Privacy Policy

Effective July 15, 2026

Petal Post is a private space for two people, operated by its individual developer, Andrew Girard (“we”). This policy explains what information the app collects, why, and what happens to it. The short version: your data exists to run your shared space, it is only ever shown to you and your partner, it is never sold, rented, or used for advertising or tracking, and you can delete all of it yourself at any time.

What we collect

• Account details — your email address and first name. If you sign in with Apple or Google, we receive your name and email from them (with Apple you may hide your real email), never your password.
• Your shared space — what you and your partner create together: love notes, daily-question answers, moods, calendar events and ratings, plans and lists, saved recipes, restaurants, movies, your anniversary date, and a home city if you set one.
• Push tokens — if you turn notifications on, a device token used only to deliver them.
• Subscription status — if you subscribe to Premium, we receive confirmation of the subscription (product, period, and status) from Apple. We never see your payment details — Apple handles all billing.
• Server logs — like nearly every online service, our servers briefly keep standard request logs (IP address, timestamps, request metadata) for security, debugging, and abuse prevention. They are retained for a short period and are not used to profile you.
• Feedback — if you use the feedback form in Settings, we receive your message and the app version it came from, linked to your account so we can fix what you reported. Feedback is only ever readable by us — never by other users.

We do not collect your precise location, contacts, photos of you, or browsing history. The app contains no ads, no third-party advertising or analytics SDKs, and no trackers. We do not sell or “share” (as U.S. state privacy laws use that word) personal information, and we do not use your content to train AI models.

Who sees it

Your partner — that is the whole point. Content you post to your shared space (notes, answers once both of you have answered, moods, plans) is visible to the person you are paired with. Nobody else can browse it: every read and write is locked to your couple at the database level. As the operator, we access account data only when needed to run the service, investigate abuse, respond to a support request you make, or comply with the law — never to browse your content.

Services that help run the app

These providers process data on our behalf, solely to operate Petal Post, and are not permitted to use it for their own purposes:

• Supabase — our database and sign-in provider; your data is stored on their servers in the United States.
• Vercel — hosts the app’s servers.
• Expo & Apple — deliver push notifications. Notifications are written as teasers: your partner’s actual words never appear in one.
• RevenueCat — manages subscription status (it receives your purchase receipt and an anonymous app user ID from Apple, never your payment details).
• Anthropic (Claude) — powers the optional “magic” features (date planning, recipe import, conversation questions, gift ideas, monthly letters). These are off until you explicitly turn them on in Profile. When on, only the practical details a feature needs (like your shared lists, saved places, city, and watch history) are sent — your love notes and question answers are never shared with the AI, and Anthropic does not train on this data.
• TMDB — movie search and artwork (your search words are sent to them). This product uses the TMDB API but is not endorsed or certified by TMDB.
• OpenStreetMap / Nominatim — nearby restaurants and date spots (your chosen city — never your device’s GPS — is sent as the search area). © OpenStreetMap contributors.

Beyond these providers, we disclose personal information only if required by law or legal process, to protect the rights and safety of users or the public, or as part of a transfer of the service itself (in which case this policy’s protections follow your data and you will be notified).

Cookies & email

The website uses only the essential cookies needed to keep you signed in. There are no advertising, analytics, or cross-site tracking cookies — which is also why we don’t respond to “Do Not Track” signals: there is no tracking to turn off. We email you what the service requires (sign-in codes, account notices) and, occasionally, optional product updates — every optional email has an unsubscribe link, and opting out never affects your account.

Your rights & choices

Regardless of where you live, you can: access what you’ve created (it’s all visible in the app), correct it (edit or remove your own content anytime), delete everything (Delete account, described below), export a copy of your data (Download your data, in the app’s Settings), and withdraw consent for optional features (turn off notifications or the AI features whenever you like). For anything else — a question, a complaint, help exercising a right — email support@petalpost.app and we will respond within 30 days (we may need to verify it’s really you first). We will never treat you differently for exercising a privacy right.

If you are in the EU, EEA, or UK (GDPR): we process your data to provide the service you signed up for (performance of a contract), with your consent for optional features like notifications and AI (withdrawable anytime), and for our legitimate interests in securing and improving the service. You have the rights of access, rectification, erasure, restriction, objection, and data portability — the app exposes all of these directly (see above), and email works for the rest. You also have the right to lodge a complaint with your local supervisory authority.

If you are a California resident (CCPA/CPRA): the categories we collect are listed under “What we collect” — identifiers (email, name), user content, and internet activity (server logs); we collect no sensitive categories beyond what you choose to write. You have the right to know, access, correct, and delete your personal information, and to non-discrimination for exercising those rights. We do not sell or share personal information as the CCPA defines those terms, so there is nothing to opt out of. Requests: in-app (see above) or support@petalpost.app.

Deleting your account

Settings → Delete account (Profile on the web) erases your account immediately and permanently: your profile, your notes, answers, and ratings, and — because a shared space cannot outlive its couple — the space itself closes. If you were never paired (or your partner already left), every trace of the space is deleted outright. There is no recovery. If you signed in with Apple, we also revoke the app’s connection to your Apple ID. Deleted data may persist in encrypted backups for a limited period (typically no more than 30 days) before those backups age out; backups are never used to restore deleted accounts.

Retention & security

We keep your data only while your account exists (plus the backup window above), and server logs only briefly. Everything travels over HTTPS, sessions are stored encrypted on your device, and access is enforced with row-level security so one couple can never read another’s data. No online service can promise perfect security, though — if a breach affecting your personal information ever occurs, we will notify you and the relevant authorities as the law requires.

Where data lives

Petal Post is operated from the United States and your data is stored there. If you use the app from elsewhere, you understand that your information is processed in the U.S., where privacy laws may differ from your jurisdiction’s.

Children

Petal Post is for adults (18+). It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If we learn we have collected personal information from a minor, we will delete it and the account. If you believe a minor is using Petal Post, email support@petalpost.app.

Changes & contact

If this policy changes materially, we will note it in the app before the change takes effect. Questions or requests: support@petalpost.app.