The Couple’s Currency

Privacy Policy

1. Who we are

The Couple's Currency (the "app", the "Service", "we", "us", "our") is operated by E and E Ventures LLC, 24910 Kuykendahl Rd, Tomball, Texas 77375, United States. Privacy questions: privacy@thecouplescurrency.com. The Service is offered in the United States.

2. The zero-knowledge model, first

When you and your partner pair, each of your devices generates its own key pair (RSA-OAEP, 2048-bit). Your devices then agree a shared content key (AES-256-GCM) that is exchanged between them wrapped in those keys. The private keys and the shared key live on your two devices. They are never sent to us in a form we can use.

Everything you create together is encrypted with that shared key before upload: messages, flirts, photos, videos, voice and audio notes, journal entries, daily check-ins, daily-question answers, offers and their replies in the Exchange, calendar items, session transcripts and notes, thoughts on terms and articles. What reaches our servers is ciphertext. That has three consequences we want you to understand:

• We cannot read it. Not our staff, not a support request, not an automated system. We also cannot moderate its plaintext or produce it in response to a legal demand, because we do not hold the key.
• Neither can our providers. The database, the file storage and the email service see the same ciphertext we do.
• If both of your devices lose the key and you have no restore path, that content is gone. Not archived somewhere for later, gone. The app offers a paired-device restore and a key backup; using them is your responsibility.

We verify this claim ourselves. A read-only audit runs against our database every morning and reports whether any registered content field is stored in cleartext. It reports zero.

3. What we collect

a. Account

• Email address and sign-in identity (Google sign-in, or an email sign-in link). Used to create your account, sign you in, pair you with your partner, and send account email.
• Display name and optional photo, shown to your partner.
• Settings: notification preferences, sharing levels, the comfort setting that decides what content is shown, feature toggles, the display name your partner sees.

b. Content you create

Listed in Section 2. Stored encrypted. We hold the ciphertext, the time it was written, which account wrote it and which pairing it belongs to. We do not hold the words, the pixels or the audio.

c. Billing

Payments are handled by Stripe. When you buy a plan, Stripe collects your card and billing address on Stripe's own page. We receive and store a Stripe customer identifier, the plan you chose, its status and renewal date, and the last four digits and brand of your card for display in your account. Your full card number never touches our systems. Stripe's own privacy policy governs what Stripe holds.

d. Collected automatically

• Diagnostic error reports: when the app hits an error, it records the error type, the screen it was on, the app version and the device or browser type. Never content, never keys.
• Coarse activity timestamps such as "last active", used to show your partner the state of the pairing and to keep the account tidy.
• Push notification tokens, only if you turn notifications on.
• Server logs kept by our hosting provider for security and abuse prevention: IP address, request time, request path. Retained for a short period and not joined to your content.

What we do not collect in the app: no behavioural analytics, no advertising identifiers, no third-party analytics or advertising SDKs, no location, no contacts, no device calendar, no health data. The app contains no tracking pixels.

e. Device permissions

• Camera and photo library: only when you attach or capture something. It is encrypted before it uploads.
• Microphone: only when you record a voice note, dictate, or take part in a session with voice. A recording is encrypted on your device before it uploads. Dictation — the live “type as you speak” microphone — is handled by your device's own speech service, not by us. On some browsers that runs entirely on your device and the audio never leaves it. On others, including every browser on an iPhone, the platform sends the audio to Apple or Google to turn into text. We never receive that audio either way, but it is not ours to make promises about, so the app tells you which one you are getting: where the platform’s service is doing the typing, the microphone button says so and wears an amber ring, and where your browser supports an on-device model the app offers to install it so the audio stops leaving.
• Notifications: only if you opt in.

4. How we use it

• To run the Service: sign you in, keep you paired, store and sync your encrypted space, show your account.
• To bill you for a plan you chose, and to show its status.
• To send the notifications you turned on and the account email you are owed (sign-in links, receipts, plan changes, security notices). Neither contains your encrypted content.
• To provide the guides you choose to use (Section 5).
• To find and fix errors, prevent abuse, and keep the Service secure.
• To comply with law.

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use your content, or anything derived from it, for advertising, profiling or training.

5. The guides, and where your words go when you use them

The app includes guides for structured talks and reflection (on your own, or together with your partner), reading help, and short lessons. When you use a guide, the text of that conversation — what you type or dictate, and the step of the walk you are on — is sent from your device, through our server, to Google's Gemini API to generate the reply, and the reply comes back the same way. This happens at the moment you use it, for that request only.

Recorded audio, when you ask for it to be written out. If you record instead of typing and the app turns that recording into text, the audio itself travels the same path — from your device, through our server, to Google's Gemini API — because that is where the transcription happens. The stored copy of the recording stays encrypted and unreadable to us; it is the transcription request that leaves. If you would rather no recording of your voice reach an AI provider, type instead, or use the live microphone on a device that has an on-device model.

What travels with your question. A guide is given a little context so its answer fits you rather than being generic, and you should know exactly what that is: your first name and your partner’s first name, your comfort level, and anything you wrote in your own profile about your relationship or what you are working on. That is the whole list. Your messages, flirts, journal entries, photos, check-ins and answers are not sent — they stay encrypted and we could not send them if we wanted to. The deep dives in the Directory send less still: the term and your comfort level, with no names at all. Nothing is sent in the background or on a schedule; this happens only in the moment you ask a guide something. You can see the same breakdown inside the app, under How the guides work.

