Last updated October 18, 2026
Başak Ulcay, Stargarder Str. 18, 10437 Berlin, Germany, [email protected] ("we"). We have not appointed a data protection officer.
Everything you enter: people (by the name or nickname you choose), dates, ratings, answers to the date questions, notes, spending you log, photos (of people and from your dates), plans, check-ins, your Compass, your Date DNA quiz answers, your reflection journal (your answers to Today's thought and anything you write in it), your relationship profile answers, reminder settings, your pause setting and your Story. It is stored in the app's private storage on your device. We do not receive this data. Your PIN is kept in your phone's secure keychain (iOS Keychain). Face ID / Touch ID is handled entirely by iOS; the app only gets a yes or no.
Entries can reveal sensitive information about your private life, including sexual orientation or sex life. This is why we keep them local by default. Deleting the app, or "Delete all my data" in Settings, removes them.
Your reflection journal. Your answers to Today's thought and anything you write in the journal are kept on your phone, with the date, the question and a topic label that the app works out on your phone. Answering is always optional. You can delete single entries, or everything, in the app. They are used for AI reflections only as described in section 4.
Sharing your Intro card (optional). Your answers to the Intro card questions stay on your phone. From them the app works out a few soft traits (for example how much time together you like, planner or spontaneous, how you feel most cared for, what you are looking for). If you make a share card, you choose which of those traits and which first name or nickname go on it. Your answers themselves, your closeness style, phone habits, boundaries, intimacy, kids and exclusivity are never on a card. The card leaves your phone only when you share it: as a picture, or as a QR code or link that you send or show to someone. The link looks like datefolio.app/c#... and everything after the # sign stays in the browser: it is not sent to our server, and that page uses no cookies or analytics. Once someone has your card we cannot take it back from them. The profile is never sent to the AI. A card you open from someone else is shown on your screen and is not saved.
Pause. If you pause Datefolio, the end date is stored on your phone and the app stops reminders and nudges until then.
You can use the app without an account. If you create one, you sign in with your email address and a one-time code (no password). We process your email address, an account ID, the time of sign-in, and technical sign-in records (including IP address and device information) held by our authentication provider Supabase. The purpose is to run your account and to count your AI reflections per account. Legal basis: performance of the service you asked for (Art. 6(1)(b) GDPR) and, for security and abuse prevention, our legitimate interest (Art. 6(1)(f)). Sign-in emails are sent through our email delivery provider Resend, as our processor.
We keep this data until you delete your account. You can delete it yourself in the app (Settings → Delete account); this removes your email, account ID and usage counters from our server straight away. Your journal is not part of your account and stays on your phone; delete it with Settings → Delete all my data. You can also request deletion by email (see how to delete your account).
When you tap "Reflect" (for a person, a week, an archived person, "Your patterns" or "Your Story") and have given your consent, the app builds a short text summary on your phone and sends it over an encrypted connection to our server function, which is hosted with Supabase. The function forwards it to Anthropic, PBC (USA), which runs the Claude AI model, and returns the reply to you. The summary can contain:
Never sent: photos, your real name, contacts, birthdays, spending amounts, your location, audio, your PIN, your relationship profile answers or your Intro card.
What we keep. We do not store or log the text or the reply on our side. Anthropic is a separate company that processes the text on our behalf under its commercial terms and data processing agreement. According to Anthropic's current terms, inputs and outputs sent through its API are deleted within 30 days (exceptions apply, for example to enforce its usage policies or where the law requires), and are not used to train its models. These terms are Anthropic's and may change; see anthropic.com/legal/privacy.
Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), given in the app before the first use. You can withdraw it at any time in Settings → AI & support → AI reflections; no AI request is sent after that, and earlier processing is not affected. We ask for your consent again if the data we send changes. AI reflections are optional; the rest of the app works without them. Replies are generated automatically by an AI and can be wrong. You can report a reply in the app ("Report this response").
Your notes describe other people. The name you gave them is part of what is sent. We suggest you leave out phone numbers, home addresses and other details that could identify them.
| Data | Purpose | Kept |
|---|---|---|
| Random install ID (not linked to your name) and number of reflections used this week | Enforce the free weekly limit | up to 60 days |
| If you have an account: your account ID and the number of reflections used this week | Enforce the weekly limit per account | up to 60 days, or until you delete your account |
| Scrambled (HMAC-hashed) network address and a daily counter | Prevent abuse and protect against cost attacks | up to 7 days |
| Monthly total call count and estimated cost (no personal data) | Spending cap | indefinitely |
Legal basis: our legitimate interest in preventing abuse and controlling costs (Art. 6(1)(f) GDPR). You can object by emailing us.
We do not sell your data and do not use it for advertising or profiling. The app contains no ad, analytics or crash-reporting tools.
If you write to us, we process your email address and message to answer you (Art. 6(1)(b)/(f) GDPR) and keep it for as long as needed, normally up to 12 months after the conversation ends. If you join the Plus waitlist by email, we keep your address to notify you about Plus, until you ask us to delete it (consent, Art. 6(1)(a)). Please don't send journal content by email.
The app does not include crash-reporting or analytics tools and does not send them to us.
Local storage in the app sandbox, optional app lock (PIN / Face ID / Touch ID, with the PIN in secure keychain storage), encrypted connections (TLS) for AI requests and sign-in, passwordless sign-in (one-time email codes), the account session stored in the phone's secure keychain and excluded from device backups. No system is perfectly secure; if there is a personal-data breach affecting you, we will inform you and the authority as the law requires.
Under the GDPR you can request access, correction, deletion, restriction and portability, you can object to processing based on legitimate interests, and you can withdraw consent at any time. Because your journal isn't on our servers, access and deletion of journal data are done directly in the app (Export / Delete all my data). Your account can be deleted in the app (Settings → Delete account). For anything else we hold (account email, usage counters, support emails), write to [email protected]; we answer within one month. You may complain to a supervisory authority, for example the Berliner Beauftragte für Datenschutz und Informationsfreiheit, or the authority where you live.
The people you write about are not our users and we don't know who they are. If you believe someone has entered your data, write to us and we will help as far as we can; we cannot look up journals, because they are on people's phones.
The app is for people aged 18 and over.
If we change this policy in a material way (for example when Plus adds cloud sync, or when the data sent for AI reflections changes), we will tell you in the app and ask for your consent again where required.