Privacy Policy

Last updated: 8 September 2026

loved (“we”, “us”) is operated by loved.com Inc. This policy explains what information we collect when you use the loved website or mobile app to send or receive a gift, why we collect it, and the choices you have.

Information you give us

When you send a card or gift, or sign in, we collect:

• Your name, mobile number, and (optionally) email address
• Your return address, if you provide one
• The recipient’s name, mobile number, email, and delivery address
• The note you write, your chosen card design, font, and any photo you upload
• Payment details — these go directly to our payment processor, Stripe; we never see or store your full card number

Your contacts (mobile app only)

If you grant Contacts permission in the loved mobile app, we read the name, birthday, phone number, and address already saved on each contact card on your device, and sync that to our servers so we can show you upcoming birthdays and remind you in time to send a card. This means we hold personal information about people who have never used loved and never agreed to this policy themselves — we use it only to power birthday reminders shown to you, never to contact those people directly, advertise to them, or share it with anyone else. You can revoke Contacts access at any time in your device’s Settings, which stops future syncing; ask us (see “Contact us” below) to delete previously synced contact data at any time.

Your profile photo

If you upload a profile photo, it is shown to other loved users who have your mobile number saved in their contacts — so when they open your page in the app, they see your photo rather than a blank initial. We match on the number alone: we never tell them anything else about your account, and we never tell you whose contacts you appear in. This is the only piece of your information that is shown to another user this way, and it only happens if you actually upload a photo. If you would rather not appear this way, don’t set a profile photo, or ask us (see “Contact us” below) to remove the one you have.

Information collected automatically

• A device push-notification token, so we can tell you when someone replies to a card you sent, or a birthday is coming up
• Crash reports and error logs (via Sentry) if the app or site encounters a bug, to help us fix it
• Standard technical data such as IP address and device/browser type
• For fraud prevention: your IP address and the approximate location it maps to (country/city — derived from the IP itself, not GPS), and, in the mobile app, a device identifier tied to this install (not an advertising ID — it resets if you uninstall every loved.com app on your device). We record these against orders and sign-in attempts so we can review suspicious activity; they’re not used to track you across other apps or websites.

How we use your information

• To print, package, and mail physical cards and gifts, or deliver digital ones
• To detect and prevent fraud and abuse (e.g. stolen cards, promo code abuse) — including via Stripe Radar’s own risk scoring on each payment
• To process payment and send you a receipt
• To send you and the recipient SMS/email updates about a gift (e.g. delivery status, a reply notification)
• To show you upcoming birthdays from your synced contacts
• To show your profile photo, if you have set one, to other loved users who have your number saved (see “Your profile photo” above)
• To keep your account signed in and secure, and to detect and fix bugs

We do not sell your personal information, or your contacts’ information, to anyone.

Who we share it with

We share information only with the service providers we use to actually run loved:

• Stripe — payment processing
• Twilio — SMS verification codes and delivery-status texts
• Resend — transactional emails (receipts, reply notifications)
• Google Maps Platform — address suggestions and verification, so physical cards arrive at a real, deliverable address
• Sentry — crash and error reporting
• Vercel — hosting, and storage for uploaded photos/designs
• Apple and Google — delivering push notifications to your device

Each of these providers only receives what it needs to do its specific job, and is contractually restricted from using it for anything else. If you send a business/bulk order, your order may also be shared with the creator or brand fulfilling it, to the extent needed to complete that order.

Data retention

We keep gift and order records for as long as needed to handle receipts, replies, and support requests, and as required by tax and payment-processing law. Synced contact data is kept only to power birthday reminders, for as long as your account is active or until you ask us to delete it.

Your choices

• Turn off Contacts access any time in your device Settings
• Turn off push notifications any time in your device Settings
• Delete your account — from the mobile app, under Profile → “Delete account”, or by emailing us below
• Remove your profile photo, if you’d rather not be shown to people who have your number saved
• Ask us to access, correct, or export your personal information, including synced contact data, at any time

Children

loved is not directed at children, and we don’t knowingly collect information from anyone under 13.

Changes to this policy

If we make a material change to how we handle your information, we’ll update this page and change the date above.

Contact us

Questions about this policy, or a request about your data? Email hello@loved.com.