1. Controller
CrushPulse – an offering by Valentin Spöth
Valentin Spöth, sole proprietor
Turnhallestrasse 31, 77654 Offenburg, Germany
Phone: +49 152 29262825
Email: privacy@lumefide.com
No data protection officer has been appointed because no statutory appointment obligation currently applies.
2. Visiting this website
This static website is delivered through Cloudflare Workers Static Assets by Cloudflare, Inc. Requests can process IP address, request time, resource path, referrer if transmitted, browser or user-agent information, and technical status and error data. The purposes are delivery, security, abuse prevention and troubleshooting. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and reliable information service.
The website adds no advertising, analytics, tracking pixels, external fonts or embedded third-party content. It sets no first-party cookies and uses no local storage. It has no account, contact form or payment system. Styles load from this domain. External providers receive a request when you deliberately open their links. Email links open your mail app; no email is sent automatically.
Cloudflare acts as a processor for applicable hosting data and may control certain service data itself. It may use technically necessary security cookies and Network Error Logging headers; supported browsers may send network failure reports to Cloudflare. We keep no separate visitor log or visitor profiles. Cloudflare determines its technical retention periods; operator diagnostics are retained only as long as necessary for security, troubleshooting or legal claims.
Processing outside the EEA, including in the United States, is possible. Applicable safeguards can include adequacy decisions and Standard Contractual Clauses where their conditions are met; exclusively European processing is not promised. See the Cloudflare Privacy Policy and Data Processing Addendum. Section 25(2) TDDDG applies to strictly necessary device storage or access where its conditions are met.
3. Support and privacy requests
If you contact us, we process your contact details, message, attachments you choose to send, technical context and correspondence to answer your request. Email also involves sender, recipient, subject, time and delivery metadata. Depending on the request, the legal basis is Article 6(1)(b), (c) or (f) GDPR: contract support, legal obligations, or efficient support, security and defense of claims.
The listed addresses use Apple iCloud Mail. Apple may process content and metadata internationally under its applicable terms and Privacy Policy. Support correspondence is generally deleted no later than twelve months after final resolution, unless legal retention duties or claims require longer storage.
Please send the app version, iOS version, device model and an error description. Do not send private messages, intimate details, other people’s photos, passwords or payment details. Remove personal content from screenshots and receipts. If you voluntarily send personal information, we process only what is needed to handle your request.
4. Personal app records stay on your device
The current version uses a local SwiftData database and local settings. It has no CrushPulse account or content backend. It does not activate CloudKit or proprietary iCloud sync. Apple device backups enabled by you are separate and governed by Apple’s settings and terms.
Local records can include your optional name, pronouns and setup choices; crush names, photos, relationship context, interests and notes; questionnaire answers, drafts and immutable analysis results; moments, dates, moods, contact observations and tags; message drafts, extracted screenshot text, saved word ideas, date plans, location text entered by you, budgets, reminder preferences, language and progress. Photos selected for a profile are resized and stored locally. Date-plan place text does not access GPS.
Personal entries can reveal sensitive information about you or somebody else, including relationships, sexual orientation or health. Only enter information you are entitled to use. Prefer nicknames, omit intimate details and respect other people’s rights. The developer cannot view these purely local records. They are not transmitted to RevenueCat.
Local processing provides the functions you select (Article 6(1)(b) GDPR where applicable); strictly necessary device storage or access follows Section 25(2) TDDDG where applicable. The app stores limited local conversion counters and timestamps, for example onboarding and purchase events, in UserDefaults. Those counters are not sent to a separate analytics service.
5. Screenshot recognition, permissions and sharing
Apple’s photo picker exposes only photos you select. Chat Lab recognizes text locally using Apple Vision. The screenshot preview is transient; recognized or edited text can persist as a local draft. No screenshot or text is sent to an external AI provider. The current app has no remote AI, advertising SDK, attribution SDK or additional product analytics service, and does not access IDFA. It requests no location, contacts, camera or microphone access.
Optional reminders require notification permission and are scheduled locally. No remote push service is used. Copying text writes to the iOS clipboard. Export and sharing use the system share sheet; you choose the recipient or destination, whose processing then applies. The JSON export can contain personal entries and profile photos. Share it carefully. The app does not automatically contact a crush or publish a profile.
