Privacy Policy

Who this policy is for

This policy explains how Paeonia handles personal data when you use the Paeonia iOS app, paeonia.no, or contact us. Paeonia is operated by Hjalmar Karlsen, Storgata 61, 0182 Oslo, Norway. Hjalmar Karlsen is the data controller responsible for the processing described in this policy. You can contact us at contact@paeonia.no, or use support@paeonia.no for help with the app.

Paeonia is a private shared space for two partners. It has no public profiles, people search, followers, or advertising audience.

Data we collect

Account and profile data includes your account identifier, sign-in provider, email and name when Apple or Google makes them available, your chosen display name, profile photo, language, time zone, and account status. An OAuth profile photo may be used as a fallback if you have not added a Paeonia photo.

Relationship data includes invites, relationship membership and status, your relationship start date if you add it, blocks, safety warnings, and the choices needed to manage access to a shared space.

Content you choose to add includes your answers to daily questions (text, photos, voice, and partner choices), chat messages with replies, photos, and voice messages, memories with photos and notes, stories (a photo with an optional caption), short notes, dates and countdowns, hearts, drawings, and your moves, drawings, words, and guesses in games. Paeonia only reads the photos you pick or take, and it saves a photo to your photo library only when you tap Save to Photos. This content is private to the shared space unless it is reported or access is needed for the limited purposes described below.

Service data includes subscription and access status, App Store transaction references (including one-time purchases such as bringing back a streak), streak progress, notification choices, your phone's push token, app version, language, and time zone, upload and sync status, request identifiers used to prevent duplicate actions, and security or operational records. Apple processes your payment details. Paeonia does not receive your payment-card details.

Usage statistics and crash reports show us which parts of Paeonia get used and where the app breaks. The app asks you once, after you pair, whether to share them, and sends none of them before you say yes. If you do, it sends which screens you open, which actions you take (for example that you sent an answer, never what it says), crash reports, and details about your iPhone such as model, iOS version, language, and time zone. It never records your screen. This data is linked to your Paeonia account, and PostHog keeps a random code on your phone to tell one phone from another. It is not used for advertising, and Paeonia does not track you across other apps or websites.

Before you sign in, the app counts how many people reach each step of the welcome screens, such as choosing to start or picking a date. It sends only the name of the step, and our server adds one to a count for that day. Nothing in this count is tied to you or your phone, and it does not use PostHog.

The website paeonia.no sets no cookies and uses no analytics. Cloudflare, which delivers the website, processes technical request data such as your IP address to serve the pages.

If you turn on location sharing, Paeonia processes your latest precise location and when it was recorded. We do not keep a location history for this feature.

Where data comes from

Most data comes directly from you and your use of Paeonia. We also receive limited identity data from Apple or Google when you sign in, subscription information from Apple, and content or relationship actions from your partner inside your shared space.

How we use data

We use personal data to create and secure your account, connect you with the partner you choose, provide and sync shared features, show subscription access, deliver notifications you allow, answer support requests, and keep the service reliable.

We also use data to prevent fraud and misuse, enforce blocks and access rules, review reports, protect users, comply with legal obligations, handle data requests, and delete or anonymize data when required.

We use usage statistics and crash reports to find bugs and decide what to improve. We collect them only if you agree, and you can withdraw your consent at any time in the app. Saying no, or changing your mind later, does not affect your subscription or anything else in Paeonia.

Where consent is the appropriate legal basis, such as precise location sharing, usage statistics, and device permissions, you can withdraw it by turning the feature off or changing your device settings. Other processing is necessary to provide the service, fulfill our agreement with you, meet legal duties, or protect legitimate security and service interests.

Your partner and shared content

Your active partner can see the profile details and relationship content that the app makes part of your shared space. Some daily answers stay hidden until the matching reveal condition is met. Do not add content you do not want your partner to see when the feature reveals or shares it.

Paeonia does not automatically restore content from an ended relationship if the same two people pair again later.

