I See You Best
I See You Best Privacy Policy
Effective: [EFFECTIVE DATE]. Published by [COMPANY]. Contact: [CONTACT EMAIL].
I See You Best is a private space for two people in a relationship. This policy says what we collect, what we do with it, and what we will never do. It is written to match how the app actually works.
The short version
- We sell a subscription. We do not sell ads, we do not sell your data, and the app contains no advertising or third-party analytics trackers.
- We never access your location. When date ideas need geography, you type a ZIP code yourself.
- Your private writing is private from everyone, including your partner. Some things you write are shared with your partner only when you both choose to reveal them. That boundary is enforced by our servers.
- You can export your data and delete your account at any time, by yourself, from the app.
What we collect
Account. When you sign in with Apple or with Google we receive a stable account identifier from that provider and your email address (from Apple, which may be a private relay address if you chose to hide yours; from Google, only when Google has verified it). We ask Apple for no name; the name shown to your partner is one you type yourself. We do not receive your password. You can add the other provider as a second way into the same account from Settings; we keep the provider's identifier for as long as your account exists and never match accounts by email address. We require your date of birth once, to verify you are 18 or older; we store it to keep your account eligible and, if you use them, for birthday features. By default your partner is shown the month and day of your birthday (as the next date it falls on) and, when a round birthday is coming, the age you turn; never your birth year otherwise. A switch in Settings keeps your birthday private, and then nothing about it reaches your partner. Dates you two mark together (a first date, the day you moved in, your anniversary) are shared content that both of you can view and remove.
Your relationship content. The app exists to hold what you and your partner create: daily answers, private journal entries, conversations with Ivy (the app's AI guide), appreciation notes, game responses, answers to the get-to-know-you questions, date plans and post-date captures (a line and an optional photo), and, if you both open that space, intimacy deck answers. Private-scope content (journals, your Ivy chats, unrevealed answers, your intimacy answers) is encrypted at rest with keys separate from the database, and our systems enforce that your partner can never access it. Shared content becomes visible to your partner only through the app's reveal rules. Get-to-know-you answers are shared with your partner as soon as you give them; they leave with you if you unpair or delete your account.
What Ivy remembers. Ivy works from the couple's shared memory: revealed answers, delivered appreciations, game results, date memories, milestones and get-to-know-you answers, plus a short summary our servers write from them each week. Your private conversations with Ivy stay in your own scope; your partner's Ivy never receives them.
Self-stated place. If you use Date Night, you may type a ZIP code (or city) and a search radius. That is all the location data we have. We never read GPS, Wi-Fi, or anything from your device's location services.
Subscription status. Whether your household has an active subscription, which product, and when it renews. Payment itself is handled by Apple or by Google Play; we never receive your card.
Operational records. Sign-in sessions and one-time sign-in challenges, pairing invites, notification delivery records, safety-signal flags (a category and timestamp, never the text of what you wrote), AI usage metering (token counts and costs, not content), and error reports (the kind of error and where in our code it happened, never content). These keep the service working, safe, and honest.
What we do NOT collect
No advertising identifiers. No third-party analytics or attribution SDKs. No contact-list access. No photo-library scanning (when you attach a photo, Apple's system picker hands us only the single photo you chose). No device location, ever. Our website (iseeyou.best) sets no cookies and loads nothing from third parties.
How the AI features work
Ivy's replies and Date Night ideas are generated by a large language model operated by Anthropic. To generate a reply, our servers send the relevant conversation and shared-couple context to Anthropic for processing. We send only what the feature needs, our systems prevent your private content from appearing in your partner's AI context, and your intimacy answers are never included in any AI request. AI usage is metered with strict budgets.
Anthropic processes this data to provide the service under its commercial terms. Anthropic does not use this content to train its models. Anthropic does not retain conversation content by default; limited operational logs may be kept for a short period, and content flagged by Anthropic's automated safety systems can be retained by Anthropic for up to two years. We do not allow our AI providers to use your content for advertising.
When Date Night attaches real venues, our server queries Google's Places service with a generic category and a search AREA derived from your self-stated ZIP or city (a bounding box around that ZIP's center), and nothing else: no name, no account identifier, no device information, and never a reading from your device's location sensors. The area comes from what you typed, not from where your phone is.
Sharing
We share data only with the processors that run the service:
- Apple (sign in and payments).
