LoveJan Privacy Policy

Last updated: October 20, 2026. The biometric section is version 2026-09-29 of our biometric policy.

LoveJan is a privacy-first dating app for the Persian-American diaspora and all who wish to join.

Who we are: LoveJan, Inc., a California company, runs the LoveJan apps for iPhone, Android and the web, and lovejan.app. This policy covers all of them. Contact: privacy@lovejan.app.

What we collect

• Account: when you sign in with Apple, an Apple-issued identifier and, if you choose to share it, your email address (which can be an Apple relay address that forwards to you). If you continue with Google where it is offered, your Google account identifier, your name, your email address and whether Google has verified it. When you sign up with your email address, that address. If phone sign-in is offered and you use it, your phone number. If you add an email address in the app, that address. If you use a password with LoveJan, it is stored only as a secure hash. We never receive your Apple or Google password, and we never post anything on your behalf.
• Profile: display name, birth date (to keep LoveJan 18+ and to show your age), gender, who you're interested in, your home city, optional details you choose to add (such as languages, relationship intent, generation, education, occupation, religious observance, lifestyle habits and family plans), bio, photos, and, if you add them, voice prompts and short profile videos. Religious observance is optional; if you add it, it shows on your profile and other members can filter by it. You can clear it at any time in Edit profile.
• Location: with your permission, the app reads your device's location once, at sign-up, to suggest your home city; you can refuse and type your city instead. For the city you choose we keep only a point rounded to about 1 km. We never track your location, and other members see only a rounded distance (for example “Nearby” or “~50 km”), never coordinates. If you use Travel Mode, we store the place you choose. We also derive your country from your IP address, as described under “Before you sign in” and “Sign-in security”.
• Activity: likes and passes (including whether someone you passed had already liked you, so the app can tell you once), matches, messages and voice messages with your matches, reactions, event RSVPs, date invitations you send, and the reports and blocks you make. Voice calls happen in real time and are never recorded; we keep a call record (who called whom, when, for how long, and connection-quality data such as whether the call went through a relay).
• Subscriptions: LoveJan is free to join, with optional Premium subscriptions purchased through Apple In-App Purchase. If you buy one, we store an Apple transaction reference and an expiry date (validated with Apple). We never see your card details.
• Verification: Profiles need verification approval to appear in Discover. Our automated selfie check derives a faceprint, described in full under Identity verification & biometric data below. We never store the selfie image itself. A human-review alternative is available that creates no biometric data.
• App usage: while you use the app we record product events, such as which screens you open and which features you use, together with your account, a random identifier created for this installation, the app and system version, your language setting and the type of device, to keep LoveJan working and to improve it. We keep these events for 180 days. We use no third-party analytics or advertising SDKs.
• Before you sign in: when you open LoveJan before signing in, we record what happens on the first screens, for example whether the sign-in sheet opened and whether it finished, together with a random identifier created for this installation, the app and iOS version, your phone's language and region settings, and the IP address the app connects from. We derive your country from the IP address. We use this to find and fix problems with signing in and to protect LoveJan against fake accounts and abuse. If you then sign in, these records are connected to your account. Only LoveJan administrators can access them. We keep the IP address for 12 months and then keep only the country, and we delete these records after 24 months. We do not use them for advertising, and we do not sell them or share them for advertising. While the law there requires consent for this kind of measurement, we do not store these records for devices in the European Economic Area, the United Kingdom or Switzerland.
• Sign-in security: each time you sign in, we record the sign-in method, the time, the IP address and the country derived from it, to protect your account and other members. We keep the IP address for 12 months and then only the country, delete the record after 24 months, and delete it sooner if you delete your account.
• Age check: where your device and region support it, the app asks the App Store for your age range when you sign up. We keep only the result (for example, whether you are an adult or chose not to share), how your age was declared, whether that range fits the birth date you gave, your App Store country and when we checked. If the App Store reports that you are under 18, you cannot create an account.
• Birth date: after you confirm your birth date, you can change it once in the app; after that, a change needs our team. Some members who joined earlier are asked once to confirm their birth date.
• Notifications: if you allow notifications, we store your device's push token and your notification choices (which kinds you get and in which language). We work out the times of day you usually open the app, and we may use them to time notifications. A notification about a like or a match may show that member's photo, blurred unless you have Premium; if you like someone, your main photo may appear in their notification in the same way. Notifications appear outside the app, so photo protection does not cover them. If you turn on “New people near me”, we use the city you set in LoveJan to tell you when a newly verified member joins your search area; you can turn it off in Settings.
• Photo protection: what follows applies when photo protection is on in the iPhone app. Other members' photos are hidden in screenshots and screen recordings. If you take a screenshot or record your screen while another member's photo is showing, the app records that it happened, the screen, and whose photos were showing, to stop members' photos being copied; we keep this record for 90 days. Full-screen photos you view carry a very faint code linked to your account so that copied photos can be traced. Even so, anyone who can see a photo can photograph it with another device.
• Optional ID check: when it is offered, you can choose to confirm your identity and age for an “ID verified / Age confirmed” badge. Your iPhone reads the printed code on your passport or ID card and then, over NFC, the chip in the document; or you photograph the document instead. We check the chip's digital signature and compare the chip photo (or the document photo) with a new selfie. A person on our team makes every negative decision and reviews the cases the automated check cannot decide. We keep the result, how it was checked, whether you are over 18 and, for most documents (never for German documents), a one-way keyed code of the document number, so that one document cannot verify two accounts. We never keep your name, the document number or the document itself. Photos of a document, and the chip photo and selfie when a person must review a chip check, are kept encrypted and deleted when the decision is made, within 72 hours at most. The result is kept while your account exists; the keyed code is kept while your account exists and, if an account is banned for fraud, for one year after the ban; case records are deleted 90 days after the case is closed. You can always choose an option that needs no ID document.
• Support: if you use Send feedback in Settings, we receive your message, the email address you give for a reply (optional), and your app version, iOS version and device model, so we can answer you and fix problems; it never includes your photos or chats. If you email us, we receive your message and your email address.
• Website: when you visit lovejan.app, the servers that deliver it receive the technical data any website receives, such as your IP address, your browser and the page you ask for, to deliver and protect the site. We count visits with a cookieless page-view measurement service from our hosting provider, which gives us totals such as the pages viewed, the referring site, the country and the type of device and browser, and does not follow you to other sites. If a member sends you a date invitation link and you answer it on lovejan.app, we keep your answer, the time you choose and, if you give it, your name, and we show them to that member.
• Service providers: we use service providers to host our database and files, to check faces for verification, to send e-mail and push notifications, and to relay voice calls. They process personal information only on our instructions and not for their own purposes. Our verification processor (see Identity verification & biometric data) and our database hosting are located in the United States.

