what we hold.

1. Who we are

TilDawn is a long-distance relationship app operated by Pixelated Vectors LLC, a mainland company licensed in Dubai, United Arab Emirates (“TilDawn,” “we,” “our”). For privacy questions, legal notices, and anything else, write to hello@tildawn.app. It’s one address, read by a person. Put “Privacy” or “Legal notice” in the subject and it reaches the right place.

If you’re in the EU or UK: we have not appointed a Data Protection Officer or an EU or UK representative. Pixelated Vectors LLC is a Dubai company and is not established in the EU or UK. Write to hello@tildawn.app with any data-protection question.

2. What we collect, and why

We only collect what the app needs to do its job. Each class below is tied to the feature it powers.

Account data

Your email and password (the password is hashed by our sign-in provider; we never see it), or the details Apple or Google share when you sign in with them. If you sign in with Apple, we also keep a token from Apple so we can unlink your Apple ID from TilDawn when you delete your account. Your name, pronouns, timezone (so we wake your partner at 7am and don’t wake you at 3am), the city you set, and a profile photo if you choose one. When you create an account, we ask you to confirm you are 16 or older and we record the time you confirmed; we don’t ask for your date of birth.

Relationship data

Your partner’s name or nickname, key dates like your anniversary, and both of your cities and timezones. This is how the countdown and the Sky Window know what to show.

Your content

The messages, photos, voice notes, doodles, time capsules, moods, daily-question and Know Me answers, shared lists and notes, visit plans, milestones, and Watch Together picks you create inside the app. This is your side of the relationship, and it lives here so both of you can keep it. A voice note is only sent when you tap send.

Live signals

While you’re in the chat, your partner can see that you’re online and when you’re typing. These signals travel live and aren’t saved.

Derived data

Streak counts and freezes, milestones, story progress, daily-question history, activity counts, and weekly summaries built from your activity, so the Activity view and Year in Review have something to show you.

Your city and location

Your partner sees the city and timezone you set in your profile. If you turn on Share my city (it’s off by default), they see the city your phone detects when you open TilDawn instead. Section 9 has the details. Your partner never sees coordinates or a street.

Device data

Your push notification token (so the app can reach you), device timezone, locale, OS version, and app version. No ad IDs. No contacts. No calendar. No health or financial data. So you aren’t asked twice, the app also keeps a small note on your phone that you confirmed you are 16 or older: your account ID, or your email address in lower case if you confirmed before your account was ready, up to 10 of each. The note stays when you sign out and is removed when you delete your account on that phone.

Notifications

When your partner writes to you, the notification shows their name and “just wrote.”, not the words of the letter. A photo, voice note, or love note arrives as a line saying what was sent, not what’s in it.

Home-screen widgets

The Photo, Doodle, and Sky widgets show a copy of your partner’s latest photo, doodle, city, and local time that the app saves on your phone, in storage the widget can read. Widgets don’t fetch anything on their own; they update when you open TilDawn. The copy is wiped from your phone when you sign out, your pairing ends, or you delete your account.

Cooling Filter data

The Cooling Filter is optional, and it asks for your ok before the first time you use it. Nothing is sent anywhere until you tap Soften. When you do, only the draft you typed goes to Anthropic’s Claude API to be rewritten, and the softer version comes straight back to you. We never store the original draft, not in plain text and not encrypted. The only message that gets saved is the version you actually choose to send. Anthropic processes the draft under its API terms (see section 3). Free accounts can soften up to three drafts a day, and premium accounts up to 100 a day. You can withdraw your ok at any time in Settings → Privacy and safety, and the filter simply asks again next time.

Safety: blocks and reports

If you block someone, we keep the block until you unblock them or either account is deleted. If you report a problem, we keep the report (its category, what you wrote, and which account it concerns) and up to five screenshots you choose to attach. Only the TilDawn team sees reports.

Feedback

If you send feedback from Settings, we store your message, the app version, and a screenshot if you attach one. Screenshots are stored privately: only the TilDawn team can open them, not your partner. Your feedback and its screenshot are deleted when you delete your account.

Crash and performance data

When the app crashes or slows down, Sentry receives a stack trace, device and OS details, the app version, performance timings, and your account ID (a random identifier, so we can match a crash to a support request). Before anything is sent, we remove message content, email addresses, sign-in tokens, invite codes, and coordinates. No photos or screenshots are attached.

3. Who processes your data

We rely on a small set of vetted processors to run TilDawn. Each one is contractually bound to protect your data and only use it to provide their service to us.

Watch Together plays videos in YouTube’s embedded player. When a video plays, YouTube (a Google service) receives the information its player normally collects, under Google’s privacy policy.

We do not share data with advertisers, brokers, or analytics networks. There are no tracking SDKs in this app.

4. How long we keep it

When you delete your account (Settings → Account → Delete account), your pairing ends first. Then your profile, the messages, photos, and voice notes you sent, your moods and answers, the time capsules you created (opened ones included), and your files are deleted, and your sign-in is removed last. If you signed in with Apple, we ask Apple to unlink your Apple ID first, and your sign-in is removed only after Apple confirms. Shared plans, lists, notes, milestones, and key dates stay readable to your former partner until the 30-day archive closes, then they are deleted too. We keep a minimal record that a deletion or an archive purge ran (account IDs and timestamps, no content). Step by step, including the email route if you no longer have the app, on our account-deletion page.

5. Your rights

Wherever you live, you have the right to see and control the data we hold about you. In the EU, UK, and California, these rights are backed by GDPR, UK GDPR, and CCPA/CPRA respectively, but we honor them for everyone.

