Privacy policy

LoveLust Privacy Policy

Last updated: 2026-10-20

The basics

  • Controller: The LoveLust Company SL (section 10).
  • What you record: stays on your phone. We don't receive or process it (section 1).
  • What we process: a technical record for notifications, Plus and rewards; app errors and performance; analytics, only if you turn it on; and survey answers, without identifying you (section 2).
  • Legal basis: providing the service, your consent and our legitimate interest in the app working (section 2).
  • Recipients: the providers in section 3, some in the USA.
  • Your rights: access, rectification, erasure, portability, objection and restriction, and withdrawing your consent (section 6).
  • Automated decisions: none. Cycle estimates and safety readings are calculated on your phone and are for guidance only.

1. What you record stays on your phone

Your activity, partners, cycle, medication, tests and photos are stored encrypted on your phone (section 7). The app processes them on your phone, under your control: they never reach our servers, analytics or error reports, and are never sold or shared with advertisers.

They only leave the phone if you decide so:

  • Apple Health or Health Connect: if you turn the integration on, the app writes and reads cycle and activity data there.
  • Backup: if you turn it on (with Plus), it is encrypted on your phone and uploaded to your Google Drive or iCloud. It includes your records, photos and settings. With a passphrase, only you can open it. Without one, it is encrypted with a key built into the app, so its protection depends on the security of your Google or Apple account. We never receive the backup, the key or the passphrase.
  • Sharing or exporting: whatever you send from the share menu goes wherever you choose.

2. What we process

Your record on our server

LoveLust has no account or sign-in. To send you notifications, give you Plus and not repeat rewards, we keep:

  • the random identifier RevenueCat uses for your purchases, which is not your name;
  • your language, platform, app version and, if you have notifications on, their token;
  • your communication preferences and the news you asked to hear about (store, games, toys, cycle);
  • the status of your Plus and where it comes from (purchase, trial, survey or code), which RevenueCat tells us;
  • the rewards and promo codes you have redeemed. So that a code isn't redeemed twice on the same phone, we keep a value calculated on your phone from the code, different for each code, which can't identify the phone.

Legal basis: providing the service (GDPR art. 6.1.b) and your consent to communications (art. 6.1.a). We delete it after 12 months without using the app, or within 30 days if you ask (section 5). The code value is deleted 90 days after redemption or after the promotion ends.

Surveys

They are voluntary (art. 6.1.a). Your answers are stored with the survey, its version, your language and the date, with nothing that identifies you, so they can't be deleted one by one. Separately, our server notes that you started and finished a survey so the reward is given only once. Some questions accept free text: don't write anything you don't want stored.

Errors and performance

So the app works well (legitimate interest, art. 6.1.f):

  • Sentry receives errors: what failed, where, device and system details and, on some launches, how long the app took to open. No identifiers, personal data or session recording.
  • EAS Observe (Expo) measures start-up, screen loading, smoothness and memory, and collects JavaScript errors, with the screen's name (never its content) and a random install and session identifier.
  • Firebase Remote Config (Google) turns features on or off. Each request carries a Firebase installation identifier, the app version, the language and the platform.

You can turn off error and performance reports in Settings → Privacy. They are kept for each provider's retention period.

Analytics

We use Aptabase, hosted on our own servers. Events carry the system and app version and a session identifier, never your identifier, names, notes, free text, contacts, locations or dates of birth. They are kept for 12 months.

Without your consent, only one event is sent: that the app was opened, with the language and whether you accepted, declined or haven't yet answered the analytics question. It tells us how many people accept, which the rest is measured against (art. 6.1.f).

With your consent to basic analytics (art. 6.1.a), also: the screens you visit, feature use, settings changes, whether you have Plus and how you got it, which version of a feature you see when we test two and, on Android, the campaign you installed the app from.

With your separate consent to intimate data analytics (art. 9.2.a): your sex, gender, sexual orientation and age band (calculated on the phone), counts of what you record, the kind of medication you add and when you log doses, that you attended a test or linked a treatment, and the games and intensity you choose. Never names, notes, results or anything about your cycle.

