Privacy & security
The promises, and the specific controls behind each one. Written to be checked, not just believed.
What we promise
No ads
No advertising, retargeting or data-broker code anywhere on this site or in the app.
No sale of personal health data
We do not sell or rent personal data, and we never share it with advertisers.
No AI training on your content
Your entries and messages are not used to train, tune or improve AI models.
Named subprocessors
Every third party that touches your data is listed by name, purpose and location.
How it is enforced
Encrypted in transit and at rest
All traffic runs over HTTPS/TLS, and the database is encrypted at rest by the hosting provider.
Row-level security on every table
Access is enforced at the database level, so one account cannot read another's rows.
Separated admin roles
Administrative access requires an explicit admin role held in its own table — never a flag on a user profile, which is how privilege-escalation bugs happen.
Payments never touch our servers
Card details go directly to Stripe. We never receive, see or store them.
Who processes your data
- • Lovable Cloud — hosting, database and authentication
- • Stripe — payments and subscription billing
- • Lovable AI Gateway (Google Gemini) — replies from the website assistant
- • Apple App Store — app distribution
Full purposes, data categories and retention periods are in the Privacy Policy.
Exercise your rights, or report an issue
Access, correction, export, deletion and consent withdrawal are one email away, answered within 30 days. Security reports go to the same address and are read the same day. Deleting your account is self-serve in the app.