• Access and portability. Settings → Export your data. We build one JSON file with your profile, the messages you sent, your moods and answers, and your shared space’s plans, lists, and history, and email you a download link that works for 7 days. After that, the file is deleted. Photos and voice notes appear as entries in the file, not as the files themselves. One export per 24 hours.
• Rectification. Edit your photo, name, pronouns, city, and start date in Settings → Profile, and your preferences elsewhere in Settings. For anything else, email hello@tildawn.app.
• Erasure. Settings → Account → Delete account. Two-step confirm. Section 4 lists what is deleted straight away and what stays readable to a former partner for 30 days. No app? See tildawn.app/delete-account.
• Restriction and objection. Skip the Cooling Filter (it only runs when you tap it) or withdraw your ok, pause or stop sharing your city, revoke the sharing and spicy-content consents you gave, or block someone. Each is a control in Settings → Privacy and safety.
• Automated decision-making. We don’t use any. The Cooling Filter rewrites text you asked it to rewrite; you always see both versions and choose which to send.
• Complaints. You can lodge a complaint with your local data-protection authority. In the UK it’s the ICO; in the EU, your national DPA. We’d rather you talked to us first at hello@tildawn.app.

6. Who can use TilDawn

TilDawn is for people 16 and older. When you create an account, we ask you to confirm you are 16 or older, and we record the time you confirmed. We don’t ask for your date of birth. If you believe a child under 16 has created an account, email hello@tildawn.app and we’ll remove it within 72 hours.

7. Where your data travels

Our primary database lives in the United States (Supabase on AWS US-East). Several of our processors are also US-based. If you’re in the EU or UK, transfers to the US are covered by Standard Contractual Clauses (SCCs) where adequacy decisions don’t apply, and by the EU-US Data Privacy Framework where they do. A full list of SCCs and processor addenda is available on request at hello@tildawn.app.

8. The Cooling Filter, specifically

The Cooling Filter is optional. It never fires on its own, and it never reads your messages in the background. Here is exactly what happens:

• You say yes first. The first time you reach for it, the app explains what it does and asks for your explicit consent. Until you agree, nothing is sent anywhere.
• Only when you tap Soften. The draft you typed is sent to Anthropic’s Claude API to be rewritten, and the rewrite comes back to you. You see both versions and choose which to send, or neither.
• We don’t keep the original. Your original draft is not stored on our servers: not encrypted, not in plain text, not for 90 days, not at all. The only thing that gets saved is the message you actually choose to send, exactly as any other message.
• Anthropic’s standard API policy retains request and response data for up to 30 days for abuse monitoring. We are in active discussions with Anthropic to sign a Zero Data Retention (ZDR) amendment that removes this retention; until that is signed, the 30-day window applies.
• The Filter rewrites language. It doesn’t diagnose, advise, or take sides. It is a communication tool, not therapy or counseling.

9. Your city and location, specifically

Your partner sees the city and timezone you set in Settings → Profile, so their Sky Window, your local time, and your visit plans make sense. You can change it anytime. When you search for a city, the text you type goes to Open-Meteo to find matching places.

Share my city is off by default. You can turn it on from a one-time card on Home after you pair, or anytime in Settings → Privacy and safety. The app asks for location permission only while you’re using it. While sharing is on and not paused, the app checks your city when you open it or come back to it, at most once every 15 minutes. It never tracks you in the background.

Your phone rounds its position to about 1 km before sending it. We send that rounded position to OpenWeatherMap to find your city and country, and we keep only the latest city, country, rounded position, and your phone’s timezone. There is no location history. Our server also uses the rounded position to work out roughly how far apart you are for Year in Review (rounded to 10 km). Your partner’s app shows the city only: never coordinates, never a street, never a map pin.

While sharing is on, your partner sees the city your phone detected. While sharing is paused or off, they see the city you set in your profile, and our server doesn’t send your detected city to their app. When your detected city changes, including the first time it’s found after you turn sharing on, your partner may get a notification naming the new city. We don’t send it again for the same city within 24 hours.

You can pause sharing for 2 hours (it resumes on its own) or stop sharing. Stopping clears your detected city, country, rounded position, and timezone; the city you set in your profile stays until you change it. Your partner isn’t sent a notification when you pause or stop. When a pairing ends (either of you ends it, blocks the other, or deletes their account), your former partner stops seeing your city, and we clear the detected city, country, rounded position, and timezone for both of you. Ending a pairing doesn’t change the city you set in your profile or your Share my city setting.

10. How we protect your data

• Encryption in transit. Every request uses HTTPS/TLS 1.2+.
• Encryption at rest. Supabase storage and database are encrypted with AES-256.
• Row-Level Security. Every table enforces access at the database level, so even a compromised client can’t read another couple’s data.
• Secure tokens. Your sign-in session is kept in your phone’s secure storage (the Keychain on iPhone, the Keystore on Android), not in general app storage.
• Two-factor support. Sign in with Apple and Google both offer 2FA from the provider, and we honor it transparently.

No system is perfectly secure. If we become aware of a breach that affects you, we’ll notify you within 72 hours of confirmation, per GDPR Art. 33, and we’ll tell you what happened, what we’re doing, and what you can do.

11. Changes to this policy

If we change this policy in a way that materially affects you, we’ll notify you in the app and by email at least 30 days before the change takes effect. We won’t quietly rewrite it. The Effective and Last updated dates at the top always reflect the current version.

12. How to reach us

Pixelated Vectors LLC, a mainland company licensed in Dubai, United Arab Emirates, operator of TilDawn.
Privacy: hello@tildawn.app (subject “Privacy”)
Legal notices: hello@tildawn.app (subject “Legal notice”)
Support: hello@tildawn.app
Account deletion: tildawn.app/delete-account
EU/UK Data Protection Officer or representative: not appointed (see section 1).