Cheramor Privacy Policy

Beta version. This policy will be updated after legal review.

Effective date: November 11, 2026 Last updated: November 11, 2026

1. Who this policy covers

This Privacy Policy explains how Rodolph Tebcherani ("Cheramor," "we," "us," or "our") collects, uses, shares, and protects information when you use the Cheramor mobile app (the "App" or "Service"). By using Cheramor, you agree to the practices described here. If you don't agree, please don't use the App.

Cheramor is intended for individual adults, generally as part of a couple, who are each using their own account. It is not directed at children, and you must meet the age requirement in Section 10 to use it.

2. Information we collect

2a. Information you provide directly

• Your health data consent — after sign-up, a separate screen, "Your health-related information", asks you to agree to Cheramor using what you write, your survey answers and your check-ins to run the app, and separately whether what you write may shape your partner's general ideas. We record which version you agreed to, your partner choice, and when.
• Account information — your email address and password (we store only what our sign-in provider needs to check it, never the password itself in readable form) and whether you've verified the email address (Conflict Coach, AI categorization and partner linking need a verified address), or, if you sign in with Google, the identifiers Google shares with us (your email address and name), or, on an iPhone or iPad, if you sign in with Apple, the identifiers Apple shares with us (an email address, which can be a private address that Apple forwards to you, and your name if you choose to share it); a display name if you set one. When you sign up, we also record that you confirmed you're 18 or older, which versions of these Terms and this Privacy Policy you agreed to, and when. If you start signing up with Google (or Apple) and stop before agreeing, our sign-in service briefly creates a login record with your Google (or Apple) email and name so the app can check whether you already have an account; the app deletes it right away, and nothing else is kept. If that fails (for example, the phone loses its connection), a daily cleanup deletes any login that has no Cheramor account once it's been unused for a day.
• Onboarding & preference information — your relationship setup (married or not, and living together or long-distance), which you can change in Settings, and your reminder-frequency and notification preferences. (What you're hoping Cheramor helps with is a baseline survey question, below.)
• Baseline survey responses — your initial answers about relationship satisfaction, which emotional-need and conflict-topic categories feel relevant to you, and what you're hoping the app helps with, including anything you write in the optional free-text field.
• Journal entries and "Tell Me Anything" entries — anything you choose to write. These are private to you; see Section 5 for exactly what that means and doesn't mean.
• Ongoing check-in and survey responses [Not yet active: the app doesn't send check-ins yet.] — answers to the periodic, lightweight check-ins the app sends, such as the occasional "where things stand" question (the same Struggling → Thriving scale as the baseline survey) and how often you'd like to be asked. If you skip a check-in, we record that it was skipped, not a score.
• Feedback on suggestions ("tips") and how you interact with them — whether a suggestion was shown to you, and whether you marked it done, chose "not now," dismissed it, or didn't act on it. Also whether you tried it ("Yes," "Not yet," or "Not for me") and, if you choose to share it, how it felt to do (for example, good, awkward, or that it wasn't received).
• Thoughts [Not yet active: in testing.] — Cheramor occasionally shows a short line on the Home screen. We store which lines have been shown to you and when, so they don't repeat, and any you choose to save. You can turn Thoughts off in Settings. Thoughts are never shown to or chosen from your partner, and never sent as notifications.
• Insights [Not yet active: in testing.] — Cheramor may occasionally show a short research fact about relationships, with a small idea to try, on the Home screen or under a suggestion. We record which insights you were shown and when, and whether you marked one "Tried it" or dismissed it, only so they don't repeat, so you get no more than one or two a week, so one you've answered leaves your screen, and so you can look back at past ones. Marking an insight "Tried it" or dismissing it never changes the suggestions Cheramor picks for you. To choose one, the app uses the kinds of ideas you said you'd like and, if you use growth, your growth areas; it also pauses some insights while a safety pause is active (Section 8). Insights never use what you or your partner wrote, are never sent as notifications, and are the same facts for everyone. This record is included in "Download my data" and deleted with your account.
• Daily listen [Not yet active: in testing.] — Cheramor may offer a short audio piece on the Home screen, read by an AI voice from a fixed script that's the same for everyone. We record which episodes you were given, on which day, and whether you listened to most of one, so they don't repeat and the Home row can show you've heard it. If you give an episode a thumbs up or down, we keep that too: a thumbs down means we won't give you that episode again, and a thumbs up lets it come back sooner. We also keep a count of thumbs up and down for each episode, with no names or account IDs attached, to learn which episodes people find helpful; that count isn't linked to you and stays after you delete your account. To choose one, the app uses the topics in your own profile (Section 2c) and, if you use growth, your growth areas; it never uses what your partner wrote, and none appears beside a safety message or during the strongest safety pause (Section 8). It's never sent as a notification, and you can turn it off in Settings. This record is included in "Download my data" and deleted with your account.
• Growing as a partner [Not yet active: in testing.] — an optional check-in you can choose to take about how you handle stress, conflict and closeness: your answers (for example, how often you get defensive, lose your temper, feel jealous, or are hard on yourself), the strengths and focus areas you pick, and anything you write in its optional box. We also store your growth settings (on or off, and how often you'd like growth ideas) and which growth ideas you were shown and whether you tried them. You can change your answers, turn growth off, or delete your growth answers at any time in the app. Your partner never sees any of it (Section 5).
• A Conflict Coach reply you report — if you tap "Report this reply" under something Conflict Coach wrote, we keep that reply as the coach wrote it, the reason you chose (for example "Wrong or unhelpful") and any note you add, tied to your account and the session. We don't keep what you wrote in the session with it. We use reports only to find and fix replies that went wrong; they're never sent to AI, never used for suggestions, and your partner never sees them. Reports aren't monitored for emergencies.
• Feedback you send from a testing version [Testing versions only.] — if you test a version of Cheramor that isn't public yet, you can send feedback. We store what you write, an optional rating, the screen you were on, how you opened the form, the app version, your phone's platform and system version, and the date, tied to your account. We also record which version of the tester agreement you agreed to, and when. Please don't include private details about your relationship in feedback.
• Partner-linking information — that your account is linked to another account, and the state of that link (invited, linked, unlinked) with its dates. While you're linked, we also store the first name you choose to show your partner; it's shown to them and erased from the link record when either of you unlinks. While an invite is open, we store its code and when it expires (30 days). We do not store message content between you and your partner, because Cheramor is not a messaging channel between partners — see Section 5.
• Wrong-code counter — if you enter a partner's invite code, we count how many wrong or expired codes you've tried in the past hour (a number and a start time, nothing else), so codes can't be guessed. It's used for nothing else.
• Daily AI-use counts — for each day, how many times what you wrote was screened or sorted into categories by AI, how many characters were screened, and how many Conflict Coach steps you took, and whether you reached a daily limit. Numbers only, never anything you wrote. We use them only to keep Cheramor available and affordable and to spot automated misuse: past a generous daily limit, AI work waits until your next day (your entries still save, and safety screening still happens then, with support information shown meanwhile). They're deleted after 30 days, and when your account is deleted.

