Privacy Policy
Last updated: November 2, 2026
The short version
- Your WhatsApp chat is analyzed on your phone. We do not upload your chat file to build your report.
- When you talk to Zappy or request a Deep Read, the recent messages and stats Zappy needs are sent over an encrypted connection to our server (hosted on Cloudflare) and to our AI provider to generate the answer. The app asks for your permission before it sends anything for the first time, and you can withdraw it anytime in Settings › Zappy AI sharing. We do not store that content on our servers.
- We never contact, notify or sell anything to the person you are chatting with.
- You can delete everything from the app at any time (Settings › Delete all my data).
What we process
Chat exports you choose to import. Parsed and analyzed locally on your device. Your report, score history, check-ins and conversations with Zappy are stored locally on your device.
Zappy requests. Nothing is sent until you allow it on the permission screen the app shows before your first message to Zappy or your first Deep Read. If you turn it off in Settings › Zappy AI sharing, the app stops sending anything for Zappy until you allow it again. When you send a message to Zappy, the app sends your conversation with Zappy, a summary of your relationship stats and an excerpt of your most recent chat messages to our API, which forwards it to an AI model provider (through OpenRouter) to generate a reply. Our API runs on Cloudflare Workers; it does not log or store message content, and we only use providers that do not train on it. Before Zappy answers, your latest few messages to Zappy (not your chat export) may also be checked by a decision model (TypeSafe, or Cloudflare's model served by DeepInfra), for example to notice when you might need safety resources. Only probabilities come back. We log those probabilities and the resulting labels (never the message text) to tune the checks; the logs are kept as described under Technical data.
Technical data. Each request to our API includes an anonymous app-generated device identifier and your IP address. We use them to enforce daily limits and prevent abuse, and we keep them only in memory. Cloudflare keeps our API's logs (request time, path, status and IP address, plus which model answered, token counts and the decision model's scores; never message content) for up to 7 days so we can keep the service running.
Zappy's memory. So Zappy can pick up where you left off, the app periodically sends your recent conversation with Zappy to our API, which asks a model to turn it into a few short notes. The notes are returned to the app and stored only on your device. Messages about crisis or safety are never sent for memory. Deleting your data in Settings deletes the notes.
Purchases. Subscriptions are processed by Apple. We use RevenueCat to check whether your subscription is active, using an anonymous app-generated identifier.
Analytics. We collect anonymous product events (for example "paywall viewed" or "insight unlocked") to improve the app. These never include your chat content or names.
Who we share data with
We do not sell your data. These service providers process it on our behalf, only to run the features above: Cloudflare (hosting our website and API), OpenRouter and the model providers it routes to (Zappy's replies, Deep Reads and memory notes), TypeSafe or DeepInfra (the decision model, if enabled), Apple (purchases), RevenueCat (subscription status) and PostHog (anonymous analytics).
The other person in your chat
Your chat contains messages written by someone else. LoveZap only processes them to give you insights about your own conversation. Excerpts reach the service providers above only when you use Zappy; we never share them with anyone else, and never contact that person. Please use LoveZap only with conversations you are part of.
Retention and deletion
Local data stays on your device until you delete it or uninstall the app. Our API keeps no chat content. Anonymous analytics are kept for up to 24 months.
Your rights
Depending on where you live (for example under the GDPR, the CCPA or Brazil’s LGPD), you may have rights to access, correct or delete personal data. Because your chat data lives on your device, you can delete it yourself instantly. For anything else, contact us at lukeberrypi@gmail.com.
Children
LoveZap is for adults 18+.