What is saved
Before sign-up, setup answers are held in this browser. Drafts expire after 30 minutes and are removed when the app next checks or setup completes. You can clear them during setup. They are carried into account setup only for the email you verify. Your exact age is used for the 18+ check and is not added to your cloud profile.
Supabase stores your verified account, first name, age declaration, country, time zone, policy choices, weight permission and joining date. PINs are salted and hashed; raw PINs are not stored there. Verification codes expire and can be used once. Request a fresh code if yours expires.
Your optional height, weight history, goals, notes, reflections, selected AI information, meal plans, activity history and showroom favourites sync privately to your account. A browser copy supports use between visits. Offline changes wait to sync. If two devices conflict, the app keeps the unsynced copy and asks you to resolve it. Do not clear your browser before resolving a conflict.
Your private photo journal
Optional dated photos and notes are stored in a separate private Supabase bucket and account-restricted table. Only the owning account can access them through the app. They are not available to circle members, sharing tools or Olive. Photos are resized and re-encoded on your device to remove original location metadata. Images are opened temporarily in memory, with no journal copy stored in the app’s offline records. An optional separate four-digit journal PIN restricts photo and note access on the server; the PIN is stored as a salted hash. Five incorrect attempts pause access for ten minutes. Unlocks apply to the current sign-in session and expire after 15 minutes. This extra lock does not encrypt the photos. Delete individual photos in the journal. Deletion removes active files; provider backups may persist for their retention period. This is access-controlled storage, not end-to-end encryption. Authorised infrastructure operators may have technical access for service or security purposes.
What your circle can see
Live chat stores messages, replies, hearts, your first name, country and finished portrait for your circle. Recorded videos and posted card images are held in private shared storage for circle playback. They are not limited to the device that posted them. Media playback expires after 30 days; stored-object and backup retention still need a final published schedule.
Height is never posted to your circle. Exact weights, personal notes, goals and reflections are not automatically posted. Circle placement does not use or reveal your weight. You can share a one-time card or choose a live graph that updates with future saved weigh-ins. The live graph’s goal and notes stay private; exact weight numbers are optional. You can stop live sharing, and leaving the circle stops it. Someone may still keep an earlier screenshot or exported copy.
Circle recaps
A saved weekly weigh-in can count anonymously towards the circle’s check-in count. You choose separately whether to contribute its change to a combined total and whether to include your chosen weekly win. A win does not require a weigh-in. No individual weight change or contributor identity is returned in the recap. A combined weight total is shown only with at least three opted-in contributors. Choices can change until the displayed circle cutoff. Completed recaps remain available to members of that circle.
Activity calendar
The calendar is private to you. It records dated weigh-ins, meals you mark as made, listening time and one chat visit per day. A chat visit does not record other members’ presence or the conversation. Goal check-ins and private notes have their own history; they are not automatically inferred from listening or making a meal.
Olive and OpenAI
After you opt in, pressing Send shares your first name, message and relevant recent conversation with OpenAI to generate a reply. You can choose whether remembered preferences, your most recently saved idea and selected journey details are included. New memory suggestions need your approval. Pause AI sharing or review and clear saved information in AI preferences and saved ideas.
Earlier messages may contain details you shared before. Start a fresh conversation to leave that history out of future requests. Clearing a preference does not remove it from an earlier message or saved idea. The app requests that API replies are not stored as application state by the provider; this is not a promise of zero provider retention. OpenAI may retain data for abuse monitoring or other obligations. Optional sharing for model improvement is not enabled in this app.
Camera and exported copies
The optional mirror shows a live camera view without recording or uploading it. Closing it releases the camera. Video asks for camera and microphone access and previews the recording before posting. The original portrait photo is processed on the device; the finished pastel portrait is saved and can still be recognisable. Exporting or using phone sharing sends only the content you choose to the chosen app or recipient.
Reports and support
Reports save the selected message, reason, optional note and review history. Support requests save your subject, message and the reply. Only you and the Pastel Hearts administrator can read your request or report. Blocking and appeals are also saved. These records are not deleted by signing out. Avoid including credentials or unnecessary health details. Requests and reports are not monitored continuously.
Live circle chat
Your online photo and optional bio are visible to your circle while you are in the chat room. Leaving the chat starts a 15-minute grace period for your messages. Returning within that time continues the same session. After the grace period, messages disappear for everyone and are removed by the server cleanup. A lost connection may take up to 45 seconds to be detected. Reported content may be retained privately for moderation. Do not use chat as permanent storage.
Hosting and security
Cloudflare hosts the app. Supabase provides sign-in, private account storage, live messaging and media. The account and media project is hosted in South Korea; other providers may process information outside Australia. Providers may also retain connection and security logs. Final provider, international processing and retention arrangements must be published before public launch. Browser records are not encrypted by the four-digit PIN. Use Remember me only on a trusted device.
Private activity checks
Unusual steps or cycling records may be flagged for private owner review to protect shared activity totals. A review records the entry, the reason for the flag and any decision. A flag is not proof of misuse and does not automatically restrict an account.
Your choices and requests
Edit your profile and use the controls for each feature to change or remove information. Signing out ends this device’s sign-in; it does not delete your membership. Resetting a preview is not an account-deletion request. Use Help to request access, correction, withdrawal of permission or deletion. Identity may need checking. Provider copies and any applicable retention duties must also be considered.
A final retention schedule, public operator details and public privacy contact are still being established. Raise a concern through Help during this private preview. Where applicable, you can also contact the relevant privacy regulator, including the Australian Office of the Australian Information Commissioner. No promotional email permission is collected by joining this preview.