2b. Information collected automatically

• Device and usage information — device type, operating system, app version, crash logs, and basic in-app usage events (for example: opened the app, completed onboarding, sent a partner invite, a suggestion was delivered) collected through our analytics tooling.
• Push notification tokens — a token for each phone you use Cheramor on, so we can tell you when something is waiting in the app. You can pause notifications in Settings, or turn them off completely in your device settings, at any time. Signing out of Cheramor on a phone removes that phone's token. Notifications themselves never contain what you wrote, what you need, or anything about your partner; they only say that something is waiting. Your notification settings (delivery window, quiet hours, pause) are stored with your account.

2c. Information we infer

• Need and topic categories detected in what you write — for each journal or "Tell Me Anything" entry (and the optional free-text survey answer) that passes safety screening, which emotional-need and conflict-topic categories it touches, whether each seems like a struggle or something going well, and how strongly it's expressed (mild, moderate or strong, judged from the wording, not the length). This is done by an AI model (Section 4). If that isn't available, simpler keyword rules running on our own servers do it instead. These records contain categories only, never your text.
• Your "pain-point" profile — a working model of which emotional-need and conflict-topic categories seem relevant to you right now. It's built from your survey answers and the categories above. Things you write on your own count more than answers to questions the app asked, and "going well" lowers a category just as "a struggle" raises it.
• Your writing-style baseline (not yet active) — Once you've written about 10 entries, a few numbers describing how you usually write: typical entry length, how often you use emotionally charged wording, and how strongly your entries usually express things. It never contains your words. It's used for one thing only: judging how strongly a new entry expresses something compared with your own normal, so a naturally expressive writer isn't over-counted and a reserved one isn't under-counted. It is never used for safety screening (Section 6), which treats everyone's words the same way, and it's never shown to or used for your partner.
• Snapshots of that profile over time [Not yet active: designed, not built.] — a weekly copy of the profile's category weights (no text), together with your check-in answers [Not yet active: check-ins], so you and the app can see whether things are improving. If you edit or delete an entry, the snapshots are recalculated as though the deleted entry had never been written, or as though the edited entry had always said its new text.
• Whether to show a Thought today [Not yet active: in testing.] — to decide whether a Thought is suitable on a given day, the app checks your own recent safety screening results, your own feedback on suggestions, and whether your own recent entries use words about a loss, such as a death, a funeral or a serious illness (a fixed word list, checked automatically). Nothing new is stored from this check except which Thought, if any, was chosen for that day. It never uses anything your partner wrote.
• Your growth focus [Not yet active: in testing.] — if you take the growth check-in, we work out from your answers which areas you might like ideas about (for example, staying calm or listening), and give the areas you picked yourself the most weight. If you write something in the check-in's optional box and it passes safety screening, it's also sent to our AI provider to pick the areas you said you want to work on, which count like areas you picked (Section 4). To decide whether to pause growth ideas, the app checks your own recent safety screening results and your own feedback on suggestions, as for Thoughts. This is used only to choose your own growth ideas. It is never shown to your partner, never used for your partner's suggestions, and never used for collective learning (Section 3a).
• Your personal suggestion-matching weights — adjusted over time from your own feedback on past suggestions (Section 2a, "Feedback on suggestions"). This is calculated from your own history alone; it does not draw on other users' data.
• A partner-safety check on what you write — when we detect categories in an entry, our AI also notes whether the entry describes you monitoring or controlling your partner (for example, checking their phone or location, or restricting where they go or who they see). We use this note for one purpose only: if you're linked with a partner, an entry noted this way never shapes the suggestions your partner receives, and for 30 days afterwards none of your entries shape them. It is never shown to your partner or anyone else, never used for your own suggestions, never used for anything else, and it is deleted when the entry is edited or deleted, or when your account is deleted. It isn't a finding that you did anything wrong, and it isn't included in "Download my data" (Section 9).
• Safety/crisis classification signals — every journal entry, survey response, and "Tell Me Anything" entry is automatically screened for language that may indicate a safety concern, distress, or risk (see Section 6). This screening produces an internal classification, not a diagnosis, and is used only to decide whether to offer you supportive resources.

We do not collect payment information at this time (Cheramor does not currently offer paid features), and we do not knowingly collect government ID numbers, financial account numbers, or similarly sensitive identifiers.

3. How we use your information

We use the information above to:

• Provide the core functionality of the app: journaling, check-ins, partner linking, and the suggestion ("tip") delivery system.
• Generate and personalize the suggestions delivered to you and, once you're linked, to your partner — see Section 5 for exactly how this works and what it never reveals.
• Screen content for safety/crisis signals and, where appropriate, surface supportive resources (Section 6).
• Show you, and let the app gauge, whether things are improving over time: your check-in answers [Not yet active] compared with your baseline, and your profile snapshots (Section 2c).
• Only if you opt in: contribute pseudonymized signals to collective learning (Section 3a).
• Improve and maintain the app (troubleshooting, security, basic product analytics), including de-identified, aggregated statistics that contain nothing you wrote (Section 3b).
• Only in testing versions: read the feedback testers send, to find bugs and improve the app. Feedback is never added to your journal, never screened as a journal entry, never used to choose suggestions, never shared with your partner, and never used to train AI models.
• Communicate with you about your account, respond to support requests, and send the notifications you've opted into.
• Comply with legal obligations.

We do not sell your personal information, and we do not use your journal or "Tell Me Anything" content for advertising or share it with advertisers.

3a. Collective learning (opt-in; not yet active)

[Not yet active: this setting isn't in the app yet, and none of what this section describes happens. It isn't shown in Settings until it is built.]

You can choose to help improve Cheramor's suggestions for everyone by turning on "Help improve Cheramor for everyone" in Settings → Privacy & data. It is off unless you turn it on. Each person decides for themselves, not per couple. Cheramor works fully either way.

If you turn it on, we build a separate learning dataset from your records. It is keyed by a random code instead of your name, email, or account. It contains only:

• the month you joined;
• your baseline survey rating, the categories you checked, and your goal;
• whether you use Cheramor solo or linked (never who your partner is);
• week by week: your "where things stand" check-in answers, and how strongly each need or topic category shows up in your profile (in broad bands);
• the suggestions you received (which suggestion, its category, and the week) and how you responded to them.

It never contains:

• your journal, "Tell Me Anything," or survey text, or anything that points to a specific entry;
• your name, email, account identifiers, or your partner's identity;
• exact dates (only "week 1, week 2…" since you joined), or your location or time zone;
• any safety or crisis screening information;
• anything from Growing as a partner (your check-in answers, growth focus, or growth ideas).

