LoveBox privacy notice

How LoveBox handles your information

LoveBox provides a voluntary communication service for paired adults. This notice includes the same sharing and privacy disclosures shown in the app, with additional information about your rights and this website.

The app does not provide a personal-data download or email-request button. To request a copy of your personal data, email lovebox.support@servisite.co.il from your account mailbox. The Request personal data page explains this support process.

Account deletion remains available both in the app and through the account-deletion page on this website. A deletion request receipt is not confirmation that all erasure steps have finished.

Sharing agreement

Read these disclosures before enabling sharing. By continuing, I represent that I am 18 years of age or older. Age is self-confirmed, not independently verified; no date of birth is collected.

LoveBox is a communication tool that allows paired adults to share a self-reported readiness or availability signal. LoveBox does not determine, verify, enforce or guarantee consent, willingness, intent, identity, capacity, relationship status, or future agreement. Participation, pairing, signaling and sharing must always be voluntary. I choose to share my current readiness signal, chosen symbol and color, and delivery and viewing receipts with my paired partner. A readiness signal reflects only the user's current self-reported state at the time it was shared and can be changed or withdrawn at any time. A signal is not a promise, commitment, obligation, approval, or acceptance of any future activity. LoveBox cannot determine whether a signal was created under pressure, misunderstanding, mistake, influence or changing circumstances. Delivered means the recipient application successfully fetched the exact current signal. Seen means the exact signal was displayed while the partner had the Connection screen open. Delivery, viewing, and receipt records describe application events only; these receipts do not prove human consent, agreement, or behavior. Microsoft provides account sign-in, hosting and email services; Google provides optional sign-in and notifications. Account and service data are encrypted in transit and at rest, not end-to-end, and authorized operators and providers can process them. The privacy notice explains linked-device storage, recipients, retention and deletion limits. I can turn off my signal, confirm clearing both signals, unlink, withdraw consent, export my data or request deletion. Neither partner can set the other’s signal to ready. Real-world consent must always be communicated directly between participants at the relevant time. LoveBox readiness signals never replace direct communication or ongoing consent.

Adults, purpose and consent

LoveBox lets two mutually paired adults share a current readiness signal and chosen symbol/color. You must confirm you are 18 or older and explicitly agree to sharing. Age is self-confirmed, not independently verified. No birth date or gender declaration is requested; symbols are decorative choices.

Readiness and pairing may reveal intimate preferences or information about a person's sex life. We rely on explicit, voluntary consent to process and share that sensitive information for the selected partner-signalling purpose. We also use necessary account information to provide the service you request, meet applicable legal obligations and protect accounts and service reliability where lawful legitimate interests apply. Privacy-notice acknowledgement and adult confirmation do not replace explicit sharing consent.

A readiness signal never replaces freely given, ongoing consent to any activity. Withdrawal ends sharing; agreeing again does not restore the old pairing or signals.

Information processed

LoveBox uses your account identity, explicit consent, invitations, appearance, current signals and current delivery/viewing receipts to provide and protect the service. Microsoft supplies account sign-in, hosting and email services; Google supplies optional sign-in and notifications. LoveBox lets paired adults share a self-reported readiness or availability signal. It does not determine, verify, enforce or guarantee consent, willingness, intent, identity, capacity, relationship status or future agreement. Participation, pairing, signaling and sharing must always be voluntary. A signal reflects only the state reported when shared and can be changed or withdrawn at any time. It is not a promise, commitment, obligation, approval or acceptance of future activity. LoveBox cannot determine whether a signal was created under pressure, misunderstanding, mistake, influence or changing circumstances. Your partner receives your shared signal, appearance and receipts for their own active signal only. Delivered means the recipient app fetched the exact current signal; Seen means that signal was displayed on the Connection screen. These are app events, not proof of human behavior or consent. Account and service data are encrypted in transit and at rest, but not end-to-end; authorized operators and providers can process readable data. LoveBox does not collect location, contacts, chat messages, gender, product analytics, signal-value statistics or application signal history. Optional device setup uses Nearby devices/Bluetooth permission only while finding and setting up the selected device. Older Android versions may require location permission for Bluetooth scanning, but LoveBox does not collect location. Wi-Fi details are sent directly to the selected device through authenticated encrypted Bluetooth, not kept or logged by the app or sent to the LoveBox service. The device stores the Wi-Fi and access information it needs; prototype hardware storage protection is not complete.