Why (GDPR lawful bases)

• Contract: to operate the matching and messaging service you sign up for.
• Consent: optional profile fields (languages, intent, generation, Travel Mode) — provided only if you choose. Withdraw anytime by editing or clearing them.
• Consent: biometric processing (the selfie check and the optional ID check), notifications, and optional profile details such as religious observance. You can withdraw consent at any time.
• Legitimate interests: safety (block and report) and fraud or abuse prevention.
• Legitimate interests: keeping sign-in secure and preventing fake accounts, scraping and abuse (pre-sign-in records, sign-in security, and screenshot records when photo protection is on), and keeping the app working and improving it (usage events).
• Legal obligation: age checks that the law requires, such as the App Store age range.
• We do not profile by ethnicity or religion, and we do not infer sensitive characteristics. Pricing is flat and identical for everyone (no gender-based or personalized pricing).

Your rights (GDPR / UK GDPR / CPRA / PIPEDA)

• Access, portability, correction: edit your profile in-app; contact us for a copy.
• Erasure: Settings → Delete account performs an immediate hard, cascading delete of your profile, photos (both blurred preview and original), your verification faceprint (removed from our verification processor), matches, messages, and your authentication record. This is irreversible and runs server-side.
• Objection, restriction, withdraw consent: clear optional fields or delete your account.
• California (CPRA): we do not "sell" or "share" personal information; no targeted ads. We use sensitive personal information (such as biometric data, religious observance if you add it, and the ID-check result) only for the purposes described in this policy, and we do not use it to infer characteristics about you.
• Canada (PIPEDA): Canadian users may contact us to access or correct their data and may escalate to the Office of the Privacy Commissioner of Canada.

International data transfers

LoveJan’s database and files are hosted by our service providers in the United States (California). If you use LoveJan from the EU, UK, Canada, or elsewhere, your data is transferred to and processed in the United States under appropriate safeguards (e.g., Standard Contractual Clauses with our processors). The location-related data we process is limited to what is described under “Location” above.

Photos

Preview blurring is available only on eligible profiles; profiles marked as men use clear previews. When you like someone, that person can see your original photos before a mutual match. A mutual match also allows original-photo access, subject to blocking. Turning off blur makes your preview clear as well. Originals are stored separately with access controls, but that does not mean access waits for a mutual match. Anyone who can view a photo may save it or photograph it, except where photo protection hides it in screenshots and recordings (see “Photo protection”).

