What we keep, and what we'd never do with it.
The short version
The rest of this page is the longer version: what we keep, why, who else handles it, how long we keep it, and what you can ask of us. It applies to everyone we hold something about: people with a box, and the recipients and trusted contacts they name. The English version is the one that counts; the German, French and Spanish pages are translations, for convenience.
What we store
Your email address, your first name, the letters, videos, photos and files you add, the recipients and trusted contacts you name, your check-in settings, and the usual technical records (sign-in times, device type) needed to keep the account secure.
In full. About you: your email address; your first name and phone number, if you give them; your language; your plan, and the record of each payment (the amount and currency, when, Paddle's reference, and whether it was refunded). In your box: the letters, recordings, voice notes, photos, keepsakes and notes you add, sealed, with their titles, dates and sizes, and the key that seals them, itself sealed. The people you name: the first name, relationship, email address, phone number, language and dates you give for each. Your trusted contacts: the name, email address and phone number you give, and whether they said yes. Your check-in: how often we ask, how long you have to answer, any pause, the disguise you wrote, and each round (when it began, what was sent, and what was answered, when). Your signed-in devices: when each session began, how you signed in, and the browser and kind of device, read from what the browser tells us. Sign-in links, kept only as a fingerprint for the 15 minutes they work, and for a day after.
The unlock log. Every time something sealed is opened, our release system writes an entry: when, which box, which thing (by its number, never its words), and who asked: you, on a device named by its browser; or a recipient, by her delivery. The entries are chained and signed, and kept twice: in our database, and in a store that nobody, including us, can change or empty for ten years. That is what lets us show you that nothing was opened quietly. The log never holds a word of what was opened.
Technical logs. Our hosting keeps request logs for 30 days: the page asked for, when, and the address it came from. Pages that carry a link (a recipient's box, a check-in, an alert) are never logged. We keep no analytics and no advertising data. What you write to us at Help stays in our support inbox, with the name and the address you gave us to reply to.
What we never hold: your card details (Paddle has them, and we see only that a payment was made), a password (there is none), or anything about you from anywhere else.
Why we store it
To do what you asked. Everything in your box, the people you name and your check-in settings are kept because you asked us to hold them and to deliver them as you said. That is the agreement between us; in the words of data-protection law, we process them to perform our contract with you.
To keep your box safe. Sign-in records, signed-in devices, the unlock log, the request logs and the limits on how often a link can be asked for are there to keep your box yours and to stop abuse. Our lawful basis is our legitimate interest in running a safe service, which is your interest too.
To do what the law asks. The record of each payment is kept because tax law requires it: a legal obligation. Paddle keeps its own records, as merchant of record.
Nothing else. No marketing emails, no profiling, no advertising, no selling, no sharing for anyone else's purposes. If we ever wanted to use your data for something new that needs your consent, we would ask you first, plainly, and you could say no.
Who can see it
How that works. Everything you write or record is sealed in your browser before it leaves your device, with a key made for that one thing. That key is itself sealed for our release system: a small program running in a locked machine at Google that only a program with exactly its fingerprint may use, which Google checks every time. Our servers, our database, its backups and our storage hold only sealed pieces. What stays readable, because delivery needs it: names, email addresses, phone numbers, dates, the kind and size of each thing, your check-in settings and your disguise.
The edges, honestly. Whoever can read your inbox can ask for a sign-in link and open your box as you; that opening is in your log, from a device you don't know. A recipient's box opens only in a browser where a code sent to her inbox has been entered, so a forwarded link opens nothing, but whoever reads her inbox can get the code. And a changed version of our own website could, in principle, read what a browser shows; every version we publish comes from reviewed code and leaves a record.
Who else handles it. Google Cloud (Google Cloud EMEA Limited, Ireland) hosts the site, the database, the sealed files, the keys and the logs, in its region in Belgium. Cloudflare (Cloudflare, Inc., USA) carries every visit to lovingli.com through its network, and forwards mail sent to our address. Resend (Resend, Inc., USA, sending from Ireland) sends every email we send, and keeps a record of each for a short time. Paddle (Paddle.com Market Ltd, UK; Paddle.com Inc. for people in the USA) takes your payment as merchant of record, and holds your card and billing details under its own privacy policy, as a controller in its own right. Google or Apple, if you sign in with them, learn that you use Lovingli. Our support inbox is at Proton (Proton AG, Switzerland). Each sees only what its job needs, and none of them the words in your box.
