Privacy Policy
Last Updated: October 8, 2026 · Effective immediately
This Privacy Policy describes how LovieMe ("we," "us," or "our"), founded and built by Sagar Kewat, collects, uses, stores, and protects your personal data when you use lovie.me and its associated services. This policy is compliant with the Indian Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 (IT Act), and the General Data Protection Regulation (GDPR) for users located in the European Economic Area (EEA).
1. Data Controller Information
The data controller responsible for your personal data is:
2. Data We Collect
We collect the following categories of personal data:
2.1 Data You Provide Directly
- Account data: Your name, email address, and profile photo — sourced from your GitHub or Google OAuth provider at sign-in.
- Subdomain configurations: Subdomain names, DNS record types and values, and email forwarding alias rules you create.
- Support communications: Any messages sent to us via email or the contact form.
2.2 Data Collected Automatically
- Usage analytics: Aggregate, anonymised page-view events and button interaction events collected via Vercel Analytics and Google Analytics (GA4). No personally identifiable cross-site tracking is performed.
- DNS aggregate metrics: We collect aggregate counts of DNS query volumes per subdomain (no per-query logs; no query content is stored).
- Technical data: IP address (held briefly by Gcore for DDoS mitigation), browser type, and referring URL, as part of standard web server access logs. These are not linked to your account.
- Session tokens: Authentication session cookies managed by Supabase Auth for maintaining your login session.
2.3 Data We Do NOT Collect
- Payment card numbers or banking information (payments handled externally by Ko-fi / PayPal).
- Content of emails routed through our forwarding service (we only store alias rules, not email bodies).
- DNS query content or per-request DNS logs.
3. How We Use Your Data
We process your personal data for the following purposes and legal bases:
| Purpose | Legal Basis (GDPR) | Legal Basis (DPDP) |
|---|---|---|
| Providing account and subdomain services | Contract performance (Art. 6(1)(b)) | Consent / Legitimate use |
| Displaying your name and avatar in the dashboard | Contract performance (Art. 6(1)(b)) | Consent |
| Sending transactional emails (signup confirmation, etc.) | Contract performance (Art. 6(1)(b)) | Consent |
| Platform analytics and improvement | Legitimate interests (Art. 6(1)(f)) | Legitimate use |
| Abuse prevention and security | Legitimate interests (Art. 6(1)(f)) | Legitimate use |
| Legal compliance and regulatory obligations | Legal obligation (Art. 6(1)(c)) | Legal obligation |
4. Third-Party Data Processors
We engage the following sub-processors to deliver LovieMe services. Each is bound by appropriate data processing agreements and privacy standards:
| Processor | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, Authentication, Real-time | Account data, subdomain configs, session tokens |
| Gcore | Authoritative Anycast DNS & Edge Network | Subdomain DNS records, aggregate query stats, IP routing |
| Vercel | Web hosting, CDN, Edge functions | Page request logs, anonymous analytics |
| Google Analytics (GA4) | Anonymous usage analytics | Anonymised page views (IP anonymisation enabled) |
| GitHub OAuth | Authentication provider | Name, email, avatar (passed to Supabase) |
| Google OAuth | Authentication provider | Name, email, avatar (passed to Supabase) |
| Ko-fi | Payment processing (Pro tier) | Your Ko-fi transaction — LovieMe receives only payment confirmation |
| PayPal | Payment processing (Pro tier) | Your PayPal transaction — LovieMe receives only payment confirmation |
| Google AdSense | Advertising network and publisher monetization | Anonymized advertising cookies, device identifiers, and impression telemetry |
5. Cookies, Advertising, and Tracking
LovieMe uses cookies strictly necessary for authentication and session management (Supabase session tokens), functional performance (Vercel), and anonymized analytics (Google Analytics).
Google AdSense & Third-Party Advertising
We partner with Google AdSense to serve contextual and interest-based advertisements across select public pages of the platform:
- Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites on the Internet.
- Google's use of advertising cookies enables it and its partners to serve ads to our visitors based on their visit to LovieMe and/or other sites across the Internet.
- Users may opt out of personalized advertising at any time by visiting Google Ads Settings, or opt out of third-party vendor use of cookies for personalized advertising by visiting aboutads.info.
For complete details on our cookie classification and management, please review our Cookie Policy.
6. Data Retention
We retain your personal data for as long as your account is active. Specifically:
- Account data: Retained indefinitely until you request deletion.
- Subdomain and DNS configurations: Retained for the duration of your account; purged within 30 days of account deletion.
- Analytics data: Aggregated and anonymised; retained per Google Analytics and Vercel Analytics default retention periods.
- Server/access logs: Retained by Gcore and Vercel per their standard policies (typically 30–90 days).
7. Your Rights (GDPR — EU/EEA Users)
If you are located in the European Economic Area, you have the following rights under the GDPR:
- Right of access: Request a copy of all personal data we hold about you.
- Right to rectification: Correct inaccurate personal data.
- Right to erasure ("Right to be Forgotten"): Request deletion of your personal data.
- Right to data portability: Receive your data in a structured, machine-readable format.
- Right to object: Object to processing based on legitimate interests.
- Right to restrict processing: Request that we limit how we use your data.
- Right to lodge a complaint: You may lodge a complaint with your local supervisory authority.
8. Your Rights (DPDP Act 2023 — Indian Users)
Under the Digital Personal Data Protection Act, 2023, Indian data principals (users) have the right to:
- Access a summary of personal data being processed and the purposes thereof.
- Correct or update inaccurate personal data.
- Erasure of personal data where the consent is withdrawn or the purpose for which it was collected is no longer being served.
- Nominate an individual to exercise rights on their behalf in the event of death or incapacity.
- Grieve any violation of DPDP rights to the Data Protection Board of India.
To exercise any of these rights, contact us at legal@lovie.me. We will respond within 30 days.
9. International Data Transfers
Your data may be processed and stored on servers located outside India, including in the United States and the European Union (via Supabase, Gcore, and Vercel). These transfers are made subject to the data protection agreements of each processor and are necessary for the delivery of LovieMe services.
10. Children's Privacy
LovieMe is not directed to children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us immediately and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via the LovieMe announcement banner and/or email. Continued use of the platform after the effective date constitutes your acceptance of the updated policy.
12. Contact and Data Requests
For all privacy-related requests, data subject access requests, or complaints, contact our Privacy Officer at:
Privacy Officer — LovieMe
Founder & Builder: Sagar Kewat
Email: legal@lovie.me
Response time: Within 30 days