Service records include your verified email and account references; agreement versions and times; invitation addresses, status and times; current pairing and receipts; notification registration information; optional device verification, binding, status and connection times; and limited temporary verification, request-protection, delivery and deletion records. Hosting, identity, messaging and app-store providers may process IP addresses, app/device identifiers and connection metadata needed for their services.

Decorative symbols are appearance choices, not gender declarations. Finite daily service totals may be kept without an account identifier. Account references, device references and protected identifiers remain personal data when they can reasonably be linked back to a person.

Optional linked device

During setup, Android requests Nearby devices/Bluetooth only while finding and configuring the selected nearby LoveBox. On Android API level 30 or earlier, Android may also require location permission for Bluetooth Low Energy scanning; LoveBox does not collect location. The app sends the Wi-Fi network name and password directly to that selected device over an authenticated, encrypted Bluetooth connection. The app does not persist or log those credentials or send them to LoveBox Azure.

The linked device stores its Wi-Fi credentials locally until factory reset and generates and keeps its private P-256 key locally. LoveBox Azure stores the corresponding public key and the limited device records listed above. While authorized, the device fetches the same authorized pair, appearance and current signal state available to its linked owner and can submit only actions and receipts permitted for that owner. It can mark Delivered only after fetching the exact signal and Seen only after rendering that exact signal.

A linked LoveBox mirrors app state and is another control surface for its linked owner. It never represents consent and cannot set the partner to ready. Unbinding blocks server access immediately, but a local factory reset is still required to clear the device's Wi-Fi credentials and private key. Accepted account deletion removes the deleting owner's server binding, public credential, enrollment and anti-replay state so the device can enroll later for a new account. It does not delete or transfer the remaining partner's device; normal backup limits still apply.

Sharing, providers and protection

Microsoft email services send invitations and mailbox-verification codes. An invitation shares your name and email with the future verified owner of the recipient address and sends that address to the email provider. Acceptance of a sending request is not proof of delivery and does not disclose whether an account exists. The account sign-in provider handles password recovery. Google credentials are entered only at Google, not in LoveBox.

Optional notifications use Google notification services. The notification payload contains the event type, its intended app account and timing/version information, but no name, email, pairing identifier, access credential or signal value. The app checks the current paired state before displaying private content and obtains any preferred name locally. Private notifications can say that your partner sent love or chose a quiet pause; public lock-screen text stays generic. Delivery can be delayed, lost or repeated. Main service data and operational services are hosted in European regions. This does not guarantee Europe-only processing: identity, email, notifications, app-store services, support, logs and backups may involve provider-controlled processing elsewhere.

There is no public user directory. A partner may retain screenshots or information already received. Information is protected in transit and at rest, but is not end-to-end encrypted; authorized operators and providers can process readable data where needed to provide and protect the service. No system can guarantee absolute security.

Main application information is hosted in European Azure regions. Identity, email, notifications, app-store, support, logs and recovery services can involve processing in other countries. This is not a promise of Europe-only processing. Cross-border handling must use the safeguards required by applicable law; contact support for information about the arrangements relevant to your request.

Retention

When the service supports automatic mutual reset, both active signals turn off 24 hours after the second signal was accepted. This deadline uses server time; repeated taps and retries do not extend it. A single signal stays on until cleared, unless it has an older individual expiry. The app shows the automatic-reset note only when the service confirms support. Only current signals and receipt times are stored, not application signal history. The app keeps your last confirmed symbols, names and signal state visible while checking for updates; cached display does not authorize stale actions or extend signal expiry. An encrypted, account-bound local cache retains these current details and queued signal commands across offline use and restarts, until updated or removed by sign-out, account change, confirmed end of sharing, withdrawal or deletion. It is excluded from app backups and is never shared with another account. Your own pending appearance or consent choice can be saved for less than 24 hours for retry; saving consent does not enable sharing before server confirmation. Minimal deletion retry information can remain until completion or sign-out. Signing out, changing accounts, withdrawal or deletion removes pending consent and prevents appearance updates without current permission. Retention limits include recovery backups for 7 days, operational/support logs for 30 days, deletion-prevention records for 35 days after confirmed identity deletion, completed/cancelled delivery work for 7 days and failed delivery work for 35 days, expired verification evidence for 1 day, stale identity checks for 7 days, stale notification registrations for 30 days, and non-user-linked daily service counters for 400 days. Invitations expire after 7 days; mailbox codes after 10 minutes. Other temporary verification, request-protection, export and device-link information has short expiry limits of between 2 minutes and 24 hours; export links are single-use. Identity, email, notification, app-store and support providers follow their own retention policies. Device-stored Wi-Fi and access information remains until a physical factory reset.

