Privacy Policy

Who we are, and what this covers

Between Us is a relationship understanding platform. Two people answer questions about their relationship separately, and then — only if they both agree — see a structured comparison of their answers. There are also free individual quizzes, short reflection tools, and articles.

Between Us is operated by [Legal entity name], registered at [Registered address] in [Jurisdiction]. For the purposes of data protection law, that entity is the controller of the personal data described here. This policy covers the public website and the signed-in application. It does not cover websites we link to, which have their own policies.

We are not a healthcare provider. Between Us does not provide therapy, counselling, diagnosis or clinical assessment, and we do not hold ourselves out as doing so. We mention this in a privacy policy because it affects how your answers should be understood: they are self-reported reflections, not clinical records.

What we collect

Account data

An email address, a display name you choose, and timestamps for when the account was created and last updated. The display name can be a first name, a nickname or anything else — we do not ask for a legal name and we do not verify it. If you sign in with Google, we receive the account identifier, email address and name that Google passes to us, and nothing more. If you sign in with a password, that password is hashed by Supabase before storage; we cannot read it, and neither can anyone working on Between Us.

You can also set a timezone, and separately opt in to reminder emails and product updates. Both default to off.

Your answers

Your responses to couples questions, individual quizzes and tools: the option you selected, the rating you gave, which question it belonged to, and when you answered. Some couples questions ask you to predict how your partner would answer; those predictions are stored the same way as everything else.

Free-text reflections

Anything you type into a reflection box, a conflict description or the private journal. This is the most sensitive category of data on Between Us, and it is treated as such: journal entries are never shared with a partner under any setting, and free-text answers inside a shared session require a separate, explicit agreement before a partner sees them.

Session and consent records

Which couples sessions you belong to, whether you are partner A or B, whether you have finished answering, and whether you have agreed to generate a comparison. Consent decisions are stored as records with a timestamp and the policy version they were given under, so that both you and we can see what was agreed and when. Withdrawals are recorded too, rather than overwriting the original.

Partner invitations are stored as a hash of the invite token, never the token itself. The usable link exists only in the message you send.

Payment metadata

If you buy a report or start a subscription, Stripe handles the payment. We never see, receive or store your full card number, CVC or bank details. What we keep is the metadata we need to give you what you paid for and to answer a billing question: the product, the amount, the currency, the status, Stripe's identifiers for the checkout session and payment, and the date. For subscriptions we also keep the plan, the current period end and whether it is set to cancel.

Technical and operational data

Standard server logs generated by our hosting provider — IP address, user agent, request path, timestamp, response status — which exist for security, abuse prevention and debugging. We also keep rate-limit counters, an internal audit log of significant account actions such as deletions and consent changes, and operational records of AI requests. Those AI records contain the model used, token counts, cost, duration and whether the request succeeded. They do not contain the text sent or returned.

We do not buy personal data from data brokers, we do not build advertising profiles, and we do not sell personal data.

Why we process it

Where data protection law requires us to name a legal basis, these are the ones we rely on.

• Performance of a contract. Running your account, storing your answers, producing your free results, delivering a report you bought, and handling billing. Without this we cannot provide the service you asked for.
• Consent. Generating a joint comparison with a partner. Sharing free-text answers with a partner. Sending your answers to an AI provider for an interpretive section. Analytics cookies. Advertising cookies. Marketing email. Each of these is a separate, specific opt-in, and each can be withdrawn.
• Legitimate interests. Keeping the service secure, preventing abuse and fraud, fixing faults, and understanding in aggregate which parts of the product people use. We keep this narrow, and we do not use legitimate interests as a cover for behavioural advertising.
• Legal obligation. Retaining records of completed purchases for tax, accounting and dispute-resolution purposes.

Partner privacy, in detail

This is the part of the policy worth reading closely, because it is the part most likely to affect how you answer.

Answers have exactly one owner

Every answer row in our database is owned by one user. Access is governed by row-level security in Postgres, which means the rule lives in the database itself and applies to every request, including ones that bypass our application code. A partner does not have a slow path or an undocumented path to your raw answers. They have no path.

The practical consequence: if you answer a question in a way you would find hard to say out loud, your partner will not read that answer. What they may see, later and only with your agreement, is a derived statement about the two of you together.

