Privacy, in plain language

Session setup. The pace and topics you choose, a name or nickname for each partner (a real name is never required), and for each partner a gender identity, anatomy selection, and email address. These exist so the questionnaire reads correctly for your couple and so your report can be delivered. The live copy deletes with your session; encrypted recovery copies are described below.

Your answers. Your answer for each question (yes, maybe, rather not, or no), plus any optional notes you write. Answers are stored on the server with access controls for the questionnaire and matching service. Your partner sees an answer of yours only through the two routes described under The founding rule below, and never otherwise. Answers exist to compute what the two of you share and, if you purchase a report, to attach your notes to matched items only.

Age confirmation. A timestamp of your confirmation that you are both 18 or older.

Demographics. An age range for each partner (a coarse band, not your exact age), and, if you choose to share them, how long you have been together and your country. These are coarse buckets rather than exact values, and they exist to power anonymous, aggregate statistics such as comparisons with couples like you. The live raw values delete with your session; encrypted recovery copies may hold those values briefly as described below. Only aggregate counts persist as benchmark data. Cohort comparisons are only ever shown once a cohort holds at least 20 couples.

Contact messages. If you use the contact form, we receive your message and email address, used only to reply to you and never linked to any questionnaire session.

Nothing you answered alone leaves our servers, except through the two routes below. Everything else stays private: not in the results page, not in the report, not in any statistic, not in any email, and not through any counting that would let one partner infer the other’s private answers. A yes that your partner did not share is never revealed under any circumstances.

1. What you both agreed to. Items you each independently answered yes or maybe. Neither of you learns anything the other did not also say.

2. Boundaries. Anything you both marked as a boundary is shown to both of you, for the same reason: you each already said it. A boundary only one of you marked stays private. Unmatched answers and notes are never included in a report or model prompt.

Session access ends 30 days after it begins. Automatic cleanup removes live answers, notes, matches, setup details, session email addresses and stored report files. Failed file deletions are retried. Copies already downloaded or emailed are unaffected. Payment and provider records do not follow the session deletion schedule. Encrypted recovery copies can briefly outlive the live session as described next.

To recover from a serious outage, we may hold a separately encrypted copy of operational records and current report files as a restricted recovery artifact in our private GitHub repository. It can include setup choices, aliases, session email addresses and private access links, age ranges and other optional demographics, mutual matches, payment references and report files. Report files may contain notes attached to items you both chose to share. The recovery copy excludes raw individual questionnaire answer and note rows, benchmark rows and report-job snapshots. Only report files created under the current mutual-only disclosure rules are eligible; older files are excluded rather than relabelled. Unmatched answers are never exported.

Before creating any such recovery set, we will activate a seven-day artifact expiry and an alert if the daily backup is missed. The private decryption key stays separate from GitHub. GitHub may retain expired data under its own service terms. A recovery copy cannot reconstruct individual answers or an unfinished questionnaire. If we restore a set, we reapply session expiry and deletion before reopening customer access.

If you buy a report, three things outlive the 30-day window:

• The payment record held by Stripe and referenced by us (amount, date, and payment identifier; we never see or store card numbers).
• Your return code, kept temporarily with the live session so it can be shown after purchase. It may be included in a short-lived encrypted recovery copy. The record that persists after the session stores only a scrambled (hashed) version, valid for US$5 repeat reports for 14 months.
• A fingerprint of your mutual matches: the list of items you both consented to reveal, kept so a future report can show you what changed. It contains mutual items only, never private answers, and it is linked to the scrambled code, not to a name or email. New secure return codes grant access to this comparison, so keep them private. Older three-word codes grant a discount only.

Couple-level tallies (for example, how many couples mutually said yes to a given question) feed an anonymous benchmark pool that powers the comparison section of the report. The pool contains counts only: no individual answers, no session identifiers, nothing that can be traced back to any person or couple. Published comparisons use a minimum cohort threshold to reduce the risk of identifying an individual couple. They are aggregate comparisons, not information about any particular other couple.

Necessary cookies connect you to your private session. There are no advertising cookies. Optional Plausible analytics collect only allowlisted public pageviews, without URL queries, fragments, referring URLs or custom properties. Questionnaire, invitation, results and report routes and funnel events are excluded. No third-party analytics script runs on the site.

Hosting and database providers process session data to run the service. Stripe processes payments and Resend handles report email. If narrative generation is enabled, the configured model provider receives aliases, mutual matches and aggregate summaries only, never individual answers, unmatched items or notes. Provider operational, backup and transaction records may have separate retention terms.

For questions about access, correction or deletion, including deleting a session before its expiry, use the contact form and we will act on it promptly. Depending on where you live, you may also have statutory rights to access, correct, or delete personal information; we honor such requests regardless of jurisdiction.

Only If You Do is strictly for adults 18 and over. We do not knowingly collect anything from anyone under 18, and sessions require an explicit confirmation of age before they begin.

If this policy changes, the date at the top changes with it, and material changes will be flagged plainly on this page. We will never weaken the founding rule.