Privacy Policy

Last updated: October 18, 2026

This policy covers our apps, the Multiamory account, and the account site at user.multiamory.com. Our main website, multiamory.com, is a separate thing with a separate policy — it is an ordinary website that uses cookies and analytics, and our apps do not. If you came here about the website, that policy is here.

Multiamory, LLC ("Multiamory," "we," "us") makes the RADAR app and the Multiamory account that signs you into it. This policy explains what we collect, what we do with it, and what we don't do with it.

We've tried to write this so you can actually read it. If anything here is unclear, email techsupport@multiamory.com and we'll explain it.

The short version

• We collect the minimum needed to run an account and sync your check-ins between your own devices and your partner's.

• No third-party analytics, no advertising networks, no profiling. The only thing the app sends anyone but us and your sign-in provider is an error report when something breaks, and that carries no identifier and none of your content.

• When the app breaks, it tells us where — a crash report with the app version and the place in our code, sent to a crash-reporting service. Never your name, your email, your IP address or anything you wrote. Details under Error reports.

  • We do not sell your personal information, and we never will.

• Your notes are encrypted, and we do not read them. Our servers do know which accounts are connected to each other, because they have to deliver what you share.

  • You can delete your account yourself, and this policy says exactly what that removes.

Who we are

Multiamory, LLC — a Washington company — makes RADAR and runs the Multiamory account. We are responsible for your information, and we are who to contact about it.

You may also see "Argonaut Creations, LLC" on the App Store or Google Play. That is the Washington company Jase Lindgren — one of Multiamory's founders — uses to build and publish our apps. Same people, same team, and this policy covers you either way. We mention is since an unfamiliar name on a store listing is a perfectly good reason to stop and wonder who you are dealing with.

You must be 18

Our apps are for adults. They are not directed at children, and we do not knowingly collect information from anyone under 18. We do not verify your age: creating an account is your statement that you are 18 or older. If we learn that an account belongs to someone under 18 we will close it and delete its data, and if you believe that has happened, email us.

What we collect

Your account

• Your email address. It is how you sign in, how we send you a verification code, and how you get back in if you lose your password.

• Your display name. Your partners see this, so they know who they are connected to.

• How you sign in. A password — stored only as a cryptographic hash, so we never see or store the password itself — and/or passkeys you register, and/or a Google or Apple sign-in you connect. For a passkey we store only its public half; the private half never leaves your device.

If you sign in with Google

We receive your Google account's stable identifier, your email address, your name, and your profile picture URL if you have one. We request only the openid, email and profile scopes, and nothing else.

We use this only to identify you and set up your account. We do not use Google user data for advertising, we do not sell it, and we do not use it to train any model.

If you sign in with Apple

We receive Apple's stable identifier for you and your email address. If you choose Hide My Email, that address is one of Apple's private relay addresses: it forwards to you, and you can switch it off at any time. Apple sends us your name on the first sign-in only, if you allow it.

What you write in the app

Your check-ins, notes, agenda items, topics, action points, the relationships you set up, and the name, notes, tags and photo you keep about each partner. This is your content and it belongs to you. How it is protected is described under Encryption below.

A photo you add is stored inside your encrypted content, not as a separate file. The app shrinks it on your device to a small square (about the size of a thumbnail), seals it with the rest of that record, and syncs it the same way. It is never uploaded as an image file, it is never shown to your partner, and nothing of ours ever sees it unencrypted.

What our servers can see without reading your content

Encryption hides what you write so the contents cannot be read. Here is the complete list of what our servers hold in readable form, which is accessible only to us:

• Who has an account — the account details above.

• Which accounts share which relationship. When you pair with a partner, our sync service records that your two accounts are connected, because that is how it knows whose device to deliver a shared item to. It is a plain list of connected accounts with nothing else on it. We do not look at it except to run the service and to answer your own questions about your account — but it is readable, and we would rather tell you than have you assume otherwise.

