Fondlore Privacy Policy

Revision: 2026-10-27-fondlore

Operator and privacy/grievance contact: Abhishek Mishra, Delhi 110092, India. Email: support@lovediary.in.

The previous Privacy Policy remains available at its original revision. The service is now called Fondlore; its previous name was Apna Safar. This brand-name update does not change the operator, domain, support email, subscription ownership, prices or data-handling commitments.

Version date: 27 October 2026. This policy explains the data practices of the redesigned service and the shared Pro Pass/personal-storage offer when available to your account. Publishing it does not activate an unreleased feature or claim that an existing account has accepted a new agreement. Earlier app versions and earlier recorded acknowledgments remain associated with their linked policies, including the previous personal-storage policy. Material storage and access changes retain the notice protections explained in the Terms.

The previous Pro Pass trial Privacy Policy remains available.

The previous Letters Privacy Policy remains available.

The previous notification-service Privacy Policy remains available.

The previous current-service and Pro Pass Privacy Policy remains available.

The previous experiences Privacy Policy also remains available.

The 19 October India pilot Privacy Policy is also preserved for reference.

1. Scope

This policy describes how Abhishek Mishra handles information when you use available Fondlore features, private journals that you may share with one invited partner, private activities and keepsakes, and a separate moderated Community for signed-in users, and when you visit the Fondlore legal website at https://lovediary.in/. The app's journal content is private to its members within the service, but it is stored in the cloud and is not end-to-end encrypted. A person you invite can see and keep copies of content made available to them. Private drafts, sealed letters and unrevealed activity answers have separate access restrictions and do not become shared merely because a partner joins.

2. Information Fondlore handles

Account and profile. You sign in using Apple or Google through Clerk. We receive an authenticated account identity and, when available, its email address, including an Apple private-relay address if you choose Hide My Email. Personal setup collects your display name and date of birth; gender, manually entered city, bio and profile photo are optional. Date of birth is used for the stated minimum-age check against the calendar date in India; this is a self-declaration, not identity-document verification. Your connected, unblocked current partner can see your personal profile, including full birthday, birth year/age and the optional fields you provide. They can also see your server-verified primary account email when it is available. If you use Apple Hide My Email, this may be your Apple private-relay address. This email is not your public Community identity. Other Community users and former partners do not receive access to your current private profile through that connection. Avoid putting information in a shared profile that you do not want your connected partner to see.

Clerk handles authentication and stores supported name, photo, bio and onboarding metadata. Fondlore also stores account-linked profile information in Convex. Date of birth, optional gender and city are not copied to Clerk profile metadata by the app. Existing legacy pronoun information is not interpreted as gender. Your relationship status is a shared journal detail rather than a separate required field for each partner. Shared relationship records include the together-since date, where and how your story began, dated status entries, future status dates and revision history used to update relationship keepsakes and reminders. A status edit alone does not end or change the partner connection. These private fields are not automatically used as your Community identity.

Journal content. We store the journals you create or join, their titles, dates and cover photos; account-specific theme preferences; the text, dates, times, optional manually entered locations and photos in memories; milestones and reminder settings; and records of who created content, invitations, membership, and account or content deletion. Images you choose for upload are prepared on your device, uploaded to Convex storage, and processed into smaller preview images. We do not access your entire photo library merely because you use Fondlore; you choose images through the picker. We have not verified that all embedded photo metadata is removed, so avoid uploading a photo whose metadata you do not wish to share.

Private activities, letters and books. We store each author's independently attributed Two Sides contribution; question and game sessions, answers, choices and predictions; challenge confirmations; shared streaks and badges; bucket items and completion dates; and references connecting an activity to its saved memory. We store letter titles, words, optional photos, original sender/recipient, chosen visibility, unlock time, revisions, delivery/opening state. Server-side authorization protects sealed letter content and unrevealed answers; this is an access control, not end-to-end encryption. Recaps and the digital book combine eligible saved content with dates, deduplication references, book title/cover preferences and each member's exclusions. Drafts, unopened letters and unrevealed answers are excluded. PDF books are generated on your device and are not uploaded as new cloud copies by that export operation.