Both are off by default and can be changed in Settings → Privacy.

Separately, once a day the app tells our server it has been used, with the platform, the version, the day, the week it was installed, the days since the previous notice and your answer to the analytics question, and no identifier. We only keep how many notices arrive each day, never one per person, to know how many people use the app (art. 6.1.f).

Purchases

RevenueCat validates and restores your purchases with its random identifier, transaction identifiers and your purchase history (art. 6.1.b). We never see your card details.

Content the app downloads

The app downloads the games catalogue, the list of surveys, notices, this policy and the terms. These requests carry your language and platform and, depending on the case, whether you have Plus or use the cycle module, but no identifier. Links to our social media and campaigns go through this site, which only counts how many times each link is used per day and, for promo code campaigns, how many codes are checked, open the app or are redeemed from each link.

3. Providers and transfers

  • RevenueCat (USA): purchases
  • Sentry (EU servers): errors
  • Expo (USA): performance (EAS Observe), notifications and app updates, which carry an install identifier
  • Google (USA): Firebase Remote Config, sign-in for Google Drive, Health Connect and Google Play services
  • Apple: Apple Health, iCloud and purchases on iOS
  • LoveLust: our server, analytics, surveys and content

Transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified and, otherwise, on the European Commission's standard contractual clauses. We don't sell your data or use advertising networks.

4. Do you have to give us data?

No. Without your record on our server you won't get notifications or be able to use Plus or rewards, but you can record everything else.

5. Deleting your data

  • Settings → Storage deletes all data on your phone and asks our server to delete your record, which is gone for good within 30 days.
  • The cloud backup is deleted separately, in the sync settings. Otherwise it is kept so you can restore it.
  • Uninstalling the app only deletes the data on your phone.
  • Your purchase history at RevenueCat and your analytics data are deleted if you ask us.

6. Your rights

You can access your data, rectify it, erase it, restrict its processing and take it with you: your records can be exported as JSON from Settings → Storage (without photos). You can withdraw your consent in Settings → Privacy at any time, without affecting what came before.

Right to object: you can object at any time to what we process under legitimate interest (errors, performance and the app-open event). Turn off error reports in Settings → Privacy or write to us.

We reply within one month at most (section 10).

7. Security

Your records and photos are encrypted on the phone with AES-256. The key is random, different for every install, and kept in the system's secure store (Keychain on iOS, Keystore on Android), with a protected copy in the app's storage so your data isn't lost if the system deletes it.

There are two exceptions, both on your phone:

  • Widgets and the Apple Watch app read what they show from a separate, unencrypted space, because otherwise they couldn't show it. It holds a summary of your latest records (including your partners' names), activity counts, today's medication and appointments and the cycle dial (bleeding days, fertile window, predictions and pending alerts). It holds no notes from your records, locations, contacts, photos or survey answers. With private mode on, names are stored already masked. It is not included in device backups.
  • Photos you open are decrypted into a temporary cache, which is emptied when you reopen the app, when it locks (if you use the lock) or when you delete your data.

8. Minimum age

LoveLust is for people over 18. If you believe a minor has used it, write to us and we will delete their data.

9. Changes

The app reads this policy from this site, so you always see the current version. We'll tell you about important changes in the app and, if one needs your consent, we'll ask again.

10. Controller and contact

  • Controller: The LoveLust Company SL, NIF B88747696, Calle Huesa del Común 2, 2C, 50011 Zaragoza, Spain.
  • Contact and data protection officer: [email protected]
  • Complaints: to the Spanish Data Protection Agency (aepd.es) or the authority in your country.

History

  • 2026-10-20: rewritten to be clearer and more accurate. Promo codes, US providers, retention periods and the right to object added; Google Analytics for Firebase and Firebase Crashlytics removed, as the app no longer includes them.
  • Earlier versions: 2026-10-18, 2026-09-27, 2026-08-20 and 2026-05-15 (first version). Available on request.

In case of discrepancy between translations, the Spanish version prevails.