• The shape of your sync traffic. For each encrypted record: which kind of thing it is (a note, an action point, a check-in), a random identifier for it, a version number, its size, whether it is shared or private, when it arrived, and which of your devices sent it. Each installation of the app makes up an identifier for itself so the service can tell your phone from your tablet.

• The sealed key to your content, in a form that only a separate system of ours can open — see Encryption.

• Invite links carry their secret after the # in the address, which browsers never send to any server. The site that serves the link page does not see the code or the name you attached to it.

Technical information

• Server logs. Our hosting providers keep ordinary request logs — the address requested, the time, a status code, and the IP address it came from — for security and debugging. Cloudflare's logs for our services are kept for at most seven days; Amazon's for thirty. These logs never contain your content or your keys.

  • Abuse limits. Our account website counts recent requests per IP address to stop password guessing, code guessing and mass sign-ups. Those counters expire within an hour at most — most within a few minutes — and are used for nothing else.

  • Cookies, only to keep you signed in. Signing in at user.multiamory.com sets encrypted cookies that hold your session: one for the hour your sign-in token lasts, one that lets the site renew it quietly for up to thirty days, and a short-lived one that exists only while a sign-in is half finished. None is used for tracking, none is shared, and there is no advertising or analytics cookie anywhere on that site.

  • Email delivery notices. If an email we send you bounces or is marked as spam, our mail provider tells us, and that notice includes the address it was sent to. We use it only to fix delivery.

Error reports

From version 0.6.0, when the app hits a bug — a crash, or a failure it would otherwise only have written to its own log — it sends us a short report so we can fix it. We use a crash-reporting service, Sentry, to receive these, and we hold the reports to the following rules:

• A report says where, not what. It carries the app version, the platform and its version (for example iOS 26.1 on an iPhone, or Android 16 on a Pixel 9), which part of the app it came from, the places in our code the failure passed through (a list of function names, the way a programmer reads a crash) or a short technical description of the failure, the app's sync status at that moment as rough counts, and a short trail of which screens the app was on in the minutes before — the names of screens, never what was on them. A crash report carries the crash message only when it is one of the standard technical phrases the programming language itself produces (such as a number being out of range). It never carries a message built by the code that crashed, because that could contain your words.

  • It carries nothing that identifies you. No account, no email address, no device identifier, no installation number. Reports from one run of the app share a random number so we can tell one phone's bad evening from many phones' bad evenings; that number is forgotten when the app closes and never ties two runs together. We have turned off the storage of IP addresses on our Sentry project, so the address your phone sent from is not kept.

• It counts launches. Each time the app starts it tells Sentry so, with the app version and a random number for that run, so we can see what share of launches end in a crash.

• It never contains your content. Not a note, not a topic, not a partner's name.

• It cannot be switched off in the app, because without it we would not know the app was broken for you. It is the one thing our apps send to anyone other than ourselves and the sign-in provider you chose.

• Sentry keeps a report for 90 days, then deletes it.

Crash reports through Apple and Google

If your phone is set to share crash reports with app developers — a setting in iOS and Android, not in our app — Apple or Google may send us a report when the app crashes. Those reports come from the operating system under Apple's or Google's own privacy terms, we see them only in the developer consoles those companies provide, and they contain technical state, not your content. You control them from your phone's settings. While you are testing a pre-release build, Apple's TestFlight and Google's App Tester app do this as part of their service (see Beta testing).

What we never do

We do not track you across other apps or websites. We do not build a profile of you. We do not fingerprint your device. We do not use advertising SDKs, and there is no advertising in our apps, so no advertising network receives anything about you at all. The app talks only to our own servers, to the sign-in provider you chose, and — when something breaks — to the error-reporting service described above. We do not use your content to train AI models. And we do not share your personal information with third parties for their own purposes — ever.

