LoveWatch

Privacy Policy

What LoveWatch stores about you, why, and how to remove it

Last updated: October 6, 2026

This policy describes what LoveWatch (lovewatch.live) actually stores and does with your data. It is written from how the service works, not from a template.

What we store when you create an account

When you sign up we store:

  • your email address and display name;
  • an optional avatar image;
  • if you sign up with a password, that password stored only as a hash — we cannot read it back.

Each signed-in session also records the IP address and browser user-agent it was created from. This exists so that you (and we) can spot a login that isn't yours. Session records are deleted when the session expires or you sign out everywhere.

To limit password guessing and repeated emails, we count sign-in, sign-up and email requests per IP address for up to an hour.

Email we send

We send transactional email only: email verification, password reset, replies to messages you send us, and — only if you switch it on for a companion — a short note when that companion writes to you first while you are not in the chat. That note quotes the start of the message and links to a page where you can turn it off. There is currently no marketing mailing list. If we start one, subscribing will be disclosed here first, and every such email will contain an unsubscribe link.

Conversations with your companion

When chat features are available in your account, the messages you send and the video replies generated for you are stored in your account so your conversation history works across devices. They are used to provide the service and are never shared with other users or used for advertising.

We do not expire them. A video you paid for stays until you delete it from Moments, or until you delete your account, at which point every one of them is deleted along with the files behind them. If that ever changes we will say so here first, and in the product.

Where your conversation actually goes

Generating a reply means sending your message to companies outside LoveWatch. Naming them is the point of this section:

  • Your text goes to OpenRouter, which routes it to the model that writes the reply: DeepSeek during the free trial, MiniMax on a paid plan. Both are suppliers based in China. If you are not comfortable with your messages reaching a provider in that jurisdiction, this is the paragraph to act on.
  • Voice, when voice replies are switched on, is generated by MiniMax directly.
  • Your character's portrait and the prompt describing the scene go to fal.ai, which runs the video model.
  • Images we generate — a character's portrait and scenes, and the first frame of a video you share — are checked by OpenAI's moderation service before they are used or published.
  • We send what is needed to produce the reply. We do not send your email address, your name, or your billing details to any of them.

A short summary of your relationship and a profile of things you have told your companion are kept so she remembers you between sessions. Those summaries are generated from your messages and travel the same path. You can view and delete them.

Photos you upload for a character

If you create a character from a photo, the pipeline is deliberately narrow:

  1. You confirm the photo is yours or that you are authorised to use it, and that the person in it is an adult.
  2. We run face detection on it. A photo with no face, more than one face, a face our checks read as a minor, or a public figure is rejected and nothing further happens. These checks send the photo to Amazon Web Services (Rekognition), for face detection and public-figure recognition, and to Sightengine, for the age check. They analyse the face in it; neither is asked to keep it.
  3. The photo is restyled into a semi-realistic canonical portrait. The restyle is done by our image provider (fal.ai), so the original photo reaches them for that one step, and again if you ask for another look at it (up to two more).
  4. Only the restyled portrait and the scenes derived from it are ever sent to the video model. The original photo is never used to generate a video.
  5. The original photo is deleted within 24 hours, or as soon as the character is finished.

You can upload up to twelve photos a day; a refused photo does not use one of your characters.

Do not upload a photo of someone who has not agreed to it, and do not upload a public figure.

Videos generated for you

Finished videos are stored on Cloudflare R2 and served from lovewatch.live itself (under /api/media/). A private video is reachable only through a short-lived signed link — roughly an hour — that is issued to your session; the link is not guessable and expires on its own. Every video generated for you carries a machine-readable marker identifying it as AI-generated, and the player shows an AI badge.

If you create a share link, that specific video becomes publicly readable to anyone with the link, and no part of your conversation goes with it. Revoking a share link stops it working straight away; a copy a browser or our cache already holds can be served for up to about a minute after that. Deleting the video itself from Moments deletes the file.

If someone reports a shared video, we keep a one-way hash of the reporter's network address (not the address itself) with the report, so that three reports have to come from three different people.

Files you upload

Files you upload (such as an avatar) are stored on Cloudflare R2 under your account and are deleted when you delete them or your account.

