Privacy Policy

1. Introduction

LoveFlix ("we," "our," "us") is a private streaming service designed for couples. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (loveflix.us) and use our service.

By using LoveFlix, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please discontinue use of our service immediately.

2. Information We Collect

2.1 Information You Provide

When you create an account, build a LoveFlix site, or contact us, we collect:

• Account information — your name, email address, and password (stored as a salted hash).
• Profile information — names, photos, avatars, anniversary dates, and any other details you add to your LoveFlix site.
• Content you upload — videos, photos, voice notes, music files, and text you upload to your private site.
• Partner information — the name, email, and profile details of your partner, as provided by you. You represent that you have their consent to share this data with us.
• Communications — any messages, support tickets, or feedback you send us.

2.2 Information Collected Automatically

When you visit LoveFlix, we automatically collect:

• Usage data — pages viewed, time spent, features used, content played, and interactions with the interface.
• Device information — browser type, operating system, device type, screen resolution, and language preference.
• Log data — IP address, date and time stamps, referring/exit pages, and clickstream data.
• Location data — approximate geolocation derived from your IP address. If you use LoveConnect, precise location data is collected with explicit consent for real-time map features.

2.3 Cookies & Tracking Technologies

We use cookies and similar tracking technologies to improve your experience, analyze usage, and process payments. Specifically:

You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of LoveFlix.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and maintain the service — operate your private LoveFlix site, serve your uploaded content, manage user profiles, and deliver the LoveConnect feature.
• To process payments — handle subscriptions, billing, and account management via Stripe.
• To improve our service — analyze usage patterns with PostHog to refine features, fix bugs, and optimize performance.
• To communicate with you — send service-related emails (password resets, billing notifications, feature updates) and respond to support requests.
• To ensure security — detect and prevent abuse, unauthorized access, or violations of our Terms of Service.
• To comply with legal obligations — respond to lawful requests from regulators, courts, or law enforcement.

4. Third-Party Services

LoveFlix integrates with the following third-party services to operate effectively. Each service processes your data under its own privacy policy:

• Stripe (payment processing) — collects billing information, payment method details, and transaction data. Stripe Privacy Policy
• PostHog (product analytics) — collects anonymized usage data, session recordings, and feature interaction events. PostHog Privacy Policy
• Supabase (database & authentication) — stores account credentials, user profiles, content metadata, and application data. Supabase acts as our data processor. Supabase Privacy Policy
• Cloudflare (CDN & DNS) — caches static assets, routes traffic, and provides DDoS protection. Cloudflare Privacy Policy
• Google Fonts (typography) — serves web fonts. When you load a page, your browser requests fonts from Google's servers, which may log your IP address. Google Privacy Policy

We do not sell your personal information to any third party. We do not share your uploaded content (videos, photos, voice notes) with any third party except to the extent necessary to store and deliver that content (e.g., Supabase for database storage).

5. Data Storage & Retention

5.1 Where Your Data Is Stored

Your data is stored on servers located in the United States and the European Union (depending on your region). We use industry-standard physical and technical safeguards to protect your data:

• Encryption at rest (AES-256) and in transit (TLS 1.3).
• Access controls — only authorized personnel with a legitimate business need can access production data.
• Regular security audits and penetration testing.

5.2 Retention Periods

We retain your data only as long as necessary for the purposes described in this policy:

• Account data & uploaded content — retained for the duration of your active subscription. Upon cancellation, your data is retained for 30 days (grace period to reactivate or export), after which it is permanently deleted within 90 days.
• Usage analytics (PostHog) — retained in aggregate form for up to 24 months. Individual session recordings are retained for 90 days.
• Payment records (Stripe) — retained for as long as required by applicable tax and financial regulations (typically 7 years). Stripe is our payment processor and stores this data on their infrastructure.
• Communication records — support ticket data retained for 3 years after resolution.

When you delete your account or request deletion, we will securely erase or anonymize your personal data, except where retention is required by law.

6. Your Rights (GDPR & CCPA)

6.1 Your Rights Under GDPR (European Economic Area Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):

• Right to access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure ("Right to be forgotten") — request deletion of your personal data, subject to legal retention requirements.
• Right to restrict processing — request that we limit how we use your data.
• Right to data portability — request your data in a structured, machine-readable format (JSON).
• Right to object — object to our processing of your data for analytics or marketing purposes.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, contact us at privacy@loveflix.us. We will respond within 30 days as required by law. You also have the right to lodge a complaint with your local data protection authority.

6.2 Your Rights Under CCPA (California Residents)

If you are a resident of California, the California Consumer Privacy Act (CCPA) grants you the following rights:

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete — request deletion of personal information we have collected, subject to certain exceptions.
• Right to opt out of sale — LoveFlix does not sell your personal information. We have no knowledge of selling personal information of minors under 16.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights.

To exercise your CCPA rights, contact us at privacy@loveflix.us. We will verify your identity before fulfilling your request.

7. Children's Privacy

LoveFlix is not intended for or directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe that a child has provided us with personal data without parental consent, please contact us immediately at privacy@loveflix.us and we will take steps to delete such information promptly.

By using LoveFlix, you confirm that you are at least 18 years old or have obtained parental/guardian consent to use the service.

8. Data Security

We implement a variety of security measures to protect your personal information:

• All data transmitted between your browser and our servers is encrypted using TLS 1.3 (HTTPS).
• Passwords are hashed using bcrypt — we never store plain-text passwords.
• Uploaded content (videos, photos, voice notes) is stored in private, access-controlled storage buckets with server-side encryption.
• Access to production systems is restricted to essential personnel and logged for audit.
• We conduct regular vulnerability assessments and dependency audits.

While no method of transmission over the Internet is 100% secure, we strive to use commercially acceptable means to protect your data. Security is central to the LoveFlix experience — your private moments deserve nothing less.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own (including the United States). When we transfer data from the EEA or UK to other jurisdictions, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions where applicable.

Our sub-processors (Supabase, Cloudflare, Stripe) also maintain GDPR-compliant data processing agreements and Standard Contractual Clauses for international transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on this page with a revised "Last updated" date.
• Sending an email notification to the address associated with your account (for significant changes).

We encourage you to review this Privacy Policy periodically. Your continued use of LoveFlix after changes become effective constitutes your acceptance of the revised policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

• Email: privacy@loveflix.us
• Data Protection Officer: dpo@loveflix.us
• Support: support@loveflix.us