Stories, notes, and games

A story is a photo with an optional caption. Your partner sees it on Home for 24 hours. After that it stays in the Stories section of Memories for both of you until the person who posted it deletes it. A note shows over your picture on Home for 24 hours and is then deleted.

Games save turns, drawings, words, guesses, and scores in your shared space. When you draw together live, the strokes pass through a relay run on Cloudflare. The relay forwards them to your partner while you draw and does not store them. A finished drawing is saved in your shared space like other content. Stories and games follow the same hide-then-delete rules as other content when a relationship ends.

Location sharing

Location sharing is optional and works only when both partners turn it on. Paeonia updates your latest location when you open the app, each time you move about 250 meters or more while it is open, and when you ask it to refresh. Your partner sees the location and when it was recorded, including when it may be old.

You can also choose to share while Paeonia is closed. This is a separate setting on each phone, it is off by default, and it needs location access set to Always. When it is on, iOS wakes Paeonia after you move a good distance, usually 500 meters or more, and Paeonia sends that one latest location. It does not track your route or keep a history. Turning location sharing off, or changing location access away from Always, stops it.

You can pause location sharing for 1 hour, 4 hours, or until morning. While it is paused, nothing is sent, your latest shared location is deleted, and you and your partner cannot see each other on the map. Your partner sees that sharing is paused, but not when it ends. Sharing starts again by itself when the pause ends.

Turning location sharing off deletes your latest shared location. The latest locations are also removed when the relationship ends or account deletion begins.

Notifications and widgets

If you allow notifications, we use a device token and your preferences to deliver service and relationship updates. Notification previews can appear outside the app depending on your iPhone settings, so choose the preview settings that are right for you.

The Home Screen widget uses a prepared local preview on your device. It is redacted by default and clears private cached content when you sign out, delete your account, or lose access to the relationship.

Who we share data with

These service providers process data for Paeonia, and only to run the service. Apple handles Sign in with Apple, App Store payments and subscriptions, and push notifications. Google handles Sign in with Google. Clerk handles sign-in and sessions. Cloudflare stores photos, voice messages, drawings, and other files in the EU, runs the live drawing relay, and delivers the website. PostHog stores usage statistics and crash reports on its EU servers in Frankfurt, Germany, and keeps neither your IP address nor a location worked out from it. Paeonia's database and application server run on a server we rent in a data centre in Leipzig, Germany, so this data stays in the EU and EEA. Each provider is subject to its own security and privacy obligations.

We may disclose data when required by law, to protect a person or the service, or as part of a business reorganization with appropriate safeguards. Trusted support or moderation personnel may access the minimum data needed to resolve a request, review reported content, keep the service safe, complete a data request, or perform deletion and recovery work.

We do not sell personal data. We do not use relationship content for advertising, and Paeonia does not include third-party advertising or cross-app tracking.

Reports, blocks, and safety

You can report content or conduct connected to your current or recently ended relationship. A report can include a protected snapshot of the reported text, metadata, photo, voice answer, drawing, or other relevant content so it can still be reviewed if the original is changed or deleted.

The reported person is not shown the report. We review every report and reply within three working days. A block closes contact through Paeonia and prevents pairing again unless the person who blocked later removes the block. Safety and moderation records may be kept after other relationship content is deleted when needed to prevent repeated harm and document how a report was handled.

How long we keep data

We keep active account and relationship data while it is needed to provide Paeonia. When a relationship ends, shared content is hidden immediately and is normally scheduled for deletion after about 30 days. Latest shared locations are deleted immediately. Local private caches are hidden or cleared when access ends.

Reported-content snapshots are kept while a report is open and normally for 180 days after it is resolved. The report record, moderation actions, block state, safety warning, subscription records, privacy-request audit records, and limited security or legal records may be kept longer when needed for safety, accounting, dispute handling, fraud prevention, or legal obligations.

Pending uploads and operational records are kept only as long as needed to finish, retry, secure, or clean up the related action. Notification and request records are normally deleted after about 30 days. A copy of your data that you prepare with Download my data is deleted from our servers after three days, or sooner if you delete it. Deleted data can stay in our server backups for up to 14 days before the backups are replaced.

