Privacy policy

1. Who is responsible

Seluno is the product name. The operators responsible for your personal data are:

Legal name of the operator(s)

See the operators identified in our Legal Notice

Contact address

Postfach 6010 Kriens 2 Fächer Switzerland

Privacy contact

privacy@seluno.io

You can direct a privacy request to either operator using the contact above.

2. What we process and why

• Account and preferences: your email, login credentials managed by our authentication provider, display name, avatar, time zone and preferences let us create and secure your account.
• Relationship and activities: invitations, partner membership, optional relationship details, city/country, questions and answers, conversations, plans, game turns, reactions and uploaded photos enable the features you choose. Online and typing indicators share limited activity status with your connected partner. We also receive information your partner supplies about your relationship.
• AI guidance: selected text and relevant context are used to generate reflections, conversation support and date suggestions. Separate memory preferences control reuse of saved summaries.
• Safety and operation: technical request information, authentication events, limited safety flags, reports, related content references, review notes and consent records help us protect accounts and respond to misuse. A report contains the information the reporting person chooses to include, which may be sensitive.
• Purchases: Apple supplies purchase and renewal information, including transaction identifiers, product, purchase and expiry dates, refund or revocation status, and an account token linking the purchase to your Seluno account. We use this for access, restoration, billing questions and fraud prevention. Seluno does not receive your full payment card details from Apple.
• Support: if you contact us, we use your contact details and the information you provide to respond. Please include only the personal information needed for your request.

Account emails and invitations: we send requested sign-in and recovery links, account security notices, a welcome email and confirmation after successful account deletion. If someone invites you, we receive your email address from that person and use it to deliver their invitation. An invitation does not create an account or subscribe you to reminders. Unexpected invitations can be ignored or reported to support.

Optional email reminders: weekly reminders are off unless you enable them in Profile. We store your choice, its timestamp and an unsubscribe token. This processing relies on your consent; you can withdraw it in Profile or through the unsubscribe link. Essential account and security emails continue. These emails do not include your conversations, personal answers or AI reflections.

Optional push notifications:if you enable push notifications, we link this installation's delivery identifier and your notification choices to your Seluno account and sign-in session. Apple Push Notification service delivers iPhone alerts, and Google Firebase Cloud Messaging delivers Android alerts. The delivery provider receives the device delivery identifier, a notification reference and generic activity text. These alerts do not include names, personal answers or private conversation text. You can turn push notifications off in Profile or your device settings. Turning them off or signing out removes the device's server registration when a connection is available.

If you choose Google or Apple sign-in, the provider authenticates you and shares an account identifier, your email address and, where available and permitted, your name and profile image. Apple may provide a private relay email address. We use this information to sign you in and maintain your Seluno account. Google sign-in does not give Seluno access to your Gmail, Google Calendar or Google Drive. Your sign-in provider processes the authentication under its own privacy policy.

We receive data from you, your connected partner, people who submit a report, your device and the providers involved in sign-in or purchase verification. We do not buy relationship profiles from data brokers.

For ordinary personal data needed to provide a feature you request, our basis is performance of the service contract (GDPR Article 6(1)(b)). This includes account access, requested shared features, purchase verification and support for the service. Security, fraud prevention and necessary incident handling use legitimate interests (Article 6(1)(f)), subject to necessity and your rights. Where a specific legal duty requires processing, Article 6(1)(c) applies. Optional personal sharing and AI processing rely on consent (Article 6(1)(a)). The Swiss Federal Act on Data Protection also applies to our processing where applicable.

Conversations can reveal health, sex life, sexual orientation or other specially protected information. Contract necessity alone does not authorize that processing. Before collecting personal answers, conversations, photos, memories or free-text plans, we ask for separate explicit personal-sharing consent (Article 9(2)(a)). This covers the selected features and their hosting and database processing, including non-AI content. AI requires another permission. Neither choice is included in acceptance of the Terms.

Personal sharing is off until you choose it. You can decline, skip the personal onboarding questions and use basic games without personal stakes, account settings and privacy controls. Adding private content requires its owner’s permission; adding new shared content or newly revealing private answers requires the applicable permission of both partners. You cannot consent on another person’s behalf. Do not include intimate details about other people who have not agreed.

Change or withdraw personal-sharing consent in Profile → Data & privacy → Personal sharing. Withdrawal blocks new covered content and its use for new AI requests. It does not automatically erase existing history or partner copies. Use the deletion and rights controls described below for those records.