Account, agreement and appearance records remain while the account exists, including after withdrawal. Invitations are cleaned up seven days after expiry when no existing pairing depends on them.

Clearing a current signal does not erase earlier recovery copies. Recovery must restrict access and reapply deletion restrictions before normal service resumes. Outages and retries can delay removal; we explain delays or lawful retention when handling your request. Delivered emails, screenshots and files already received cannot be recalled by LoveBox.

Commercial trial information, if applicable

If you use a commercial free trial, LoveBox keeps a protected code derived from your verified email and the original trial dates until 12 months after the trial starts, including after account deletion. This separate record contains no readable email, account ID, partner information or signals. It is used only to prevent repeat trials within that period, not for advertising. Deletion or re-registration does not restart the trial. Expired records are ignored immediately and removed by scheduled cleanup; recovery copies follow their separate retention limits. Accounts using the free service without a commercial trial do not create these records.

Your choices and deletion

You can end pairing, withdraw consent or request deletion through Your data & choices. To request a copy of your personal data, email lovebox.support@servisite.co.il. The app does not send that email or download an export. Support-operated data delivery goes only to the matching verified account mailbox, not another recipient. Protect any file and password you receive; email providers process the messages. Unlinking or withdrawing consent clears both signals and ends pairing; agreeing again restores neither. Deletion requires verification and deliberate confirmation. Accepted deletion requests immediately restrict sharing, unpair both accounts and revoke account notification/device access. Background work then removes service account data and requests deletion of the sign-in identity, including any provider recovery stage before permanent removal. A request receipt is not proof that deletion has finished. Limited records prevent a deleted account being recreated through an earlier sign-in; recovery copies and provider records have separate retention periods. Deleting LoveBox does not delete your Gmail or Google Account. No GDPR certification, complete security guarantee or instant/absolute erasure guarantee is claimed. Linked devices lose service access immediately, but their saved Wi-Fi and local access information must be cleared by a physical factory reset.

Use your symbol to turn off your own signal, or Until next time for the permitted pair reset. Neither partner can set the other ready. Hiding a partner signal changes only your view of that revision.

A data copy contains permitted account-owned application data, not another person's private profile, passwords, access credentials or internal security records. Provider-held information may require additional searches or proportionate identity checks.

Support-operated data delivery is separate from the app and goes only to the matching verified account mailbox, never to a substitute recipient. It does not send a customer data copy to the support operator. Request scope, verification and applicable provider-held records are handled through support.

Recent sign-in emails on this phone

For easier sign-in, this phone remembers up to five successfully used email addresses for up to 90 days, encrypted and excluded from backup. They are visible in the sign-in email dropdown even after logout. Use the remove icon beside an email to forget it here; this does not delete its password from your phone password manager. LoveBox does not store the password in this list.

Rights-request procedure

1. Contact lovebox.support@servisite.co.il for access, correction, restriction, objection, provider-record or other privacy requests. The Request personal data page explains how to request a copy. Account deletion remains available in the app and through the account-deletion page.
2. We verify only what is proportionate to the request, normally control of the verified account mailbox or your authenticated session. We may request further evidence only when necessary. Never send a password, sign-in code or intimate details to support.
3. A data copy covers your own permitted application data. We also consider relevant provider or support records when your request includes them, and explain any data controlled by a provider or information that cannot lawfully be supplied.
4. We handle requests within the deadlines required by applicable law. Where GDPR applies, we respond without undue delay and normally within one month; a complex or numerous request may require up to two additional months, with notice and reasons within the first month. Rights under Israeli privacy law are handled within the applicable statutory periods.
5. We record the scope, proportionate identity check, decision and completion without copying unnecessary sensitive content. If a request is refused or limited, we explain the reason and available review or complaint routes.
6. We aim to acknowledge receipt within 48 hours when operationally possible. This is a service target, not a statutory deadline or a promise that the request has been completed.

You may complain to the Israel Privacy Protection Authority or the relevant data-protection authority where applicable. Information about applicable European rights is available in the General Data Protection Regulation.

This website

These pages include no trackers, external fonts or scripts, marketing form, or cookies set by page code. The account-deletion controls send an account email and purpose-bound code to the LoveBox service. They do not ask for passwords, access credentials, partner details or intimate information. Personal-data copies are requested through support, not downloaded by a button on these pages.

Hosting providers can process connection metadata needed to deliver and protect this website. A support email link opens your email application; your message is then processed by the operator and email providers, not submitted through an app request button.