Privacy Policy

Last updated: 26 October 2026

Heartpact is a private space for two people. You link phones with your partner, set each other exercise dares, share an album, and keep track of the things that matter to you both. A lot of what you put into Heartpact is personal, and some of it is very personal. This policy explains, in plain English, what we collect, why, who can see it, and how you stay in control.

The short version:

Camera frames from your workouts never leave your phone. We only receive the counts.
There are no ads in Heartpact, no advertising or analytics trackers in the app, and we never sell your data.
Your partner sees what you choose to share with them. Our staff see your account details and what kinds of things you do and when (for example, "did a squats dare" or "finished a game"), never your photos, answers, drawings, meals, health logs or location.
Location is shared only while you both have it switched on. We keep only the latest point, never a history, and it is wiped when you stop sharing.
You can download your data and delete your account at any time. Deletion is immediate and permanent.

1. Who we are

Heartpact is run by HeartPact, 651 N Broad Street, Middletown, Delaware 19709, USA ("we", "us"). We are the controller of the personal data described in this policy. If you have a question or want to use any of your rights, email us at [email protected].

This policy covers the Heartpact Android app, our website and the service behind them. You must be 18 or older to use Heartpact.

2. What we collect and why

We only collect what we need to make Heartpact work. The table shows each kind of data, what we use it for, and who can see it. "Us" means our staff through our admin tools (see section 5).