This dataset is pseudonymized, not anonymous. We keep a separate, restricted link between the random code and your account. We keep that link only so that we can delete your rows when you turn the setting off or delete your account. We learn from it only in aggregate: a finding is used only if it's based on a group of at least 20 contributors. It changes Cheramor's suggestion library only after human review.

When you turn the setting on, your contribution covers your history in Cheramor so far as well as going forward. When you turn it off, your rows and the link to them are deleted right away, and nothing further is added. Honest limit: improvements already made to the shared suggestion library from aggregate findings can't be undone.

3b. Aggregate usage statistics

[Not yet active: we don't compute these statistics yet. This section describes what we will do once we do.]

To improve Cheramor for everyone, we use statistics that combine many people's use of the app: for example, how often suggestions are marked as tried or helpful, how often each feature is used, and how these differ between broad groups of users (such as solo and linked accounts, or people who chose the same goal). These statistics:

• are counts and rates across groups, never about one person, and never include anything you wrote;
• are de-identified: they can't reasonably be linked back to you, and we don't try to re-identify anyone from them;
• are used only to improve the app and its content for everyone. They never change how the app treats you individually, and we never use them to show you comparisons, scores, or rankings against other people or couples.

Your baseline survey answers (the multiple-choice ones) may be counted in these statistics, with extra safeguards:

• only as counts across groups of at least 50 people; a smaller group is never reported or used;
• never at the level of an individual, and never joined with what you write;
• never your optional written answer;
• never answers about intimacy, sex, mental health or safety. Those could only ever be used through "Help improve Cheramor for everyone" (Section 3a), and only if you turn it on.

This is separate from collective learning (Section 3a), which learns from your own records over time and happens only if you choose to turn it on.

4. How AI processing works

Cheramor uses third-party AI models, provided by Anthropic (the maker of the Claude models), to help power these things. We ask first: before anything you write is sent to Anthropic, the "How Cheramor works" screens name Anthropic and ask you to agree, and we record which version of that wording you agreed to and when. If you don't agree, you can sign out; Cheramor can't screen entries for safety without it, so it can't be used without this processing.

• Safety/crisis screening (Section 6) — every entry you write is passed through an automated classification pass to check for language suggesting distress or risk. It's sent twice at the same time, and the more cautious result is used. If you edit an entry, the new text is sent and screened again.
• Detecting need and topic categories (Section 2c) — each entry that passes safety screening is sent in a separate request, so the model can note which emotional-need and conflict-topic categories it touches, whether each seems like a struggle or something going well, and how strongly. Only these categories and labels are kept, never a summary of what you wrote. [Not yet active: once your writing-style baseline exists (Section 2c), a short, numbers-only description of it is sent along with the entry in this request. It contains no text from past entries. It is never sent with the safety screening request.] Entries flagged by safety screening are never sent for this. If you edit an entry, it is checked again once the new text has passed screening. If this AI request fails, simple keyword rules on our own servers are used instead.
• Partner-safety signals [Not yet active: in testing, for listed test accounts only.] — each entry that passes safety screening is also sent in one more separate request, which notes only whether you describe controlling your partner, being afraid of your partner, resentment about being sexually refused, or not wanting to be touched right now, and how strongly. Only these notes are kept, never a summary of what you wrote. They're used only to pause some suggestions for a while (Section 5), and they're never shown to anyone. If this request fails, it counts as a sign for caution, never as all clear.
• Suggestions are not written by AI. Every suggestion comes word for word from our own vetted content library (Section 5). No AI writes or rewords them.
• Replies to Tell Me Anything — if you ask for a reply to a Tell Me Anything note (or choose "Always" in Settings), that note's text is sent to the same AI provider to write a short reply, only after it has passed safety screening (Section 6); a note flagged by screening never gets an AI reply. Only that note is sent, never your other entries, your profile or anything of your partner's. The reply is shown only to you, kept with the note, included in "Download my data", and deleted when you edit or delete the note or delete your account. If you mark a reply helpful or not, we keep that with it. Replies never shape your partner's suggestions.
• Conflict Coach — when you use Conflict Coach, what you type there is sent to the same AI provider, first for the same safety screening (Section 6) and then to the coach, which replies only to you. Each time, the coach is sent the session so far: what you've typed and its own earlier replies. If screening suggests you may be unsafe with a partner, a short further request decides which supportive line to show above the support resources. If the coach's model declines a request, another Claude model from Anthropic may answer it instead. The coach sees only that session's text, never your journal or profile. [Not yet active: in a shared session (Section 5), your side is sent to write the version your partner sees, and again to check that version against what you wrote; once you've both approved, both approved versions are sent to help you both with what comes next.] Nothing you write in Conflict Coach is shared with your partner or used to shape suggestions, unless you choose to save a takeaway to your journal, which then works like any journal entry except that it never shapes your partner's suggestions.