Community and moderation. Community has a separate posting profile containing a nickname, public name, guidelines acceptance and posting restriction state. Each post or answer includes its author, selected posting identity and displayed label, text, category, moderation status, revisions and operation identifiers. We store reactions, poll options, aggregate counts, account-associated votes, Community blocks and reports, operator decisions and audit records. Other users see Anonymous or your chosen posting label, not the internal account linkage or individual voters' identities. The operator can identify the authenticated author, including for anonymous submissions. Public response objects do not expose a stable anonymous author identifier that links an account's anonymous and named posts. Identifying facts in your own words may still reveal who you are. Journal content cannot be published to Community from the journal. Community posts are authored separately; the app does not prefill them with private memories or perspectives. The same account can use Community without a journal or partner.

Pro Pass, personal storage and usage. We create a stable opaque billing identifier linked to your Fondlore account and use RevenueCat with Apple or Google Play to verify independent Pro Pass and personal-storage subscriptions. Records identify the product family, product/store and transaction identifiers, purchased capacity or feature access, production/sandbox environment, purchase/expiry/grace and renewal dates, scheduled changes, verification times, checkout retry identifiers and deduplicated provider events. Current journal membership is used to determine whether your own or current partner's verified Pass covers your account. A partner may see that shared Pro access is available and its source, but not your private receipts, transaction identifiers or payment details. A personal-storage purchase does not grant partner capacity or premium feature access.

We record an explicit current-service agreement and acknowledgment of this exact versioned policy for Free and paid users, including people without a partner or journal. It is separate from the historical age and personal-storage records and does not itself grant a paid feature, purchase storage or shorten notice protections. We also store a separate Pro release and account-enrollment record linking the published Terms revision and exact Terms/Privacy URLs, the account’s explicit Agree and continue acceptance time, new notice delivery/display evidence and enforcement eligibility. Earlier personal-storage acceptance and notice records are separate and do not establish the new agreement or advance-notice period. We store account-level daily and monthly memory-creation counters, monthly Community-submission counters, quota periods in India time and reservation or retry records used to prevent duplicate usage. Counters use actual server creation time, independently of dates chosen for a memory. These usage records enforce Free or Pro limits and do not reset on journal or subscription changes. We also retain your owned-photo and reserved-upload byte totals across current, Past and retained journals, selected photos to keep, and any storage-over-limit deadline, notices and cleanup progress. Pro Pass expiry alone cannot create a photo-cleanup deadline. We do not receive your full card number or bank credentials; the purchasing store handles payment details. RevenueCat and the stores may process app, device and transaction information under their own policies. This integration is not used for advertising tracking across other companies' apps.

Pro Pass trial information. Store verification can include whether the current billing period is a free trial, its exact end/first-payment time, offer eligibility information, renewal intent, offer/product identifiers and source revision. These account-linked billing fields let Fondlore show the correct trial status, verify access and avoid duplicate offers or stale first-charge reminders. A current partner receives shared feature coverage, not the purchaser's trial dates, payment details or receipts. Apple or Google handles payment-method confirmation and any temporary verification hold; Fondlore does not receive card details, bank credentials or UPI PINs.

On-device data. Fondlore stores a copy of journal data, preferences, pending invitation codes, and edits waiting to sync in app storage on your device. It caches viewed photos for faster access. Unsent letter words, date/time, visibility and retry identity are saved in account-scoped app storage so an unfinished letter can survive reopening; selected photos are not included in that text autosave. The app does not restore another account's unfinished letter. Restoring an unfinished letter or joining a journal never sends or reveals it automatically. An unfinished letter from another journal or an older edited revision requires an explicit restoration choice. After authentication, the same welcome screen asks an account that has not accepted this revision to review the linked documents and choose Agree and continue. A temporary acknowledgment receipt records that explicit action and is tied to the authenticated account and current session, so the app can finish saving that agreement after an interruption. Authentication alone does not create this current-service receipt. Valid receipts from older app versions remain tied to their original historical documents; they are not converted into acknowledgment of this revision. It contains the agreement version, current session identifier, explicit action time and authenticated account identifier; it is not an authentication token. It is valid for up to 24 hours, is not used for another account or session, and is cleared after the agreement is confirmed. The app also attempts to clear it after confirmed sign-out or account deletion; expired or invalid current-session receipts are deleted when read. A random app-installation identifier and request-ordering number are also saved for notification registration. They remain across sign-out so registration can follow the current account on a shared device and older requests can be rejected. On the web, downloaded image copies are held in an in-memory browser cache during the session; a browser download may save selected photos or a ZIP to your device. Other device and browser storage behavior can depend on your operating system.