Safety reporting and requests to exercise your rights remain available without these permissions. Include only the information needed, preferably a reference to the incident rather than intimate details. Our review procedure requires unnecessary sensitive details to be removed. Retaining sensitive evidence requires a specific applicable exception, such as necessity for a legal claim under Article 9(2)(f); ordinary legitimate interests alone are insufficient.

3. AI consent and saved context

AI is optional from the start, including when joining by invitation. Before using it, you must explicitly enable OpenAI processing with an initially unchecked choice. Personal-sharing permission is also required for the content involved. Declining AI does not prevent account setup or non-AI features. Saved AI memory stays off for new choices and can be enabled separately in Settings. You can change or withdraw these choices in Profile → Data & privacy → AI privacy. Withdrawing later stops future AI processing; existing accounts retain access to permitted non-AI features and account controls. Shared AI processing that includes both partners’ context requires each person’s current consent. Memory for future conversations is a separate, optional choice.

When authorized, relevant conversation text, profile or relationship context and permitted saved summaries are sent to OpenAI. Photo files, passwords and authentication tokens are not included in these text requests. Text can itself identify you, so this is not anonymous processing. Private input may be processed by AI even when it is hidden from your partner.

OpenAI does not use API content to train its models by default. Seluno requests no stored Responses history (store: false). This is not Zero Data Retention: default abuse-monitoring logs may retain content for up to 30 days, with longer retention in stated legal or safety circumstances; model-dependent prompt caching can also retain temporary state. Special retention or regional settings require separate configuration. See OpenAI’s API data controls.

Withdrawal stops new authorized AI processing; it cannot recall a request already sent. It does not automatically erase conversation history or copies already shared. You can review and delete saved context under “What Seluno remembers”, delete your account or contact us for an erasure request. AI suggestions may be inaccurate. They do not make decisions with legal or similarly significant effects about you and are not medical treatment.

4. What your partner and others can see

Safety reports contain the concern and details you choose to submit and are not shown to the reported partner. Blocking stops further contact in the shared space. Previously downloaded content cannot be recalled. Authorized personnel can examine reports and related review notes to handle the issue.

In private or dual-blind modes, your partner does not receive your raw input; the shared AI reflection can still convey information derived from it. Reveal-together modes intentionally display both answers after both people submit. Messages in shared conversations, shared plans, game activity and shared memories are visible to your partner.

If you create a public share link, people who receive it can access the selected shared content. You can revoke links, but cannot recall screenshots, downloaded files or copies another person has made. Do not publish another person’s sensitive information without their permission.

• Hosting and domain services: the app and website are hosted by Google Cloud Run. Hosting can involve request metadata and personal content processed by app pages, APIs or exports. Vercel provides domain registration and DNS; retained earlier deployments are used only for rollback.
• Supabase: provides authentication, database, file storage, realtime activity and backend functions. These services handle account data and the content needed for the relevant features.
• OpenAI: receives the selected text and permitted context described in section 3 for AI responses, subject to your separate choices.
• Resend: delivers authentication and service emails using the recipient address and necessary message content. Seluno does not include conversation text or AI summaries in these automated emails.
• Google Workspace: handles emails sent to our support and privacy addresses, including the sender, subject, message and any attachments you choose to send. Include only what is needed for your request.
• Apple: handles App Store purchases and supplies the transaction information described in section 2. Apple also processes information under its own Privacy Policy.

Authorized operators and service providers may access data as needed for their roles, security or legal obligations. We may disclose necessary information to competent authorities or legal advisers when lawfully required or necessary for a legal claim. Privacy from your partner does not mean end-to-end encryption that prevents all access by Seluno or its providers.

If you choose to open a date suggestion in Google Maps, the place query is sent to Google and the external service receives the usual connection information. Maps is opened only when you follow that link. Its processing is governed by Google’s Privacy Policy.

5. Where data is processed

Google Cloud Run for the app and website; Vercel remains the domain registrar and DNS provider, with earlier deployments retained for rollback.

Website processing locations: Belgium (europe-west1); application hosting region

Supabase project location: Ireland (eu-west-1); primary database region

International transfer arrangements: Supabase stores the database in Ireland and Google Cloud Run hosts the app and website in Belgium, both inside the EU. For customers in Switzerland, OpenAI contracts through OpenAI Ireland Ltd. Resend keeps stored email and log data in the United States. Where a provider processes data outside Switzerland and the EEA, that transfer relies on the provider data processing agreement together with the EU standard contractual clauses, and for Google additionally on the EU-US Data Privacy Framework.