- Google (sign in, if you choose to sign in with Google: Google's sign-in page runs in your phone's browser and Google learns that you signed in to this app, as with any Google sign-in; we receive the identifier and a verified email address, nothing about your use of the app).
- RevenueCat (subscription management; receives your purchase state and an account identifier, never content).
- Anthropic (AI processing as described above).
- Google (venue search as described above).
- Google, through Firebase Cloud Messaging (on Android only, delivering push notifications to your phone: a device token and the notice's short text, the same category-and-line content as on iPhone, never private content). Google's messaging client runs inside the Android app to receive them and registers an identifier for the installation with Google; no Firebase analytics or crash reporting is included.
- Google Play (on Android, the subscription purchase, handled by Google; we never receive your card).
- Expo (push notification delivery, and delivery of updated app code when the app starts; the update check carries the app version, the platform, which update the app already holds and a random installation identifier, never your account).
- Render (hosting; our servers and database run in the United States).
- Sentry (error monitoring; receives the error reports described above, which carry no content and no account identifier).
We do not sell or rent personal information, and we do not share it for cross-context advertising. We may disclose information if the law genuinely requires it; where permitted, we will tell you first.
Your partner, and what stays yours
I See You Best has a strict two-layer design. Shared things (revealed answers, matched game results, delivered appreciations, get-to-know-you answers, date memories, mutual intimacy matches) belong to the couple's space. Private things (your journal, your Ivy conversations, your unrevealed answers, your non-mutual intimacy answers) are yours alone: no screen, no export, no AI request, and no notification ever carries them to your partner. If you unpair or delete your account, your private content goes with you.
Retention and deletion
Relationship content is kept while your account is active, so the app can be your shared memory. Operational records expire automatically:
| Record | Kept for |
|---|---|
| One-time sign-in challenges | 1 day after expiry |
| Apple's sign-in revocation notice ids (a replay guard, no personal data) | 7 days |
| Per-day venue search counters (counts only, no personal data) | 90 days |
| Pairing invites and attempts | 30 days |
| Sign-in session records | 30 days after expiry |
| Notification delivery records | 90 days |
| Daily nudge records | 30 days |
| AI usage metering (counts, never content) | 400 days |
| In-flight AI budget bookkeeping (ids and counts, never content) | 2 days |
| Product analytics (event counts, never message text) | 400 days |
| Error reports (error type and code location, never content) | up to 90 days, at the monitoring service |
| Dissolved-couple shared data (after unpair) | 30 days, then deleted |
| Safety-signal flags and their review records (category only, never content) | 2 years |
Unpairing works without your partner's participation and closes the shared space for both of you right away: neither person keeps a visible former-couple archive. You choose whether your contributions are removed immediately or expire with the shared record after a 30-day grace period, after which the couple's shared data is deleted for good.
Deleting your account is available in the app, works without your partner's participation, and removes your content and your encryption keys from our live systems immediately. Deleting your account also revokes the Sign in with Apple authorization at Apple, so the app no longer appears under your Apple ID, and asks our subscription processor, RevenueCat, to delete the subscriber record it keeps under your account id. A record of each AI request (provider, model, token counts, cost and time, with no account reference and no text) is kept for up to 400 days for cost accounting. Copies in our routine encrypted database backups expire within 7 days, after which deleted content is gone from backups as well.
Security
Private content is encrypted at rest with per-person keys (AES-256-GCM) held separately from the database; all traffic is encrypted in transit; sessions use rotating tokens stored in your device's Keychain; and access inside the service is restricted by the same partner-privacy boundary described above. No system is perfectly secure, and we do not claim to be unable to read content required to operate the service (AI features require our servers to process your messages).
Age
I See You Best is for adults. You must be 18 or older; we verify date of birth at sign-up and close underage accounts.
Your rights
Depending on where you live (including California and the EU/EEA), you may have rights to access, correct, delete, or receive a copy of your personal information, and to complain to a regulator. The app's built-in export (Settings, then Export my data) and deletion cover most of this directly; for anything else, contact [CONTACT EMAIL] and we will respond within the legally required time. The export file lists your date photos but does not contain them; open a date in the app to view or save its photo.
Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect. We will never weaken the "short version" promises above without asking for your consent. The current version always lives at https://iseeyou.best/privacy.