reminders.
• To deliver notifications you have allowed, such as "your partner answered" and daily reminders.
• To provide and verify Premium purchases.
• To keep the service secure and prevent abuse (for example, rate limits on nudges).
• To reply when you contact us.

We do not sell your personal information, we do not use it for advertising, and we do not use your content to train any AI.

Legal bases (EEA/UK)

• Contract: to provide the app and Premium you signed up for.
• Consent: for optional features such as location and notifications. You can withdraw it at any time in the app or your phone's settings.
• Legitimate interests: to keep the service secure and working.
• Legal obligation: to keep purchase records required by tax law.

Where your data is stored and who processes it

We use Google services as our processors:

• Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Realtime Database and Cloud Messaging). Our database and server functions run in Google Cloud's Mumbai, India (asia-south1) region; some Firebase services, such as Authentication and Cloud Messaging, are operated by Google globally.
• Google Play for app distribution and payments.

Data is protected in transit with TLS and at rest by Google's encryption, in addition to our own end-to-end encryption of your content. Access is restricted by security rules, so only you and your partner can reach your couple's data. When you unpair, both of you lose access to the old couple's data straight away.

Payments

Premium is sold through Google Play. Google handles your payment details; we never see your card or bank information. We receive and keep a purchase token, the plan you bought and its status, so we can turn Premium on for you and your partner and handle renewals, cancellations and refunds.

Your partner

For Us is built for sharing. Your partner can see your profile (name, photo, mood), your answers once you have both answered, your shared content and, if you turn it on, your approximate distance. Please share only what you are comfortable sharing with them.

How long we keep data

• While you use the app: we keep your data until you delete it or your account.
• Deleting an item (a memory, special day or photo) removes it for both of you straight away.
• Unpairing: the shared couple data, including all photos, is permanently deleted 7 days later. The 7 days give you a chance to reconnect if it was a mistake.
• Deleting your account: your profile, profile photos and sign-in account are deleted immediately, you are unpaired, and the shared couple data is permanently deleted 7 days later.
• Purchase records are kept for as long as tax and accounting law requires.

Your rights

Depending on where you live, you have the right to access, correct, delete, or receive a copy of your personal data, to withdraw consent, to object to or restrict processing, and to complain to your data protection authority (in India, the Data Protection Board of India). You can correct your profile and delete content directly in the app, and delete your whole account from Us → About you → Delete account. For anything else, email contact@glitgrace.in. We reply within 30 days. Because your content is end-to-end encrypted, we can only provide or act on the information we are able to read; your phone holds everything else.

California residents: we do not sell or share personal information for cross-context behavioural advertising, and we will not treat you differently for exercising your rights.

Children

For Us includes romantic and intimate content and is only for adults aged 18 or older. The app asks for your date of birth and does not let anyone under 18 continue. If you believe someone under 18 is using the app, email us and we will delete their account.

Security incidents

If a breach affecting your personal data occurs, we will notify affected users and the relevant authorities as the law requires. Because your content is end-to-end encrypted, it stays unreadable even to someone who gains access to our storage.

Changes to this policy

We will update the date at the top when this policy changes, and tell you in the app before any change that significantly affects how we use your data.

Grievance officer and contact

For privacy questions or complaints, including under India's DPDP Act, contact our grievance officer at contact@glitgrace.in.