App lock. Optional App lock uses your phone’s supported Face ID, fingerprint or device passcode to unlock Fondlore when it opens or returns from the background. Your phone performs the authentication; Fondlore receives the result, not your biometric data or device passcode. The on/off choice is stored securely on this installation and is not synchronized to your partner. App lock does not add end-to-end encryption to cloud journals.

Home Screen widget. Fondlore prepares a small on-device snapshot for its optional Home Screen widget: the current journal’s title, partner names, relationship start date and status, and beginning place. This is stored in local widget storage, including a shared app container on iOS, to display selected relationship details outside the app. The snapshot contains no email addresses, sign-in tokens, memory words, private photographs, birthdays, sealed letters or game answers. No separate remote widget service is used.

Permissions and notifications. Photo selection and saving to the device use the relevant system photo permissions. Push delivery requires permission on each phone. Notification choices are saved for your account and synchronized across registered devices; OS permission itself stays device-specific. All push notifications, category switches, editable daily/weekly reminder times and quiet hours are separate from essential email. Categories include partner memory and journal changes, relationship updates, birthdays, Milestones and Our beginning, letters, partner answers and games, bucket lists, daily/weekly reminders, On This Day, monthly recaps, Community responses and moderation decisions, and account/storage alerts. Moderators can separately control their workspace alerts. Disabling Memories does not disable another category. Birthday and anniversary reminders use server-side India-time schedules, normally 9 AM, rather than relying on an open app or a local-only reminder. Activity reminders default to 8 PM India time, with editable daily and weekly times, and skip answered or ineligible activities and journals without a partner. Letters unlock at their authorized server deadline independently of push arrival. Quiet hours can defer eligible push messages and invalid or obsolete alerts are suppressed. Notification content is generic and does not include memory text, journal titles, personal names, private answers or photos; internal routing references open only content the signed-in recipient can currently access. Verified HTTPS app links identify a destination and do not grant account access. Before server reminders take over on an installation, the app cancels obsolete local reminders to avoid duplicates. The app does not request camera, microphone or GPS permission through its current configuration.

Push delivery information. We store Expo tokens, installation identifiers, platform, registration-ordering numbers, active/refresh state and compatibility information needed to target registered devices. We store account-level notification preferences and their revision/migration state separately, so a denied OS permission or stale device request cannot change the account preference. Persistent notification events, source revisions, category and routing references, send attempts, provider tickets/receipts and operational failure metadata support retry, grouping, duplicate prevention and checks that the underlying content remains accessible. We also keep calendar/reminder reconciliation and delivery records, moderation-alert batch counts and storage-threshold state to avoid repetitive alerts. These records do not contain private memory text, game answers, sealed-letter words or uploaded images. Events can be suppressed after deletion, editing, separation, blocking or loss of permission. A provider ticket or accepted push does not prove that a person read the alert.

Support. In Settings → Report a problem, you may enter a reply address, subject and message. Fondlore saves them with your account/display name and forwards the request through Resend to our support@lovediary.in mailbox hosted with Hostinger, using the supplied reply address only as the internal request's Reply-To. An automatic acknowledgment goes only to your server-verified Clerk primary email address, not an arbitrary form address. A saved/queued status is not proof of inbox delivery. You can email support directly; avoid passwords, one-time codes and unnecessary private journal content. Essential app-owned emails use Fondlore <support@lovediary.in> with support Reply-To, escaped HTML and plain text, and approved app links. They include support acknowledgments, account-deletion request/completion, verified subscription activation/change/cancellation/expiry/refund or billing-issue notices, material legal/service notices, owner storage warnings and necessary operator alerts. They are independent of push settings and have no email opt-out; we do not send marketing, digests or engagement campaigns. Authentication mail and store receipts remain with the respective providers, and the app does not duplicate routine renewal receipts. Automated messages contain no private journal or sealed content. Delivery, bounce, complaint and failure events support retry and suppression. We do not use open or click tracking for these messages. Validated open/click events are discarded before local storage or callback queueing.