Resend states that its stored email and log data is in the United States, even when a European sending region is selected. OpenAI, Google and the other providers can also involve processing or access outside Switzerland and the EEA. We do not claim that all Seluno data stays in Europe.

A database region alone does not establish that all support, logs, backups or subprocessors remain in that region. Where applicable, transfers require an adequacy decision or appropriate safeguards such as standard contractual clauses and additional measures. A provider’s general contract is not proof of the settings or safeguards for every Seluno data flow. You can request information or a copy of applicable safeguards from our privacy contact.

6. Retention and deletion

When you use Apple subscriptions, Seluno verifies purchase records with Apple and retains transaction and ownership records for access, recovery and fraud prevention. Deleting your Seluno account does not cancel Apple billing. You can manage subscriptions in your Apple account.

• Account details, activities and saved conversations are kept to provide your account and history until you remove them where a feature permits, delete your account, or an applicable erasure request is completed.
• Account deletion removes your login, profile, avatar, private answers, Solo reflections, authored conversation messages and share links you created. Your partner keeps shared photos, memories, plans, already revealed answers and shared AI reflections in an archive they can view but cannot edit. This content may still mention you; it is not automatically anonymized. Contact us to request review of personal information remaining there.
• The shared archive remains while a member keeps it. Removing it in Profile → Data & privacy → Archive removes your access. When the last member removes it, Seluno deletes its data and stored photos. Either partner can also delete an individual shared memory photo in an active relationship. Previously issued temporary photo links may work until they expire.
• Saved AI context remains until it is forgotten or deleted under the account/archive rules. Withdrawing memory permission prevents its future use and new memory generation. Consent records are retained with the account to demonstrate your choices.
• Purchase records support access, restoration and verification while your account exists. After account deletion, technical transaction details become due for removal once both their expiry and their most recent receipt or update are more than 12 months old. A documented legal preservation hold can delay removal for the records needed for a specific claim. Active or recently updated purchase records are not removed by this rule.
• Minimal identifiers binding an original Apple purchase to its original account and shared space remain separate from the detailed transaction history. They prevent an old purchase being reassigned to someone else and remain necessary while that purchase can be presented for restoration or verification. They are pseudonymous, not anonymous, and contain no email address, payment card details, messages or raw Apple payload. You may request a review of continued retention through our privacy contact.
• Statutory accounting retention applies to the documents we are legally required to keep, generally for ten years from the end of the relevant financial year under Swiss accounting law. This does not extend retention of relationship content or every technical purchase record.
• Email delivery records in Seluno, including an address retained to send a deletion confirmation, are removed after seven days by scheduled cleanup. Email preferences and unsubscribe tokens are removed with the account. Our email provider has its own retention described below.
• Safety reports and review notes can remain after account deletion. Account links may be removed while the report text still identifies people. Reports and review notes are removed at the earlier of 180 days after closure and 365 days after receipt. A specifically documented preservation hold lasts at most 90 days per authorization and requires a new review to extend it. Removing a report does not lift an active safety block. Requests for access or erasure protect the reporter and other people concerned.
• Earlier product-measurement events exclude conversation text but can be linked to your account. They are removed after 90 days from the original event, or earlier with the associated account. This release stops sending new optional product and onboarding events.
• Online and typing indicators stop being displayed after a short interval, but the last stored status is removed after 24 hours, or earlier under the account, relationship or safety controls.
• Unfinished server-side preparation previews expire for reuse after 24 hours. Expired preview rows are removed by scheduled cleanup even if you never return. Approved text already saved in a conversation follows that conversation’s retention rules.
• Signup protection stores a pseudonymous network identifier, not the raw network address in its limiter table. Cleanup removes it after more than 48 hours without an accepted signup, normally within 72 hours. Limited crisis events have a 30-day retention period with scheduled cleanup.

The general privacy cleanup runs hourly; email delivery records are checked every five minutes. A time limit makes data due for deletion; physical removal takes place on the next successful run. A failed run must be investigated and retried. Earlier applicable erasure rights still apply.