6. Apple purchases and RevenueCat
Plus uses Apple’s In-App Purchase system. Apple processes the purchase, payment and subscription through your Apple Account under its terms and Privacy Policy. We receive no card details. The app verifies signed StoreKit transactions, including product and transaction identifiers, purchase and expiration dates, revocations and entitlement status, to provide and restore purchased access (Article 6(1)(b) GDPR).
RevenueCat, Inc. is our technical processor for purchase and subscription information and operational reporting. The SDK is initialized during normal app startup, even without a purchase. Because no proprietary account ID is supplied, it creates an “Anonymous App User ID”. This is a persistent pseudonymous identifier, not truly anonymous data. Non-paying users may therefore also appear as SDK users.
RevenueCat can process that identifier, the vendor-specific Apple identifier IDFV where supplied by the SDK, IP and network information, device, operating-system, app and SDK metadata, product information, first and last SDK contact and other technical timestamps, receipt or transaction information, purchase history, subscription and Plus entitlement status. IDFV is not the IDFA advertising identifier. Optional attribution identifier collection and SDK diagnostics are disabled; necessary SDK communication and technical identifiers can remain.
Purposes include recording and validating purchases, restoration, reliable subscription operation, fraud prevention and an overview of SDK users, renewals, cancellations, refunds and revenue. These are not complete installation counts or records of your personal app content. Legal bases are Article 6(1)(b) GDPR for purchased services and Article 6(1)(f) GDPR for reliable purchase operation, abuse prevention and operational reporting. Our legitimate interest is dependable app operation and understanding its business performance. StoreKit remains authoritative for access if RevenueCat reporting fails.
No names, email addresses, photos, questionnaire responses, moods, journal entries, message text or date-plan content are passed to RevenueCat. RevenueCat is based in the United States and uses infrastructure including AWS in the United States. International processing is possible under applicable data-processing terms and safeguards including Standard Contractual Clauses. See its Privacy Policy and Data Processing Addendum. Integration alone does not promise EU-only processing or an individually signed agreement.
Purchase data is retained as needed to provide and document entitlements, comply with legal duties and address claims. Technical data also follows applicable service settings and terms; no fixed automatic deletion period is promised. Request access or erasure at privacy@lumefide.com. The privacy identifier available in app settings can help identify your RevenueCat record. Never send Apple credentials. Deleting local content does not cancel a subscription or automatically erase Apple or RevenueCat records.
7. Export, deletion and retention
Settings → Data management allows export and deletion without Plus. Individual record or crush deletion scrubs the associated stored content and photo. Deleting all personal data resets the user profile, scrubs stored personal records and removes pending reminders. Minimal deletion markers containing record IDs and deletion timestamps can remain in the local database to prevent deleted records from returning; local diagnostic counters, technical settings and SDK storage are separate.
Personal content otherwise remains until you remove it or the app’s local data is removed. A subscription expiry does not erase content. Uninstalling can remove local app data but does not automatically remove backups or Apple and RevenueCat records. Reinstalling can restore purchases, not guarantee recovery of your personal content. Manage Apple-controlled backups and purchase data through Apple. Requests about support and RevenueCat records we control go to the privacy address; statutory duties and legal claims may justify retention.
8. Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and data portability (Articles 15–20 GDPR). Where consent is used, it can be withdrawn for the future without affecting earlier lawful processing. You can object under Article 21 GDPR, on grounds relating to your situation, to processing based on Article 6(1)(f). We then stop the affected processing unless overriding compelling legitimate grounds or legal claims justify it.
Contact privacy@lumefide.com. Purely local entries must normally be managed through your app or device because we cannot remotely access them. Apple and Cloudflare also handle requests for processing under their own control. PulseScore is a local reflection aid, not a solely automated decision with legal or similarly significant effects under Article 22 GDPR.
You can complain to a supervisory authority, including where you live or work. The authority responsible for our establishment is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany. See the official GDPR text.
9. Required data, minors and changes
No registration or date of birth is requested. Technical request data is necessary to deliver the website; contact information may be necessary to reply to support. Necessary purchase processing is required to provide and restore paid access. Optional photos and reminders are not required to use other features.
CrushPulse is intended for ages 13 and above, subject to local law and Apple Account restrictions. Minors should involve a parent or guardian where required, especially for purchases. The regional App Store age rating is separate. See Age suitability.
We update this policy when the app, website, providers or legal requirements change. The date above identifies the current version. Material changes will be communicated appropriately.