Together — Privacy Policy

Last updated 17 October 2026. Controller: My Indie Studio, the developer of Together on Google Play. Contact for privacy requests: info@usetogether.app.

Together is an app for two partners. This policy explains what we collect, why, who processes it, how long we keep it and what you can do about it. It applies to the Together Android app and this website.

1. What we collect

• Account: your email address and a salted Argon2id hash of your password, or your Google account identifier and name when you sign in with Google; your display name, time zone, device region and language, app language, interests and evening ritual time.
• Content you create: day notes (text, voice recordings and their transcripts, photos and captions), check-ins, your private turns in “Talk it through”, summaries you confirm, plans, plan reactions and agreements, topic feedback.
• Sensitive information: this content can reveal information about your relationship, sex life or emotional health. We process it only with your explicit consent (see section 3).
• Consents: the time and version of your acceptance of the Terms and of the separate sensitive-data consent.
• Purchases: the Google Play purchase token, product, subscription state and expiry, used to verify Together+. We never receive your card details.
• Notifications: a Firebase Cloud Messaging token and the app language of the device, when you allow notifications.
• Password reset: a keyed hash of a one-time code, valid for 15 minutes, when you ask to reset your password. The code itself is never stored or logged.
• Technical data: IP address and request time, used for rate limiting and security; server logs record error categories, not your content.

Together shows no ads, contains no third-party analytics or advertising SDK, does not use the Advertising ID and does not sell or share personal data for advertising.

2. How we use it

• To run your account, sign you in and connect you with the partner you invite.
• To provide the features you ask for: evening topics, rephrased check-ins, plans for two, conversation coaching, summaries, shared plans and weekly recaps. These are generated by AI in your app language.
• To transcribe voice notes into text.
• To check text for safety before anything is shared or generated, and to show crisis resources instead. Safety stops never notify your partner.
• To verify subscriptions, send reminders and partner notifications, and email password reset codes.
• To protect the service against abuse.

We do not use your content to train AI models and we do not make decisions with legal or similarly significant effects about you by automated means.

3. Legal bases (EEA, UK and similar laws)

• Contract (GDPR Art. 6(1)(b)): your account, the features you use and subscription verification.
• Explicit consent (Art. 9(2)(a)): processing relationship and well-being information, including by the AI providers below. You give it in the app before adding any content and can withdraw it at any time in Us → Settings → Privacy. Withdrawal does not affect earlier processing; afterwards the app stops adding, sharing and generating from sensitive content, while you can still read, export and delete your data.
• Explicit consent to transfer (Art. 49(1)(a)): sending text to DeepSeek in China, which has no EU adequacy decision (see section 5).
• Legitimate interests (Art. 6(1)(f)): security, rate limiting and preventing abuse.
• Legal obligation (Art. 6(1)(c)): where we must keep or disclose data by law.

4. What your partner sees

A note is shown to your partner only when you choose “Shared”. Your private notes, your private conversation turns and the original words of a check-in are never shown to your partner. A check-in is shared only as the rephrased text you approve. A summary becomes part of a shared plan only after you confirm it, and shared plans and agreements are visible to both of you. When you leave a couple, your earlier shared notes become private again.

5. Service providers and international transfers

Providers process data only to deliver these features. DeepInfra’s terms include a data processing agreement. DeepSeek’s platform terms do not offer a data processing agreement or EU standard contractual clauses, and China is not recognised by the EU as providing an adequate level of data protection. Authorities there may have broader access to data than in the EU. We send text to DeepSeek only after your explicit consent and only with names and contact data removed. If you do not want this, do not give the sensitive-data consent or withdraw it; AI features then stop.

6. Storage and security

Traffic between the app and the server is encrypted with HTTPS. Sensitive text and derived results are encrypted at rest with a per-user key that is itself encrypted with a server master key; deleting your account deletes your key. Photos and voice recordings are kept in private storage reachable only through short-lived signed links. This is not end-to-end encryption: the server decrypts content to provide features and to send it to the providers above.

7. How long we keep data

• Your account and content: while your account exists, until you delete them.
• A deleted note: removed after a 5-second undo window.
• After you leave a couple: shared plans and agreements stay read-only for 30 days, then are deleted; a couple with no remaining members is deleted.
• Sign-in sessions: access tokens expire after 15 minutes, refresh tokens after 60 days and are deleted a day after expiry.
• Password reset codes: 15 minutes, at most 5 attempts, deleted after use.
• Rate-limit counters: 1 to 2 days. Processed background jobs: 30 days. Request de-duplication keys: 60 days.
• Account deletion: your records, your partner-visible content, your encryption key and your push tokens are deleted immediately; erasure of uploaded media is queued and completed by the background worker.

8. Your rights

You can access and export your data (Us → Settings → Privacy → Export), correct your profile, withdraw consent, leave your couple and delete your account in the app or at /delete-account. You may also email us to access, correct, erase, restrict or object to processing, or to receive your data in a portable format. We answer within one month. You can complain to your local data protection authority; in the UK, the ICO.

California and other US states: we do not sell or share personal information for cross-context behavioural advertising and do not use sensitive personal information to infer characteristics beyond providing the service. You can request access, correction and deletion as described above; we will not discriminate against you for doing so.

9. Age

Together is only for adults aged 18 and over. We do not knowingly process data of anyone younger; if you believe a minor uses Together, contact us and we will delete the account.

10. Safety

Together is relationship coaching. It is not a medical or mental-health service and not an emergency service. If you are in danger, contact local emergency services.

11. Changes

We will update this page and its date when this policy changes, and ask for consent again in the app when a change requires it.