Where it goes. Your data lives in the European Union. Cloudflare, Resend and Paddle handle parts of it in the United States or the United Kingdom; those transfers rest on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses in our agreement with them. Lovingli itself is run from Kosovo, whose data-protection law follows the EU's.
Discretion
By design, our name doesn't appear on your bank statement, in your check-in emails, or in the browser tab unless you choose otherwise. That's a product choice, not a loophole: the data we hold is the same, and you can see all of it from Settings.
Trusted contacts and recipients
When you name someone, we store the name and contact details you give us and tell them the minimum: that you named them, and (for trusted contacts) one question if we lose touch with you. They can ask us to stop at any time.
If you were named by someone. We hold your name, your email address and, if the person who named you gave them, your phone number and how you're related. A recipient hears from us only when something is delivered: one email from Lovingli with the sender's first name and a link, and a code to the same address the first time the box is opened on a new device. A trusted contact hears from us when invited, and then only to be asked whether the person is okay. Neither is ever shown what is in a box, and nobody is sold or shown anything else.
What you can do. A trusted contact can decline the invitation, or take themselves off from any email we send them; the person who named them is told. A recipient can download everything that was left for her, ask us not to remind her, or ask us to put a delivery away. Both have every right under “Your rights”: write to hello@lovingli.com from the address we wrote to, and we'll act on it. We can't tell a recipient what is in a box before it's delivered, because we can't open it either.
How long we keep things
For as long as your box is open. A draft stays until you seal it or let it go. Something made on Free and not paid for is removed 30 days after it was last saved, except letters, which are never removed for that. After a refund, recordings, photos and keepsakes stay 30 days for your export, then go.
What you send. A delivery stays online for the person it's for one year from the day its latest thing arrived, and three months longer if she asks. After that her link no longer opens it. We keep the delivered copy, sealed, so that it can be brought back if she writes to us, until she or you asks us to delete it.
When you close your box. Everything in it is deleted the moment the box closes: words, files, people, settings, devices. What was already delivered stays with the people it was for, under the rule above. The record of your payments stays for as long as tax law requires. Copies in our database backups and in our storage's recovery window are gone within seven days.
Technical records. A sign-in link works for 15 minutes; its fingerprint goes after a day. A session lasts 30 days, or until you sign that device out. An email we send keeps no words and no address once it has gone; one we could not send after a day of trying keeps the address, the subject and the reason, so that someone can look into it. Request logs are kept 30 days. The unlock log is kept ten years, as said above.
Children
Lovingli is for adults. You must be 18 or over to open a box, and we don't knowingly keep a box for anyone younger; if you think we do, write to us and we'll delete it. Someone under 18 can be a recipient (a letter for an eighteenth birthday is one of the reasons Lovingli exists). What we then hold is the name and the address you gave, and we write to it only when something is delivered.
Your rights
Everything in your box is yours to see, take and delete, without asking us: “Export my box” in Settings gives you every letter, recording, photo and keepsake in ordinary formats, with a list of your people and dates, and “Close my account” deletes it all. Settings also shows, and lets you change, everything else we hold about you, and signs out any device.
Under the data-protection laws of Kosovo, the European Union and the United Kingdom you can also ask us to confirm what we hold about you and give you a copy; to correct it; to delete it; to limit how we use it, or object to a use that rests on our legitimate interest; and to receive it in a form you can take elsewhere. Write to hello@lovingli.com from the address on your box, or from the address we wrote to if you were named by someone. We answer within a month, and never charge for it. We may ask you to show it's you, the way the box does: with a link to your inbox.
If you're unhappy with how we've handled your data, tell us first and we'll try to put it right. You can also complain to a data-protection authority: in Kosovo, the Information and Privacy Agency; in the European Union, the authority of the country you live in; in the United Kingdom, the Information Commissioner's Office.
Contact
Write to hello@lovingli.com; a person answers, usually within a day. For anything about your data, say so in the subject line, and we'll treat it as a request under this page.
Lovingli is run by Albatros Sherifi B.I. (business number 812020676, Prishtina), an individual business registered in Kosovo, which is the controller of the data described here. We have no data protection officer; a service of this size isn't required to appoint one.