Privacy notice

Information and where it comes from

Dovlets holds account and authentication details, profile choices, relationship and shared-space records, plans, dates, notes, journals, private reflections, personal goals and milestones, social links, beta request notes, gifts, ideas, check-ins, notifications, settings, sharing and invite records, privacy requests, and limited operational email records. Information comes from you, from the person who links a shared space with you, and from Google when Google sign-in is enabled and you choose it.

Dovlets does not intentionally ask for special-category details. Free-text fields can nevertheless contain intimate, health, or sexual-orientation information. Any intentional use of that content needs a separately reviewed Article 9 condition, including during the private beta.

Why information is used

The application uses information to provide accounts and shared features, preserve each member's chosen private and shared records, secure and operate the service, send low-volume transactional notices, respond to support and rights requests, and meet record-keeping duties. The applicable Article 6 bases still require Task 8 review and are not asserted here.

Personal reflections and goals are private to your account. Social links start private and are shown to your current partner only when you choose to share them. Beta request notes are shown to the beta owner to review access requests.

Dovlets does not add advertising, behavioural analytics, or marketing email.

Configured or intended service providers

The repository is configured or intended to use Vercel for application hosting, Turso/libSQL for the database, Resend for transactional email, Google OAuth when enabled, and Cloudflare for DNS and intended email routing. Actual production plans, regions, contracts, routing, international transfers, and safeguards require Task 8 verification before release.

How long records are kept

Ordinary account and shared content is kept until deletion or another relevant product event. Unconverted waitlist entries expire after 12 months. Sent email-outbox recipient and template data is redacted after 30 days; terminally failed rows after 90 days. Terminal privacy-request records are kept for two calendar years, then deleted.

Live deletion is not the same as immediate backup removal. Backup periods, beyond-use controls, and provider deletion behaviour require Task 8 verification, so this notice does not promise an unverified backup expiry.

Account and shared-space deletion

Deleting one account removes that member's account and private records while keeping the other member's account and the shared-space root. Structured shared records stay with that space; former-member attribution is anonymised where the data model permits. Partner-authored shared free text can retain the deleted member's text where removing it would alter the remaining member's record.

Deleting the shared space is a separate action. It removes the shared root and its shared records, detaches members, and keeps each member's own account and private journal entries, reflections, goals and social links (with sharing reset).

Your choices and rights

Depending on the circumstances and processing basis, rights may include access, correction, erasure, restriction, objection, and data portability. You may use the account centre or make a request by email in any reasonable wording. Dovlets may need to verify identity and consider other people's rights before responding.

You can complain directly to Dovlets, and you do not have to contact Dovlets before you complain to the ICO. The ICO also publishes guidance about your data rights.

Contact and requests