Privacy policy

Your account

Your email address and a hashed password. If you sign in with Google or Apple, they tell us your email address and name, and we use nothing else from them. If you turn two-factor sign-in on, its secret and backup codes. Each sign-in session records the IP address and browser it was made from; a session ends when you sign out, when you change your password, or after 90 days without use.

Your profile

Your name, birth date, birth time (or that you do not know it, or are not sure of the minute), birth place, gender and anything you wrote about it, who you are interested in, your orientation if you chose to add it, what you are looking for, your photos, prompts, bio, height and lifestyle answers, the city you live in and how far you want to look. You choose the city; we never read your device's location.

Your charts

The charts we compute from your birth details across every system, and the text written about them. Your exact birth details are never shown to another member.

Charts you keep for other people

With Premium you can add someone who is not a member, a friend, a parent, someone you are seeing, and keep their chart: the name you give them, when and where they were born, the charts computed from that, and anything written about them. Only you can see it. Those people are never matched, never shown to anyone and never contacted; their details are not used for anything except your charts. They are in the copy of your data you can download, you can remove any of them whenever you like, and they are deleted with your account. You can also set two of them side by side; that comparison is kept the same way and goes when either chart does. Please add only people who would be glad you did.

How you use it

Your likes and passes, your matches, your messages, when you last opened the app, what you filtered for, the words you type into the natural-language search, and the counters that meter the free plan and the generated text. If you turn notifications on, the push subscription for that browser or the app's device token for that phone. If you took a founding place, whether you hold it. Anything you send us through the contact page, and a request to remove an intimate image, with what we did about it.

Invite and earn

If you joined through a member's invite link or code, that you did and whose it was, so they can be credited: they see how many people joined and pay through their link and what it earned them, never who. If you earn through your own link, the record of each share, refund and payout. To be sure a payment was not made with the inviter's own card, or with a card that also paid for another member they invited, we keep a code Stripe derives from the card (a fingerprint) beside each share; it cannot be turned back into the card number. When the check finds a match, our team sees both accounts to look at it. Payouts go through a Stripe account in your name: Stripe checks your identity and holds your bank and tax details, which we never see. If what you earn in a year reaches the threshold the IRS sets, we file a Form 1099 with the IRS and your state through Stripe, using the tax details you gave Stripe. A partner account, which our team makes for someone who shares My Beloved without a profile, holds only a name, an email, the link and its earnings.

Technical

Your IP address and browser appear in our server logs for a short time and in rate limits held in memory. If something in the app breaks, it sends us a short report with the page, the browser and the error, never what you wrote. We set only the cookies the service needs: your session; one that remembers an invite link you opened, for 30 days, until you sign up; in the apps, one that remembers you have seen the introduction; and nothing for advertising. The app keeps a few settings in your browser or on your phone (whether you dismissed the install prompt, how you like the map, when it last asked for a rating), which never reach us.

To compute your charts and score compatibility, to show your profile to members whose preferences match yours and vice versa, to run your conversations, to write the interpretations and compatibility notes you read, to take payment and credit invites, and to answer you when you write to us. Compatibility scores and the order of your feed are computed automatically from charts and preferences; no decision with a legal effect on you is made automatically.

To send the emails an account needs (verification, password resets, confirmations, a receipt) and, unless you switch them off under Settings, Account, an email when someone likes you, when you match, and when a message has waited unread for an hour (never the message itself); notifications, if you turn them on, carry the same.

To keep the service safe: automated filters check names, prompts, bios and messages for slurs and threats before they are stored, and refuse them; when a profile or a conversation is reported, our team reads what was reported, the conversation included, and every action they take is logged. We report apparent child sexual abuse material to the National Center for Missing and Exploited Children, as United States law requires, and we may disclose data where the law requires it or to protect a member from harm. We never sell your data, and we never use it for advertising.

My Beloved runs on servers we operate. A few providers process data on our behalf, each only for its task:

• Hetzner runs the servers My Beloved lives on, in Nuremberg, Germany. Your data is stored there.
• Cloudflare stands in front of the website and routes the email sent to our addresses, and its storage holds our encrypted backups.
• OpenAI writes the chart interpretations, compatibility notes and place descriptions from chart facts, first names, pronouns and each person's answer to what they are looking for; the name you give someone whose chart you keep; and the words you type into the natural-language search, so they can be turned into filters. Never your email, photos, birth details as such, or messages. OpenAI does not use what we send to train its models.
• OpenStreetMap's Nominatim finds the city you type when you set your birthplace or where you live, so we can place it on the map. Nothing about your account goes with it.
• Amazon Web Services delivers our email and tells us when an address bounces or marks us as spam, so we stop writing to it.
• Stripe takes web payments (we never see your card number) and, if you earn through your invite link, checks who you are, holds your bank and tax details, which we never see, pays your bank, and files the tax forms described below.
• Apple, Google and RevenueCat process purchases made in the apps. RevenueCat links a store purchase to your account and holds the purchase record against your account id.
• Google's Firebase and Apple's push service carry notifications to the Android and iPhone apps: the sender's first name and, for a message, its text, on the way to your phone.
• Umami counts page visits. It runs on our own server, sets no cookies, does not store your IP address, and is never linked to your account.