Data	Why we need it	Who can see it
Account details: email address, a password (stored only as a salted hash) or your Google account ID if you sign in with Google, display name, date of birth, gender (you can choose "prefer not to say"), the country you live in (chosen when you sign up, and changeable under Us), the language of your app, time zone, map colour, and your profile picture if you add one (the picture itself, at most 400 KB, stored with your account in our database).	To create your account, sign you in, keep it secure, check that you are 18 or over, send password reset codes, show times in your own time zone, write notifications and emails in your language, show photos, food tips and game versions from your part of the world, and set up features such as cycle tracking (choosing Woman turns it on).	You. Your partner: your name, profile picture and map colour, and your time zone, so that a dare they set for you rings at your local time. Us: your email, name, time zone, sign-in method, whether your email is verified, when you signed up and were last active, and your country (in totals by country, and in the live feed when you sign up). Never your date of birth or gender.
Your couple link: invite codes and links (stored only in hashed form, valid for 48 hours), when you linked and when the link ended.	To connect you with your partner, and to end the link cleanly if either of you unlinks.	You and your partner. Us: whether you are linked, to whom (by email and name), and when you linked or unlinked, including in the live feed (for example, "Maya & Theo linked up").
Dares: the exercise, target, time, time zone and grace period; for each attempt, its status and times, the number of reps or seconds counted, a confidence score, form faults, reps that were too fast, surprise check-ins passed and missed, reps counted while the phone was moving, seconds out of frame, a Google Play Integrity result, and any short note you add when asking to be let off.	To ring the alarm at the right time, decide whether a dare is done, and show you both the result, your streaks and your history.	You and your partner (your partner can also watch your count live while you exercise). Us: how many dares were set, completed or missed, on which days and for which exercise, including in the live feed with both your names (for example, "Maya did the dare · squats, set by Theo"); and, across everyone, the times, confidence and failed checks of dares, as totals.
Shared album: photos and videos you choose to sync, their thumbnails, captions, the date taken, file type and size; how many items are waiting to sync on your phone.	To keep your shared album, show it to both of you, apply storage limits, and remind you when photos are waiting.	You and your partner. Us: how many items you have shared, on which days, and how much space they use.
Daily questions, games and messages: your answers to daily couple questions, your moves, answers and drawings in games, scores (including your 0 to 100 score for each Heart to heart skill round), and any messages you send through Heartpact.	To run these features for the two of you.	You and your partner. Your partner sees your daily answer only once they have answered too, and your score for a Heart to heart round once they have played it too. Us: how many questions you have answered and on which days, which types of game you finished and when; and, across everyone, Heart to heart scores as numbers in charts. Never what you wrote or drew.
Food log: meals and snacks, calories, optional protein, carbs and fat, your daily targets and sharing setting; for each photo estimate, a record of when it ran, the photo's size and type, the AI model used, how much processing it took and how long, the result and whether it worked. The record is made as soon as the photo is sent, so the scan counts towards your daily limit however it ends. We do not keep the meal photo itself.	To keep your food log, estimate meals from photos, apply the daily scan limit, keep an eye on what estimates cost, and show your partner what you have chosen to share.	You. Your partner: depends on your setting: nothing, daily totals only (the default), or full detail. Us: how many meals and scans you have logged, and on which days.
Cycle tracking (health data): period start dates, average cycle and period length, and daily logs of flow, symptoms, mood, whether you had sex and used protection, and notes.	To show your cycle, predict upcoming dates, tell you when a period is late, and share what you choose with your partner.	You. Your partner: depends on your setting: nothing (the default), predictions only, or predictions plus your logs. Predictions include that your period is late, and by how many days. Shared logs show the date, flow, symptoms, mood and notes, only from the day you linked, and never whether you had sex or used protection. Us: only whether the feature is in use, never the details.
Pregnancy (health data): due date, appointments (title, time, place and notes) and kick counts.	To run pregnancy mode for you and, if you choose, your partner.	You. Your partner: only while the pregnancy is active, you share it (sharing is on unless you switch it off), and you are still linked with the partner you started it with. Us: only whether the feature is in use, never the details.
Location: your latest position, its accuracy and when your phone took it, whether you are sharing, when your phone last checked in, and when a pause ends.	To show you and your partner to each other on the map while you both share.	You. Your partner: your position only while you are both sharing; your sharing status (off, sharing or paused) at all times. Us: only how many people are sharing, never where anyone is.
Notifications and devices: your notification history (title and text), notification preferences and quiet hours, your phone's push token, platform and app version, and when it was last seen.	To deliver alarms and notifications to your phones, respect your preferences, and stop sending to phones that are no longer in use.	You. Us: your devices' platform, app version and when they were last seen. We never show push tokens in full.
Subscription: the Heartpact Plus product, its status (for example active, cancelled but paid up, in a grace period or on hold after a failed payment, paused or expired), expiry date, whether it auto-renews, and the Google Play purchase token; and any complimentary Plus we give your couple, with its reason and end date.	To check your purchase with Google, unlock Plus for you and your partner, and handle refunds or support requests.	You. Your partner: that your couple has Plus. Us: yes, to manage payments and support, including when Plus started or ended (also in the live feed). We never see your card or payment details; Google handles those.
Usage: when you were last active, which days you used the app, and when you did things in it (for example, when a dare was done or a meal logged).	To understand how Heartpact is used (for example, how many people were active this week, or how far new couples get), help with support, and keep it running well.	Us, as described in section 5.
Security signals: the IP address a request comes from.	To limit repeated failed sign-ins, sign-ups, password resets and invite code guesses.	Nobody. It is held briefly in our server's memory (an hour at most) and not written to our database.
Account deletions: that an account was deleted, when, and whether it was one of our test or team accounts. Nothing that says whose it was.	To count how many people leave.	Us, as a count and in the live feed ("An account was deleted").

Our legal bases

If you are in the UK or the European Economic Area, the law asks us to say why we are allowed to use your data:

To provide the service you signed up for (contract). Most of the table above: your account, couple link, dares, album, questions, games, food log, notifications and subscription.
Your explicit consent. Cycle and pregnancy data (see section 7) and location sharing (see section 8). You can withdraw your consent at any time by stopping the feature and deleting the data.
Our legitimate interests. Keeping Heartpact secure and fair (rate limits, the Play Integrity check on finished dares), understanding how Heartpact is used through the admin views in section 5, and handling support. We balance these against your rights and keep them to a minimum.
Legal obligations. For example, keeping records we are required to keep, or responding to lawful requests.