• Our server relays the request and does not keep a readable copy. The conversation is stored in your space encrypted like everything else.
• We use Google's API under its paid-service terms, under which Google states that content sent through the API is not used to train or improve its models. [CONFIRM: project on the paid API tier — Estevan]
• The guides are software. They are not therapists, counsellors, clinicians or lawyers, and nothing they say is professional advice. If you are in danger or in crisis, the app tells you plainly that it is not the right place and points you to help.
• If you would rather no words of yours reach an AI provider, do not use the guides. Everything else in the app works without them.

6. Providers we rely on

A small number of companies process data on our behalf, only to provide their service to us, under contracts that restrict what they may do with it:

• Google Firebase / Google Cloud: sign-in, database, file storage, hosting, push delivery, server functions. Stores ciphertext and account records. United States.
• Google Gemini API: generates guide replies (Section 5).
• Stripe: payments, subscriptions, receipts, tax calculation, and the billing emails — receipts, the trial-ending reminder, renewal reminders, expiring-card and failed-payment notices (Section 3c).
• Email delivery: Google (sign-in links) and, for account and notification email, SendGrid.
• ElevenLabs: produces the recorded readings of our published articles and terms in advance. Nothing of yours is sent to it.

7. When we share

We share personal information only: (a) with your partner, as the Service is built to do; (b) with the providers above; (c) when the law requires it, in which case we can produce account and billing records but not the plaintext of your content, because we do not hold the key; (d) to protect the rights, safety or property of users, the public or us; and (e) if the business is sold or merged, in which case this policy continues to apply to the information transferred and you will be told.

8. Email and notifications

• Account email (sign-in links, receipts, plan and security notices, the note when a trial is ending) is sent to everyone with an account. It is about your account, not a sale.
• Everything else by email — tips, news, offers — is sent only if you have not opted out, and every such message carries an unsubscribe link and our postal address.
• Push notifications are off until you turn them on and can be turned off per kind in the app or in your phone's settings. Their text never includes your encrypted content.

9. Keeping and deleting

• While your account exists, your encrypted content is kept so the two of you can use it.
• Deactivate (Account → Privacy) locks and hides your account and archives your encrypted data. Nothing is deleted; sign in again to reactivate.
• Delete (Account → Privacy) permanently removes your account, your encrypted content and media, your sign-in, your push tokens, and ends the pairing. It cannot be undone. Content your partner created stays theirs.
• After deletion we keep only what the law makes us keep: billing and tax records held by Stripe and us for the period tax law requires (generally seven years), and short-lived security logs.

10. Your choices and rights

You can read, change and delete your account information in the app, export what you can see, and delete the whole account. You can turn every notification off, opt out of non-account email, and set the comfort level that decides what the app shows you.

California residents. Under the CCPA/CPRA you have the right to know what personal information we collect and why (this policy), to delete it, to correct it, to opt out of sale or sharing, and not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of in the app. Our public website uses advertising pixels (Section 12) and honours the "Do Not Sell or Share" control and the Global Privacy Control signal there. Categories we collect: identifiers (email, account id, Stripe customer id, push token), account and billing information, encrypted content you create, internet activity limited to error reports and server logs, and inferences: none. To exercise a right, use the app or email privacy@thecouplescurrency.com; we will verify the request through your signed-in account. An authorised agent may act for you with written permission.

Other US states with privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others) give similar rights to access, correct, delete and opt out. The same route applies. If we decline a request you may appeal by replying to our answer.

Outside the United States. The Service is offered in the United States and our systems are there. If you use it from elsewhere you accept that your information is processed in the United States. Where the GDPR or UK GDPR applies to you anyway, our lawful bases are contract (running the Service), legitimate interests (security, error fixing) and consent (notifications, guides, marketing email); you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your supervisory authority.

11. Security

Content is encrypted end-to-end (AES-256-GCM, RSA-2048 key exchange), everything travels over TLS, database and storage rules restrict every record to the accounts that own it, secrets are held in a managed secret store, and access to production is limited to the people who run it. No system is perfectly secure. If a breach affects your personal information we will tell you, and any regulator we must, without undue delay. Note that a breach of our servers exposes ciphertext, not your content.

12. Our public website

Our marketing site at thecouplescurrency.com is a separate surface from the app. It may load advertising and measurement pixels from Meta, Google and TikTok so we can tell whether our advertising works. They are loaded only with consent where consent is required, are not loaded for visitors in US states whose law requires an opt-out to be honoured before loading, and the "Do Not Sell or Share My Personal Information" link in the site footer turns them off. They are never present inside the app or in your account.

13. Children

The Service is for adults. You must be 18 or older to use it. We do not knowingly collect information from anyone under 18; if you believe someone under 18 has an account, tell us and we will delete it.

14. Changes

When this policy changes we post the new version with a new date and, for changes that matter, tell you in the app or by email before they take effect.

15. Contact

E and E Ventures LLC
24910 Kuykendahl Rd, Tomball, Texas 77375
privacy@thecouplescurrency.com