privacy, in plain english.

the short version ← read this if nothing else

you do not need an account, but chats are not anonymous to our server. for every new chat turn we store the message, the AI reply, your raw IP address, a random visitor ID, and technical/request metadata for up to 30 days. authorized love.doctor operators can review those records for safety, abuse prevention, support, and product analytics. we do not sell them, use them for advertising, or use them to train our own models. the AI provider still processes messages under its service settings and terms.

what each chat turn stores

• content. the current message you send and the AI reply. if you send several turns, each new turn is stored as its own record.
• network data. your raw IP address and a short derived hash used for rate limiting and log correlation; an approximate country may be supplied by our network provider.
• browser data. user-agent/browser, accepted language, referring host and path, originating host, browser locale, time zone, viewport size, and a random first-party visitor ID.
• request analytics. timestamps, conversation and turn IDs, account ID if signed in, guest/signed-in status, model/provider, selected tone or mode, response status and timing, message lengths, and whether an image was attached.
• automatic classifications. broad topic and purpose labels (for example, relationship, technical, or prompt attack) and whether our crisis scanner flagged self-harm or abuse language. these labels can be wrong.

these per-turn records are automatically deleted from the active database after 30 days and are excluded from database backups. shorter operational security logs may contain a hashed network address and event metadata, but not the chat text.

what we don't collect

• your real name, age, or exact GPS location unless you choose to put it in a message.
• your contacts, social profiles, or private data from third-party sites.
• advertising identifiers or data bought from data brokers.
• the image bytes you attach in our server database. the server stores a [image] placeholder and an attachment flag instead.

guest chats and signed-in chats

without an account: your browser keeps the conversation locally so it can re-render it on that device. our server still keeps the per-turn record described above for up to 30 days. clearing or deleting the browser copy does not immediately delete the server record; it expires automatically.

when signed in: your email and full text conversation are also saved so the conversation can sync across devices. that saved conversation remains until you delete it or your account. per-turn analytics are linked to your account during their 30-day retention period.

• where it lives. account and analytics records live in our PostgreSQL database. access-restricted nightly backups keep signed-in account data for up to about 14 additional days; the 30-day per-turn analytics table is excluded from those backups.
• image attach. an attached screenshot or photo is sent to the AI provider for that reply and may remain in your browser's local storage. our server-side conversation and analytics tables replace the image with a [image] placeholder; they do not retain the image bytes.
• shared replies. when you create a public /r/<token> link, we store that reply with a random token. anyone with the link can read it until you take it down.
• weekly reflections. if you opt in, recent signed-in chats are processed to create and save a short reflection on your account.
• sessions & devices. signed-in devices have a session record with a user-agent label and last-seen timestamp. chat analytics can also connect the raw IP and request metadata for a turn to your account.
• optional email and push. magic links, re-engagement email, and daily-question push notifications work only as described in their account controls. push payloads do not contain conversation text.

crisis-keyword scanning

messages get an automated scan for self-harm and abuse phrases so we can show relevant helplines. when triggered, the category is stored with that chat turn for up to 30 days and also counted in a content-free operational event log. this is an automated signal, not a clinical assessment, and it can be wrong.

how we use the data

• send your message and conversation context to our AI provider so it can generate a reply;
• operate, secure, debug, and prevent abuse of the service;
• understand usage, including repeat use, popular topics, off-purpose use, failures, and response performance;
• review recent conversations when needed for safety, support, abuse investigation, and product quality.

love.doctor does not sell this data, show behaviorally targeted ads, or use conversations to train its own models. our configured AI provider processes messages under its service settings and terms.

who can see or process messages

• our AI provider, which processes the message and conversation context to produce the reply;
• authorized love.doctor operators, through a protected owner dashboard or direct systems access for the purposes above;
• service providers that run the network, email, hosting, or other required infrastructure, to the extent needed to provide those services;
• authorities or other parties when required by law or when reasonably necessary to protect rights and safety.

what you control

• delete a signed-in chat. deleting it from /account removes the saved conversation and linked per-turn analytics from the active database.
• delete your account. this removes the account, saved conversations, linked analytics, reflections, shared links, and sessions from the active database. account data already present in access-restricted backups rotates out after about 14 days; per-turn analytics is not backed up.
• guest server records. because a guest record is not authenticated as yours, deleting the local browser chat does not delete its server copy. it ages out automatically within 30 days.
• export your signed-in data. /account downloads your saved conversations as Markdown. the export does not include internal security or analytics metadata.
• revoke devices and optional features. account controls let you end sessions and manage reflections, links, email, and push settings.

cookies and local storage

ld_visitor is a random, first-party, HttpOnly visitor cookie used to recognize repeat chat use. it lasts up to one year unless you clear it. ld_session keeps signed-in users logged in for up to 30 days. both are Secure and SameSite=Lax. browser local storage holds guest conversations and interface preferences. we do not use third-party advertising cookies.

about younger users

love.doctor is intended for people 13 and up. if you're younger, please talk to a trusted adult or a school counselor instead — we mean that genuinely. for users under 18, we don't link accounts to social profiles or provide conversations to parents or schools unless required by law or reasonably necessary to protect rights and safety. the provider and operator access described above still applies.

changes

if we ever update this policy in a meaningful way, we'll tell you the next time you open love.doctor. no quiet midnight rewrites.

questions

email us at [email protected]. we read everything.

last updated: October 29, 2026