Tester feedback (testing versions only) isn't sent to AI when you send it. To sort it into themes, we may send exported feedback to an AI service (Anthropic) without your name or email (testers appear as T1, T2…).

• Growing as a partner [Not yet active: in testing.] — what you write in the check-in's optional box is sent for the same safety screening as an entry. If it passes, it's sent in a separate request so the model can pick up to three growth areas you said you want to work on. Only the areas are kept from that request. They're used only to choose your own growth ideas.

So one journal entry can go to Anthropic in up to four separate requests: two safety checks, one for categories and, in testing, one for partner-safety signals. Each request holds only the text and our instructions, never your name, email address or account ID.

Anthropic processes this content for us as our service provider (a "processor"), under its Commercial Terms of Service and the Data Processing Addendum those terms include. Those terms say Anthropic may not train models on our content. It is not shared with your partner, other users, or any advertiser.

How long Anthropic keeps it: Anthropic deletes what we send and what its models return within 30 days. Two exceptions are in Anthropic's own terms, not our control: if Anthropic's automated safety systems flag something as breaking its Usage Policy, Anthropic may keep it for up to 2 years (and the safety scores for up to 7 years), and it may keep data longer where the law requires. Because people write about hard things in Cheramor, including abuse and self-harm, some of what you write could be flagged this way.

5. What we never share with your partner

Cheramor's entire design is built around one rule: your partner never sees what you write. That means your journal entries, your "Tell Me Anything" entries, your survey answers and your raw feedback. This is not a messaging app: none of it is shown to your partner, in whole, in part, or in paraphrase. [Not yet active: in testing.] The one exception is a Conflict Coach session you choose to share: your partner then sees a version of your side that an AI wrote and that you read and approved first, never what you typed (see below). If you choose, what you share can help shape the general suggestions your partner gets, as explained below. Those suggestions never quote you and are never shown as coming from you, but we can't promise your partner will never guess something from one: a suggestion might happen to match something the two of you have talked about.

Here is exactly what does happen: if something you've shared suggests your partner might appreciate a particular kind of gesture (more quality time, a specific kind of appreciation, and so on), Cheramor may, at its own timing and from its own curated content library, send your partner a general suggestion tied to that category — worded so it doesn't reveal what you wrote, when you wrote it, or that it was connected to you. Cheramor also sends unrelated, "just because" suggestions on its own schedule, so a suggestion arriving doesn't, by itself, mean you wrote anything. Your partner is told, in general terms during onboarding, that this is how the app works — they know the category of mechanism exists, but never the specific content or timing that triggered any one suggestion.

What can shape your partner's suggestions. [Not yet active: in testing, for listed test accounts only. Until then, only three kinds of need can shape your partner's suggestions: appreciation and kind words, quality time, and fun and new things together.] Any topic you write about in your journal or "Tell Me Anything" can shape the general suggestions your partner gets: for example, a wish for more time together, appreciation or affection, or stress around money or family. A suggestion is always a kind gesture or about the feeling underneath, never about the topic itself: writing about money stress can lead to a warm suggestion for your partner, never one that mentions money. Some kinds of suggestion reach your partner only if they chose to get them (physical affection, for example). Suggestions about your sex life are never shaped by what you write: they appear only if you both privately say yes. Some things never shape your partner's suggestions: anything flagged by safety screening, an entry noted as describing monitoring or control (Section 2c), Conflict Coach, and Growing as a partner. This only happens if you say yes. Since 2026-11-09 it's a separate choice, "Let what you write shape your partner's ideas?", which everyone answers Yes or No on the "Your health-related information" screen (nothing is picked for you), and you can change it in Settings → Relationship → "Shape my partner's ideas". It's off unless you say yes, and turning it off stops it for future suggestions at once. There's no setting for individual topics: if there's something you'd rather not have shape them, you can leave it out of what you write, or edit or delete the entry at any time, which removes it from future suggestions. Your partner chooses whether to get suggestions about physical affection, and is never told what shaped any one of them.

The same is true in reverse: you will not be told what your partner has written, only that Cheramor may occasionally send you a general suggestion of its own.