Your data is stored in Germany, in the European Union, with encrypted backups in Cloudflare's storage. The providers above that process it in the United States do so under contracts that bind them to this policy and, for members in the European Economic Area and the United Kingdom, under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework where the provider is certified.

Your first name and age, your photos and prompts, your city, your Sun, Moon and Rising, your Human Design type, what you are looking for, their compatibility with you, and anything you wrote about your gender. Your orientation only if you switched its display on. Never your email, exact birth details, or messages with anyone else.

For as long as your account exists. A conversation that ended by unmatching or blocking stays stored until one of you deletes their account, so that a report about it can still be checked. When you delete your account, your profile, charts, photos, matches, messages, invite earnings and sign-in are removed from our live systems immediately; a subscription bought on the web or through Google Play is cancelled first, and we tell an App Store subscriber how to cancel theirs, since only they can.

We keep one record of the deletion (a keyed hash of the email, your plan, how long you were a member and, if you gave one, the reason) so that we can see how the service is doing without knowing who left, and so that deleting an account and signing up again does not start a second free trial. The hash is made with a secret key, so it cannot be turned back into the address or matched against a list of addresses by anyone without that key, and we delete these records after two years. The notes our team kept about the account are removed with it. Reports about a deleted account keep the report itself, with the same keyed hash of the email in place of the profile, so that patterns of harm remain visible if the address returns; they are deleted after two years as well. A request to remove an intimate image (which anyone can make, on the safety page) is kept, with the name, email and signature it carries and what we did, for two years after it is resolved, as the record of what was done. What we report to the National Center for Missing and Exploited Children is kept for as long as the law requires. Stripe keeps its own records of payments, payouts and tax forms for as long as the law requires it to.

Encrypted backups are taken nightly for disaster recovery and kept for up to 90 days, after which they are deleted, so a deleted profile or photo can linger in a backup for that long; we do not restore backups to bring back deleted profiles. Messages you send us through the contact page stay in our mailbox for as long as we need them to answer you.

You can see and change everything in your profile and settings. You can pause your profile, change your email or password, turn notification emails and push notifications off, show or hide your orientation, download a copy of your data, and delete your account, all from Settings (the steps are on the account deletion page). The copy holds what is yours, your own likes and passes included; other members' choices about you, such as a like you have not answered or a pass, are theirs and are left out. The messages you wrote are in it in full; a message someone sent you is listed by when it arrived and when you read it, since its words are theirs.

You can also ask us for a copy, or to correct or delete what we hold, through the contact page or by writing to [email protected], yourself or through someone you authorise. We confirm the request through the email on your account, we answer within thirty days, and we never treat you differently for asking. Where the law where you live gives you further rights, they apply.

If you live in California

We do not sell personal information, and we do not share it for cross-context behavioural advertising; we have not done either in the past twelve months. The sensitive information we hold (your orientation, if you add it, and your birth details) is used only to provide the service you asked for, never to work out anything else about you. The rights above are the rights to know, to correct, to delete and to take a copy, and we honour them without discrimination.

If you live in the European Economic Area or the United Kingdom

Internect LLC is the controller. We process your account, profile, charts and messages to provide the service you signed up for (performance of a contract); your orientation only with your consent, which the switch in Settings gives and withdraws; security logs, rate limits and the fraud checks on invite earnings in our legitimate interest in running a safe service; and payment and tax records because the law requires them. Your data is stored in Germany, and transfers to the providers named above rest on the safeguards described there. Besides the rights above, you can ask us to restrict processing while a question about it is settled, take your data in a machine-readable form (the download under Settings is that), object to processing based on our legitimate interests, withdraw consent at any time, and complain to your data protection authority. Your birth details are needed to provide the service; without them there is no chart and no matching.

Everything travels over encrypted connections. Passwords are hashed, never stored. Card details go straight to Stripe or to the app store and never touch our servers. Photos are re-encoded on upload so that camera and location metadata never reach our storage. Access to production systems is limited to the people who run the service, staff accounts use two-factor sign-in, every action staff take on an account is logged, and every request is rate-limited. No system is perfectly secure; if a breach ever affects you, we will tell you.

My Beloved is for adults 18 and over. We do not knowingly hold data about anyone younger; if we learn that we do, we delete the account. Anything that sexualises a minor is removed and reported, as the safety page says.

When this policy changes in a way that matters, we tell you inside the app or by email. The date at the top is the date of the current version. Questions about it go to [email protected]; reports about child safety or an intimate image to [email protected].