Encryption, and an honest limit

Your content is encrypted on your device before it is sent anywhere, and it is stored encrypted on your device too, with the key kept in your phone's secure keychain. The keys that unlock the synced copy are deliberately split across two separate systems: one holds the encrypted data and a sealed copy of your key, a different one holds the key that can unseal it. Someone who breaks into one gets unreadable data and no way to open it. They would have to break both.

Here is the honest limit, because we would rather state it than imply otherwise. This is not "zero knowledge." We do not read your notes, nothing in our software sends your content anywhere for analysis, and the system is built so a single breach cannot expose it. But someone who compromised both systems, or an insider with access to both, could in principle decrypt data. Any company claiming otherwise should be able to explain exactly how. We will say so plainly when we can make the stronger promise — it is a direction we are deliberately building toward.

We never use your content to train AI models, ours or anyone else's.

What your partner sees, and what they don't

When you connect a relationship with someone, these are shared between the two of you:

• the agenda you agree for a check-in,

• your shared action points and who they are assigned to,

• your check-in history for that relationship, including notes either of you marks as shared,

• your display name.

These are not shared:

• your private notes and prep,

• the name, notes, tags and photo you keep about your partner on their relationship page — those are yours alone, and your partner has their own,

  • anything in a different relationship,

• your email address.

Nothing you wrote before you paired travels to your partner, and nothing travels afterwards unless you mark it as shared.

Deleting a shared item removes it from your partner's copy too, the next time their device syncs. What you cannot take back is what they have already read, screenshotted or copied — the same as any message you have ever sent. You can leave a relationship at any time. Leaving removes it from your own devices only: your partner keeps everything they already received, and the relationship stays theirs until they leave too. Nobody can delete a shared relationship from the other person's devices; when the last person leaves, it is gone for good. Your choices below says what to do if you need to cut contact.

Email we send you

Account email only: verification codes, password resets, and notices about your account. It comes from accounts@send.multiamory.com, and replies reach our support inbox. Signing up for an app does not sign you up for any mailing list.

Who processes data for us

A small number of providers, only to run the service:

Beta testers additionally receive builds through Apple TestFlight and Google Firebase App Distribution — see Beta testing below for what those services collect.

Our providers act on our instructions. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Where your data lives

On your device first — the app keeps a full local copy, which is why it works offline.

Your account, your sign-in credentials, and the key that unseals your content key are stored with Amazon Web Services in the United States. Your encrypted content, your sealed key, and the list of connected accounts are stored with Cloudflare, which runs a single worldwide network: your encrypted store is created in the Cloudflare data center nearest the device that first used your account, which for a person in the United States is in the United States, and Cloudflare's request logs and abuse counters are held across its network. Wherever the bytes sit, they are encrypted and the key to them is in the United States. If you use our apps from outside the United States, your information is transferred there.

How long we keep it

We keep no separate backups of the sync store beyond Cloudflare's recovery history above.

Content you shared with a partner is in their copy of that relationship as well as yours. Deleting it, or deleting your account, removes it from their copy the next time their device syncs — but see What your partner sees for what no deletion can reach.

Deleting your account — what it removes, and what it does not

You can delete your account at user.multiamory.com — sign in, open Account, and choose Delete my account. It asks you to type your email address to confirm, and it needs a sign-in from the last ten minutes. You can also email us and we will do it for you.

Deleting your account removes, immediately: your account record, your email address, your display name, your password hash, your passkeys, and your connected Google or Apple sign-in. Nobody, including you, can sign in to that account again, which means nothing can ask our key system to unseal your content key.

What deletion removes from our servers. When you delete your account, our sync service removes your encrypted content, the sealed copy of your key, and your entry on the rosters of the relationships you joined, in the same step — and only then is the account itself deleted, so that if the first part fails you can try again rather than be left with remnants nobody can ask for. Within 30 days after that the removed data also leaves Cloudflare's recovery history. Shared items you authored stay in your partners' copies; those were shared, and we treat them as theirs.

