DRAFT for review. This is not legal advice and has not been reviewed by a lawyer. It must be reviewed and completed before Holly launches.
Privacy Policy
Effective date: October 22, 2026 · Applies to the Holly website and waitlist (joinholly.app) and the Holly mobile app.
1. Who we are
Holly is operated by Jordan Coates, a sole proprietor operating as Holly (“Holly”, “we”, “us”), based in Winnipeg, Manitoba, Canada. We are responsible for personal information under our control and have named a privacy contact, reachable at hello@joinholly.app.
2. What we collect
| Where | Information | Why |
|---|---|---|
| Website waitlist | Your email; optionally your partner's email and which description fits you; the consent wording you agreed to and when | To tell you about Holly's launch and offers you agreed to receive, and to keep a record of your consent |
| Website analytics | Page views and two events (viewing and submitting the waitlist), browser type, approximate location from IP. No cookies or local storage. Visitors are counted with a privacy-preserving hash on PostHog's servers. | To understand whether the site works and how many people visit |
| App account | Name, email, profile photo, sign-in method (email, Apple or Google), partner link | To create your account and connect you with your partner |
| Shared content | Calendar events, reminders, tasks, lists, notes, bucket list, chat messages, voice notes and their transcripts, photos and comments, reactions | To provide the features you and your partner use. Shared content is visible to your linked partner. |
| Location (optional) | Your live location while sharing is on, including Timed Share and Arrive/Leave alerts | To show your partner where you are. You can pause or stop sharing anytime and can turn off the permission in your device settings. |
| Cycle and intimacy tracking (optional, off by default) | Cycle dates, phase, symptoms you log, Love Log entries and signals | To show you, and your partner only if you choose, your logs. This is sensitive health information; we collect it only with your express consent, which you can withdraw by turning the feature off and deleting the entries. |
| Purchases | Subscription status, product, renewal dates, store transaction IDs. We do not receive your card details. | To unlock Holly Plus for both partners |
| App analytics and diagnostics | Usage events, device and app version, in-app survey responses | To fix problems and improve Holly |
| Push notifications | Device push token | To deliver reminders and messages |
We do not sell your personal information, we do not share it for cross-context behavioural advertising, and Holly shows no ads.
3. Service providers
We use service providers who process data on our behalf under contract, only to run Holly:
- Supabase: database, file storage and sign-in. Waitlist data is stored with Supabase in Canada (Central). Website analytics run through PostHog on its US cloud, so some usage data may be processed in the United States and be accessible to authorities there under local law.
- Vercel: website hosting.
- PostHog: analytics. Region: [POSTHOG REGION, e.g. US or EU].
- RevenueCat, Apple App Store and Google Play: subscriptions and payments.
- Apple Push Notification service and Firebase Cloud Messaging: notifications.
- Google Maps: maps and directions.
- Formbricks: in-app surveys.
- [CONFIRM AND LIST ANY OTHERS IN USE AT LAUNCH, e.g. Giphy/Pixabay for GIF search, Google Gemini for AI features, the email service used for the waitlist.]
4. Where your data is stored
Holly is run from Canada, but our providers may store or process your information in the United States or other countries. Information held there may be accessible to courts and authorities under those countries' laws. For people in the EU/UK, transfers rely on [adequacy decisions / Standard Contractual Clauses, TO CONFIRM].
5. Consent and your choices
We rely on your consent, which you can withdraw at any time, subject to legal or contractual limits. You can unsubscribe from emails using the link in each email or by writing to us. We will not send commercial email to a partner email you give us on the waitlist; we keep it only to connect your accounts at launch.
6. How long we keep it
- Waitlist: until you unsubscribe or 12 months after launch, whichever comes first, except a minimal consent and unsubscribe record we keep as proof while you are subscribed and for 3 years after you unsubscribe.
- Partner emails from the waitlist: deleted after launch matching, and no later than 12 months after collection.
- App data: while your account is active. Content past the free plan's 30-day window is kept, not deleted, so it is available if you upgrade.
- After you delete your account: removed from active systems within [30] days and from backups within [90] days, unless we must keep something by law (for example, transaction records).
7. Access, correction, export and deletion
You can delete your account in the app. You can ask us for access to, or a copy of, your personal information, or for a correction, by emailing hello@joinholly.app. We will respond within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).
8. Additional rights by region
US (including California): depending on your state, you may have the right to know, access, correct and delete your information, and to opt out of sale, sharing and targeted advertising (we do none of these). We will not discriminate against you for using your rights. Some states require consent for health data; we only collect cycle and intimacy data when you turn those features on.
EU/UK: you can request access, correction, deletion, restriction, portability and object to processing, and complain to your local data protection authority. Our legal bases are contract (running the app), consent (emails, location, cycle and intimacy data, which is special category data processed on your explicit consent) and legitimate interests (security, basic analytics). [EU/UK REPRESENTATIVE IF REQUIRED.]
9. Children
Holly is for adults. The app is rated 17+ and is not directed to children. We do not knowingly collect information from anyone under 13 (or the minimum age in their country). If you believe a child has given us information, contact us and we will delete it. Censored photos are hidden until tapped, but you are responsible for what you share and with whom.
10. Safeguards
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information. No method of transmission or storage is completely secure. If a breach creates a real risk of significant harm, we will notify you and the regulator as the law requires.
11. Changes
We will post updates here and tell you in the app or by email about material changes.