Hosting logs, backups and their deletion cycle: Automatic daily database backups and a separate backup of uploaded files are not set up yet. We will add both as Seluno grows and will update this notice when we do. Server logs record technical events only, never your messages, answers or AI content. Live deletion does not guarantee immediate deletion from provider recovery systems or records retained for a lawful purpose.

Provider defaults are not a single retention period for Seluno. For example, Resend publishes a standard 30-day period for email and log content and a 7-day backup period, with exceptions for particular plans and account closure. Our operating rule for ordinary support emails is 90 days after case closure, with minimal evidence for rights requests or a specific legal claim handled separately. The Google Cloud target is 30 days for application logs; Google’s required audit-log categories have a 400-day period. Daily database and separate file backups are planned with a rolling seven-day window. These account settings and backup jobs still need verification. A database backup does not include uploaded photo files, and a provider offering backups does not prove one exists.

Deleting live data does not necessarily remove it immediately from provider backups or legal/safety records. Copies already downloaded by another person cannot be recalled.

7. Cookies and storage on your device

Product feedback. When you send a problem report, suggestion or optional in-app rating, we store your submission separately from aggregate measurement in Supabase. It includes the selected app area, question and rating where applicable, your optional comment, platform and app version, and your account identifier. Your partner cannot access it. We do not automatically attach private answers, chats or screenshots. The Seluno Team can use your account email for follow-up only if you allow this when submitting. Feedback is deleted after 180 days or when your account is deleted. A private account preference controls optional questions and their frequency. Limited completion counts and recent completion identifiers are held on your device to avoid repeated questions. These are not added to aggregate analytics.

Authentication cookies keep you signed in. Browser storage holds preferences and feature state such as theme, dismissed notices and unfinished drafts. Private preparation drafts expire after seven days when next read; closing a tab does not necessarily remove local storage. Signing out clears identified private drafts. On a shared device, sign out and clear browser data when finished.

In the installed iPhone app, authentication session credentials are stored using the iOS Keychain. The bundled app does not fall back to plaintext browser storage if Keychain access fails. Signing out removes the stored session and its associated authentication entries; a failure is reported so you can retry. Deleting the app is not the same as deleting your Seluno account, and should not be relied on to erase every Keychain entry.

The app also keeps preferences, drafts and temporary screen data on the device to support its features and avoid unnecessary loading. Identified private drafts and account-specific caches are cleared during sign-out through the app’s cleanup flow. Files or photos you export to Files or Photos remain under your control and must be deleted there separately. Revoking server access cannot recall a copy already exported.

Aggregate measurement notice, 20 September 2026. Builds with aggregate measurement enabled automatically add feature visits, navigation clicks, approximate active time and reached onboarding steps to daily totals in Supabase. The metrics table contains no account, device or session identifiers and retains totals for up to 90 days. It contains no answers, chat text, recordings or URL parameters. Ratings are added only when you send feedback. We do not create individual activity histories or use advertising trackers. Network providers still process technical request information, such as IP addresses, under their operational logging practices. Earlier account-linked measurement is disabled. Where consent is required, automatic collection must remain disabled until a compliant collection mechanism is available.

8. Your choices and rights

Depending on the applicable law, you can request access, correction, erasure, restriction and a portable copy of your data, object to processing based on legitimate interests, and withdraw consent without affecting the lawfulness of earlier processing. These rights can be subject to limits, including the rights of your partner and legal obligations.

Use Profile → Data & privacy for an account export, saved-context controls and archives, or the account deletion control under Account. The self-service export contains supported structured records, not every support, safety, purchase or historical measurement record, provider log, or the photo files themselves. Contact us for a complete access request, photo copies or a review of shared information that concerns you.

We may need proportionate identity verification. Under the GDPR we normally respond within one month; if a lawful extension is needed, we explain it within that month. You may complain to a supervisory authority, including in your EU country of residence, work or the alleged infringement, or to the Swiss Federal Data Protection and Information Commissioner. You do not have to contact us first.

Use the privacy contact in section 1 for these requests. You can also use the Swiss commissioner’s website or find an EU supervisory authority. Privacy rights, withdrawal of consent and account deletion do not require acceptance of updated Terms.

9. Adults and changes to this notice

Seluno is intended for adults aged 18 and over. If you believe a child has submitted personal data, contact us. If we materially change a purpose, provider or consent-based use, we will update this notice and obtain a new choice where required. The version date above identifies this notice. Reading or acknowledging a new notice does not automatically renew AI consent or enable saved memory.