3. What stays on your phone

When a dare rings, your phone's camera counts your reps. The pose detection (Google's open-source MediaPipe) runs entirely on your phone, using a model built into the app. Camera frames are never stored and never uploaded, not to us and not to anyone else. When you finish, the app sends us only the numbers listed above: the count, the confidence score and the form and fairness checks.

Other things that stay on your phone:

Photos waiting to sync. Photos and videos you add to the album stay on your phone until you tap Sync. Nothing uploads by itself.
Motion readings. The app uses your phone's motion sensors during a dare to notice if the phone is moving. Only the number of reps counted while it moved is sent.
Practice scores. Your best scores when you practise Heart skills on your own are kept on your phone only. Only scores from a Heart to heart game with your partner are sent to us.
Your sign-in. Heartpact's app data, including your sign-in, is excluded from Android cloud backups and device transfers. On a new phone you simply sign in again.

The app asks for camera, notification, alarm, location and (for album uploads) foreground service permissions. You can change any of these in your phone's settings; the related feature will stop working until you allow it again. Heartpact does not ask for permission to read the location embedded in your photos.

On our website, a language you pick is remembered in your browser. The pictures on the home page are chosen from the time zone your device reports; that happens in your browser and nothing is sent to us.

4. What your partner can see

Heartpact is built for two, so your partner sees a lot of what you do in the app. In particular:

Your name, profile picture and map colour, and your time zone.
Dares set for either of you, and how each one went, including the counts and any "worth a look" flags (for example, a missed check-in or a lot of time out of frame). While you are doing a dare, your partner can watch your count go up live.
Everything in your shared album, with captions.
Your daily question answers, once they have answered the same question.
Your games, including your drawings and scores. In a Heart to heart duel, your score for each round shows once they have played that round too.
Your food log, cycle and pregnancy information, at the level you have chosen to share (see the table above). You can change these settings at any time.
Your location, only while you are both sharing, and whether you are sharing, paused or off.
Notifications about things you do together, such as "Maya added 12 photos to your album".

When you unlink, your partner stops seeing all of this. See section 10 for what happens to shared things after a couple ends.

5. What our staff can see

A small number of people who run Heartpact use an admin dashboard. It shows account details, counts, and when things happened, with names:

Your account: your email, name, time zone, sign-up and last-active dates, how you sign in and whether your email is verified, whether you are linked and to whom, your devices (platform and app version), your subscription and any complimentary Plus, how many dares, meals, food scans, photos and answers you have, and every admin action on your account.
Your activity, day by day: for each day, the kinds of thing you did and how many: dares set, done or missed (with the exercise, for example squats), meals logged, photos synced, questions answered, games finished (with the type of game), Plus started or ended (with the plan), and admin actions.
A live feed of what is happening across Heartpact, with display names: for example "Kayla & Austin linked up", "João did the dare · squats, set by Leticia", a new sign-up and their country, a couple starting Plus, a game finished, a couple ending, or an account being deleted (without saying whose). It also shows who is online right now.
Charts and totals across everyone: sign-ups and how far new couples get, how often couples come back, the times of day people use Heartpact, dares by exercise, games by type, Heart to heart scores as spreads of numbers, renewals and estimated revenue, and the couples making the most hearts, by name.
A world view of how many people and couples are in each country, from the country on their accounts. It never uses anyone's location.

The dashboard never shows what you wrote, photographed, drew or logged: no photos, captions, answers, messages, drawings, meals, cycle or pregnancy details, or location. There is no admin function that returns any of it.

Accounts we use for testing, and our team's own accounts, can be marked as internal. They work as usual but are left out of every chart and total.

Admins can help with your account: disable or re-enable it, sign you out everywhere, email you a password reset code, give your couple complimentary Plus, refund or cancel a Google Play subscription, or delete your account. Every admin sign-in and action is recorded in an audit log with who did it, when, why and from which IP address. Admins sign in with a password and a one-time code from an authenticator app, and must enter a fresh code again before disabling or deleting an account, refunding or cancelling a subscription, giving Plus, or marking an account as internal.

