Privacy policy

Last updated 6 November 2026

Pothos is a private app for two people in a relationship. This page explains what we collect, why, who else handles it, and how to delete it. Pothos is run by an individual developer based in India ("we"). Questions: Pothos.support@gmail.com.

The short version

• Your chats (including photos and voice notes), love notes and journal photos and captions are encrypted. They're locked on your phone before they're uploaded, and only the two of you can open them in the app. We don't read them. (This isn't end-to-end encryption: so that a new phone you sign in on opens your chats straight away, our server keeps a protected copy of your couple's key; see Security below.)
• We don't sell your data, show ads, or use your data to train AI models.
• You can delete your account and data at any time.

What we collect

• Account: when you sign in with Google we receive your name, email address and Google account ID. You choose a display name and emoji for the app.
• How you found us (optional): your answer if you pick one when you sign up. Your partner can't see it, and it's deleted with your account.
• Your couple: who you're paired with and the date you got together, if you add it.
• Things you share in the app: moods and mood notes, answers to daily questions and games, shared lists, countdowns, your pet and its colours, reactions, and which features you chose to show on Home. These are stored on our servers so your partner can see them, and are not encrypted like chats are.
• Encrypted content: chat messages, chat photos and voice notes, love notes, and journal photos and captions. We store them only in encrypted form. Our database shows that a message or memory exists, who sent it and when, but not what it says or shows.
• Microphone (optional): only when you record a voice note in the chat. The recording is encrypted on your phone like your photos before it's uploaded; nothing is recorded otherwise.
• Location (optional): only if you turn on distance sharing. We store your position rounded to about 1 km so your partner can see how far apart you are. You can stop sharing at any time, which deletes it.
• Device data: a push notification token so we can notify you, a random ID for this install of the app (stored only as a one-way hash, so notifications move to the right account when someone else signs in on the same phone), your phone's public encryption key, and the app version you run (so features only appear when both your phones support them). If you use the home-screen widget, a device key lets it load your couple's widget data.
• Your couple's key: a copy of the key that opens your encrypted content, itself encrypted with a separate key that is kept apart from the database. It's only given to a phone signed in to one of your two accounts, locked so that only that phone can open it, and your partner is notified when a new phone signs in. It's deleted when either of you leaves the couple.
• Crash reports: if the app crashes or hits an error, we receive the error, the screen it happened on and basic device details (model, Android version, app version). Reports never include your messages or other content, and we don't record your IP address.
• Feedback: if you send feedback from the app, we receive what you wrote, your Pothos name and the same device details, so we can follow up on it.
• Purchases: if you buy Pothos Plus, we store whether your subscription is active and when it renews. Google Play handles the payment; we never see your card details.

Cupid, the optional AI helper

Cupid suggests questions, ideas and small nudges. It is off until you turn it on, and you choose which of your data it may use (moods, daily answers, games, lists, countdowns, journal activity). When it's on, the relevant data is sent to Anthropic, which runs the Claude AI model, to generate suggestions. Anthropic processes it for us and does not use it to train its models. Cupid never receives your encrypted content (chats, love notes, journal). Cupid keeps notes ("memories") about your preferences so its suggestions improve; you can see and delete them in the app.

Who else handles your data

• Supabase: hosts our database and file storage.
• Google: sign-in and Google Play payments.
• Expo: delivers push notifications and app updates.
• Sentry: receives crash and error reports, and feedback you send from the app, so we can fix bugs.
• RevenueCat: checks Pothos Plus subscriptions with Google Play.
• Anthropic: only if you turn Cupid on (see above).

Each of them processes data only to provide their service to us.

Where your data is stored

Our database and file storage are in India (Mumbai). Some of the services above process data outside India, mainly in the United States: push notifications (Expo), crash reports (Sentry), subscription checks (RevenueCat), Google sign-in and payments, and, only if you turn it on, Cupid (Anthropic). Each of them receives only what it needs for its job, and your encrypted content (chats, love notes, journal) is never sent to any of them in readable form. By using Pothos you agree to these transfers; for Cupid we ask separately when you turn it on.

How long we keep it

We keep your data while your account is active. When you delete your account we delete your profile, your device keys and the content only you can see. Things you shared with your partner (messages, memories, lists) stay stored; your partner can keep reading them only if you agree when you leave, and otherwise nobody can open them. If both of you leave, your couple's data is deleted. Backups are overwritten within 30 days.

Your choices and rights

• Turn location sharing, Cupid and notifications on or off at any time.
• Ask us for a copy of your data, to correct it, or to delete it by emailing Pothos.support@gmail.com.
• Delete your account.

Security

Data is sent over encrypted connections, access is limited to you and your partner by security rules on every table, and private content is encrypted on your phone before it's uploaded. The database holds it only in encrypted form, and holds your couple's key only encrypted with a separate key kept outside the database, so a copy of the database alone can't open anything. That separate key lets our server give your couple's key to a new phone you sign in on, which means this is not end-to-end encryption: we could technically open your content, but we don't, and nothing in Pothos does. If you lose or reset your phones, signing in again brings your chats back.

Grievance Officer

For any complaint about Pothos or how we handle your data, contact our Grievance Officer:

• Name: Srimukh Mamidi
• Email: Pothos.support@gmail.com (subject "Grievance")

We acknowledge complaints within 24 hours and resolve them within 7 days. Complaints about intimate images or someone impersonating you are acted on within 2 hours. If you're not satisfied with our answer, you can appeal to the Grievance Appellate Committee set up under India's IT Rules (gac.gov.in).

Age

Pothos is meant for adults (18+) and isn't directed at children.

Changes

If we change this policy we'll update the date above, and tell you in the app if the change is significant.