Security

Security at LoveLust

Last updated: 27 October 2026

What you record in LoveLust is intimate. That's why the app is designed so we don't have to keep it: it stays encrypted on your phone. This page explains how we protect it, and how we protect the little that does reach our servers.

On your phone

Encryption. Your records and photos are encrypted with AES-256. The key is random, different for every install, and kept in the system's secure store (Keychain on iOS, Keystore on Android).
App lock. You can protect the app with a PIN and your phone's biometrics, in Settings → Privacy.
Privacy mode and discreet notifications. The first hides your partners' names; the second keeps notifications from saying what they're about.
Backups. They're encrypted on your phone before they're uploaded to your Google Drive or iCloud. With a passphrase, only you can open them: we can't recover it.
Exceptions. Widgets and the Apple Watch read an unencrypted summary, because otherwise they couldn't show it, and photos you open are decrypted into a temporary cache that's emptied when the app locks or reopens.

On our servers

Hosted in the EU. Our servers and database are in Germany.
No passwords. You sign in with passkeys or one-time codes sent by email. There are no passwords to steal or reuse.
Sign-in alerts. We email you when someone signs in from a new device or country, and on the account site you can see your devices and end any session.
Confirmation for what matters. Deleting your account, changing your email or managing passkeys needs a recent sign-in.
Minimal data. Apple and Google tokens are stored encrypted, and our technical logs keep no IP addresses or emails.
Limited internal access. Only the team members who need it can reach our systems, with passkeys, and every access is recorded.

What we don't do

We don't use advertising networks or third-party tracking tools, and we don't sell data. So no third party can receive what you do in the app.

If something goes wrong

If a security breach affected your data, we would notify the Spanish Data Protection Agency within 72 hours and you without undue delay, explaining what happened and what you can do.

Report a vulnerability

If you find a security flaw, write to [email protected] with a description and the steps to reproduce it. We reply within 72 hours. Please don't publish it until we've fixed it.