Payments

Paid plans are sold through Waffo Pancake (Waffo.com Limited), which acts as the merchant of record. When you buy a plan you are redirected to Waffo's hosted checkout; your card details are entered on and processed by Waffo, never on our servers. We receive your email address, order and subscription status, and the billing country needed for tax, and we store those to grant access to paid features. Waffo's handling of your data is described in its own privacy policy at https://www.waffo.ai/en/privacy.

Analytics

We measure how the site is used with three services, and only these three:

  • Plausible Analytics — counts page views and product events. We run it on our own server rather than sending your visit to Plausible's hosted service. It sets no cookies, stores no identifier for you, and cannot follow you to another site.
  • Google Analytics 4 — the same page views and events, so that they can be read alongside our Google Search Console data. This one does set cookies (_ga and _ga_…); the cookie policy lists them.
  • PostHog (US) — the same events, used to see where people drop out of sign-up and checkout. It keeps a random identifier in a cookie and in local storage, and when you are signed in it links that identifier to your account id (not your email or name), so a visit before sign-up and the account after it count as one person. Requests to PostHog go through our own domain (/api/ingest) and on to PostHog. Session recording and automatic click capture are off.

You can confirm what is running on the page you are reading by opening your browser's network tab and looking for analytics.xhorizon.org, googletagmanager.com and /api/ingest.

What we send them is page addresses and a fixed list of product events: a public page or the guest page being opened, a guest conversation starting, a first message, a video being requested and becoming ready, a guest reaching the sign-up prompt, a sign-up being submitted and verified, the pricing page being viewed, a checkout being opened and a payment completing. Alongside those we may send a character's short name (such as mia), a plan name and billing interval (such as pro, month), how you signed up (email or google), whether you were signed in, and which button or page led there.

What we never send them is anything you wrote. No message, no reply, no display name, no email address, no photograph. That is enforced in the code by a list of permitted fields for each event rather than by care at each point where an event is sent, and there is a test that fails if the list is bypassed.

If we ever add another service, this policy and the cookie policy change first.

The contact form

The contact form sends your name, email address and message to us by email. We use it only to reply to you.

Who processes data for us

  • Cloudflare hosts the site and stores our database and files. Like any host, Cloudflare processes requests on our behalf and keeps its own short-term logs, which include IP addresses, under its terms.
  • OpenRouter routes your messages to a text model.
  • DeepSeek (China) writes the text replies during the trial; MiniMax (China) writes them on a paid plan and, when voice replies are switched on, generates the audio.
  • fal.ai generates the portraits, scenes and videos.
  • Amazon Web Services (Rekognition) and Sightengine check an uploaded photo for faces, public figures and age.
  • OpenAI checks generated images (portraits, scenes and shared first frames) for unsafe content.
  • PostHog, Google Analytics and Plausible (self-hosted) measure use, as described above.
  • Cloudflare Email sends transactional email.
  • Discord receives our internal alerts, including a note of each new order with the buyer's name or email address, in a private channel.
  • Waffo Pancake (Waffo.com Limited) is the merchant of record for paid plans and credit packs.

We do not sell your data to anyone.

Taking a copy

In settings, under Security, Download a copy gives you one JSON file with your account details, the characters you created, every conversation (messages, memories and relationship) and the share links you made.

Deleting your data

You can delete your account at any time in settings. Deletion removes your account, sessions, uploaded files, conversation history, memories, characters you created and the videos generated for you, along with the R2 objects behind them. Share links you created stop working.

If we cannot identify all files belonging to your account, deletion pauses and you can try again; your account stays in place. Once the files are identified, a temporary storage outage does not prevent account deletion. Any incomplete file cleanup is recorded for follow-up and may finish later, so account deletion does not confirm that every stored file was physically removed at that moment.

Deletion is not reversible and we do not keep a shadow copy, with one narrow exception: we keep a keyed one-way hash of your email address, with the old account's id and the date its trial started, so that deleting an account and signing up again with the same address does not start a second free trial. It cannot be turned back into the address. Payment records Waffo holds as merchant of record are kept by Waffo under its own policy. What we cannot reach is what has already left: a message that was sent to a model provider is subject to that provider's own retention, which is why the section above names them.

Changes

If we materially change what we collect or who processes it, we will call the change out on this page rather than quietly editing it.

Contact

support@lovewatch.live