An essential trial first-charge reminder is scheduled three days before a verified Pro Pass trial is due to renew, only while verified renewal intent remains active. Its minimal account, subscription source and deadline references support deduplication, cancellation, delivery and suppression checks. Superseding cancellation, trial-end changes or deletion invalidate queued reminders. This is service email, not marketing or a replacement for the store's charge and cancellation terms.

Safety and agreements. We store the version and time of your accepted terms, Privacy Policy acknowledgment, and confirmation that you are at least 18. The original age acknowledgment and earlier personal-storage acceptance remain separate from this current-service agreement. This revision requires its own explicit Agree and continue action with this exact Terms revision and its linked Privacy Policy; website publication, an earlier sign-in or Continue action, profile creation and a purchase do not record that acceptance. The age statement does not verify your age or location or collect a separate residency declaration. Earlier agreement records are not relabelled as acceptance of a newer revision, and repeating acceptance of the same version does not change its recorded time. For existing accounts, we also record the applicable rollout, new email delivery confirmation, when the new in-app change notice was displayed and the resulting protected transition date. Earlier personal-storage notice records cannot supply the new Pro notice period. A new sign-in, journal change or subscription does not reset or waive that protection. If you report a memory or partner, we store your account identifier, the journal and optional memory identifier, the reported account when available, the category, your description, a retry identifier, and the review status and operator decision. A memory report hides that memory from your app view. Blocks store the two account identifiers and the partner’s display name so you can manage them. Reports and block lists are not shown to your partner; the operator can review them to address misuse.

Technical information. The app does not include an advertising SDK. RevenueCat processes the opaque account identifier, purchase history, store product, locale/currency and subscription events for purchase verification, restoration, fraud prevention and subscription/revenue analytics. We do not send journal text, photos, partner profiles or activity answers to RevenueCat for advertising or behavioral analytics. Apple or Google handles the payment details; Fondlore does not receive full card or bank credentials. Fondlore's backend can log a photo-processing error with an internal photo record identifier. For sign-in and account security, Clerk may retain session information such as your IP address, device and browser details, and approximate city or country derived from your IP address. This supports authentication, security and fraud prevention; Fondlore does not request GPS or device-location permission. Clerk, Convex, Resend, Apple, Google, app stores, email services, and website hosting may process technical information such as network or device data under their own operations. Their privacy notices describe their practices; we do not control every technical field they collect or how long they retain their own operational logs.

Legal website. The legal pages are hosted on Cloudflare Pages. The pages contain no analytics script, form, or app-set cookies. Cloudflare receives requests needed to deliver and protect the pages, including technical data such as IP address and browser information. Cloudflare's own logs and security-cookie practices depend on its service settings.

3. Why we use this information

We use account and sign-in information to identify you, maintain your account, and restrict journal access to authorized members. We use profile and journal information to display your journal, share it with your invited partner, sync edits, provide photo previews and downloads, calculate storage usage, schedule the account reminders you enable, deliver alerts according to account choices and each phone's OS permission, and carry out deletion choices. Push tokens and installation identifiers route alerts to the current account's device; delivery records support retries, error handling and duplicate prevention. We use verified subscription and transaction records to grant Pro Pass coverage and personal storage independently, restore purchases to the correct account, handle renewals/refunds, prevent duplicate purchases and fraud, calculate uploader-owned usage, enforce personal creation allowances and apply the disclosed storage-retention choices and deadlines. Current membership determines shared Pass access without merging storage, billing identities or usage counters. We use operational records to enforce upload limits, prevent duplicate operations, and complete or retry account deletion. We use activity and letter data to enforce hidden-answer and unlock rules, deliver agreed experiences, compute game-specific results and shared streaks, and assemble factual recaps and books. We use separate Community records to display moderated content, apply your selected identity, count reactions and anonymous poll aggregates, process reports and blocks, and prevent abuse. We use support messages to respond to your request, agreement records to apply the current terms, and reports and blocks to investigate complaints, restrict harmful content or accounts, and prevent unwanted sharing. We also use information when necessary to comply with law, respond to safety or security issues, and handle your requests.