[Not yet active: Conflict Coach shared sessions are the one exception, and only when you choose them. For a single conflict, if you and your partner both agree, Cheramor shows your partner a version of your side that an AI wrote from what you typed, and that you read and approved first. Your partner never sees what you actually typed. Agreeing covers that one conflict only. Either of you can close the session at any time, which deletes its content for both of you, or delete it entirely at any time, even after it's closed, which deletes it for both of you. It's deleted automatically 7 days after you've both approved. Your partner isn't told who closed or deleted it. Nothing else you write in Cheramor is ever shared this way, and nothing written in Conflict Coach is used to shape suggestions for either of you.]

Growing as a partner [Not yet active: in testing.] is entirely yours: your partner never sees your check-in answers, your growth focus, your growth ideas or whether you use it, and none of it ever shapes your partner's suggestions. A journal entry you write from it is private like any other, and it never shapes your partner's suggestions either.

What your partner does see about you: only the first name you chose to show them, that you're linked, and since when. If either of you unlinks, the other sees only "You're no longer linked with your partner." in the app: not why, not who unlinked, and never as a notification. Your partner is never told anything about safety or crisis content, or about your looking at support resources (Section 6).

6. Safety and crisis-content handling — important limitations

Cheramor automatically screens what you write for language that may indicate a safety concern (for example, thoughts of self-harm, safety concerns in the relationship, or serious distress). When this screening flags something, the app may respond with grounding language, gentle follow-up questions, and — if the concern appears genuine and sustained — a suggestion to seek professional support, along with crisis resources (for example, the 988 Suicide & Crisis Lifeline in the United States).

Please understand the limits of this feature clearly:

• Cheramor is not a crisis service, a monitoring service, or an emergency response service. It does not notify emergency responders, your partner, or anyone else on your behalf, and no one is watching in real time.
• If you are in crisis or believe you or someone else is in immediate danger, do not rely on Cheramor. Contact emergency services (911 in the U.S.), or a crisis line (for example, 988 in the U.S.), directly.
• The screening is automated and imperfect. It is deliberately built to lean toward flagging too much rather than too little, but it can still miss genuine concerns or flag things that aren't urgent.
• Content flagged this way is handled separately from the ordinary suggestion pipeline and is never turned into a "tip" for your partner.
• If you edit an entry, it is screened again, and the earlier screening result is no longer used. If you delete an entry, its screening result is deleted with it. If that entry had started a safety pause, a short record that the pause exists, with none of your words, stays until the pause ends (Section 8, "Safety pauses when you delete an entry").
• Feedback from a testing version isn't monitored for emergencies and isn't screened like an entry or checked for crisis phrases. If you or someone else is in danger, call your local emergency number.

7. Who we share information with

We share information only in these circumstances:

• Service providers who process data on our behalf, under contract, and only to provide the service: cloud hosting and database infrastructure (Google Cloud, through Firebase), authentication (Firebase Authentication), push notification delivery (Firebase Cloud Messaging), and AI processing (Anthropic, per Section 4).
• Legal reasons — if required by law, subpoena, or legal process, or to protect the rights, property, or safety of Cheramor, our users, or the public, consistent with applicable law. In plain terms: what you write in Cheramor can be handed over if a court order, subpoena or similar legal process requires it, for example in a divorce or custody case. We can only hand over what we still hold at that time: Conflict Coach sessions are deleted after 30 days, and a deleted entry is gone from use right away (Section 8).
• Business transfers — if Cheramor is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction; we'll notify you if this changes how your information is handled.
• With your direction — for example, if you explicitly ask us to export or share something on your behalf.

We do not sell your personal information to third parties, and we do not share your journal or "Tell Me Anything" content with any party for advertising purposes.

8. Data retention and deletion

We keep your information for the periods below, and delete it sooner when you ask. Deleting your account deletes everything listed here that's still kept (see "Deleting your account" below).

The details:

