Privacy Policy

DeluluJar is made by AnyFikra. When this page says “we” or “us”, that's who it means. We're the data controller for the information described below. You can reach us at privacy@anyfikra.com for anything privacy-related, or support@anyfikra.com for everything else.

This policy covers the DeluluJar mobile app and the delulujar.com website, including the public message pages at delulujar.com/q/​your-handle.

Your account

• Your email address and password, handled by Firebase Authentication — we never see your password.
• If you use Sign in with Apple, we get whatever Apple sends us. If you chose to hide your email, we only ever see Apple's private relay address.

Your profile

• The things you enter during onboarding: name, nickname, gender, birthday, the date your relationship started, your love language, your favourite memory, dream date, colour, food, drink and hobbies.
• Your profile photo, if you add one.
• Your public handle, if you set one up. This is the only part of your profile that anyone can look up without being paired with you — see anonymous messages below.

What you create in the app

• Notes you send and receive, including the paper colour and handwriting you picked, and any bouquet you build.
• Photos and voice clips attached to notes, stored as files in Firebase Storage.
• Your reactions to notes.
• Your mood, your vibe, and the per-day vibe calendar that builds up from them.
• Rituals — journal entries, gratitude notes, sparks, workouts and photos.
• Shared lists, trips and trip items.
• Anonymous messages people send to your handle.

Location — only if you ask for it

Find Each Other is off unless you turn it on. While it's on, the app stores a single pair of coordinates: your most recent position. There is no location history — each update overwrites the last one. Turning sharing off deletes the record entirely.

Device and diagnostic data

• Which platform you're on (iOS or Android) and the app version, so we know when to prompt an update.
• A push notification token, so your partner's notes can reach you. It's stored on your profile and removed when your account is deleted.
• Crash and error reports through Sentry. These include an account identifier and your IP address alongside the technical details, which is how we tell “this is broken for everyone” apart from “this is broken for one person”.
• An advertising identifier, if you're on a free account and consented to tracking — see ads below.

Purchases

Delulu+ is billed by Apple or Google, not by us. We receive a subscription status and a purchase identifier from RevenueCat and store them on your profile so the app knows whether to hide the ads. We never receive your card number, billing address, or anything else you gave the app store.

If you're in the UK or the EEA, the GDPR requires us to name a legal basis for each use. Here they are.

• To run the service — storing your notes, syncing them to your partner, delivering push notifications, keeping you signed in. Basis: performing our contract with you.
• To keep it working — crash reports, debugging, abuse prevention, and the force-update check. Basis: our legitimate interest in a functioning, non-abusive app.
• To show ads on free accounts — basis: your consent, which you give through the iOS tracking prompt or Android ad settings, and can withdraw at any time.
• Optional features — location sharing and your public handle. Basis: your consent, withdrawn by turning the feature off.
• To email you about the service — occasional announcements about DeluluJar itself. Basis: legitimate interest, and you can unsubscribe.

We do not use the content of your notes for advertising, and we do not use it to train machine learning models.

Pairing is the whole point of the app, so it's worth being precise about what it opens up. Once you're paired, your partner can see:

• Your profile — including your nickname, birthday, and the answers you gave during onboarding.
• Notes in their own jar that you sent, and the reactions on them.
• Your mood, your vibe, and your vibe calendar.
• Your rituals, shared lists, trips, and the photos attached to any of them.
• Your location, but only while you have Find Each Other switched on.

Your partner cannot see the anonymous messages in your Feed my Delulu inbox unless you show them.

You can only be paired with one person at a time. Unpairing cuts off their access to everything above from that moment on — but notes already delivered are an exception, covered under deletion.

If you set up a handle, anyone with the link can send you a message from delulujar.com/q/​your-handle without signing in. We designed this to be genuinely anonymous, so it's worth spelling out both directions.

• We store only the message text, who it's for, and when it arrived. No sender name, no account, no IP address, no device information.
• That means we cannot tell you who sent a message, even if you ask us to, and even if the message is abusive. There is nothing on file to look up.
• Sender IP addresses are passed to Cloudflare for the are-you-a-bot check and are not written to our database.
• Your handle resolves to your display name and profile photo on that page. Don't pick a handle you'd rather not have linked to you publicly.

If the inbox becomes a problem, you can change or remove your handle in the app, which immediately breaks the old link.

Free accounts see two kinds of ad from Google AdMob: a rewarded ad you choose to watch for coins, and an occasional full-screen ad before a note opens. A Delulu+ subscription removes both.

• On iOS, the app asks for permission through Apple's App Tracking Transparency prompt. Decline it and AdMob serves non-personalised ads instead. You can change your mind in Settings → Privacy & Security → Tracking.
• On Android, you can reset or delete your advertising ID in Settings → Privacy → Ads.
• AdMob is Google's product and operates under Google's own privacy policy. We don't send them your notes, your profile, or your email.

We don't sell your personal information, and we don't share it for cross-context behavioural advertising. The companies below process data on our behalf so the app can function:

Beyond that, we'd only disclose data if the law required it, or if it were genuinely necessary to protect someone's safety. If we're ever acquired, your data would transfer with the app and we'd tell you before it did.

Your data travels over TLS and is encrypted at rest by Google. Access is governed by security rules that check, on every single read, that you're either the owner of the data or the partner they paired with. Nobody can browse the user list, and nobody can add themselves as your partner without an invitation you created.

Your notes are encrypted in transit and on disk, but not end-to-end, so a small number of authorised people at AnyFikra can access stored content through our internal tools. We do that only to fix bugs, answer support requests, investigate abuse, and meet legal obligations — we don't read your notes for any other reason.

We keep your data for as long as your account exists. Delete your account from Profile → Settings and the app immediately removes your profile, the notes in your jar, your rituals, lists, trips, anonymous messages, location, uploaded photos and voice clips, your push token, and your handle. Your partner is unlinked at the same time.

Backups can hold residual copies for up to 30 days after deletion, after which they roll off. Apple and Google keep their own records of your purchase for their own accounting reasons — those aren't ours to erase.

Wherever you live, you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that's wrong — most of it you can edit yourself in the app.
• Delete your account and everything attached to it.
• Stop a particular use, or withdraw a consent you gave.

The fastest route for deletion is the in-app button, which does the whole job in one step. For anything else, email privacy@anyfikra.com from the address on your account and we'll respond within 30 days.

If you're in the EEA or the UK, you also have the right to complain to your local data protection authority. If you're in California, we confirm that we have not sold or shared personal information in the preceding 12 months, and we won't discriminate against you for exercising any of these rights.

DeluluJar isn't for children. You need to be at least 13 to use it, and at least 16 if you're in the EEA or the UK. If we find out an account belongs to someone younger, we delete it. If you believe a child has signed up, tell us at privacy@anyfikra.com and we'll take care of it.

Our infrastructure runs on Google Cloud and Vercel, which means your data may be processed outside your own country, including in the United States. Where that involves an EEA or UK transfer, it relies on the European Commission's Standard Contractual Clauses. Our error reporting is hosted in the EU.

When we change this page we update the date at the top. If a change meaningfully affects what we do with your data, we'll tell you in the app before it takes effect rather than quietly editing the page.

Questions, complaints, or a correction to something here: privacy@anyfikra.com. This policy is governed by the laws of Morocco, without prejudice to any data-protection rights you have where you live.