Lovkiz, back to home
Français/English

Privacy

Version of November 3, 2026

Lovkiz keeps as little data as possible, and only to let you play. This page says what we keep, why, for how long, who else processes it, and how to erase it all.

Who is responsible

Chrislo Group LLC, which publishes and sells Lovkiz. Address: 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA. Contact: contact@lovkiz.com. Details are in the legal notice.

What we never keep

  • Your date of birth. We only keep “adult: yes” and the date of your declaration.
  • Your Mobile Money or card number. You type it for the payment provider; Lovkiz does not keep it.
  • Action ou vérité (truth or dare) games. Paid Action ou vérité games leave no trace: the cards are drawn on your phone, and we keep no game, no points and no event. Each day, we only count how many games were played across all of Lovkiz, per level, without knowing by whom. The free trial game only keeps its points.
  • No photos, no videos, no messages. Lovkiz never asks for them, and asks no written question about gender or sex life.
  • Your IP address in our database. Only a fingerprint of the address, which cannot be turned back into it, counts wrong tries at a code to link a phone: it is erased after one day.

What we keep, why, and for how long

To play

The data
Each person's first name or nickname, never a last name; “adult: yes” and the date of the declaration; your answers, reactions, streak, points and memories; the level of the question of the day; the couple's time zone and country, inferred from the connection when the space is created.
Why
To run the games, and to keep your partner's answer hidden until both your answers are in.
How long
As long as your space is in use. A space with no visit for 12 months is deleted. You can erase your part at any time (see “Your rights”). Answers to cards about faith or health are erased after 30 days, unless you choose to keep them in your memories.

Your phone

The data
A secret token, drawn at random, stays on your phone in a cookie: we only keep a fingerprint of it, which cannot be turned back into the token. With it: your place in the space, the type of phone (Android, iPhone or other) and the date of your last visit. When a phone is linked to the space: the date, the phone that made the code and the person chosen.
Why
To recognize you without an account or password, and to protect your space if a phone is lost or stolen.
How long
The cookie lasts 400 days and starts again at each visit. The rest, as long as the space exists. A code to link a phone only works for 10 minutes.

The invitation

The data
A fingerprint of the link sent to your partner, its end date and the date it was used.
Why
To let your partner join, once.
How long
The link works for 7 days, once. Its record stays with the space.

Payment

The data
The offer, the amount, the date, the status, which of you two paid, the source of the space's visit, the email of the person who pays, the reminders sent (how many, and the time of the last one) and, if you stop them, the date you did. Their first and last name go to Chariow, the payment provider, without being kept by Lovkiz. The Mobile Money or card number is typed for Chariow: Lovkiz never keeps it.
Why
To give access, send the receipt, keep the accounts, and let the person who paid recover the space on a new phone. If a payment that was started does not go through, at most three emails go to that address, with a link to resume the same purchase: 1 to 4 hours later, then about one day and three days later. None if that purchase has been paid since, or after “Effacer mes données” (erase my data). The last two carry the “Ne plus recevoir ces rappels” link (stop these reminders): one tap, without signing in, stops them for that purchase and that address. Nothing is sent after the third one, or after that tap.
How long
As long as the law requires for accounting, even after the space is erased: the payment is then no longer linked to any space.

Recovering the space by email

The data
The email on the receipt, and a fingerprint of that email to limit sending to 3 per hour.
Why
To send a link that reopens the space on a new phone, only for the person who paid.
How long
The link works for 30 minutes, once. Its record stays with the space.

Our song, if you ask for it

The data
Your answers to the “Our story” questionnaire and, if you add them, answers from the games; the preview, the text, the lyrics and the audio file of the song, the chosen style, the rewrite instruction and the surprise date.
Why
To make your song, and your written story when it is offered. The text and the lyrics are written by an AI, Claude, from the company Anthropic, in the United States: your answers are sent to it for that. The music and the voice are made by another AI, Eleven Music, from the company Eleven Labs Inc., in the United States: it only receives the lyrics, with your first names, and the chosen style, never your answers. Before and after, filters block any sexual content and any story from before age 18.
How long
As long as the space exists. It is deleted as soon as one person in the couple erases their data, because it is about both of you; the song file is deleted within the hour.

Notifications, if you say yes

The data
Your phone's subscription (encrypted) and the reminder time. Messages go, encrypted, through your browser's notification service (for example Google, Apple or Mozilla).
Why
To remind you of the question of the day, to tell you when your partner has answered, and to tell you the day before a pass ends. Never the text of a question or an answer, never a promotion.
How long
Until you turn them off in the settings, erase your data, or this phone is disconnected from the space.

Where your visit comes from

The data
The 4 parameters of a link to Lovkiz that say where the visit comes from (source, medium, campaign, content; for example “meta” and “paid” for an ad).
Why
To know whether a space comes from an ad or from elsewhere, to judge our ads.
How long
7 days on your phone. If your phone creates a space, the source is copied to the space, for as long as it exists, and to each of its payments.

Usage measurement

The data
The steps of the journey (for example “visit”, “sales page card answered”, “space created”, “invitation sent”, “payment succeeded”). On the sales page, before a space exists, they carry no identifier: nothing links them to each other or to your phone. Once the space is created, they carry a fingerprint of the couple's identifier. With a few details: the game, the number of cards, the offer and the price, the version of a title or price being tested, the source of the visit. Never a first name, an answer or a game level. These steps go through our server before PostHog: PostHog does not see your IP address.
Why
To know which steps work and which ones block.
How long
1 year, at PostHog, in the European Union.