On the device in your hand, deleting your account on the website does not erase the app's local copy or the key in that phone's keychain. To clear a device: in the app, Settings → Storage → Clear local data, or delete the app. Deleting the app removes its data; on an iPhone the small keychain entry can outlive the app until it is reinstalled, and on its own it opens nothing.

Signing out is not deleting. Signing out of the app on a device forgets your sign-in but leaves your local copy and its key on that device, so that signing back in is instant. If the device is leaving your hands, clear its local data first or delete the app.

Your choices and rights

• See or change your details. Sign in at user.multiamory.com to update your name, email address, password, passkeys, and connected sign-ins.

• Disconnect Google or Apple at any time from that same page.

• Delete your account from that page, or by emailing us — see the section above.

• Get a copy of your data. Everything you wrote is already on your device. If you want what we hold, email us: we will send your account details, and your encrypted content exactly as we store it, which only your own app can open. A readable export from inside the app is planned.

• Cut contact with a partner. Leave the relationship from its page in the app: it disappears from your devices, nothing further reaches you through it, and your partner keeps what they already received. Deleting your account ends everything. If you need something in between — a partner who should no longer be able to reach you at all — email us.

How to ask, and how fast we answer. Email techsupport@multiamory.com from the address on your account. We may ask you to confirm something only the account holder would know. We answer within 45 days, and if a request takes longer we will tell you why before then. We never charge for this. If we refuse a request, we will say why, and you can ask a different member of our team to review the refusal by replying to that email; we answer the review within 45 days.

Depending on where you live — including the EU, the UK, California, and Washington — you may have further rights to access, correct, delete, or restrict the use of your information, and to complain to a regulator. Email us and we will honor them wherever you live, whether or not a law requires it of a company our size. We will not treat you differently for exercising a right.

Security

We use encryption in transit and at rest, split-custody key storage, passkey and password authentication, and least-privilege access to our own systems. No system is perfectly secure. If a breach affects your data, we will tell you promptly.

Requests from authorities. If a government or court demands information about you, we will provide only what we are legally compelled to, we will push back on requests that are overbroad, and we will tell you about the request unless the law forbids it. What we could hand over is listed under What our servers can see; we cannot be compelled to hand over what we do not read in a readable form, but see Encryption for the honest limit.

Beta testing

If you are testing a pre-release build, a little more is true:

• Apple TestFlight (iPhone and iPad) is Apple's service, under Apple's TestFlight terms. Apple collects crash logs and usage data from the TestFlight app and any feedback or screenshots you send, and shows them to us. Builds expire after 90 days.

• Google Firebase App Distribution (Android) is Google's service. Google holds your name, your email address and a device identifier so it can offer you builds, and keeps them until we remove you as a tester or you ask us to. Google processes Firebase data worldwide.

• Pre-release builds can lose data. Apple says so in its terms, and so do we: keep anything you cannot afford to lose somewhere else. Before a public release we may need to reset accounts or content created during testing; if we do, we will tell you first and give you time to keep what you want.

Everything else in this policy applies to testers exactly as written.

Washington residents: consumer health data

Washington's My Health My Data Act gives you specific rights over "consumer health data." We collect no health information at all unless you choose to write it: the app has no health field, asks no health question, and infers nothing. But a check-in note is free text, and you might write about your sexual health, your mental health, a medication, or a pregnancy. The law is written broadly enough that we would rather treat what you write as covered than argue that it isn't. The same information, in the form the Act asks for, is on its own page: Consumer Health Data Privacy Policy.

• What we collect and why. The content you write and the photos you add, which can include health information only if you choose to write it. We collect it for one purpose: to store it for you, sync it between your devices, and deliver to your partner the parts you choose to share. We do not use it for anything else, we do not infer anything from it, and we do not read it.

• Where it comes from. From you, and — for the items a partner shares with you — from your partner. Our sign-in providers (Google, Apple) give us account details only, never health data.

