privacy, in plain english.

here's exactly what we do with what you tell us — and what we don't.

what we collect

your messages. the things you type into a chat.
basic technical data. browser type, ip address, approximate region — the standard stuff every website logs to keep itself running and secure.
account info, if you sign in. just your email address. there is no password — sign-in is magic-link only.

what we don't collect ← read this if nothing else

your real name, unless you tell it to the AI in a conversation.
your contacts, social profiles, or anything from third-party sites.
location beyond rough region (city level), used only for fraud prevention.
anything we'd be embarrassed to be caught collecting.

for signed-in users

signing in is optional. you only need it if you want your conversations to follow you across devices. here's exactly what changes when you do.

what we store. your email address (so we can email you the sign-in link) and your conversations (so they sync). that's it. no password — there isn't one. no name, no age, no profile.
where it lives. a postgresql database on our own server, behind a firewall. encrypted backups. no third-party cloud sync service ever sees your conversations.
who can see it. the AI that responds to you, a small number of love.doctor engineers only when investigating a bug or abuse report, and law enforcement only when legally compelled — and we'll fight overbroad requests. that's it. no advertisers. no data brokers. nobody else.
image attach. if you attach a screenshot or photo, it goes to the AI for that one reply. we do not store the image in our database — what gets saved is a literal "[image]" placeholder so the conversation reads sensibly. the image only ever exists in your browser's local storage and in the in-flight API call.
shared replies (the /r/<token> pages). when you share a single reply as a public link, we store the body of that one reply alongside a random token. anyone with the token can read it. "take it down" on /account flips the link to a 410 page instantly. the conversation it came from is never linked from a shared page.
weekly reflections. if you opt in, once a week we send the last 7 days of your chats to the AI to generate a 2-3 sentence summary, then store that summary alongside your account. you can read it on /account and turn the feature off at any time. the reflection never leaves your account.
sessions & devices. each device you sign in from gets a session row with a user-agent string (e.g. "Chrome on Mac") and a "last seen at" timestamp, so we can show you the devices & sessions list on /account and let you revoke any of them. we never log your IP address against your account.
account deletion. one click on /account wipes your user row, every conversation, every reflection, every shared link, every active session — immediately, irreversibly, no soft delete. backups are encrypted and rotate within 30 days.
data export. one click on /account downloads a Markdown file with every conversation, in order. yours to keep, no questions asked.
magic-link tokens. the link we email you is one-use, expires in 15 minutes, and is never reused. if you didn't ask for one, it does nothing on its own.
session cookies. when you sign in, we set one cookie (ld_session) that keeps you signed in for 30 days. it's HttpOnly (no JavaScript can read it), Secure (HTTPS only), and SameSite=Lax. signing out destroys it on both ends.
optional emails. we don't email you unless you ask us to: the magic-link itself, and (only if you toggle it on) a single soft re-engage email after you've been quiet for 7+ days — capped at one per 30 days. you can turn it off in /account.
optional push notifications. if you toggle on the daily-question notification, your browser gives us an opaque push endpoint URL (plus two browser-generated keys) and we store that. the notification itself carries no content — your device fetches the day's public prompt when it arrives. nothing about your conversations ever rides a push. toggle off in /account (or revoke in browser settings) and we delete the endpoint; dead endpoints are pruned automatically.
if you don't sign in. nothing changes. local-only mode still works exactly as before — your conversations live on your device and never touch our database.

crisis-keyword scanning

messages you send get a fast, on-the-fly scan for self-harm and abuse phrases. when one trips, we surface country-appropriate helpline numbers above the reply. the scan happens in memory — the result is never stored against your account beyond a logged-and-rotated event that says "level: self_harm / level: abuse" with no message content. we do this because false negatives matter more than false positives in this space.

how we use it

your messages go to our AI provider so they can be answered. they're encrypted in transit. we do not use your conversations to train AI models. we do not sell your data. we do not show you ads.

we may use anonymized, aggregated data to understand how love.doctor is used and to make it better — for example, "people are asking about long-distance relationships more in winter." that kind of thing. never anything traceable to you.

who sees your messages

the AI model that responds to you. that's the whole point.
a small number of love.doctor engineers, only when investigating a bug or abuse report, and only when strictly necessary.
law enforcement, only when legally compelled, and we'll fight overbroad requests.
nobody else. ever.

what you control

delete a chat. one click on /account. gone.
rename a chat. one click, inline.
delete your account. one click. all your data — conversations, reflections, shared links, sessions — wiped from the live database immediately. backups roll out within 30 days.
export your data. one click on /account downloads a Markdown file of every conversation in order. or pull it via GET /api/export.php with your session cookie.
revoke any device. /account lists every active sign-in session with the device label + last-seen time. "revoke" kills the session immediately.
turn off saved replies, shared links, reflections, or re-engage emails — every one is opt-in and reversible from /account.

cookies

we use a minimal set: one to keep you logged in, one to remember UI preferences. no advertising or tracking cookies. ever.

about younger users

love.doctor is intended for people 13 and up. if you're younger, please talk to a trusted adult or a school counselor instead — we mean that genuinely. for users under 18: we don't link your account to any social profile and we don't share any data with parents, schools, or anyone else without a clear legal requirement.

changes

if we ever update this policy in a meaningful way, we'll tell you the next time you open love.doctor. no quiet midnight rewrites.

questions

email us at [email protected]. we read everything.

last updated: 2026