Privacy policy

Draft of 13 November 2026

Bonded is built for two people sharing private answers. This policy explains, in plain words, what we collect, why, and the choices you have.

The short version

• We collect what Bonded needs to work: your account, the couple you form, and what the two of you write and send each other in the app.
• Your answer stays locked until your partner has answered too. Only the two of you can read your answers and replies.
• No ads. We don't sell or rent your data, and we don't track you across other apps or websites.
• We count how the app and this website are used, without the content you write. You can switch the app's usage data off in Settings.
• You can delete your account in the app at any time. Your answers, replies and profile are then deleted.

Who is responsible

Bonded is run by [PO: legal name of the operator (person or company), postal address, and company register number if any] ("we", "us"). We are the controller of the personal data described here.

Questions about privacy or this policy: [email protected]. [PO: name a data protection contact if one is required for your set-up]

What the app collects, and why

Your account

To sign you in we use your email address (sign-in with a one-time code), or the identifier and email that Apple or Google share when you use Sign in with Apple or Google. If you use Apple's "Hide my email", we only see Apple's relay address. Why: to create and secure your account (needed to provide the service).

Your profile and your couple

The name you use in the app, your partner's name as you typed it, an optional photo, your time zone, the time of your daily reminder, and the details you give during setup: your relationship stage, what you would like more of together, the date you got together, key dates such as birthdays and anniversaries, and your answers to the setup questions. Why: to pick and time the daily question for the two of you and to show your shared space.

What you write and send

Your daily answers (text, and voice answers if you have Premium), replies and reactions in the conversation under each question, and the little moments you send (a hug, a kiss, good morning, goodnight, thinking of you). Why: this is the service itself.

Pairing

When you invite your partner, we create a code (for example BND·4827) and a private link that work for 48 hours. The code and the link's token are used only to connect your two accounts.

Notifications

A push token for each phone where you allow notifications, and your notification settings. Why: to tell you when your partner has answered, replied or sent something, and to remind you at the time you chose.

Purchases

Premium is bought and billed through the App Store or Google Play. We never see your card or bank details. Through our subscription service we receive the product you bought, its price and currency, trial and renewal status, and the store's transaction identifiers. Why: to unlock Premium for both of you and to handle renewals, refunds and cancellations.

Support

If you email us, we keep the email and our reply to help you. Why: to answer you.

Your answers and the reveal rule

Each day you both get the same question. Your answer stays locked: your partner can't read it until they have answered too, and then both answers open together. This rule is enforced by our database, not only by the app. Replies under a question open only once you have both answered.

Only you and your partner can read your answers, replies and little moments. Our team does not read them. Access to the database is limited to the people who run Bonded and is used only to keep the service working, to fix a problem you ask us to look at, or when the law requires it.

Your answers are never sent to our analytics or crash-report services, and are not used for advertising. [PO: if AI features (weekly insights) ship later, add a section here before they launch; they would need separate consent per person]

Usage analytics and crash reports in the app

Usage analytics (PostHog, EU). The app sends events such as "opened today's question", "answered", "opened the paywall", with fixed labels, numbers and dates, linked to a random account id. Events never contain what you write, names, email addresses, dates you entered, codes or links. We also receive your device type, operating system, app version, language and country. Your IP address is used only to work out the country and is then discarded. Why: to understand which parts of Bonded help couples and to fix what doesn't (our legitimate interest in improving the app). You can switch this off at any time in the app: Us → Privacy & data → Share usage data.

Session replay. [PO/SEC-23: masked replay is built in the app (D63, MOB-87) but switched off behind a feature flag; it stays off until the security review signs it off and the PO answers the consent question (SEC-23 A5: on by default with the switch, or ask first). Keep this paragraph only if it is switched on, and match the consent wording to that answer] To find confusing screens, the app may record how some screens are used, as a sequence of screenshots. In these recordings all text, everything you type and all images are hidden behind solid blocks, and screens that show answers, replies, voice, names, dates or invite codes are never recorded. No keyboard input, network traffic or logs are included. Recordings are made only while "Share usage data" is on, are kept for [PO: retention, e.g. 30 days] and are deleted with your account.

Crash reports (Sentry). When the app crashes or hits an error, it sends a technical report: what failed, device and system details, app version, and your random account id. No answers, messages or names. Why: to fix bugs (legitimate interest). Our Sentry project is hosted in Sentry's US region today, so these reports are transferred to the USA (see the table below). [PO: move Sentry to EU or keep the US transfer]

We do not collect your phone's advertising identifier, and nothing goes to advertising networks or data brokers.

This website

hellobonded.com uses PostHog (EU) to count visits without cookies and without storing anything on your device, so there is no cookie banner. We see which pages are visited, clicks on links and buttons (never what you type into a field), how far pages are scrolled, heatmaps of where people click and scroll, page speed, script errors, the site that sent you here, campaign tags (utm), browser and device type, and country. Web addresses are recorded without their query strings, except campaign tags. To count unique visitors per day, PostHog's servers compute a one-way hash that changes every day; your IP address is then discarded. There are no screen recordings on the website. Heatmaps are made on the website only; the app does not record heatmaps.

Invite links (hellobonded.com/j/…) load no analytics at all. The invite code is read by your own browser to show it on the page and to open the app; it is not sent to us or anyone else from that page.

The website is hosted by Cloudflare, which processes your IP address to deliver the pages and protect the site against attacks.

Service providers

We use these companies to run Bonded. They process data only on our instructions, under data processing terms.

We may also disclose data when the law requires it, or to protect someone's safety.

Where data is stored

Your account and everything you write are stored in the EU. Some providers above are based in the USA. Where data goes there, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses. [PO: confirm each provider's transfer basis from their DPA]

How long we keep data, and deleting it

• Delete your account in the app: Us → Delete account. Your profile, answers, replies, reactions, little moments, voice answers and photo are permanently deleted, and we ask PostHog to delete your analytics data. Your partner keeps their own answers; yours disappear from your shared history.
• Unpair (Us → Couple settings → Unpair): you can both still read your shared history for 30 days, then it is deleted.
• Deleting the app does not delete your account. If you can't open the app, email [email protected] from your account's email address and we will delete it for you.
• Backups are overwritten within [PO: backup retention of the Supabase plan, e.g. 7 days].
• Crash reports are kept for [PO: e.g. 90 days]; usage analytics for [PO: e.g. 7 years on the free plan; consider shorter].
• Purchase records are kept by Apple, Google and RevenueCat for as long as tax and accounting law requires.
• Support emails are kept for [PO: e.g. 2 years].

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to receive it in a portable format, to restrict how we use it, and you can object to uses based on our legitimate interests (such as analytics). Email [email protected]; we answer within one month. You can also complain to your data protection authority [PO: name the lead authority for your location].

Age

Bonded is for adults. You must be at least [PO: 18? confirm the minimum age and the store age rating] to use it. If we learn that a child has an account, we delete it.

Security

Data is encrypted in transit and at rest by our providers. Database rules decide who can read each row, so one couple can never read another couple's data, and a locked answer can't be read before the reveal. Our keys stay on our servers and never ship inside the app.

Changes and contact

If we change this policy in a way that matters, we will tell you in the app before the change applies. Questions: [email protected]. For anything else: [email protected].