Security & Privacy

A bubble holds exactly two people. Someone can only join with the 6-character invite code your bubble creates, and once two people are in, the bubble is full — a third person cannot join it.

Every read and write is checked on our servers against your signed-in account, not in the app on your phone. That means messages, photos, dreams, dates and moods in your bubble are reachable only by you and the one lover who joined you.

If you leave a bubble, your access to that bubble's content ends with it.

Photos you upload live in private cloud storage, not in a public folder. They are never served from a public web address — the app requests a short-lived link for your device each time a photo is opened.

Secret pics are one-to-one. Only you and your lover can open them, and when a disappearing pic is viewed or burned, the file is deleted from storage as well as from the app.

Filters and backdrops are applied on your own device before sending, so the version stored is the one you chose to send.

Sign-in is by email and password, with an optional second lock: two-factor verification using a free authenticator app. You can turn it on or off at any time in Security & two-factor.

Passwords are never visible to us or to your lover. If you forget yours, we email you a reset link rather than your old password.

Sessions are tied to your device. Signing out ends that session, and your bubble is locked again behind sign-in.

Premium is per person — you and your lover each subscribe on your own account. Nobody inherits premium from a partner.

Whether you have premium is decided on our servers from your subscription record, and re-checked every time a premium feature is used. It is never decided by settings stored on your phone, so premium features cannot be unlocked by editing the app.

Card details are entered with Stripe, our payment provider, and are never stored by LuvBubble. We keep only your subscription status and renewal dates so the app knows what to unlock.

LuvBubble runs on Lovable Cloud, which provides the managed database, authentication and file storage behind the app. Traffic between your device and the app is encrypted in transit over HTTPS, and the website sends strict security headers to browsers.

Keeping your memories in the cloud is the point: your phone stays free of storage, and your bubble follows you to a new device when you sign in.

You can delete individual photos, messages, dreams and dates from inside the app at any time, and burn a secret pic before it is even seen.

If you want your whole account and everything in your bubble removed, contact us and we will delete it.

Found a bug, or something that looks like a security or privacy issue? Please tell us before sharing it publicly, and give us as much detail as you can so we can reproduce it.

Use the Help badge in the app, or the support page. We read every report.