Comparison requires both of you

A comparison is generated only after both partners have finished answering and both have explicitly agreed to compare. One person agreeing does nothing. Until that second agreement exists, no comparison record is created and there is nothing for either of you to read.

The comparison itself is produced by fixed rules in our code — deterministic scoring, not an AI model. The same two sets of answers always produce the same comparison.

What a partner can see

• Derived, question-level statements: that you both answered similarly, or differently, or that one of you predicted the other incorrectly.
• Category-level summaries of where the two of you align and diverge.
• Discussion topics generated from the pattern of your combined answers.
• Whether you have finished answering, and whether you have agreed to compare.
• A paid report, if one of you bought it for your shared session.

What a partner can never see

• Which specific option you selected on any question.
• The exact rating you gave on any scale.
• Your free-text answers, unless you have separately agreed to share free text.
• Anything in your private journal, under any setting, ever.
• Your answers to individual quizzes you took on your own.
• Your answers from any other session, with them or with anyone else.

Free text is a separate decision

Agreeing to compare does not share what you wrote in your own words. Free-text sharing is its own agreement, asked for separately, and declining it does not block the rest of your results. We separate these because a rating is a position and a paragraph is a voice, and people reasonably feel differently about handing over each.

Withdrawing consent

Either partner can stop a session or withdraw agreement to compare at any time, from their own account, without the other person's permission. You do not need to justify it and we will not ask you to. Withdrawal stops further processing and removes your access to the comparison; we also do not send your partner an explanation on your behalf.

One honest limit: we cannot unsee something. If a comparison was already generated and read, withdrawing consent afterwards does not erase your partner's memory of it, and if they bought a report we may be required to keep a record of that purchase. What withdrawal does is end the processing and close the access.

If you delete your account, your answers are deleted with it. A session that depended on them stops producing anything new.

AI interpretation and de-identification

Most of what Between Us produces involves no AI at all. The couples comparison, the perception gaps, the alignment counts and the discussion topics are all generated by rules we wrote. AI is used only for the longer interpretive writing in paid reports and in a few clearly-marked tools.

When an AI section is generated, these constraints apply.

• It happens on our servers. Your browser never talks to the AI provider directly, and no AI request is made without the relevant consent record in place.
• Answers are de-identified first. Names, email addresses and free-text identifiers are stripped before anything leaves our infrastructure. What the provider receives is a structured summary of answer patterns, not a document with your name on it.
• Your data is not used to train models. We use the provider's API under commercial terms that exclude training on our inputs and outputs. The provider is currently Anthropic.
• We log the request, not the content. Our operational records of AI calls hold the model, token counts, cost, duration and outcome. The prompt and the response are not stored in those logs.
• AI sections are labelled. Every one of them, so you always know which sentences came from a model and which came from arithmetic.

AI output is generated text. It can be wrong, bland or confidently off the mark. It is not an assessment of either of you, and it is not a professional opinion.

Who else handles your data

We use a small number of service providers. Each one acts on our instructions, and each receives only what it needs.

If we add or replace a provider in a way that changes what is sent where, we will update this table and note the change at the top of this page.

Cookies, analytics and advertising

Consent on Between Us defaults to denied. No analytics script and no advertising script loads until you have explicitly opted in. There is no “legitimate interest” toggle quietly pre-enabled behind the banner.

Your decision is stored in a cookie called bu_consent, which records whether you said yes to analytics, whether you said yes to advertising, when you decided, and the policy version you decided under. The current version is 2026-01-01. If we make a material change, the version changes and you are asked again rather than having an old answer applied to a new question.

Analytics, if you enable it, is aggregate and privacy-conscious: page-level counts without cross-site identifiers or per-person profiles. Advertising, if you enable it, appears on public pages only.

Advertising and analytics scripts are never loaded on your questionnaire, your results, your reports, your tools or your settings — whatever you consented to. That is a rule in the code, not a preference.

You can change your mind at any time using Cookie preferences in the footer, which clears the stored decision and asks you again. The cookie policy lists every cookie by name.