• Editing or deleting an individual entry. You can edit or delete any of your journal or "Tell Me Anything" entries in the app at any time. Deleting an entry removes it — along with what we derived from it: its safety screening result, the need/topic categories detected in it, and its contribution to your profile — from active use right away. Editing replaces the old text (we don't keep earlier versions) and re-derives all of the above from the new text. Honest limits: a suggestion that was already sent to your partner can't be un-sent, and — as with account deletion below — inferences already reflected in a linked partner's own profile aren't retroactively undone. Our AI provider keeps the text it processed for up to 30 days, or up to 2 years if its safety systems flag it (Section 4), and our system logs, which record that an entry was screened and the result but never its text, are kept for 30 days before being deleted automatically.
• Safety pauses when you delete an entry [Not yet active: in testing.] If you delete an entry, we delete its text and anything derived from it. If a safety pause was active at the time, we keep only a record that the pause exists, with no entry content, until the pause and its gradual wind-down are over, and then delete that record too. A safety pause is when Cheramor quietly stops some partner-shaped suggestions for a while because something in either partner's writing suggested caution; it's never shown to either of you. The wind-down means suggestions come back in stages, a week at a time, rather than all at once. The record holds only a level and a date, never your words or which entry it came from; it can't be used to rebuild what you wrote. It's included in "Download my data" and deleted with your account. How long a record lasts depends on how serious the sign was: one week for a single minor sign, up to 35 days for a moderate one, and up to 42 days for a serious one (four weeks of pause, then one or two weeks of wind-down). Then it's deleted. New writing can start a new pause, with its own record.
• Profile snapshots and check-ins [Not yet active: not built.] are kept while your account is active. Deleting or editing an entry recalculates the snapshots too (Section 2c).
• Your writing-style baseline (not yet active) is recalculated whenever you edit or delete an entry, removed when no entries remain that it's based on, and deleted with your account.
• Collective learning (Section 3a): turning the setting off, or deleting your account, deletes your learning-dataset rows and the link to them right away.
• Conflict Coach sessions are deleted automatically 30 days after they start. You can delete any session yourself, sooner, at any time in the app, and it's deleted right away. Their safety screening results hold none of what you wrote (only the kind and level of any concern, and when it was checked) and are kept for 30 days from when they were made, even if you delete the session sooner, so that safety protections keep working. A takeaway you save to your journal is an ordinary entry and stays until you delete it. [Not yet active: in testing.] A shared session (Section 5) has its own, shorter clock: it's deleted for both of you 7 days after you've both approved, or sooner if either of you closes or deletes it.
• Growing as a partner [Not yet active: in testing.] — your check-in answers are kept until you change them, delete them, or delete your account. Delete my growth answers (on the growth screen) deletes your answers, what we worked out from them, and the safety screening and categories of anything you wrote in the check-in's optional box, and turns growth off. Growth ideas you were already shown stay in your suggestion history, like other suggestions. Everything is included in "Download my data" and deleted with your account.
• Unlinking from a partner stops the cross-partner suggestion pipeline immediately, but does not delete either person's own journal entries, survey answers, or profile. Both first names are erased from the link record at that moment; the record keeps only that the link existed, and its dates, until either account is deleted.
• The wrong-code counter covers only the past hour, and is deleted with your account.
• Conflict Coach replies you report are deleted automatically 90 days after you report them, even though the session itself goes after 30 days, so we have time to look into them. They're included in "Download my data" and deleted with your account.
• Tester feedback (testing versions only) is included in "Download my data", deleted with your account, and otherwise deleted 90 days after testing ends.