Identity verification & biometric data

This section is version 2026-09-29 of our biometric policy. Verification approval is required for a profile to appear in Discover. The automated selfie check compares your submitted selfie with your profile photo and checks for an existing verification of the same face on another account. These checks help assess photo consistency and duplicate accounts; they do not guarantee identity or eliminate fraud. If you can’t — or prefer not to — take the selfie check, you can ask for human review instead (“Have a real person verify me” on the verification screen): our team reviews your existing profile photos and can verify you without any biometric data being created. If you choose neither, your profile cannot appear in Discover, and you may delete your account at any time — all data, including any faceprint, is erased.

• What the check captures. Using your front camera you take a selfie in the moment — not an upload. If the anti-spoofing “liveness” check is enabled, the camera also captures a brief sequence of frames used only to confirm a live person is present (not a photo or a screen). In the iOS app, an on-device face check runs to help ensure a clear, single face is in frame before anything is sent. Browser verification sends the selfie for server-side face checks; it does not run the on-device check.
• How it is processed, and by whom. Your selfie (and any liveness frames) are sent over an encrypted connection to our verification service, which uses our verification processor, a cloud service provider located in the United States, to (1) when the anti-spoofing liveness step is enabled, confirm you are live, (2) compare your selfie to your own profile photo to assess whether the faces match, and (3) check that the face is not already verified on another account. To do step (3), our verification processor derives a facial-geometry vector — a mathematical “faceprint” — from your selfie. This faceprint is a biometric identifier. If you choose the optional ID check, our verification processor also compares the photo stored in your document’s chip (or your photo of the document) with a new selfie, and checks that selfie against stored faceprints for the two purposes described below; if your account is not verified yet, that selfie also serves as your selfie check and can create your faceprint. Neither image is kept unless a person on our team must review the case; then both are kept encrypted and deleted when the review ends, within 72 hours at most.
• What we keep — and what we don’t. For the selfie check, we do not store your selfie image or your liveness frames. They are used only in the moment of the check and then discarded — never saved to your profile, never shown to anyone, never posted. The only thing we retain is the faceprint vector, held by our verification processor in a private collection tagged solely with your account identifier and used for two limited purposes: preventing the same person from verifying more than one account, and checking that photos you add later show the same person. It is never used to identify you to other members, to build a profile of you, or for advertising. We also record that your account is verified, and the date.
• We never sell it. We do not, and will not, sell, lease, trade, or otherwise profit from your biometric data, and we do not disclose it to anyone except our verification processor — solely to perform the checks above — or where strictly required by law.
• Retention and destruction. We keep your faceprint only while your account is active and verified. We permanently destroy it at the earliest of: when you delete your account; when you ask us to remove your verification; or within three (3) years of your last activity on LoveJan. Deleting your account (Settings → Delete account) runs a hard, cascading, server-side delete that removes your faceprint from our verification processor’s collection together with your photos and all account data — irreversibly.
• Your consent and choices. Biometric processing happens only after you give your informed consent on the verification screen, before any capture — your consent, and the policy version you agreed to, is recorded. If you prefer not to consent, choose the human-review alternative (no biometric data is created) or delete your account. To withdraw consent and have your faceprint deleted, contact privacy@lovejan.app or delete your account.

If you live in a U.S. state with a biometric-privacy law — including Illinois (BIPA), Texas (CUBI), and Washington — those rights apply to you, and this section, together with the in-app consent, is our written policy governing the collection, use, safeguarding, retention, and destruction of biometric identifiers. Under the California CPRA, biometric information is “sensitive personal information”; we use it only for the limited verification purpose described here and do not sell or share it. Questions or requests: privacy@lovejan.app.

Retention

We keep your data while your account is active, except where the list below gives a different period. On deletion it is removed as described above, except records the list below keeps for a set time. Backups, if any, are purged on our processor's rolling schedule.

• Account identifiers, email address, phone number, profile, photos, voice prompts, videos: while your account exists.
• Likes, passes, matches, messages, voice messages, call records, reports: while your account exists.
• IP address (pre-sign-in records, sign-in security): 12 months, then reduced to the country.
• Pre-sign-in records with the installation identifier; sign-in records: 24 months (sign-in records sooner if you delete your account).
• In-app usage events: 180 days.
• Screenshot and screen-recording records: 90 days.
• Faceprint: while your account is active and verified; destroyed when you delete your account, when you ask, or within 3 years of your last activity.
• ID-check result; age-check result: while your account exists.
• Photos of an ID document; chip photo and selfie under human review: until the decision, at most 72 hours.
• Keyed code of a document number: while your account exists, and for one year after a ban for fraud.
• ID-check case records: 90 days after the case is closed.
• City you choose: while your account exists.
• Answers to a date invitation link: while the inviting member’s account exists.
• Website request data and page-view statistics: for a limited time, under our hosting provider’s schedule.

Age

LoveJan is strictly 18+. We enforce this on our server at sign-up in every territory and, where the App Store provides it, with your App Store age range.

Contact

privacy@lovejan.app