¹ Transfer to the USA / Israel is covered by EU Standard Contractual Clauses (SCCs). Hetzner Online GmbH, Mailgun (EU servers), and SMTP2GO (EU servers) process data within the EU — no SCC required for those processors.

6. Data Sharing & Disclosure

We do not sell your personal data. We may disclose data:

To the sub-processors listed above, only as necessary.
To another Luvu user, only as part of the matching, chat, or block-report features.
To authorities when required by law, court order, or to prevent serious harm.
In the event of a business sale or acquisition, subject to equivalent privacy commitments by the successor.

7. Data Retention

We retain personal data only as long as needed for the purposes described above:

Account & profile data: until you delete your account, then irreversibly removed within 30 days (except where law requires longer retention — e.g. financial records, 10 years).
Voice messages: removed 1 hour after the recipient’s first playback, or after the chat retention window if never played.
Push tokens: removed when you log out, uninstall the app, or revoke notifications.
Attribution-event records (Singular): aggregated after 90 days; identifiers removed on account deletion.
Server logs (including hashed IPs): 90 days.

8. Your Rights (GDPR — EU/EEA Users)

Right to access, rectify, or delete your data.
Right to data portability — you can request an export from Settings.
Right to restrict or object to processing.
Right to withdraw consent (for the special category data described in § 1, and for advertising attribution).
Right to lodge a complaint with a supervisory authority.

9. Security

We use industry-standard encryption (TLS 1.3 in transit, AES-256 at rest), photo URLs are short-lived signed S3 links, passwords are hashed with bcrypt, and we operate read-only admin defaults to limit accidental data exposure. Voice and image files in S3 are stored with private ACLs and only delivered via short-lived signed URLs.

10. Self-Hosted Analytics

We run our own self-hosted analytics on infrastructure we control (currently Plausible Analytics; we reserve the right to switch to a self-hosted Matomo instance under the same configuration). No data is sent to Google Analytics, Facebook Pixel, or any other third-party tracker. Marketing-attribution data sent to Singular (see § 5 and § 11) is separate from product analytics and is only collected when you allow tracking at the OS level.

11. Mobile App: Push Notifications, Location Messages, and Attribution

Three mobile-app capabilities involve specific personal-data flows that you can control from your device:

Push notifications — Required for delivering match alerts, message previews, and security notifications. Disable from your device’s Settings → Notifications → Luvu. Disabling there removes the active push token from our records on the next session.
Location messages — Optional. When you send a location message we transmit your precise GPS coordinates to Google Maps (for the static map image) and Geocoder (for the city label), and store them on the message row so the recipient sees the map. To disable, simply don’t use the location-message feature. The general distance-based matching uses a coarser location signal collected only at app startup.
Marketing attribution — We use the Singular SDK to measure which advertising campaign brought you to Luvu, and which in-app events you complete (so we can pay our advertising partners only when ads actually convert). On iOS, this only happens if you allow tracking in the App Tracking Transparency prompt. On Android, this only happens when you have not opted out of personalised ads in Settings → Google → Ads. You can revoke either at any time from your OS settings.

12. Contact

Sparkle5, LLC — privacy@luvu.plus.

Privacy Policy