Privacy Policy
On this page
WeOnly helps two partners track closeness and intimacy in their relationship. That is unusually sensitive information, so this policy is written to be read, not skimmed. It describes exactly what we store, what we never store, who else can see it, and how to delete all of it.
In short
- Your notes are encrypted with AES-256-GCM before they reach our database.
- Your partner sees your closeness ratings and statistics from the day you connected, plus what you choose to share. Never your notes.
- AI reflections run only with your permission. A note is sent only if its AI sharing is on, which you decide note by note or by having your new notes start shared, and your question of the day answers only if you switch that on.
- No ads, no third-party trackers, and we never sell your data.
- You can delete everything at once in Settings → Delete account.
This summary does not replace the full policy below.
1. Who we are
WeOnly is operated by Fariz Mirzayev. For any question about your data, write to support@weonly.app.
2. What we collect
| Data | Why |
|---|---|
| Sign-in identifier from Apple or Google, and an email address if you choose to share one | To recognise your account. If you use Apple's "Hide My Email", we only ever see the relay address. An account without an email works exactly the same. |
| If you sign in with an emailed code: a keyed fingerprint of your email address, and of the one-time code | To recognise your account without storing the address: the fingerprint cannot be read back into an email address. Codes expire after 10 minutes. If Apple or Google has confirmed the same address on your WeOnly account, both ways of signing in open that one account. |
| When you create your first AI reflection: a one-time device check through Apple (DeviceCheck) | So that the free first reflection is used once per device. Apple keeps a single yes/no flag for this device; we receive that answer only. We do not store a device identifier, and neither your entries nor your account are sent to Apple for this. |
| Nickname | Shown to your partner instead of your email address. |
| Birth year, gender, relationship length, whether young children live with you, whether you live together or at a distance, what brings you to the app, love language, attachment style | Used only to give the AI reflections context. Asked once during setup: birth year, gender, relationship length, living arrangement and what brings you to the app need an answer; for young children you can choose “Prefer not to say”, for love language and attachment style “Not sure” — then nothing is stored. You can change them anytime in Settings. |
| Daily entries: date, a closeness rating from 1 to 5, optional tags, whether intimacy happened, who wanted or started it, and an optional free-text note | This is the core of the product: your history, statistics and trend. |
| Weekly check-in: satisfaction, whether you wanted intimacy that did not happen and why, whether your partner initiated, and situational tags | Feeds the trend and the AI reflections. |
| Couple link: an invite code, who is connected to whom, and anything you deliberately share with your partner — shared drawings, memories and their photos, compatibility answers, daily question answers | The shared features only exist once both of you have approved the connection. |
| Special dates you add, items you write for the touch game, and date ideas you save or mark as done (which idea and on which day); when you send a date idea to your partner, which idea it was and how many you have sent that day | Reminders, in-app games and your own idea list; a sent idea appears in your partner's notifications, and you can send up to 3 a day. Your partner does not see your saved or done ideas. |
| AI reports generated for you, and whether you marked one as helpful | So you can read them again later. Your helpful / not helpful rating is stored with that report, deleted with it, and counted only in aggregate to improve the reflections. |
| Subscription status and the App Store transaction that proves it | To unlock WeOnly Pro. We never see your card details — Apple handles payment. |
| Device notification token, time zone, chosen language | To send the evening reminder at the local time you choose (8pm unless you pick another), in your language. |
| If Live Activities are on for WeOnly (iOS 17.2 and later): the token that lets us show your partner's invitation on your Lock Screen, and for each invitation card its own token until the card ends | So your partner's invitation to “A moment together” or the touch game appears as a live card (“Your partner is waiting”) instead of a notification, and disappears once you join, your partner leaves or 30 minutes pass. The card contains no content; your partner's name comes from your iPhone and is hidden while app lock is on. |
| If you use the WeOnly widgets: a separate widget key (we store only a fingerprint of it), on iOS 26 the widgets' notification token, when you last sent “Thinking of you”, and which memories you or your partner chose to show on the Memories widget (and who chose each) | So the widgets can show your partner's “Thinking of you”, whether today's question has been answered, the memories you two chose and your latest shared drawing, without opening the app. The widget key works only for the widgets — it cannot read your entries, notes or AI reports, and it can fetch only the photos of memories chosen for the widget, never their text, and a simplified copy of the drawing you share on “Draw together”. The Memories widget keeps copies of those photos on your iPhone and deletes them as soon as a memory is removed from the widget, you sign out or you disconnect. |
| Messages you send to support from the app: the topic, your text, the email address to reply to, a screenshot or image from your photos only if you choose to attach it, and the app version, iOS version, device model and language | To answer you. They are not stored in our database — they go straight to our support mailbox. |
| If you delete your account: a reason you pick and a comment you write, both optional | To learn why people leave. The reason is only counted — it is not linked to you or your account. A comment goes to our support mailbox without your account number or email address, and nothing of it is stored in our database. |
| Which days you used the app, with the first and last hour of that day (UTC, rounded to the hour) | To see whether people come back. Nothing about what you did or wrote is stored with it. Deleted with your account, and after 90 days at the latest. |
| A minimal audit log: event type and account number only | Security. It contains no content whatsoever. |
Usage statistics. From the records above we also count, in aggregate, how WeOnly is used — for example how many accounts are active each week, how many people complete a setup step, which features are used and how many subscriptions are active. Only we do this, on our own server: no third-party analytics service is involved, the results contain no entry content, and they are never shared or sold.
