Privacy in plain language
Rate Your Ex is designed so that even the administration team cannot read your names, priorities or scores.
1. Controller and contact
Before production launch, the controller’s legal identity, tax number, address and email must be added here. A verifiable privacy channel will be provided for exercising rights.
2. What we process and why
We process an email encrypted by the server, profile name, birth date, plan, consent, language, usage counters and the minimum technical events needed to operate the account, prevent fraud, manage payments and invitations, and understand service health.
We do not store ex-partner names, avatars, weights or scores in plain text. Analytics expressly excludes those fields. We do not sell personal data.
3. A vault the server cannot open
A random AES-GCM key is created in your browser and stored there as a non-exportable device key. The one-time recovery code is never sent to us. The server receives only opaque encrypted envelopes and the minimum counters needed to enforce plan limits. Older PBKDF2 passphrase vaults remain supported for migration.
4. Legal basis and age requirement
Performance of the contract supports the account, vault and plan; consent supports optional advertising or analytics; legal obligations cover billing; and limited legitimate interest covers security. The service requires users in Spain to be 18 or over and records the confirmation and accepted legal version.
5. Retention and providers
We keep the account while it is active, tax records for the applicable statutory period, and access attempts only during the anti-fraud window. Before production, the specific processors—hosting, email, Stripe, OAuth and advertising—and their international transfers must be documented.
6. Your rights
You may request access, rectification, erasure, objection, restriction and portability, withdraw consent and complain to the Spanish Data Protection Agency. Deleting the account from Settings anonymizes it and cascades deletion of the encrypted vault.
7. Cookies and advertising
The session uses a technical HttpOnly and SameSite cookie. AdSense does not load until configuration and valid consent exist. Premium does not display advertising.