Privacy Policy — Reluvoa

Version: 1.2

Last updated: October 6, 2026

Effective date: October 6, 2026

Reluvoa is a private relationship copilot. It helps users understand content they deliberately select, keep an on-device relationship memory and prepare three editable suggestions. It does not read notifications, sign in to dating or messaging accounts, fill external fields or send messages.

1. Controller and contacts

Google Play publisher and controller: 2J LAMBRE, the publishing organisation displayed by Google Play, established in France.

Privacy requests and data rights: contactsnormal@gmail.com

Support and security: contactsnormal@gmail.com

No separate data protection officer is currently designated.

This version does not infer a legal form, registration number or postal address from the Play Console label alone. Legally verified public details required by Google remain those in the Google Play developer profile.

2. On-device data

At the user's direction, Reluvoa may process on device:

• a person's name, alias or label;
• voluntarily shared text and screenshots;
• text extracted locally using OCR;
• a voluntary voice draft transcribed only by the platform's on-device speech recognizer when available; no audio file is retained;
• user-confirmed source, relationship category and goal;
• summaries, facts, uncertainties, suggestions and edits;
• content-free outcome and writing-style preferences;
• language, retention and local-measurement settings;
• content-free deletion receipts and tombstones;
• the communication profile and preferences chosen by the user;
• a voluntarily created encrypted archive.

On Android, the local SQLCipher database is protected by Android Keystore. Android Auto Backup is disabled. On iOS, the local database uses iOS Data Protection with NSFileProtectionCompleteUntilFirstUserAuthentication, not SQLCipher. iOS exports and the share inbox use Apple system mechanisms and CryptoKit. Temporary images are encrypted and purged after OCR, rejection or expiry. Local product measurement is off by default and has no network transport. Data processed only on device is not “collected” for Google Play Data safety purposes.

3. Optional remote analysis

The local flow remains available without remote analysis. When a user explicitly enables remote analysis for one action, Reluvoa sends over HTTPS to its proxy:

• the latest selected text;
• language, source, relationship category and goal;
• where relevant, a minimal memory containing a summary, confirmed facts and uncertainties;
• a request ID, pseudonymous installation ID, integrity evidence and technical data needed for security and quotas.

Consent is timestamped and must be less than five minutes old. The proxy does not store prompt or output content in its application database, and application logs are designed to exclude content. It calls the OpenAI Responses API with store: false. OpenAI provides the requested remote-analysis service under the terms applicable to its API.

By default, OpenAI API abuse-monitoring logs may contain input and output and be retained for up to 30 days, unless longer retention is legally required. API data is not used to train OpenAI models unless the API customer explicitly opts in; Reluvoa must not opt in. Any approved Zero Data Retention setting must be verified on the production OpenAI project before publishing a shorter period.

Sources: OpenAI API data controls, OpenAI Services Agreement.

4. Server-side technical and purchase data

To secure the service, enforce quotas and provide Plus, the server currently stores:

• a pseudonymous Reluvoa account ID and an irreversible HMAC of the Firebase subject, account status and technical authentication timestamps;
• pseudonymous identifiers for devices linked to the account;
• a pseudonymous installation ID, device public key, attestation subject, platform, status and registration time;
• a client-encrypted recovery archive, its digest, size, revision and update time. The recovery code is not sent to the server and the server cannot read the archive contents;
• short-lived replay nonces and quota counters;
• product, base plan, entitlement state and expiry, plus a purchase-token hash — not the raw token in the database;
• RTDN event IDs used for deduplication;
• request metadata automatically logged by the Google Cloud Run host: IP address, user agent, status and latency. An IP address may reveal approximate location; Reluvoa requests no location permission and does not use this metadata for advertising;
• for a voluntary output report: an ID, category, language, suggestion kind and engine, without the conversation or suggestion text.

Reports can be withdrawn in-app and are then deleted. A signed endpoint also erases the installation's server data. The managed PostgreSQL runtime, its migrations and a point-in-time restore are deployed and verified. On 29 August 2026, the erasure flow was exercised twice from the Google Play-delivered 1.0.92/code94 build: the server returned HTTP 200, the app displayed its receipt, and a new remote analysis created a new technical registration before a second erasure was confirmed. Encrypted disaster-recovery copies may retain the earlier state temporarily until the published policy expires: eight daily backups and seven days of transaction logs. They are not used for another purpose.