Anonymous setup counts. To see where new users get stuck — often before they have an account — the app also sends us anonymous counts of setup steps, for example "language chosen", "sign-in screen shown", "reminders allowed", "a WeOnly widget was added to the Home Screen or Lock Screen" or "the app was opened again a day or a week after it was installed". Each step is sent at most once per installation, together with only the app version, the app language and the install source described below. We store nothing but daily totals: no account number, device identifier, IP address or content is saved with them, so they cannot be linked to you. Once after installation, the app asks Apple whether this install came from an Apple Ads ad. Apple's answer contains nothing that identifies you or your device. We keep only the result, added to the same daily totals.
Anonymous usage path. To see which parts of the app are useful, the app also sends the order of what happens in it, for example "app opened", "Statistics tab", "entry saved", "app closed". Each step is only a name, sent with the hour it happened (rounded to the hour), the app version, the app language and a random number created for this installation. That number is not connected to your account: these messages are sent without signing in, and no account number, device identifier, IP address or content is saved with them. A step never says what you wrote or chose — "entry saved" does not include your rating or your answers. You can turn this and the setup counts off in Settings → Privacy → Anonymous usage data; the app then stops sending them and forgets the random number.
Before you connect with a partner. If you try a shared feature on your own, your drawing, secret game picks and memory drafts (including photos) stay on your device only and are not sent to us. They reach our servers, and your partner, only if you choose to share them after you connect. Signing out or deleting your account removes them from the device. Compatibility answers are saved to your account as usual; your partner never sees an individual answer.
3. What we never collect
- Your real name, address, phone number or exact date of birth. We ask for a birth year only, so that "typical for your age" means something.
- Your location. WeOnly never requests it.
- Your contacts, photo library, calendar or microphone. Photos you attach to a memory are the ones you pick yourself, one at a time; before upload the app makes them smaller and removes their location and camera details. If you save a memory's photo, the app can only add it to your library — it cannot read your photos.
- Advertising identifiers. WeOnly contains no advertising, no third-party analytics SDK and no tracking across other apps or websites. The one Apple Ads check described in section 2 uses no advertising identifier.
- Payment card details.
4. What your partner can and cannot see
This is the part people worry about, so it is deliberately narrow. Once you and your partner have both approved the connection, they can see:
- your daily closeness rating (the number from 1 to 5) and your summary statistics;
- whatever you deliberately share with them: drawings, memories, daily question answers, date ideas you send them, and compatibility items only where you both answered yes. Your answers reach your matches at 8 pm, not the moment you tap them;
- how many compatibility items you have answered — only the number, never which items or what you answered;
- that you tapped “Thinking of you” and when (for 24 hours), and whether you have answered today's question — never your answer unless you both answered;
- which memories you chose to show on the Memories widget — the choice is shared, so a memory either of you chooses appears on both of your widgets, and either of you can remove it;
- if you subscribe to WeOnly Pro, that their Pro comes from your subscription — but never your plan, price or renewal date.
Your partner can never see:
- anything from before the two of you connected — for example, your ratings or compatibility answers from a previous relationship;
- your note text — it is not merely hidden, it is absent from the data the app sends about you;
- whether intimacy happened, or who wanted it;
- your tags, your weekly check-in, or any AI reflection written for you;
- a one-sided "yes" on the compatibility list — a match appears only when you both said yes;
- any day you marked as hidden from your partner.
Notifications never contain content. A notification tells you something is waiting; it never shows a note, a rating or an AI result on your lock screen.
5. Artificial intelligence
WeOnly's weekly reflection and 28-day deep check are generated by Anthropic's Claude API. What we send is a compact summary of your ratings, tags and profile context, a week-by-week summary of up to the last 12 weeks, and the text of your earlier AI reflections (so a new report can build on the previous one).