• Empty accounts that were never verified. If you signed up with an email address, never verified it, haven't used Cheramor for 30 days, and the account holds nothing you wrote (no journal or "Tell Me Anything" entries, no written survey answer, no Conflict Coach sessions) and has never been linked with a partner, we delete the account and everything in it automatically, without the 14-day window described below, because there is nothing to recover and we have no confirmed way to reach you. We never delete an account this way if it holds anything you wrote, or if it has ever had a paid subscription or purchase.
• A copy you download ("Download my data", Section 9) is stored privately for you, deleted after 7 days, and deleted at once if your account is deleted. Its download link works for 24 hours. We keep only the date of your last copy, to allow one a day, and delete that with your account.
• Deleting your account (Settings → Privacy & data → Delete account). You confirm your identity, then type DELETE.
  • Your account is signed out right away, and nothing new is processed for it.
  • You have 14 days to change your mind: sign back in and choose to keep your account.
  • After 14 days (or within a day after), we permanently delete your journal and "Tell Me Anything" entries, what we derived from them (safety screening results, detected categories, and your profile), your survey answers, your sign-up answers, your suggestion and feedback history, any copy of your data you downloaded that we still store, your profile record, and your login account.
  • If you're linked with a partner, you're unlinked right away. They'll see that you're no longer linked, but not why, and none of your entries. Keeping your account during the 14 days doesn't link you again.
  • Honest limits:
    • Suggestions already sent can't be unsent.
    • If your account was linked to a partner, deleting it stops your data from being used going forward, but doesn't retroactively undo inferences already reflected in your former partner's own profile.
    • Our AI provider keeps text it processed for up to 30 days, or up to 2 years if its safety systems flag it (Section 4).
    • Our system logs, which never contain what you wrote, are deleted automatically after 30 days.
    • We don't currently keep database backups. The database itself keeps earlier versions of records for one hour, so deleted data is fully gone an hour after the purge.
• Legal holds. If we receive a valid subpoena, court order or other legal obligation to preserve records, or a lawsuit is reasonably expected, we may pause the automatic deletions in this section for the records involved, only for as long as the obligation lasts.
• You can request deletion at any time from Settings, or by contacting us at privacy@cheramor.com.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at privacy@cheramor.com or use the in-app tools in Settings. You can turn off "Shape my partner's ideas" at any time in Settings → Relationship. To withdraw your consent to Cheramor using what you write at all, delete your account (Settings → Privacy & data → "Health data consent" explains this). We'll answer a request by email within 45 days. To get a copy of your information, use Settings → Privacy & data → "Download my data". You confirm it's you (your password, or Google sign-in), and the app prepares a file of everything we store about you: a readable summary and the full data, in one zip file. The download link works for 24 hours, and the file is deleted from our servers after 7 days. You can make one new copy every 24 hours. The copy never includes anything that belongs to your partner: their entries, their account, the name they chose to show you, or their side of a shared Conflict Coach session, including their approved translation. It also leaves out one internal routing note made when an entry is checked for topics (Section 2c), and notification tokens, which only identify your phone to the notification service. Each copy lists what it leaves out. We record only that a copy was made and when, never what's in it. If the download doesn't work, contact us at support@cheramor.com ("Trouble? Email us" in the app); to keep your information safe, we send a copy only to the email address on your account. You can correct or delete your individual entries yourself at any time by editing or deleting them in the app (Section 8). You can also change any of your survey answers in Settings → "Update your survey answers"; a new answer replaces the old one, and what we infer from your survey is recalculated from your answers as they are now. You can also delete any Conflict Coach session yourself at any time; for a shared session, either of you can delete it, which deletes it for both of you (Section 8). These rights also cover what we infer about you: the categories detected in your entries (including how strongly each was expressed), your profile, its snapshots, and (once active) your writing-style baseline (Section 2c). [Not yet active: you will be able to turn collective learning on or off at any time in Settings (Section 3a).]

