Apps Privacy Policy
Last updated: June 18, 2026
This policy explains what data LoveLarice collects, where it goes, and what you can do about it. We've tried to write it in plain English — no legalese. If anything here is unclear, email us at larice@lovelarice.com.
1. What we collect
When you use a LoveLarice app, three kinds of data are involved:
On your device only — never sent to us
- Your daily check-ins, journal entries, reflections, tracking data, reviews, energy ratings, and any other content you type or select in the apps. This lives only in your browser's local storage. You can inspect or delete it at any time.
Sent to us
- Your email address (used to confirm your purchase and unlock the paid apps; also used for marketing communications if you opt in via one of our free tools).
- A daily request counter tied to your IP address, used only to rate-limit the API to prevent abuse. The counter is replaced every day.
Sent only when you click "Analyze"
- A structured summary of your recent tracking data (counts, dates, ratings, short labels). The Review Journal sends the prose you've written. See section 4 for details.
We do not use cookies. We do not store your AI prompts or AI responses on our servers.
2. How we use it
- Your email verifies your purchase so the paid apps unlock, and is used for marketing if you opted in. You can unsubscribe from marketing anytime via the link at the bottom of any email we've sent.
- Anonymous product analytics (via PostHog) tell us which features people use. We never send your email or your tracking content to PostHog. We honor the "Do Not Track" browser setting.
- The rate-limit counter prevents abuse of the API. It is not used for anything else and is not joined to your identity.
3. Who we share data with
We use a small number of third-party services, each with a specific purpose:
- Anthropic — processes the data you send when you click "Analyze." Anthropic does not train its models on API inputs. Inputs may be retained by Anthropic for up to 30 days for abuse monitoring.
- Klaviyo — sends marketing emails only if you opted in via one of our free apps. Klaviyo receives your email address only.
- PostHog — anonymous product analytics. Receives event names and archetype information. Never receives your email or tracking content.
- Shopify — processes purchases on lovelarice.com. Shopify's own privacy policy governs that step. We receive only the email tied to your order.
- Netlify — hosts the apps and the supporting functions. Receives network-level information (IP address, request metadata) inherent to serving any website.
We do not sell your data. We do not share it with advertisers.
4. AI processing — what gets sent and what doesn't
When you click "Analyze my regulation," "Read my patterns," "Audit my foundations," or "Synthesize" in the Review Journal, a request goes to Anthropic. The specific content differs by app:
- Paid apps (Regulation Mastery, Boundary Mastery, Rooted Challenge): We send a structured 14-day window of your tracking data — dates, yes/no check-ins, numeric ratings, short labels for triggers or practices, and any short notes you've written. We do not send your email or any identifier to Anthropic.
- Review Journal: We send the prose you've written in your reviews, along with structured tracking data. We do not send your email.
Anthropic's response is gated by an approved phrasing policy enforced in our code: we reject any response that contains medical or diagnostic language, claims to "cure" or "treat" anything, or fails to reference your actual data. If a response fails any of these checks, we discard it and show you a fallback message instead.
If you do not want your data processed by an AI service, do not click the "Analyze" button. All other app features work without it.
5. Where your data lives
| Data | Location |
|---|---|
| Daily tracking, journal entries, reflections | Your device (browser local storage) |
| Email address tied to purchase | Netlify Blobs (our backend) and Shopify |
| Marketing-subscribed email | Klaviyo |
| Analytics events | PostHog |
| AI request body | Transient at Anthropic (up to 30 days) |
6. Your rights and controls
- Access: Open your browser's DevTools → Application → Local Storage to inspect any data stored by the apps.
- Delete on this device: Each app has a "Manage my data" link in the footer that wipes your tracking data from the device. Your purchase access is preserved.
- Delete from our backend: Email us at larice@lovelarice.com and we will remove your email from the purchase allowlist within seven days.
- Opt out of marketing: Use the unsubscribe link in any Klaviyo email.
- Opt out of analytics: Enable "Do Not Track" in your browser. We honor it.
If you live in the EU, UK, or California, you also have rights under GDPR or CCPA. Email us to exercise them.
7. Security
We take reasonable steps to keep your data safe:
- All traffic to our apps is HTTPS-only, with HSTS preload-eligible configuration.
- Server-side purchase verification is re-checked on every AI request.
- Daily request limits prevent runaway use.
- A Content Security Policy restricts what the apps can connect to.
- We do not log AI prompts or responses on our servers.
- AI responses are sanitized before reaching you — banned phrases and unsupported claims are rejected by our code, not just the model.
8. Children
LoveLarice apps are designed for adults. We do not knowingly collect data from anyone under 18. If you believe a child has used the apps, email us and we will delete any associated data.
9. Changes to this policy
If we make material changes, we will update the "last updated" date at the top of this page and, where reasonable, notify users by email.
10. Contact
Questions, requests, or concerns: larice@lovelarice.com.