We do not sell journal content, use it for targeted advertising, or use it to train generative AI models.

4. Who can see information and where it goes

Your invited partner can see the shared journal, its members' names and profile images, memories, photos, and meaningful dates. A signed-in person holding a valid invitation code can see a limited invitation preview, including the journal title and inviter's name. The invitation sender may see a recipient's email in the invitation status when that information is available. A partner can download photos; deleting a photo from Fondlore cannot remove a copy already saved outside the service.

Community submissions are visible to the operator while awaiting moderator review and to other signed-in users after publication. They are not restricted to your partner. Stories have reactions only; Questions can receive moderated standalone answers and polls. Community identity is separate from private names, photos and partner links. Anonymous posting does not prevent operator access or recognition from the content you supply. The operator may access a reported post or answer and related moderation records. No direct messaging or matching is offered.

Journal memories and Two Sides recollections remain private between journal members. The app provides no journal-to-Community publication or private-content preview. Legacy journal-linked snapshots are unavailable in Community. Voluntary Community posts are authored separately, and private edits do not change them. Other users may save or capture a Community post before its author deletes it.

Clerk processes sign-in and profile data. Apple or Google processes your chosen sign-in. Convex processes journal records, uploaded photos, previews, activity answers, letters and unlock jobs, book preferences and story indexes, Community content and moderation records, support messages, safety records, account-deletion jobs, push registrations and delivery records for the app. Resend processes the sender’s name, reply email, subject, message, and support reference to deliver support email. Our support mailbox, hosted with Hostinger, receives that email. Device operating systems handle photo access, saved downloads and scheduled local notifications. For remote memory, letter, activity, Community-response and storage-retention alerts, the Expo Push Service forwards notification routing information and the generic payload to Apple Push Notification service (APNs) or Google's Firebase Cloud Messaging (FCM). Memory-alert payloads include internal recipient, journal and memory identifiers and the change type. Storage notices contain the recipient identifier and whether the notice is for an owner or an affected partner; they do not reveal a partner's plan, receipts or private journal activity. Alerts use generic wording and internal routing references appropriate to the event, such as journal, memory, activity, letter or post identifiers; they do not include private memory/letter words, photos or unrevealed answers. Apple or Google Play processes purchases. RevenueCat receives the opaque app-user identifier and purchase-related information to validate subscriptions, provide account-wide purchase status and send server notifications. Convex stores the linked billing, personal-usage and retention records. Journal text, photos and partner receipts are not sent to RevenueCat by Fondlore for purchase verification. Cloudflare handles requests to the legal website. These providers and their subprocessors may process information in countries other than where you live, including India, the United States, and countries in Europe. Convex currently offers hosting in the United States and Ireland; this does not mean that you can choose a storage country in the app. Clerk may process data where it or its subprocessors operate. Cloudflare delivers the legal pages through its network. Privacy protections may differ between countries. Contact us for information about processing locations and any transfer safeguards applicable to your information.

Protection by third parties. We require third parties receiving personal data from Fondlore to provide the same or equal protection for that data as described in this policy and required by the App Store rules. For providers processing on our behalf, we rely on their applicable service terms and, where applicable, data-processing terms. Their published commitments and available controls support authorized use, confidentiality, appropriate security, downstream safeguards and handling privacy requests. We share only information needed for the roles described above and review provider commitments when choosing or changing an integration. Some providers also process information for their own account, payment, security or legal duties under their own notices; those roles do not authorize Fondlore to use or share your data for an undisclosed purpose. Provider commitments and safeguards reduce risk; they are not a guarantee that no security incident can occur.

We do not claim these services can read only anonymized data: journal content is not end-to-end encrypted. Access within the app is checked against your account and journal membership. Abhishek Mishra is the only Fondlore account administrator and will access journal content only when needed for a specific support request, safety review, security issue, or legal obligation. Provider personnel may have access under their own security and support procedures.