The people who maintain our servers could, in principle, reach the database directly. They do so only when it is needed to keep Heartpact running, fix a problem, or meet a legal obligation.

6. Third-party service providers

We use a few trusted providers to run Heartpact. They process data only on our behalf or to provide the specific service described, and we give them only what that service needs.

Provider	What it does	What it gets
Our hosting provider (Railway)	Runs our servers and database.	All the data described in section 2, stored on our behalf.
Cloudflare (R2 storage)	Stores the photos and videos in your shared album.	The files and thumbnails you sync. Your phone uploads and downloads them directly using short-lived links.
Cloudflare (Pages)	Serves our website, heartpact.me.	The requests your browser makes to the website, as any web host does.
Anthropic	Estimates calories and nutrients from a meal photo, when you choose to scan one.	The meal photo (shrunk to at most 1600 pixels and re-encoded, which removes embedded details such as location), any notes you add about the meal, and the country on your account so it can think of local dishes first, sent from our server. It is not sent with your name or email, and we do not store the photo.
Google: Firebase Cloud Messaging	Delivers notifications and dare alarms to your phone.	Your phone's push token and the notification itself, which can include your partner's name and a short line of text.
Google: Sign-In	Lets you sign in with your Google account, if you choose to.	We receive your Google account ID, email address, whether Google has verified it, and your name.
Google: Play Billing and the Play Developer API	Sells and manages Heartpact Plus subscriptions, and handles refunds.	Google handles your payment. We exchange the purchase token, product and an anonymous account reference with Google to confirm and manage the subscription.
Google: Play Integrity	Confirms that a finished dare came from the genuine Heartpact app on a genuine device.	Google checks your app and device. We send Google the resulting token to decode, and keep only the outcome (passed, failed, missing or not checked).
Google: Maps	Draws the map when you share location.	The Google Maps component in the app loads map tiles for the area on screen.
Google Play services: location	Works out your position on phones older than Android 12, while you share location.	Your phone's location provider, run by Google Play services on your phone. We receive only the position the app sends us.
Our email provider (Resend)	Sends password reset codes.	Your email address and the code.
Word-check services: Genderize.io, OpenStreetMap Nominatim and the Free Dictionary API	Check whether an answer in the "I call on" game is a real name, place or word.	The single word being checked, sent from our server. Nothing that identifies you.
Open Trivia Database	Supplies trivia questions for some games.	Nothing about you; we only download questions.

Each provider handles data under its own terms and privacy policy. We may also disclose data if the law requires it, to protect someone's safety, or as part of a merger or sale of our business, in which case this policy would continue to apply to your data.

7. Health data: cycle and pregnancy

Cycle and pregnancy information is health data, which the law treats as especially sensitive. We handle it with extra care:

Only with your explicit consent. We process it only because you choose to switch on cycle tracking or pregnancy mode and enter the information. You can stop at any time.
You decide what your partner sees. Cycle sharing starts at "nothing", and goes back to "nothing" whenever a couple ends or you link with someone new, so a new partner never inherits it. Pregnancy sharing is on by default, and you can switch it off at any time; ending a pregnancy stops sharing it. When a pregnancy is not shared, your partner gets no hint of it.
Late periods. If you share at least predictions, your partner can see that your period is late, and by how many days. While you have a pregnancy you are not sharing with them, they see no late count, so it gives nothing away.
Never sold, and never used for advertising. Heartpact has no ads. We do not share health data with anyone except our hosting provider, which stores it for us.
Not visible to our staff. The admin dashboard shows only whether these features are in use, never the details.
Easy to remove. You can delete a pregnancy, whether it is active or ended; this removes its appointments and kick counts too. Hiding, ending or deleting a pregnancy also removes the notification your partner got when you shared it. Deleting your account removes all of your cycle and pregnancy data.

While your pregnancy is shared, your partner can add appointments to it, and change or delete the ones they added. Those appointments are part of your record and stay with you, even if your partner later deletes their account; what they wrote is then erased (the title becomes "Appointment", and the place and notes are removed).

