Privacy, in plain language

Session setup. The pace and topics you choose, a name or nickname for each partner (a real name is never required), and for each partner a gender identity, anatomy selection, and email address. These exist so the questionnaire reads correctly for your couple and so your report can be delivered. All of it deletes with your session.

Your answers. Your answer for each question (yes, maybe, rather not, or no), plus any optional notes you write. Answers are readable only by our server code and never by any other person. Your partner sees an answer of yours only through the three routes described under The founding rule below, and never otherwise. Answers exist to compute what the two of you share and, if you purchase a report, to attach your notes to matched items only.

Age confirmation. A timestamp of your confirmation that you are both 18 or older.

Demographics. An age range for each partner (a coarse band, not your exact age), and, if you choose to share them, how long you have been together and your country. These are coarse buckets rather than exact values, and they exist to power anonymous, aggregate statistics such as comparisons with couples like you. The raw values delete with your session; only counts, which identify no one, persist. Cohort comparisons are only ever shown once a cohort holds at least 20 couples.

Contact messages. If you use the contact form, we receive your message and email address, used only to reply to you and never linked to any questionnaire session.

Nothing you answered alone leaves our servers, except through the three routes below. Everything else stays private: not in the results page, not in the report, not in any statistic, not in any email, and not through any counting that would let one partner infer the other’s private answers. A yes that your partner did not share is never revealed under any circumstances.

1. What you both agreed to. Items you each independently answered yes or maybe. Neither of you learns anything the other did not also say.

2. Boundaries. Anything you both marked as a boundary is shown to both of you, for the same reason: you each already said it. A boundary only one of you marked is private, and is shared only if both of you separately choose to share, after your answers are locked and having seen the list first. It is all of them or none, and if either of you declines, nothing one-sided is shared and neither of you is told who decided what.

3. Doors left open. Where one of you answered yes or maybe and the other answered “rather not”, the item may be shown to both of you. That answer means “I would prefer not to, but I am open to talking about it”, and the answer screen states plainly that choosing it may show the item to your partner as a conversation to have, so the decision is yours at the moment you make it. We never say which of you was the keen one. A firm boundary is never involved, and sessions answered before this was introduced are excluded.

Every session hard-deletes 30 days after it begins: answers, notes, matches, setup details, email addresses, and the stored copy of any generated report files. Deletion is automatic and unrecoverable. The files already emailed to you are yours and unaffected.

If you buy a report, three things outlive the 30-day window:

• The payment record held by Stripe and referenced by us (amount, date, and payment identifier; we never see or store card numbers).
• Your return code, stored scrambled (hashed) so that even we cannot read the code itself, valid for $5 repeat reports for 14 months.
• A fingerprint of your mutual matches: the list of items you both consented to reveal, kept so a future report can show you what changed. It contains mutual items only, never private answers, and it is linked to the scrambled code, not to a name or email.

Couple-level tallies (for example, how many couples mutually said yes to a given question) feed an anonymous benchmark pool that powers the comparison section of the report. The pool contains counts only: no individual answers, no session identifiers, nothing that can be traced back to any person or couple. It is a blend of licensed seed data and organic results, and nothing is published or used from it until it is large enough that no couple could ever be singled out.

We set one strictly necessary cookie: a private session token that keeps you connected to your own questionnaire. There are no advertising cookies and no cross-site tracking. Any site analytics we run are cookie-free and aggregate only (page counts, not people), and questionnaire answers are never part of any analytics event.

Because sessions self-destruct and we hold no accounts, most privacy rights are satisfied by design: waiting out the 30-day window removes everything a session held. If you want a session gone sooner, or have any question about your data, use the contact form and we will act on it promptly. Depending on where you live, you may also have statutory rights to access, correct, or delete personal information; we honor such requests regardless of jurisdiction.

Only If You Do is strictly for adults 18 and over. We do not knowingly collect anything from anyone under 18, and sessions require an explicit confirmation of age before they begin.

If this policy changes, the date at the top changes with it, and material changes will be flagged plainly on this page. We will never weaken the founding rule.