Google Play processes purchases under Google's terms. The proxy uses Android Publisher and RTDN solely to verify, restore, revoke or refund an entitlement.

5. SDKs and recipients

Bundled ML Kit OCR may send Google device and app information, a per-install identifier, performance metrics, API configuration, input/output sizes, feature version, event type and error codes for diagnostics and usage analytics. Google states that this data is encrypted in transit and not shared with third parties. Screenshot content and recognized text are not listed as collected for Text Recognition.

Source: ML Kit data disclosure.

Recipients are 2J LAMBRE, Google Cloud as proxy hosting processor, Firebase Authentication for account sign-in and management, OpenAI for user-requested remote analysis, Google Play for purchases, Apple for Sign in with Apple and iOS App Store purchases/subscriptions, and Google/ML Kit for the diagnostics above. Depending on the selected sign-in method, Firebase may process the email address, provider identifier, IP address and user agent. Regions, subprocessors, international transfers and safeguards are maintained in the internal processing record and reviewed whenever a provider changes.

6. Purposes and legal bases

7. Retention and security

Confirmed messages default to 90 days on device. Users may choose 30, 90 or 365 days, or no expiry. Derived memory has a separate choice. Exported .relubak archives are controlled by the user and their file provider.

Application traffic uses HTTPS. The proxy requires integrity evidence, request signatures, nonces and quotas. OpenAI and HMAC secrets remain server-side only.

8. Controls and deletion

Reluvoa distinguishes:

1. Remove from history: deletes messages; memory remains only by explicit choice.
2. Reset learning: deletes derived memory, outcomes and checkpoints, while retaining the person and messages.
3. Forget this person completely: deletes the person, messages, memory, outcomes and checkpoints, retaining a content-free anti-resurrection tombstone.

Uninstalling deletes app-managed local storage but not an exported archive, content copied elsewhere, a Google Play subscription or provider-held data.

New versions offer Google on Android and Google or Apple on iOS, after the demonstration and before the first private analysis. There is no Reluvoa password login or reviewer-code login. The historical email link may remain available in older Android versions during replacement; it is not an option in the new iOS candidate. In Your space menu > Privacy, Delete my Reluvoa account deletes the Firebase account, server links, client-encrypted recovery archive and private app-managed data. Local erasure occurs only after a server receipt, so a network interruption cannot produce a false confirmation.

A deletion request can also be initiated without reinstalling the app at: https://reluvoa-ai-proxy-p6f43gxasa-ew.a.run.app/legal/delete-data.html. Deleting the account does not cancel a subscription managed separately by Google Play or the App Store.

9. Rights, adults and third-party data

Local controls let users view, correct, export and delete relationship data. The publisher cannot remotely retrieve content that stayed on device. Applicable access, rectification, erasure, restriction, portability and objection requests for publisher-held data may be sent to contactsnormal@gmail.com; responses are generally made within one month, subject to lawful checks and extensions. Users may complain to the CNIL or their competent authority.

Reluvoa is only for adults aged 18 or over. Imported content may concern third parties and be intimate. Users must minimise it, respect rights and refusals, and never use Reluvoa for harassment, surveillance, coercion or impersonation.

People whose messages or information are imported may be data subjects under the GDPR even if they do not use Reluvoa. Depending on the context, GDPR Article 14 may require information about indirectly obtained data. The publisher documents the applicable obligations, any statutory exception, its proportionality and the safeguards used on a case-by-case basis. Reluvoa does not assume that individual notice is automatically unnecessary.

Reluvoa does not reuse conversations to train a general model, create a directory of third parties, sell profiles or make automated decisions producing legal effects. Local-first processing, encryption, minimisation, per-action remote consent and deletion reduce risk; they do not justify claiming that the product has no legal risk.

Suggestions can be wrong, do not reveal a third party's intent, and do not replace health, legal or emergency professionals. Users review, edit and manually copy every suggestion.

10. Support and changes

Never send support a real conversation, personal screenshot, archive, database, password, MFA code or recovery code. Use synthetic examples and content-free error codes.

Any material change to authentication, sync, telemetry, the AI provider or remote speech recognition requires a prior update to this policy, the Data safety form and the DPIA.

Google Play references: User Data, Data safety.