Your note text is only sent if "Share this note with AI" is on for that specific note. Consent is given per note, it is off by default, and a note without consent is not included in the request at all — the model is not told that such a note exists. Exact calendar dates are not sent either; the model sees relative days within the period, the day of the week and the month.
If you switch on "Share my new notes with AI" (Settings, off by default), that switch starts on for each new note you write, and you can still turn it off for any note. Notes you wrote earlier stay as they were. Switching it off also stops every note you have shared from being sent for any later reflection.
Your question of the day answers are only sent if you switch on "Include my question of the day answers" (when you give permission for reflections, or later in Settings → AI reflections). It is a separate choice, off by default. When it is on, your own answers from the days the reflection covers are sent together with the question they answer — the 7 days of a weekly reflection or the 28 days of a deep check, including answers you wrote before you switched it on. Your partner's answers are never sent. Switching it off stops this for every reflection from then on.
AI is used only with your explicit permission. The app shows exactly what is sent and asks for permission before your first reflection. Without it, nothing is sent to Anthropic and no report is generated. You can withdraw it at any time in Settings → AI reflections.
Anthropic processes this data to produce the response. Anthropic does not use API data to train its models. If you would rather not use AI at all, leave this permission off: tracking, history and statistics work completely without it.
If you report an AI reflection from the app, we may read that one reflection to review your report. Nothing else from your account is opened for this, and the report itself never includes your note text.
6. Who else processes your data
- Apple — sign-in, subscription payment and validation, the device check for the free first reflection, and delivery of push notifications.
- Google — sign-in, if you choose that option.
- Anthropic — AI reflections, under the limits in section 5.
- Railway — hosting of the servers and database, in the United States (east coast). If you use WeOnly from outside the United States, your data is transferred there for storage and processing.
- Resend — delivers the support messages you send from the app to our support mailbox, which is hosted by Apple (iCloud Mail), and, if you sign in with email, the sign-in code to the address you enter. Resend is based in the United States.
Each of these providers receives only the data needed for its task and provides the same or equal protection of your data as described in this policy.
We do not sell your data, we do not share it for advertising, and we do not hand it to anyone else except where the law requires it.
7. How it is protected
- Note text, special-date titles, memories and their photos, and AI report text are encrypted with AES-256-GCM before they are written to the database. They are never stored in plain text.
- Sign-in tokens are stored on your device in the iOS Keychain, and on our side only as an irreversible SHA-256 hash — a stolen copy of the database cannot be used to sign in as you.
- All traffic between the app and the server uses HTTPS.
- Sensitive values are never written to server logs — the logs contain account numbers, not content.
8. How long it is kept
- Your entries are kept until you delete them or delete your account.
- Sign-in sessions expire after 30 days of inactivity and are then removed automatically. Records of one-time email codes are removed within 2 days.
- When a couple disconnects, shared drawings and memories are not deleted immediately: the person leaving chooses a keep-for period of 7, 14, 21 or 28 days, and the person staying may extend it. If you reconnect within that period, the shared content comes back. When the period ends, it is permanently deleted.
- Support messages are kept in our support mailbox only as long as needed to help you, and deleted within 12 months of the last reply. Comments left when deleting an account are deleted within 12 months.
- Deleting your account deletes everything at once — see the next section.
- Anonymous setup counts (section 2) are daily totals that identify no one; we keep them to compare app versions over time.
- The days you used the app and the anonymous usage path (section 2) are deleted after 90 days.
- Our database is backed up only to recover from a technical failure. Backups roll over automatically, so anything you delete is also gone from them within about five weeks. Fields that are encrypted in the database (section 7) stay encrypted in the backups.
9. Your rights
- Delete everything. Settings → Delete account. This is immediate and permanent: entries, check-ins, AI reports, subscription record, notification tokens, widget keys and the couple link are all removed. There is no recovery, and no waiting period. Only the minimal audit log stays — event type and account number, no content — so that the deletion itself is on record for security. Copies in our technical backups expire within about five weeks (section 8).
- Take a copy with you. The statistics screen exports a PDF of your own data. It never includes your note text or your partner's data.
- Withdraw consent. Turn off AI reflections in Settings, or AI sharing for any note or for your new notes; turn off notifications; disconnect from your partner. Each of these is a single control in the app.
- Ask us anything about your data at support@weonly.app. If you are in the EEA or the UK, you also have the right to access, rectification, restriction, portability and to lodge a complaint with your data protection authority.
10. Age
WeOnly is for adults. It is not directed at anyone under 18, and we do not knowingly collect data from anyone under 18. If you tell us your birth year, the app will not accept a year that would make you younger than 18.
11. Changes
If this policy changes in a way that affects you, we will say so in the app before the change takes effect. The date at the top always shows the current version.