Cycle predictions and pregnancy information are for planning only. They are not medical advice and must not be used as contraception.

8. Location

Mutual or nothing. Your partner sees your position only while you are both sharing and neither of you has paused. If you stop, you stop seeing them too.
Never hidden. Each of you can always see whether the other is sharing, paused or off.
You start it. Sharing starts only when you tap to share. A late position from your phone never switches it back on.
Only the latest point. Each new position replaces the last one, and we accept at most one every 5 seconds. We do not keep a location history.
Pause any time for 15 minutes to 24 hours. Positions sent during a pause are thrown away.
It stops when your phone goes quiet. While you share, your phone checks in with us every few minutes. If we hear nothing from it for 10 minutes (for example, it was switched off), your sharing counts as off for both of you.
Signing out stops it. Signing out on any of your phones stops your location sharing on all of them. Resetting your password does too.
Visible on your phone. While you share, Android shows a notification, and you can stop from there. Heartpact does not use background location access.

When you stop sharing, your last position is wiped straight away. When a couple ends, both partners' location records are deleted. If your sharing lapsed because your phone went quiet, your last point stays stored, hidden from your partner, until you share again (when it is thrown away) or until it has gone untouched for 7 days, when it is deleted automatically.

9. How long we keep data

We keep your data for as long as your account exists, unless something below says otherwise. When you delete your account, it is erased as described in section 10.

Account, dares, food log, cycle, pregnancy, daily answers, notifications and devices: until you delete them or your account.
Album photos and videos: until the uploader deletes them, your couple ends (see section 10), or the uploader deletes their account. Files are removed from storage within minutes of being deleted. A hidden record of a deleted photo is kept only until any upload link for it has expired (15 minutes at most), so a late upload cannot bring it back, and then it is removed too.
Deleted messages: hidden from both of you straight away. The text stays in our database until the sender deletes their account.
Meal photos sent for an estimate: we do not keep them. They pass through our server to Anthropic and are not written anywhere. The record of the scan (time, size, model, result) is kept with your food log.
Location: only the latest point, wiped when you stop sharing and deleted after 7 days without use, as described in section 8.
Invite codes: valid for 48 hours. Password reset codes: stored only in hashed form, valid for 15 minutes and usable once.
IP addresses used for rate limits: held in memory for an hour at most.
Account deletions: a record that an account was deleted, with the date and whether it was a test or team account, and nothing else.
Admin audit log: kept for 2 years so we can account for every action taken on an account. If an admin deletes your account, the log keeps your email address and the reason.
Backups and server logs: our hosting provider may keep backups and request logs for 30 days, after which they are overwritten.

10. Unlinking and deleting your account

When a couple ends

Either partner can unlink at any time, without the other's permission. When that happens:

Your partner is told, and you stop seeing each other's information.
Dares stop, and any alarm that is ringing is cancelled. Open games end.
The shared album closes for both of you. For 30 days, each of you can still download or delete the photos and videos you uploaded yourself. After 30 days the whole album, both people's uploads, is deleted.
Your food log, cycle and pregnancy data stay yours, in your own account. Cycle sharing goes back to "nothing" for both of you, and a pregnancy shared in that couple is no longer visible to your former partner.
Both partners' location records are deleted.
Daily answers, messages and game history from the old couple can no longer be seen by either of you. They stay stored until the person who wrote them deletes their account.
If you link again later, even with the same person, you start a new couple space. The old album does not come back.

Deleting your account

You can delete your account at any time:

In the app: go to Us, then Delete my account, and confirm with your password.
On the web: visit heartpact.me/delete-account/, sign in, and confirm. This works even if you no longer have the app installed.
Signed up with Google? Email [email protected] from that address and we'll delete your account.

Accounts that sign in with Google confirm with their email address instead of a password.

