DRAFT for review. Not final until this note is gone.
Privacy Policy
Privacy
Last updated [date when final]
Candlelit for Couples ("Candlelit", "we") is an iPhone app made by PileUp Digital. It helps two people put their phones down together. This page says exactly what we store, why, and what we never collect.
The short version
- No ads, no ad networks, no analytics or tracking SDKs, and no selling or sharing of data with data brokers.
- No email, phone number, real name, contacts or location are asked for. Photos only if you add them to your scrapbook, and we remove their location data.
- Screen Time data never leaves your phone. We never see which apps you use or block.
- Your account is anonymous: a random ID made the first time you open the app.
What we store
| What | Why |
|---|---|
| A random account ID, and a sign-in token (we keep only a one-way hash of the token; the token itself stays in your phone's keychain) | So the app can talk to our server as you |
| The name you choose to show your partner (optional, up to 40 characters) | Shown to your partner in the app and in notifications |
| Your time zone, when your account was made and when it was last used | Counting free dates per calendar month, and keeping the service running |
| Your pairing: which account you are paired with, when you paired and when either of you unpaired, and the invite codes you made (each works once, for 24 hours) | Connecting you and your partner |
| Your dates: start and end times, length, how a date ended (finished, ended early together, emergency exit, Screen Time switched off, unpaired) and who ended it | Running the date on both phones, the recap, streaks and the free tier |
| Tonight's date idea and the date length you picked | Showing the same pick on both phones |
| Your scrapbook: a page for each date, with the title, note and mood sticker either of you adds, and tonight's idea as it was that night | Keeping a shared scrapbook of your dates |
| Scrapbook photos you choose to add, with optional captions, who added each one and when. We store a resized copy and a small thumbnail on our server. Before storing, we re-save every photo, which removes its location (GPS) and camera details | Showing your photos to the two of you, on both phones |
| A push notification token for your phone | Telling you when your partner is ready, or when a date ended |
| Subscription records from Apple: transaction IDs, product, purchase and expiry dates, whether it is a trial, renewal status, refunds, and the account that bought it | Unlocking the subscription for both of you |
While a date is being set up, our server also passes along live presence between the two phones (online, holding, the length each of you picked). That is kept in memory only and is not saved.
What we never collect
- Screen Time and app usage. Candlelit uses Apple's Screen Time (Family Controls) on your phone to block apps during a date. Which apps you pick, and anything about how you use them, stays on your phone. Apple's design does not even let the app read app names. Our server only learns that Screen Time access was switched off during a date, so the date can end for both of you.
- Payment details. Apple handles purchases. We never see your card or Apple ID.
- Contacts, microphone, location, or advertising identifiers. The app never reads your photo library on its own: only photos you pick for your scrapbook are uploaded, and their location data is removed on our server before they are stored.
What your partner sees
Your display name, whether you are online and holding, the length you picked, that you are locked and for how long, and how each date ended (for example, that you used the emergency exit). Never which apps you use. After you unpair, both of you can still read the history of dates you had together.
Your scrapbook is shared by the two of you: either of you can add to it, edit it and remove photos from it. Photos are stored on our server, outside any public web folder, and are only sent to the two of you, through your sign-in or through private links that expire within two hours. The scrapbook belongs to the couple: after you unpair, neither of you can see it. If the same two of you pair again within 30 days, it comes back. After 30 days we delete it, photos included.
Who else handles data
- Apple delivers push notifications (the notification text includes your display name) and processes purchases. Apple's own privacy policy covers that.
- OVHcloud hosts our server and database [Ally: confirm the data center location].
- Cloudflare sits in front of our server for DNS and network protection, so it carries the traffic between the app and our server.
We do not share data with anyone else, except where the law requires it.
Logs
Like most servers, ours keeps short-lived technical logs that include IP addresses and request times, for security and fixing problems. Rate limiting (stopping people guessing invite codes) uses IP addresses in memory only. [Ally: confirm log retention, default is 14 days.]
How long we keep it
We keep your account data while you use Candlelit. Database backups are kept for 14 days and then deleted. If you want your data deleted, email us (below) with your display name, your partner's display name and roughly when you paired, so we can find your account. We will delete your account, pairing and date history within 30 days. Apple keeps its own records of purchases.
Scrapbook photos you delete are removed from our server right away. When an account is deleted, the scrapbooks of every couple it was part of are deleted too, photos included, because they are shared and the couple no longer exists. Scrapbooks of couples who unpaired are deleted 30 days after the unpair. Page text (titles, notes) can remain in database backups for up to 14 days after that.
[Ally: the server now supports deleting an account (DELETE /v1/me: unpairs, deletes scrapbooks and photos, clears the name, signs out). The app still needs a delete button wired to it; App Store Review Guideline 5.1.1(v) asks for in-app deletion. Once it ships, replace the email instructions above with "Settings, Delete account". Also confirm whether photo files get an off-server backup; today they are not in the database backups.]
Your rights
Depending on where you live (for example the EU, UK or California), you can ask to see, correct, export or delete your data, or object to how we use it. Email us and we will answer within 30 days. We do not sell or share personal information as those terms are defined under California law.
Children
Candlelit is meant for adults in a relationship and is not directed at children under 13. [Ally: confirm minimum age and the App Store age rating.]
Changes
If this policy changes, we will update this page and the date above. For big changes we will tell you in the app.
Contact
PileUp Digital, contact@pileupdigital.com [Ally: add a postal address if needed].