Privacy Policy

AllHearts is run by Adityendra Suman, the account holder for the app on the App Store and Google Play, in India. Write to us at support@allhearts.app about anything in this policy.

• Your account. Your email address and name, and your profile picture if you sign in with Google. If you sign in with Apple, Apple tells us your name once and either your email or a private relay address that forwards to it. For accounts we create with a password, we keep only a scrambled (hashed) form of the password. We use these to sign you in, and your name and picture to show people in collections you share who added what.
• What you save and make. The products and brands you save, notes, sizes, comparisons, collections, likes and comments, and the links and reels you share into the app. This is the app: it exists to show you your own things. In a collection you share, the other members see what you add, like and say, and your name and picture.
• Notifications. If you allow notifications, your phone's push token, its platform and the app version, plus your notification settings, quiet hours and time zone.
• How the app is used. Which screens are opened and which buttons are used (for example a save or a compare), with your account, platform and app version — collected by us, for us, to understand and improve the app. No third-party analytics or advertising tools run in the app.
• What you search for. We keep the words people search for, to make search better, but without who searched: the text is stored on its own, with only the date, and is never linked to your account.
• Feedback and support. What you write to us, an optional screenshot, the screen you were on, and your device and app version. If you use the support or deletion form without signing in, the email you give us and your message. To stop the forms being abused we keep a one-way code made from your internet address, never the address itself.
• Technical records. Like every website, our hosting provider records each request — the internet address, browser and page asked for — to run and protect the service. We also measure how fast pages load and record which page it was, with any invite or share link removed from it.
• On your device. A sign-in cookie, and in the app's storage your recent searches and this phone's push token. These stay on your device. There are no advertising cookies or identifiers.

• We don't show advertising, and we don't sell your data.
• We don't track you across other apps or websites, and we don't use data brokers.
• We don't share your data with anyone except the service providers below, who run parts of AllHearts for us.

• Vercel hosts the app and keeps its request records.
• Turso hosts the database.
• Google provides Sign in with Google and, on Android, delivers notifications (Firebase Cloud Messaging).
• Apple provides Sign in with Apple and, on iPhone, delivers notifications.
• Anthropic (Claude) and Google (Gemini) read public brand and product web pages — and public Instagram reels you share — to work out which brand and products they show. Apify fetches those public reels for us. We send these services the public page or video, not your account details.

These providers may process data outside India, under their own security and privacy commitments.

• Your account and everything you saved: until you delete your account.
• Links and reels you shared into the app, and what we found from them: until you delete your account.
• Records of how the app is used: 12 months, then deleted automatically.
• Feedback screenshots: 90 days, then deleted automatically (what you wrote stays until you delete your account).
• Comparison links you share: they stop working after 90 days, or straight away if you revoke them on the Compare screen.
• Search words: kept without any link to you.
• Support and deletion requests: kept as our record of what you asked and what we did.
• Hosting request records: for the short period our hosting provider keeps them.

In the app: open the menu, then Delete account, below Log out. It happens immediately and can't be undone. Your account, email, name and everything you saved are deleted, along with collections only you were in. A collection you shared passes to the person who joined it first; what you added and wrote in other people's collections stays there, shown as from “a former member”; and usage records stay in our counts with no link to you. If you signed in with Apple, we also tell Apple to forget the link between your Apple ID and AllHearts.

Can't open the app? Use the form at allhearts.app/account/delete or write to support@allhearts.app, and we'll delete it within 30 days.

• Turn notifications off in your phone's settings at any time — and, where the app shows notification settings, kind by kind.
• Leave a shared collection, or remove your comments, at any time.
• Revoke any comparison link you shared, on the Compare screen.
• Ask us for a copy of your data, or to correct it, at support@allhearts.app.

Everything travels encrypted (HTTPS). Passwords are hashed; invite and share links are stored only as hashes; the Sign in with Apple token is encrypted. Only the people who run AllHearts can reach the database.

AllHearts is not meant for children under 13, and we don't knowingly collect their data. If you think a child has an account, write to us and we'll delete it.

When this policy changes, the version and date above change with it. If a change affects what we collect or who we share it with, we'll tell you in the app before it takes effect.