Privacy
LDR is an app for two people who are far apart. This page says exactly what it keeps, what it refuses to keep, and who can read it.
The short version
LDR holds what you deliberately make and send to one other person: photos, videos, voice notes, letters, drawings, answers, and a few settings. There is no advertising, no analytics, no tracking, and nothing is sold or shared with anyone. If the app crashes it sends a report saying what broke — never what you were doing, and never anything you made. If you turn presence on, your partner sees one word — a place you named, or the neighbourhood you are in — and never an address, never a map, and never a notification when you move.
What it keeps
- Your Google account details. Your name, email address and profile picture, from signing in with Google. The email address is what an invite is addressed to, which is how two people become a couple rather than a crowd.
- What you make and send. Photo, video and voice clips; letters and drawings; answers to questions; how you are feeling and any note you add to it.
- Your settings. The name you go by, the nickname you give your partner, your colour palette, your relationship start date, your next visit date, your wake-up time, your time zone, and the place name you set for yourself.
- Presence, only if you turn it on. Two separate things, kept separately — see below.
- A notification token for your device, so a notification can reach the right phone.
What it refuses to keep
- No advertising identifiers, no ad networks, no third-party trackers.
- No analytics. Nobody is counting your taps.
- No location history. Presence keeps the current word and nothing before it.
- No profiling, no inference, no training of anything on your content.
- Nothing is sold, rented, or handed to anyone for their own purposes.
Presence, in detail
Presence is off until you turn it on, and it is two different things that are kept apart on purpose.
- Places you name — Home, Work, a friend's flat — are stored with their coordinates so your phone can recognise them. These are held where no app can read them, including your partner's; the rule that enforces that denies every client, and only the server may touch them.
- The word your partner sees is just that: a word, with the time it was set. A place you named, else the neighbourhood you are in, else nothing at all. Your coordinates never reach them.
If the phone has not given LDR background location permission, presence publishes nothing rather than falling back to a worse signal. A word that only appears when you happen to open the app would quietly say home far more often than it is true, and a misleading word is worse than a blank one.
You can turn presence off whenever you like, and forget any place you named.
Who can see what
- Your partner sees what you send them and your presence word. Nothing else.
- Nobody else. Another couple using LDR cannot reach your space — that separation is enforced by the database's own rules rather than by the screens, and it is tested.
- An unanswered question stays sealed. Until you have written your own answer, your partner's answer is not merely hidden from the screen — it cannot be fetched at all.
- We can. Being honest about it: as the operator, the account that administers the project can technically reach stored data. It is not read, not analysed, and not used for anything. There is no team; there is one person.
Where it is stored, and who else is involved
LDR runs on Google Firebase — sign-in, database, file storage and server functions — in Google's United States data centres. Everything travels encrypted.
- Google Firebase stores the data and handles sign-in.
- Apple and Google's own geocoders, on the phone itself, turn a position into a neighbourhood name. This happens on the device.
- Expo's push service, with Apple and Google's, delivers notifications. A notification carries no words from any answer or message.
- Sentry receives a report when the app crashes: what broke, where in the code, and on what kind of phone. It is told nothing you made and nothing about who you are — no clip, no caption, no answer, no feeling, no place name, no name, no email address, and no account identifier. The app is built so that it cannot send those: the trail of recent activity a crash reporter normally gathers is switched off at the source, and screenshots of the app are never taken. One thing is outside our control and worth saying plainly: because the report is sent over the internet, Sentry can see the address it came from and records roughly which city that implies. We have turned off everything they offer for this and the city remains. It is never joined to your account, and it is not the presence feature — your partner is told nothing by it.
How long it is kept
What you have made together stays while you are paired. If either of you unpairs, the space is archived rather than deleted, so that two people who pair again can choose to bring their record back. An archive and all its media are permanently deleted one year after the unpair.
Deleting your account
In the app: Settings → Delete account, or, if you are not paired with anyone, the same thing on the pairing screen. If you have already uninstalled it, write to [email protected] from the address you signed in with, and a person will do it and reply.
Deleting your account removes your account and everything the app keeps about you as a person, permanently and at once. It does not delete what you and your partner made together: that is theirs as well as yours, so your couple space is archived instead and is permanently deleted when its year is up, as above. What deletion takes, in full.
Children
LDR is not intended for anyone under 13, and is not directed at children.
Changes
If this page changes in a way that matters, the app will say so rather than leaving it here quietly. The date below is the last change.