Security

The data
Turnstile, by Cloudflare, checks that you are not a robot before you create a space, type a code, ask for a link by email, ask for the preview of the song or pay: Cloudflare then sees your IP address and information about your browser, and Lovkiz keeps none of it. Sentry receives the app's technical errors, with no first name, no answer, no email and no token.
Why
To block robots, and to fix errors.
How long
Errors: 30 days, at Sentry, in the European Union. The host's technical logs: a few days at most.

No ad pixel

Lovkiz loads no ad pixel (Meta, TikTok or any other) and sends nothing to an ad network. If this changes, this page will say so first, and nothing will be sent without your consent.

On your phone

  • the device cookie, with your secret token (400 days, starts again at each visit);
  • the source of your visit (7 days);
  • your answers to the cards on the home page, until you send them;
  • if the declared age is under 18, a refusal kept for 24 hours, without the date;
  • during a pass, the cards of the paid games, erased when the pass ends or if this phone is disconnected, and the list of cards already seen.

Who else processes your data

These providers process data for Lovkiz, only for the service stated:

  • Vercel (United States): hosts the app; its servers for Lovkiz are in Frankfurt (Germany). Vercel sees your IP address at each visit.
  • Supabase: the database, the real-time service and the song file, in Frankfurt (Germany). An encrypted backup of the database is made every night outside Supabase and kept for 7 days at Cloudflare.
  • Anthropic (United States): writes the lyrics of the song, if you ask for it.
  • ElevenLabs, by the company Eleven Labs Inc. (United States): makes the music and the voice of the song, if you ask for it. It receives the lyrics and the style, never your answers.
  • Resend (United States): sends service emails: receipt, link to reopen the space, surprise reminder, song ready, and at most three emails if a payment that was started does not go through, with a link to stop them. Never a promotion.
  • Chariow, by the company Axa Zara LLC (United States), with its payment partners and your operator: the payment page.
  • PostHog (European Union): usage measurement.
  • Sentry (European Union): technical errors.
  • Cloudflare (United States): Turnstile, the anti-robot check, and the storage of the encrypted database backup (R2).
  • GitHub (United States): makes the encrypted database backup every night.
  • Upstash (QStash; servers in the European Union): scheduled tasks, such as checking pending payments and sending reminders.
  • Your browser's notification service (for example Google, Apple or Mozilla, in the United States), only if you accept notifications.

Where your data is processed. In the European Union (Germany) and in the United States, whatever your country: outside Africa, Switzerland, Monaco and Canada.

We do not sell or rent your data. In the app, nobody but the two of you sees your answers.

Your rights

  • Erase your data: in Lovkiz, Settings, then “Effacer mes données” (Erase my data).
  • Know what we keep about you, get a copy, or have something corrected: write to contact@lovkiz.com.
  • Withdraw your consent to notifications, in the settings, at any time.
  • Object to a use of your data, or complain: write to us first; if the answer does not satisfy you, contact the authority of your country (below).

“Effacer mes données” erases your part, without your partner's consent and without touching theirs: your answers, your first name, your tokens, your notifications, your consent to our ad measurement and your Meta identifiers. Your phone erases the cards of the paid games and the list of cards seen. In the memories, your partner sees “Réponse effacée” (answer erased). The song is deleted, because it is about both of you, and so are the answers to the cards on the home page. When both your parts are erased, or if your partner never joined, the whole space is deleted. Nobody can erase the other person's part. Your payments stay for accounting, with the receipt email, and still linked to the space: a pass already paid still works for your partner. They no longer say which of you paid, and that email no longer reopens the space. When the whole space is deleted, payments are no longer linked to any space.

The authorities

To complain about the use of your data, write to us first. You can also contact the data protection authority of your country.

In Africa

  • Cameroon: Autorité de protection des données à caractère personnel, set up by law no. 2024/017 of December 23, 2024.
  • Côte d'Ivoire: ARTCI (Autorité de régulation des télécommunications/TIC de Côte d'Ivoire), artci.ci.
  • Senegal: CDP (Commission de protection des données personnelles), cdp.sn.
  • Algeria: ANPDP (Autorité nationale de protection des données à caractère personnel), anpdp.dz.
  • Benin: APDP (Autorité de protection des données à caractère personnel), apdp.bj.
  • Burkina Faso: CIL (Commission de l'informatique et des libertés), cil.bf.
  • Mali: APDP (Autorité de protection des données à caractère personnel), apdp.ml.
  • Morocco: CNDP (Commission nationale de contrôle de la protection des données à caractère personnel), cndp.ma.
  • Mauritius: Data Protection Office, dataprotection.govmu.org.
  • Rwanda: Data Protection and Privacy Office, of the National Cyber Security Authority, dpo.gov.rw.
  • Seychelles: Information Commission, infocom.sc.
  • Togo: IPDCP (Instance de protection des données à caractère personnel), ipdcp.tg.

In Europe and Canada

  • Belgium: APD (Autorité de protection des données), autoriteprotectiondonnees.be.
  • France: CNIL (Commission nationale de l'informatique et des libertés), cnil.fr.
  • Luxembourg: CNPD (Commission nationale pour la protection des données), cnpd.public.lu.
  • Monaco: APDP (Autorité de protection des données personnelles), which succeeds the CCIN, apdp.mc.
  • Switzerland: PFPDT (Préposé fédéral à la protection des données et à la transparence), edoeb.admin.ch.
  • Canada: Office of the Privacy Commissioner of Canada, priv.gc.ca.
  • Canada (Quebec): CAI (Commission d'accès à l'information du Québec), cai.gouv.qc.ca.

In another country, contact the data protection authority of that country.

18 and over

Lovkiz is only for people aged 18 and over. If the declared age is under 18, nothing is recorded, except a refusal kept for 24 hours on the phone, without the date.

If this page changes

The date at the top of the page changes with it.

  • Legal notice
  • Terms of sale
  • Back to Lovkiz