5. Retention and deletion

Text and journal records remain while the relevant journal and account remain in the service, unless deletion controls or applicable legal/safety rules apply. Photo retention also follows your personal storage allowance. After a verified subscription expiry or effective downgrade leaves your own uploads over the new allowance, cleanup remains held until the initial owner email is provider-confirmed delivered or the owner actually sees the authenticated in-app warning. The server observes the first valid proof and gives 60 full days from that time to renew, download, choose photos to retain or reduce usage. A queued or accepted email/push cannot start that clock. The initial email says at least 60 days; a confirmation states the exact protected deadline in India time, followed by advance reminders at 30, 7 and 1 day. An insufficient upgrade or another delivery channel does not restart the deadline. Verified sufficient capacity or reduced usage clears the cycle; later reminder failures do not erase an already established proof. Only your excess owned photos and their stored variants are then permanently deleted; partner-owned photos, text, journals, memberships and milestones are preserved. Explicit retention selections come first, followed by your current cover and newest uploads that fit. Existing over-limit accounts receive a full 60-day transition after advance-notified personal limits take effect. Removing a Past journal from your list does not itself delete your uploads retained for the partner or stop their storage accounting. Provider uncertainty defers destructive cleanup until verification. Downloaded exports outside the app remain on the device; disconnected app caches update after reconnection. A memory moved to Recently Deleted can normally be restored for 30 days; it is then scheduled for permanent deletion, and you can purge it earlier. Closing or ending a journal can permanently clear memories already in Recently Deleted as explained in its confirmation. Blocking a partner stops access and archives an active shared journal without itself deleting its content. Pending upload reservations expire after about one hour, and unused invitation codes expire after seven days.

You can request account deletion in the app. The deletion workflow removes your profile, your authored memory text and Two Sides contributions, private activity answers, authored letters, photos you uploaded, Community posts and answers, and other account contributions from active, archived, and Recently Deleted records, and then deletes the Clerk account. If the journal has a surviving partner, their own content remains in an archived journal. Some shared records may remain in changed form; for example, a milestone with a surviving photo may be renamed “Shared milestone,” and an otherwise retained memory record can have your text cleared and its author reassigned to the surviving partner. Completed deletion-job records are scheduled to be removed after about 24 hours. The remaining partner's independently authored words and photos are preserved; a text-only Two Sides recollection can remain as a container for their contribution. Received letters written by the other partner can remain only as that sender's private copy after recipient deletion. Account-scoped book exclusions and notification records are removed in bounded cleanup. If cleanup fails, the app shows a retry state.

The app also attempts to clear its account-scoped local letter drafts and other local data and downloaded-photo cache during account deletion. Photos you exported to a device's photo library or browser downloads remain outside Fondlore and are not removed by that request. Copies held by your partner are likewise outside your account-deletion controls. In-app support records remain until your account is deleted or the operator removes them after handling the request. Ordinary service-email outboxes, component recipient/content/event copies and operational failure records have a seven-day cleanup schedule. Account-deletion messages are stricter: terminal delivery, failure, suppression or cancellation removes the individual component recipient and body; trusted callback processing immediately removes the app outbox contact and account/job links. Before completion, a separate held outbox may retain the verified address only while still needed to confirm the finished workflow, with a maximum of seven days from the original request. It cannot send before completion, and releasing it never extends that expiry. Callback retries hold redacted operational fields, not the deletion recipient or message. Deletion cancels unrelated pending messages. Validated open/click tracking events are discarded before local storage or callback queueing; automated mail has no tracking pixels. Hashed deduplication keys without an owner, address or message remain for up to 400 days to avoid repeating a long-scheduled event after short-lived contact data is purged. A minimal normalized-address hash suppression fence remains to avoid sending repeatedly to a bounced or complained address. The email provider and mailbox have their own retention. We keep support and privacy-request emails in our mailbox for 12 months after the request is resolved, unless applicable law requires longer retention. Provider backups and operational logs may remain for longer under provider retention schedules; we cannot erase copies that providers must retain under law.

Safety reports are scheduled for deletion 365 days after submission, including unresolved reports. Account deletion removes reports you submitted and removes your account identifier from reports submitted by others; those reports may still contain information others included in their descriptions until their scheduled deletion. Blocks remain until you unblock or either account is deleted. Agreement records remain with your profile until account deletion. Provider backups and operational logs may retain earlier copies under provider schedules.

