Privacy Policy

Last updated October 19, 2026. Heartread is operated by Riverside Art LLC, the data controller ("we", "us"). This policy explains what we collect, why, how long we keep it and the choices you have. Reach us through the support page.

What we collect

• Quiz answers. Your answers to all 40 questions, including questions about intimacy, closeness and conflict, and the scores we compute from them (attachment style, personality traits, love languages, archetype, goals).
• Account details. Email, a password stored only as a salted scrypt hash (we never store or see your password), birth year, gender, who you are interested in, country, and city if you give one.
• Photos, if you add them. Up to three photos, resized in your browser before upload, which removes location data and other metadata.
• Readings and the manual. The text of your vibe reading and, if you buy it, your manual.
• Technical data. Browser type, language, the country our hosting provider derives from your connection, and the time of each step. We do not use advertising cookies. We use two strictly necessary cookies: one to keep you logged in and one to save quiz progress before you create an account.
• Usage counts. Our servers record which pages and quiz steps are used (for example, quiz started, results viewed, checkout started) and send them to PostHog, our product analytics provider. No analytics cookie or script is placed in your browser. Before you start the quiz the visit is labeled with a code derived from your connection that changes every day and cannot be turned back into it; after that, with your quiz or account code.
• Purchases. If you buy the manual, the payment processor (Stripe on the web, Apple in the iOS app) handles your card. We receive only a receipt reference, amount and currency.

Sensitive data and your consent

Answers about intimacy and relationships, and photos of you, can count as sensitive personal data under laws such as the EU and UK GDPR, Brazil's LGPD, Korea's PIPA, Japan's APPI and several US state laws. We process them only with your explicit consent, which you give separately when you create an account and when you upload photos. You can withdraw it at any time by deleting your account, which deletes this data.

How we use your data

• To score your quiz and show your results, vibe reading and manual.
• To run your account, keep you logged in and process purchases.
• To keep the service secure and fix problems.
• For research and product improvement, using de-identified data only, as described below.

AI processing

Your vibe reading and manual are written by a large language model (Google Gemini) through its API. We send your photos (for the vibe reading) or your scores (for the manual), not your email or name. A couples report is written from both people's scores: attachment style, love languages, the five trait scores and archetype, which the two of you already see on your comparison page. Either of you can buy it, and both sets of scores go to the model only after both of you say yes. Under Google's paid API terms, this content is not used to train Google's models. The vibe reading looks at mood, expression and styling only. We do not create face geometry, face templates or any biometric identifier, and the model is instructed not to infer ethnicity, health, age, sexual orientation or attractiveness. Vibe readings are for fun and self-reflection.

De-identified research data

If you opt in, we keep a de-identified copy of your answers and scores, linked to a random code instead of your email, name or photos, along with broad demographics (five-year age band, gender, country). We use it to research relationships and personality, improve our questions and results, develop and test new features including matching, and train our own models. Our data team works only with this de-identified data, through a read-only database role that cannot see emails or photos. De-identified data may be kept indefinitely because it no longer identifies you. We do not try to re-identify it.

Who can see your data

Your results are private to you. Inside Heartread, a small number of authorized staff can access full records, including photos, to operate the service, answer support requests and check quality; every such access to a profile or photo is logged. We share data with service providers that run Heartread for us under contract: Vercel (hosting and support messages), Neon (database), Google (AI processing), PostHog (usage counts), Stripe and Apple (payments). They may process data only on our instructions.

Sharing and comparing. If you share your result, the link shows its names (archetype, attachment style, love language) and your position on the attachment map, never your answers, photos or account details. If someone takes the quiz from your invite, or you take it from theirs, each of you can see the other's results side by side once both have an account. Either of you can stop comparing at any time from the comparison page, which also deletes any couples report for the two of you.

We do not sell your personal data, and we do not share it with data brokers or advertisers. We will disclose data if the law requires it, or to a successor if Heartread is sold or merged, under the same promises made here.

How long we keep it

We keep account data, answers and photos until you delete your account. Quiz runs you never attach to an account are deleted after 12 months. Deleting your account removes your account, answers, results, photos, readings and manual from our live database right away, and from backups within 30 days. De-identified research data that no longer identifies you may remain.

Your rights

You can download all of your data and delete your account from the Account page at any time. Depending on where you live, you may also have the right to correct your data, object to or restrict processing, and complain to your data protection authority. Write to us through the support page and we will reply within 30 days.

Where data is stored

Heartread runs in the United States. If you use it from another country, your data is transferred to the US. Where the law requires it, we rely on your explicit consent and on our providers' standard contractual protections for these transfers.

Security

Data is encrypted in transit (TLS) and at rest by our database provider. Passwords are hashed. Photos are served only to you and to authorized staff, never from a public link. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Age

Heartread is for adults 18 and over. We do not knowingly collect data from anyone younger and delete it if we find it.

Changes

If we change this policy in a way that matters, we will tell you in the product or by email before the change applies to data we already hold.