Legal
Privacy Policy
Last updated: 22 October 2026
Petals is a daily ritual for couples: one question a night, answered privately by each partner and revealed together. This policy explains what the Petals app and website collect, why, who processes it for us, and the choices you have.
1. Who is responsible
The controller of your personal data is Ivor Visković, Split, Croatia (support@getpetals.app). You can reach us at support@getpetals.app.
2. Your account
When you first open Petals, the app creates an anonymous account for you. You do not need an email address, phone number or password to use Petals.
Your account is identified by a random user ID. Petals does not ask for your email address or a password.
If your partner invites you, you can also answer in your browser without the app: the browser gets an anonymous account the same way, your answer is stored and protected like an answer in the app, and a 6-digit code can move it into the app later.
3. What we collect
- Name — the first name or nickname you enter. Your partner sees it.
- Partner connection — the invite code you share or redeem, and the link between your account and your partner's.
- Nightly answers and reactions — your answer to each night's question, the reaction you leave on your partner's answer, the date and question, and the energy and comfort level you chose.
- Daily dares — which dares you completed and the label you gave them.
- Attachment portrait — your responses to the attachment-style questions and the portrait that results.
- AI reflections — the reflections written for you, only if you allow them (see section 7).
- Profile photo (optional) — a photo you choose from your library. In the current version of the app it stays on your device and is not uploaded to our servers.
- Email address (optional) — only if you add one.
- Push token — a device token that lets us send the reminders and partner notifications you allow.
- Purchases — your subscription status, product, and renewal and expiry dates. Payment itself is handled by Apple or Google; we never see your card details.
- Product analytics — which screens you open and which features you use (for example, that you answered a question), linked to your random user ID. The text of your answers is not sent to analytics.
- Crash reports — technical details when the app crashes or hits an error: device model, operating system and app version, the error, and your random user ID.
- Settings — language, notification time, intimate content level and boundaries, used to pick suitable questions and dares.
Account data, answers and reactions are stored in our database hosted by Supabase.
4. Sensitive information
Petals asks about your relationship, and some questions are about intimacy. Your answers can reveal information about your sex life, sexual orientation or health. Under the EU General Data Protection Regulation (GDPR) these are special categories of personal data (Article 9).
We process this information only to run Petals for you and your partner, and only on the basis of your explicit consent (Article 9(2)(a) GDPR).
You can withdraw your consent at any time by deleting your account (section 9). Withdrawal does not affect processing that happened before it.
You decide how deep questions go: intimate content can be limited or turned off in Settings › Comfort & Safety.
5. What your partner sees
Petals is made for two. The app shows your answer to your partner only after you have both answered that night's question. Until then, neither of you sees the other's answer.
After the reveal, your partner can see your answers, reactions, name and your shared garden in the app.
Your attachment portrait is private to you. A couple reflection uses both partners' answers and portraits only if both of you have allowed AI reflections.
We do not show your answers to anyone other than your partner.
6. How we use your data, and on what basis
- Running Petals (questions, reveals, your garden, the partner connection, notifications) — necessary to provide the service you asked for (GDPR Art. 6(1)(b)); for sensitive answers, your explicit consent (Art. 9(2)(a)).
- Managing your subscription — necessary for the contract (Art. 6(1)(b)) and for our accounting obligations (Art. 6(1)(c)).
- Product analytics — our legitimate interest in understanding which parts of Petals work (Art. 6(1)(f)). You can turn analytics off at any time in Settings › Privacy › Share Analytics.
- Crash reports — our legitimate interest in keeping the app working and secure (Art. 6(1)(f)).
- AI reflections — your consent (Art. 6(1)(a) and Art. 9(2)(a)), asked for in the app before anything is sent.
We do not sell your data, use it for advertising, or track you across other companies' apps or websites.
7. AI reflections
AI reflections are optional and stay off until you allow them. The app asks for your permission before anything is sent, and our server checks that permission on every request.
When you allow them, Petals sends your recent answers and your attachment results to Anthropic, which writes the reflection and returns it to us. For a couple reflection, your partner's answers and results are included only if your partner has also allowed AI reflections.
Anthropic processes this data to provide the service to us and does not use it to train its models. Anthropic may keep this data for a limited period for safety monitoring and then deletes it.
You can withdraw at any time in Settings › Privacy › AI reflections. After that, nothing more is sent.
Reflections are for your own thinking. They are not therapy, diagnosis or professional advice.
8. Who processes data for us
We use these providers to run Petals. Each one processes data only on our instructions and for the purpose listed.
- Supabase — database, sign-in and server functions. Privacy policy
- Apple App Store, Google Play and RevenueCat — purchases and subscription status. RevenueCat privacy policy
- PostHog — product analytics, which you can turn off in Settings. Privacy policy
- Sentry — crash and error reports. Privacy policy
- Expo — delivers push notifications through Apple and Google. Privacy policy
- Anthropic — AI reflections, only with your consent. Privacy policy
Some of these providers are based in, or process data in, the United States. Where personal data leaves the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, as applicable to each provider.
9. How long we keep data, and how to delete it
We keep your account data for as long as you have an account.
Delete in the app: Settings › Privacy › Delete Account. This immediately and permanently deletes your profile, answers, reactions, garden, dares, attachment results, AI reflections and your sign-in record. The nights you shared are deleted for both partners, and your partner is unlinked and notified.
Delete without the app: use our account deletion page or email support@getpetals.app.
Deleting your account does not cancel a subscription. Cancel it in your App Store or Google Play settings.
Copies in database backups are removed when those backups expire. Analytics and crash data are kept only as long as the retention periods set with those providers. Apple, Google and RevenueCat may keep purchase records where the law requires it.
10. Your rights
Depending on where you live, you have the right to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent at any time. Under the GDPR you can also complain to a data protection authority, in particular in the country where you live or where we are established.
You can do much of this in the app: edit your profile, turn analytics or AI reflections off, or delete your account. For anything else, email support@getpetals.app. Because accounts are anonymous, we may ask for your invite code or another detail to confirm the account is yours.
11. Security
Data is encrypted in transit. Database access rules limit each account to its own data and its partnership's data. Your sign-in token is stored in your device's secure storage. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
12. Age
Petals is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 is using Petals, contact us and we will delete the account.
13. This website
This website uses Vercel Analytics and Google Analytics to count visits. If you join the waitlist, we store your email address with Supabase and send emails through Resend. You can ask us to remove your email at any time.
14. Changes to this policy
If we change this policy, we will update the date at the top. For significant changes, we will also tell you in the app.
15. Contact
Questions or requests about your data: support@getpetals.app.
Controller: Ivor Visković, Split, Croatia (support@getpetals.app).