Push registrations are scheduled for cleanup after 90 days without a refresh. Push delivery records are scheduled for cleanup after seven days. Account deletion removes the account link, token, platform and preferences from its push registrations and deletes related delivery records. When a registration is retired after sign-out, account deletion, device replacement or an invalid-token response, a minimal record of the random installation identifier, request-ordering number, inactive status, update time and any obsolete-installation marker can remain to reject delayed old requests. This record has no account link, token, platform or preferences and is scheduled for cleanup after 90 days without an update. The app attempts to retire the registration when you sign out; an offline or interrupted sign-out may prevent immediate removal. Active registration tokens are also removed when the delivery provider reports DeviceNotRegistered. The random installation identifier and ordering number remain in local app storage until that storage is removed. Provider queues, backups and operational logs follow the providers' own retention practices.

Community posts and answers remain until the author deletes them, moderation removes them, account deletion removes the relevant contribution, or another applicable deletion rule applies. Deleting or removing a public post removes it from Community availability, together with the associated answer surface. Stories have no discussion threads. Reactions, votes and blocks are associated with the account and removed during account cleanup. Reports by others and anonymized operator audit history may remain where needed to investigate abuse or record a moderation decision; their descriptions may contain information supplied by the reporter. Community reports and audit history do not currently have a fixed automatic expiry. We retain evidence only while needed for a complaint, abuse investigation, appeal, security or legal obligation and review the need when a case is resolved or a deletion request is received. Account cleanup removes submitted reports and strips applicable actor links from audit history; descriptions or content references supplied by other people can remain. Ask the privacy contact about a record if you need its retention reviewed.

Letters are not a guaranteed permanent backup. Pending deliveries are cancelled when sharing ends or a journal is archived; the author may keep a private cancelled copy. A letter photo still consumes the uploader's allowance and follows the same storage deletion rules as their other uploads, even when the letter's words are fixed. Source deletion and lost access are reflected in live books and caches after synchronization. PDF exports, downloaded photos and screenshots held outside the app remain independent files and cannot be recalled.

Purchase and transaction records are retained while needed to provide and reconcile your subscription and prevent duplicate or fraudulent purchase reuse. On account deletion, personal billing state is removed or minimized; limited transaction ownership records may remain without journal content to prevent a purchase from being claimed by a different account. Store and RevenueCat records follow provider retention and applicable legal requirements. Deleting the app or Fondlore account does not itself cancel a store subscription. Contact support for billing-related privacy requests; mandatory retention may limit erasure of particular transaction records.

6. Your controls and requests

You can enable or disable App lock in Settings and add or remove the widget using your phone’s widget controls. Widget details may be visible to anyone who can see your Home Screen. When App lock is enabled or you sign out, Fondlore replaces its personal widget snapshot with a neutral design and requests a refresh; your phone controls when the displayed widget redraws. Journal changes normally refresh while the app is running or when you next open it.

In Settings → Your storage, you can inspect account-wide personal usage and your uploaded-photo inventory, including your own retained uploads in journals removed from Past, without regaining journal membership or access to partner content. You can select photos to keep, download originals or permanently delete your own uploads. Manage or cancel subscriptions through the purchasing store; Restore purchases checks ownership rather than transferring another account's plan. In the app, you can update your profile, edit or delete journal content, restore recently deleted memories during their 30-day window, clear downloaded-photo cache, download selected journal photos, report a memory or partner, block unwanted sharing, and request account deletion. In Settings → Notification preferences, All push notifications pauses account push alerts while keeping category choices. Detailed categories, daily/weekly times and quiet hours are saved to your account and applied to registered devices. OS notification permission is managed separately on each phone. Essential account, billing, legal and storage email remains separate from these push controls. A block prevents both accounts from viewing their shared journals and accepting each other’s invitations while either account still has a block. Unblocking does not reopen an archived journal. With effective Pro Pass coverage, the digital book can be exported as PDF volumes from the phone; it includes selected eligible story content, not a complete export of account, billing, settings or moderation records. Photo download is also not a complete account export. You may request a copy of your account and journal data by emailing support@lovediary.in; we will handle the request manually after verifying control of the account. You can change photo-library and notification permissions in device settings. If an offline edit has not synced, you may keep or discard it in Offline data settings.