Deletion is immediate and permanent:

If you are linked, the couple ends first, and your partner is told you deleted your account. Their cycle sharing goes back to "nothing".
Your account and everything that is yours is erased: profile, cycle and pregnancy data, food log and scan records, dares and their attempts, location, devices, notifications, subscription records, invites, messages and daily answers.
The photos and videos you uploaded are removed from storage within a few minutes.
Games from any couple you were in are deleted, because they contain both players' answers.
Things that belong to your partner, such as their own photos, answers and messages, stay with them. You appear there only as an ID that no longer matches anyone. Appointments you added to their pregnancy stay in their record, without what you wrote.
You are signed out everywhere straight away, and the email address can be used for a new account.
We keep only a record that an account was deleted and when (see section 9).

Deleting your account does not cancel a Google Play subscription. Cancel it in Google Play first. If you have one that will renew, the app warns you before you delete.

11. Downloading your data

You can download a copy of everything we hold about you as a single file (JSON format) by emailing [email protected] from the address on your account. It includes:

your profile;
cycle settings and daily logs;
pregnancies, appointments and kick counts (appointments you added to your partner's pregnancy only while you can still see it);
food entries, targets and scan records;
dares and every attempt;
your last shared location;
messages you sent, and your daily answers with the questions;
notifications, notification settings, devices and subscriptions;
the photos and videos you uploaded, as download links that work for one hour.

It leaves out your partner's data (their messages, answers, food log and uploads belong to them) and security secrets such as your password hash, push tokens and purchase tokens.

12. Your rights

Depending on where you live, you have some or all of these rights:

Access: get a copy of your data (see section 11).
Correction: fix data that is wrong. Most of it you can edit in the app.
Deletion: delete your data (see section 10).
Portability: receive your data in a machine-readable format.
Restriction and objection: ask us to limit or stop using your data, including where we rely on legitimate interests.
Withdraw consent: at any time, for cycle, pregnancy and location data. This does not affect what we did before.
Complain: to your data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EEA, it is the authority where you live or work.

If you are a California resident, or live in another US state with a privacy law, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and not to be treated differently for using these rights. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We use sensitive information, such as health and precise location data, only to provide the features you asked for.

To use any right, email [email protected] from the address on your account. We may need to confirm it is you. We reply within one month (or the time your local law sets), and we do not charge for reasonable requests.

13. Children

Heartpact is for adults only. You must be 18 or older to create an account. We ask for your date of birth when you sign up and do not create an account for anyone under 18. We do not knowingly collect data from anyone under 18. If you believe someone under 18 is using Heartpact, tell us at [email protected] and we will delete the account.

14. Security

We work hard to protect your data. For example:

The app talks to our servers only over encrypted connections (HTTPS).
Passwords are stored only as salted hashes. Password reset codes and invite codes are stored only in hashed form.
Album photos are reached through signed links that expire, after one hour for viewing and 15 minutes for uploading.
Every request checks that your account still exists and which couple you belong to now, so an old sign-in cannot reach a couple you have left.
Resetting your password signs you out on every other device.
Admins need a password and an authenticator code to sign in, and a fresh code for actions such as deleting an account; their sessions are short, and every admin action is logged.
Repeated failed sign-ins and invite code guesses are rate-limited.

No system is perfectly secure. If we learn of a breach that affects you, we will tell you and the authorities as the law requires.

15. International transfers

We are based in the United States, and our servers are in the eastern United States (Railway's US East region). If you use Heartpact from outside the United States, including from the UK or the European Economic Area, your data is transferred to the United States. Some of our providers, including Google, Cloudflare and Anthropic, may also process data in other countries. Where the law requires it, we rely on recognised safeguards for these transfers, such as the European Commission's Standard Contractual Clauses and the UK's equivalent, or an adequacy decision.

16. Changes to this policy

We will update this policy when Heartpact changes. If a change is significant, we will tell you in the app or by email before it takes effect. The date at the top always shows when it was last updated.

17. Contact us

HeartPact
651 N Broad Street, Middletown, Delaware 19709
USA
Email: [email protected]