Privacy Policy

Last updated: 18 August 2026

LightVow holds things people wrote for someone they love. This page says exactly what we store, where it physically lives, who else can touch it, and how to get it back or have it erased. The controller is Ravid Zer, a sole trader registered in Israel; write to hello@lightvow.com about anything here.

What we collect

What	Why
Your email address	To sign you in, to send the link that confirms the address is yours, and to tell you when a vow you sent has been delivered.
Your display name	It is the name your recipient reads above the message. Without it, a vow arrives signed by nobody.
Your recipient's name, relationship, email and optionally phone	To address and deliver the vow. You give us this about someone else — see below.
The vow itself: your text and any photo, video, voice note or document	It is the thing we are keeping. We do not read it, scan it, sell it, or use it to train anything.
Delivery records — when we tried, whether it was accepted, why it failed	So a failure is visible and can be retried, and so we can prove what happened.

We do not use analytics or advertising trackers, and we set no non-essential cookies. The only cookies are the ones that keep you signed in.

We never see your card details. Payments are handled entirely by Paddle, Apple or Google.

Where it lives

Text, names, dates and delivery records — a PostgreSQL database hosted by Supabase in Frankfurt, Germany (EU).
Photos, video, audio and documents — Cloudflare R2, a private bucket. Nothing in it is public; the app hands out short-lived links that expire within the hour.
Outgoing email — Resend, sending from the EU (Ireland) region.

Who else touches it

Only the services that make the product work: Supabase (database), Cloudflare (media storage), Resend (email), Vercel (hosting), and Paddle, Apple or Google for payments. Each gets the minimum it needs. Nobody buys, rents, or receives your data for their own purposes.

About the person you are writing to

When you name a recipient you give us their details. You are responsible for having a reason to contact them; we are responsible for using it only to deliver your vow.

A recipient can write to us and ask what we hold about them, ask us to correct it, ask us to stop a delivery, or ask us to erase their details. We will honour that even though it was you who gave us the data — and we will tell you that a delivery was stopped.

What deleting actually deletes

A sealed vow is kept until it is delivered and opened — that may be years, by design.
The magic link in a delivery email expires after 90 days or ten opens. A recipient with an account can always mint a fresh one; the link's expiry never decides whether a memory still exists.
Delete a vow and its media are removed from storage and its delivery is cancelled.
Delete your account and you choose what happens to vows you have sealed but that have not yet arrived: cancel them, or let them still be delivered. Vows already delivered stay with the person who received them — once somebody has been told a letter is waiting, it is not only yours to take back.
Records we are required to keep — payment and tax records, and the minimum needed to prevent fraud — remain for as long as the law says, detached from you where they can be.

Why we are allowed to hold it

Under the UK and EU GDPR every use of personal data needs a lawful basis. Ours, in plain terms:

To run the service you asked for (performance of a contract) — your account, your vows, storing them, and delivering them on the date you chose.
To reach your recipient (legitimate interests) — holding their name and contact details for the single purpose of delivering what you addressed to them. We balanced that against their interests and concluded it is what a person would expect of a letter addressed to them; they can object at any time and we stop.
To take payment and keep records (contract, and legal obligation) — tax and accounting law requires us to keep transaction records for several years even after you leave.
To keep the service safe (legitimate interests) — rate limits, abuse prevention, and the logs that make a failure visible.

We do not rely on consent for any of the above, so there is no consent to withdraw. We also do not sell personal data, do not share it for cross-context behavioural advertising, and do not profile anyone — which, in the language of California's CCPA and CPRA, means there is nothing for you to opt out of.

Who processes it for us

We use a small number of providers, each for one job, each under a data processing agreement:

Supabase — the database and accounts. Hosted in the EU (Frankfurt).
Cloudflare R2 — the files you upload. Hosted in the EU.
Vercel — running the website and the delivery worker.
Resend — sending the emails that carry your vows.
Paddle — the merchant of record for purchases on this website. Paddle is the controller of your payment details; we never see a card number.
RevenueCat — reconciling purchases across the web, Apple and Google.

We will update this list when it changes. If you would like the current version at any time, ask.

How long we keep it

Vague answers here are how retention promises get broken, so these are the actual periods, and they are the ones the software enforces.

A vow that has been delivered — for good. Not for a stated number of years: for good. It is the recipient’s, whatever plan you were on, whether you later cancelled, and whether or not you are still here. If you delete it yourself before it is delivered, it goes; once somebody has received it, it is not yours alone to withdraw.
A sealed vow that has not been delivered yet — until its day, however far away that is. That is what you paid for when you chose the date.
A vow that lapsed — one that was never delivered and now never can be, because nobody ever gave us an address for it. Kept twelve months after it lapses, so it can still be rewritten and sent, then removed. We write to you before that happens and you can download everything in it at any point.
A draft — until you seal or delete it. We may remove drafts left untouched for a long time, and will warn you first.
Your account — until you delete it.
Payment records — as long as tax law requires, typically seven years, even after your account is gone.
Delivery logs — twelve months, so a failure can be explained.

Your rights

You can ask us for a copy of everything we hold about you, ask us to correct it, ask us to erase it, or object to how we use it. One email to hello@lightvow.com is enough, and we answer within 30 days.

If you are in the EU or UK and you think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first.

Keeping it safe

Everything travels over TLS and is encrypted at rest.
Delivery links are stored only as a hash — the link itself exists in your recipient's email and nowhere else, so even we cannot reconstruct it from the database.
Row-level security means one account cannot read another's vows, and a sealed vow cannot be altered by anyone through the app.
The claim page is rate-limited and returns identical errors for wrong, expired and used links, so it cannot be probed to discover live ones.

Children

A vow addressed to a child is exactly what this product is for. But you must be at least 16 to create an account yourself, and 18 where local law requires it.

International transfers

Data is stored in the EU. Where a provider processes it elsewhere, that transfer is covered by Standard Contractual Clauses or an equivalent safeguard.

Complaining about us

If you think we have handled your data badly, please tell us first — hello@lightvow.com — because most of it we can simply fix.

You also have the right to complain to a supervisory authority without going through us. In the EU that is the data protection authority of the country you live in; in the UK it is the Information Commissioner's Office; in Israel it is the Privacy Protection Authority. You do not need our permission and we will not hold it against you.

Changes

If we change this policy in a way that matters, we will tell you before it takes effect rather than quietly updating the date.