How long we keep things

• Account data, answers and free text: for as long as your account exists. Deleting your account removes them.
• Comparisons and reports: kept with the session so you can come back to them. They are removed when the session or the account is deleted.
• Partner invitations: expire on their own and are removed with the session.
• Server logs: retained on a short rolling window by our hosting provider for security and debugging, then discarded.
• Consent records: retained while the account exists, because they are the evidence of what you agreed to.
• Completed purchase records: retained after account deletion, but anonymised. The link to your user account is removed; what remains is a transaction without a person attached. We keep these because tax and dispute obligations require a record that a sale happened, and we would rather tell you that plainly than claim a deletion is more total than it is.

Your rights, and how to use them

Depending on where you live you may have some or all of the following rights. We apply them to everyone, regardless of location, because having two standards would be harder to explain than having one.

• Access and export. Go to /app/settings and use the export control. You get a machine-readable file containing your profile, your answers, your free text, your consent records and your purchase metadata. No email, no waiting period, no retention offer.
• Correction. Edit your display name, email and preferences in settings. Answers inside a session that has not been compared can be changed by re-answering. If something is wrong that you cannot reach, write to us.
• Deletion. Also in /app/settings. Deletion is immediate and irreversible: it runs a database function that anonymises completed purchase records, then removes your authentication user, at which point everything owned by your account cascades away. We do not keep a shadow copy and we do not require you to ask a human for permission.
• Withdrawing consent. Comparison consent is withdrawn from the session screen. Free-text sharing is withdrawn in the same place. Email preferences are in settings. Cookie consent is cleared from Cookie preferences in the footer. Withdrawal is as easy as granting, and never costs you access to the free results.
• Objection and restriction. You can object to processing based on legitimate interests, or ask us to restrict processing while a question is resolved. Write to privacy@betweenus.app.
• Portability. The export file is the portability mechanism. It is structured data, not a screenshot.
• Complaint. If you are in the UK, EU or EEA you may complain to your local supervisory authority. We would like a chance to fix it first, but that is your right and not conditional on us.

For anything that needs us rather than a button, email privacy@betweenus.app. We aim to respond within five working days and to resolve requests within thirty days. We will not charge you for a request, and we will not ask for more identification than we need to be sure it is your account.

International transfers

Our providers operate internationally, so your data may be processed outside the country you live in — including in the United States. Where we transfer personal data out of the UK, EU or EEA, we rely on the providers' Standard Contractual Clauses or equivalent approved mechanisms, which form part of our agreements with them.

The honest framing: we are a small product using well-known infrastructure providers, and we rely on the transfer safeguards those providers offer rather than operating our own regional data residency. If data residency in a specific region matters to you, we cannot currently promise it.

Age requirement

Between Us is for people aged 16 and over. We do not knowingly collect data from anyone under 16, and we do not design or market the product for children. If you believe a child has created an account, tell us at privacy@betweenus.app and we will delete it.

Security, without overclaiming

What we actually do: data is encrypted in transit; the database enforces row-level security so ownership is checked at the data layer rather than only in application code; passwords are hashed by our authentication provider and never visible to us; invitation tokens are stored only as hashes; sensitive operations are rate-limited; administrative access is limited and significant account actions are written to an audit log; payment card data never touches our systems.

What we are not going to claim: that we are unbreakable, that we hold a security certification, or that we have completed an external penetration test. Those would be easy sentences to write and we have not earned them. No internet service can promise absolute security, and a policy that implies otherwise is telling you something untrue.

If something goes wrong

If we discover a personal data breach that is likely to put you at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the law requires that, and we will tell affected users directly without undue delay. The notice will say what happened, what data was involved, what we have done and what you may want to do. We will not wait until we have a reassuring story before telling you.

Changes to this policy

When we change this policy we update the effective date at the top and keep a short note of what changed. For material changes — a new processor, a new category of data, a new purpose — we will tell signed-in users by email or an in-product notice before the change takes effect, and where the change affects cookies we will increment the consent version so you are asked again rather than carried over.

We will not quietly broaden what we do with your answers and rely on you not re-reading a legal page.

Contact

Privacy and data requests: privacy@betweenus.app
Everything else: hello@betweenus.app

Postal contact and, where required, our data protection representative are listed as [Registered address] and [Data protection contact, if one is required].

Email is not a crisis channel and we do not monitor it continuously. If you are in danger or in crisis, please use these resources instead.