Usage statistics and crash reports are deleted once you have not used Paeonia for a year. They are deleted sooner if you turn off Share usage statistics or delete your account.

Retention periods may be extended where the law requires it or a legal claim must be preserved.

Leaving and deleting your account

Leaving a relationship hides the shared space from both partners immediately and starts the normal relationship-content deletion period. The other partner sees a one-time notice that the shared space closed.

To delete your account in the app, open the Us tab, scroll to Account, tap Delete account, and confirm. You can also delete it from the subscription screen. If you cannot open the app, email contact@paeonia.no from the address on your account and we will do it for you.

Deleting your account removes or anonymizes your profile, ends an active relationship, disables location sharing and notifications, revokes active sessions, and queues remaining cleanup. Shared relationship content follows the same hidden-then-delete period. Records that must be kept for reports, subscriptions, security, data requests, or legal obligations are restricted and retained only for those purposes. Deleting your account also asks PostHog to delete your usage statistics and crash reports. PostHog finishes this within about a week.

If you signed in with Apple, Paeonia asks Apple to disconnect the account when it can. If Paeonia still shows under Sign in with Apple in your Apple Account settings, you can stop using it there.

Deleting Paeonia does not cancel an App Store subscription. You can manage or cancel the subscription in your Apple Account settings.

Security and confidentiality

Paeonia uses private storage, access controls, signed access to protected files, and separation between ordinary app access and trusted operational access. No security measure is perfect, but we design the service to limit access to the people and systems that need it.

Paeonia is not end-to-end encrypted. Trusted server systems and authorized personnel can access content for sync, support, reported-content review, safety, data requests, account deletion, legal obligations, and service recovery where necessary.

International processing

Our service providers may process data in countries outside your own. Where required, we use recognized transfer safeguards and require providers to protect the data they process for us.

PostHog, Inc., which stores usage statistics and crash reports for us, is based in the USA. The data is stored in Germany, and any access from the USA is covered by the EU-US Data Privacy Framework and the EU standard contractual clauses. Email contact@paeonia.no for a copy of these safeguards.

Your choices and rights

You can edit profile details, turn location sharing and notifications off, leave a relationship, block a partner, and delete your account from the app where those controls are available. To withdraw your consent to usage statistics and crash reports, open the Us tab, then Privacy and safety, and turn off Share usage statistics. Your phone stops sending them right away, and we ask PostHog to delete what it already has, which takes about a week. Something being sent at that exact moment can still arrive.

You may ask for access to or a copy of your data, correction, deletion, restriction, or another right available where you live. To get a copy yourself, open the Us tab, then Privacy and safety, then Download my data. It is free and needs no subscription. Paeonia prepares it in the background, usually within minutes, tells you when it is ready, and keeps it for three days. It holds your account data and everything you wrote, uploaded, or chose, as JSON files that other services can read, with your original photos, voice messages, and drawings. A README explains each file and how we use your data. It also holds the things you share with your partner as one, such as memories, countdowns, streaks, and game results, while you are together. It does not include what your partner wrote or uploaded, their location or settings, or reports about you, because that is other people's personal data. To ask for a correction, open Privacy and safety and tap Ask for a correction. We reply by email to the address on your account, normally within a month. The usage statistics PostHog keeps are not in the copy. If you agreed to share them, email contact@paeonia.no and we will fetch them for you. You can also write to contact@paeonia.no for anything else.

You may also complain to your local data protection authority. In Norway, this is Datatilsynet. We may need to verify your identity before completing a request.

Children

Paeonia is for people aged 16 and older. If you think someone younger is using Paeonia, email contact@paeonia.no. We will look into it and delete the account if needed.

Changes and contact

We may update this policy when Paeonia or the law changes. We will update the date above and give additional notice in the app when a change materially affects how we use your data.

For privacy questions or requests, email contact@paeonia.no. For ordinary product support, email support@paeonia.no.