• What we share, and with whom. Only what you choose to share, only with the partner you choose, only at your direction. We do not share consumer health data with any third party. Our service providers (Amazon Web Services, Cloudflare) store it on our behalf, encrypted, under contract, and may not use it for themselves. Our affiliate Argonaut Creations, LLC — the company that publishes our apps — is the same team and has the same access we do, and no more. We do not sell consumer health data, and we do not use location or geofencing of any kind.

• Your rights. You can ask us to confirm what we hold, to have a copy, to withdraw consent to further collection, and to delete it, by emailing techsupport@multiamory.com. Your choices and rights above says how we verify you, that we answer within 45 days, that it is free, and how to appeal a refusal. If we deny an appeal, you can contact the Washington Attorney General at atg.wa.gov/file-complaint. Deletion removes the data from our systems as described under Deleting your account, and we instruct our providers to do the same.

• Consent. Storing and syncing what you write is the service you asked us for, so the law does not require a separate consent for that. Sharing with a partner happens only when you mark something as shared, which is your consent, and you can stop at any time by unsharing or deleting it.

If you are in the EU, the EEA or the UK

RADAR is offered in those places on purpose, so the GDPR and the UK GDPR apply to you in full. This section says what those laws ask us to say; everything else in this policy applies too.

• Who is responsible. Multiamory, LLC is the controller of your personal data. Argonaut Creations, LLC, which publishes our apps, acts on its behalf under the same rules. Who we are has both addresses.

• Why we may process your data (legal bases). To provide the service you asked for — your account, storing your content encrypted, syncing it between your devices, and delivering what you share to the partner you chose — we rely on our contract with you. For security logs, abuse limits and error reports we rely on our legitimate interest in keeping the service working and safe; we weighed that against your interests, the reports carry no identifier, and you may object. For anything optional we would rely on your consent. Because what you write may reveal your health, your sex life or your sexual orientation — "special categories" of data — we rely on your explicit consent for storing it, which we ask for when you create your account; you can withdraw it at any time by deleting your account, and withdrawing does not undo processing that already happened lawfully.

• Where your data goes. Your account details are held in the United States (Amazon Web Services); your encrypted content is held on Cloudflare's network, usually near you, and may be processed in the United States. Both providers are certified under the EU-US Data Privacy Framework and its UK Extension, and their data processing agreements with us include the standard contractual clauses, which is the legal basis for the transfer.

• How long. As set out in How long we keep it.

• Your rights. To access your data and get a copy of what we hold; to correct it; to have it erased; to restrict or object to processing based on our legitimate interests; to data portability, which for your content means the copy already on your device plus whatever we hold on request; and to withdraw consent. Your choices and rights says how to ask and how fast we answer (within one month under these laws, which is sooner than the 45 days we promise elsewhere). You can complain to your data protection authority — in the UK the Information Commissioner's Office at ico.org.uk; in Germany the authority of your state; in any EU country the national authority — and we would ask you to write to us first so we can put it right.

• No automated decisions, no profiling. None, anywhere in the service.

• How to reach us. Write to us directly at the address in Who we are; we answer requests under these laws within one month.

• Age. You must be 18 to use RADAR, so no child's data is processed knowingly.

Changes to this policy

If we change this policy in a way that matters, we will say so here and update the date at the top. If a change materially affects how we use your information, we will tell you in the app or by email rather than hoping you re-read this page. We keep earlier versions and will send you one if you ask.

What changed in this version: error reports, with the rules they follow; the EU, EEA and UK section in full; the Washington page; what our servers can see; what deleting your account does and does not remove; sign-out on a device; the photo; where Cloudflare keeps data; per-store retention; a process for exercising rights; beta testing; the Washington consumer-health-data section.

Contact

Multiamory, LLC and Argonaut Creations, LLC — techsupport@multiamory.com