• California residents: Under the CCPA/CPRA, you have the right to know what personal information we collect, to delete it, to correct it, and to non-discrimination for exercising these rights. We do not sell or "share" (as that term is defined under California law) your personal information.
• EU/UK/EEA residents (if and when the app is offered there): Cheramor isn't offered in the EU, the UK or the EEA yet. This section will be completed before it is.
• You can adjust notification frequency, choose when notifications may arrive (delivery window and quiet hours), pause them (or turn them off completely in your device settings), revisit the "how suggestions work" explainer, and choose whether to get suggestions about physical affection or your sex life (Settings → "More ideas, if you'd like"; Section 5) at any time in Settings.

10. Children's privacy

Cheramor is intended for adults and is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect information from anyone under this age; if we learn we have, we will delete it.

11. International data transfers

Cheramor's data is stored and processed in the United States, by Google Cloud (through Firebase) and by our AI provider, Anthropic (Section 4).

12. Security

What we do to protect your information:

• Encryption: everything sent between the app and our servers is encrypted in transit, and our cloud provider (Google Cloud) encrypts stored data at rest.
• Who can read what: database rules let each person read only their own records. Sensitive records, such as safety screening results, can only be written by our servers; the app can read your own, to show you support when it's needed. Your partner's account can't read any of your records, beyond the first name you chose to show them and that you're linked.
• Checking it's you: downloading your data and deleting your account both ask you to sign in again first. Conflict Coach, AI sorting and partner linking need a verified email address.
• Keys and logs: our AI provider's key is kept on our servers, never in the app. Our system logs record what happened (for example, that an entry was screened), never what you wrote.

No method of transmission or storage is completely secure, and we can't guarantee absolute security. If a breach affects your information, we'll tell you as the law requires.

Optional app lock. You can turn on "Lock Cheramor with fingerprint" in Settings → Privacy & data. Your phone does the fingerprint, face or PIN check; Cheramor never receives your biometric data, and the on/off setting is stored only on that phone, not with your account. While it's on, Cheramor's screens are hidden in your phone's recent-apps view. On Android 12 and older, the only way to do that also blocks screenshots and screen recordings of Cheramor while the lock is on. Separately, on Android, the shared Conflict Coach screen can't be captured in screenshots or screen recordings, whether or not the lock is on; nowhere else in the app blocks screenshots.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll notify you in the app or by other reasonable means before the change takes effect. Continued use of Cheramor after a change takes effect means you accept the updated policy.

14. Contact us

Questions about this policy or your information can be sent to privacy@cheramor.com.