Privacy requests and consent. You may ask for access, correction, a portable copy where available, deletion or review of retention. Withdraw optional permissions in device settings and stop submitting optional content at any time. Where processing relies on consent, contact the privacy contact to withdraw it; withdrawal does not make earlier lawful processing unlawful, and some account functions may no longer be available. A policy acknowledgment is not blanket consent to unrelated purposes. We do not ask you to provide a government ID by default; verification normally uses control of your registered account or email, with only the minimum additional information necessary for the request.

You can request account deletion without the app. Visit our Delete account page for the email request and verification steps. Uninstalling Fondlore does not delete its cloud data.

For access, correction, export, deletion, restriction, objection, or other requests beyond the in-app controls, contact support@lovediary.in. We will respond within 30 days of receiving your request, or sooner where applicable law requires. We may need to verify that you control the account before acting on a request. We will explain what we can provide or change, and any reason a request cannot be fulfilled. Depending on applicable law, you may have rights to a portable copy of your data, to restrict or object to processing, and to withdraw consent for processing that relies on consent. Withdrawal does not affect the lawfulness of earlier processing. Permission for photos or notifications can be withdrawn in device settings. Acknowledging this policy is not blanket consent to every use of information. You may also raise a complaint with the relevant privacy authority when applicable law provides that route. Mandatory local privacy rights continue to apply.

7. Security

The app requires sign-in for Community and journal access and checks journal membership before returning journal records or shared photo files. Letter media additionally checks the original author/recipient, letter association and server delivery state; knowing a photo ID alone does not make a sealed attachment available. Hidden answers stay outside partner responses, galleries, ordinary offline snapshots, books and exports until reveal. Community data is synchronized separately from private journal data. The separate owned-upload inventory and media endpoint check original uploader identity; this permits access only to that person's uploads, including retained photos, without exposing the removed journal or partner content. Photo requests use authorization and private cache controls; photo uploads require an authenticated reservation. These controls reduce unauthorized access but do not eliminate risk. Journal material is not end-to-end encrypted, and locally cached journal data should be protected using your device's security features. The app communicates with Clerk and Convex over HTTPS. Their infrastructure provides encryption for data in transit and at rest under their published security terms. No online service can guarantee complete security.

8. Children and geographic scope

Fondlore's initial release is intended only for adults aged 18 and older who reside in India and are legally able to use the service. The statement beside sign-in asks you to confirm the minimum age. A separate Agree and continue action accepts this current-service Terms revision and acknowledges its exact linked Privacy Policy; an earlier age acknowledgment does not accept this revision. There is no separate residency declaration. Age confirmation is a self-declaration, not identity-document age verification or verified location screening. If you believe a person under 18 has an account, contact us at support@lovediary.in so we can review and address it.

9. Grievances, incidents and contact

For a privacy or Community grievance, contact Abhishek Mishra at support@lovediary.in, Delhi 110092, India. Include a reply address, account or report reference if available and the request, without sending passwords or one-time codes. General privacy requests receive a response within 30 days or any shorter applicable legal deadline; Community grievances are acknowledged within 24 hours and addressed within seven days, subject to urgent statutory timelines. You may ask for reconsideration and use an applicable external appeal or regulator route. See the Terms' grievance section for Community complaints.

If we become aware of a personal-data breach, we will investigate, contain it and notify affected people and authorities where required by applicable law. Do not send a suspected exposed private image to multiple channels; report its reference and explain the issue so we can review access safely.

10. Changes to this policy

We will post an updated policy with a new effective date when our practices change and use email and an in-app notice for material changes. Acknowledgment of this current-service revision follows the separate Agree and continue action and exact versioned agreement pair described above, after any applicable notice. An earlier acknowledgment, sign-in or Continue action is not silently recorded as acknowledgment of this revision. Contact Abhishek Mishra at Delhi 110092, India or support@lovediary.in with privacy questions or requests.