Smooch Privacy Policy
📅 Last updated: 16 September 2026
1. Who we are
Smooch is operated by a registered individual entrepreneur (ФОП) in Ukraine, PE Barbashyna Anastasiia, Maksymovycha 26B, Kyiv 03022, Ukraine (“Smooch”, “we”, “us”, or “our”).
For personal-data purposes, we act as the controller of the personal data described in this Privacy Policy unless we state otherwise.
Contact us:
Email (general enquiries and privacy requests): hello@barbash.design
Postal address: PE Barbashyna Anastasiia, Maksymovycha 26B, Kyiv 03022, Ukraine
Smooch is intended to be available globally except in Russia and Belarus, subject to technical, legal, and App Store availability.
2. Scope
This Privacy Policy applies to the Smooch iOS application, account, couple-space features, subscription features, and related support communications.
It explains what personal data we collect, why we use it, with whom we share it, how long we keep it, and the choices and rights available to you.
3. Personal data we collect
Account and identity data
When you create an account, we may receive:
email address;
name or display name provided by Apple Sign-In or Google Sign-In;
authentication identifiers supplied by the sign-in provider;
your selected profile avatar (chosen from a predefined set of avatars provided by Smooch — users cannot upload their own photos);
account creation, login, and session information.
We do not need to collect a phone number, postal address, profile photo, or government identifier for the core Smooch experience.
Couple and app content
When you use Smooch, we may process:
relationship anniversary or other important dates;
goals;
wishes;
notes;
couple-space membership and pairing status;
information about which user created or edited an entry;
unpairing and space-splitting information.
whether an entry is marked as a surprise, and the date on which it becomes visible;
Smooch does not currently allow users to attach photos or other files to wishes, goals, or notes.
Because users may write about their relationships or private lives, app content may be personal or sensitive depending on what a user chooses to enter. Please do not enter information that you do not want your connected partner to see in a shared space.
Notifications and device data
If you enable push notifications, we may process a push-notification token and notification preferences. Notifications are limited to app-related events and content-based reminders connected to features you use. We do not currently send marketing push notifications.
Your push-notification token is deleted when you sign out of Smooch and when you delete your account. Turning notifications off in your iOS settings stops delivery, but does not by itself remove the token from our systems.
Push notifications are delivered via Firebase Cloud Messaging (Google), which is layered on top of Apple Push Notification service for iOS delivery. Firebase is used in Smooch solely for this messaging function.
We may process basic technical information needed to deliver notifications and operate the app, such as device or operating-system information, app version, timestamps, and security logs.
Diagnostics and analytics
Smooch records a small number of anonymous product-usage events — for example, that a screen was opened or that an entry was created — so that we can see which features are used and improve the app.
These events are written to a table in Smooch's own backend, inside the European Union. They are not linked to your account, your email address, your device, or any other identifier, and they cannot be traced back to you or to your couple space. They never include the text of your goals, wishes, notes, or important dates.
We do not use any third-party analytics or crash-reporting SDK. The Firebase SDK is included in the app, but it is used only for push-notification delivery (Firebase Cloud Messaging); Firebase Analytics collection is explicitly disabled in the app's configuration, and no external analytics or crash-reporting tool — for example Sentry, PostHog, Amplitude, Mixpanel, Bugsnag, or Datadog — is integrated. No usage data is sent to any advertising network, data broker, or other third party.
Subscription data
For subscriptions purchased through Apple, we may receive or process information needed to determine entitlement and subscription status, such as an App Store transaction or original-transaction identifier, product identifier, purchase status, renewal status, introductory-offer eligibility and use, and expiration information.
RevenueCat processes subscription-related information on our behalf to help us verify and manage entitlements. Apple processes payment details. We do not receive your full payment-card number through Smooch's Apple In-App Purchase flow.
Smooch's own backend does not store transactions, receipts, or any payment-card data. It stores only your couple space's subscription status — whether the space is on its free week or on an active subscription, the applicable end date, and the plan identifier — and that record is deleted together with the space.
4. How we collect data
We collect data:
directly from you when you sign in or create content;
from Apple or Google when you use their sign-in services;
from Apple and RevenueCat when a subscription transaction changes;
automatically from the app and device when needed for security, notifications, diagnostics, and service operation;
when you contact us for support or privacy assistance.
5. Why we use personal data
We use personal data to:
create and manage your Smooch account;
authenticate you through Apple Sign-In or Google Sign-In;
provide couple spaces and synchronise content between connected partners;
save and display goals, wishes, notes, and important dates;
send app-related notifications you enable or request;
provide, verify, and restore subscription access;
detect abuse, fraud, unauthorised access, and security incidents;
diagnose crashes and improve reliability;
understand, from anonymous usage events, which features people use, so that we can improve Smooch;
respond to support and privacy requests;
comply with legal obligations and enforce our Terms.
We do not use personal data for targeted advertising, sell personal data, or use User Content to train artificial-intelligence models.
6. Legal bases
Depending on the circumstances and applicable law, we rely on the following legal bases:
Contract: to create your account, provide Smooch features, synchronise couple content, and manage paid access.
Legitimate interests: to secure Smooch, prevent abuse, troubleshoot, maintain records, improve reliability, and understand at an aggregate level which features are used, where those interests are not overridden by your rights.
Legal obligation: to keep records or respond to lawful requests where required.
Consent: where applicable for optional notifications or other processing that legally requires consent. You may withdraw consent through available app settings or by contacting us.
If we need data for a particular feature and you do not provide it, that feature may not work correctly.
The anonymous usage events described in Section 3 do not identify you and are not personal data. Where they are nonetheless treated as personal data under applicable law, we rely on our legitimate interest in understanding which features are used.
7. Sharing and service providers
We share personal data only as reasonably necessary to operate Smooch, provide requested features, protect the Service, or comply with law.
Current providers include:
Lovable: application hosting and the managed backend on which Smooch runs, including database, file storage, and authentication-related infrastructure. Lovable acts as our processor and engages its own sub-processors for this infrastructure. Smooch's backend is deployed in the European Union (Frankfurt, Germany).
Supabase: sub-processor engaged by Lovable, providing the database and authentication technology underlying that backend.
Apple: Apple Sign-In, App Store distribution, App Store payments, and subscription transactions;
Google / Firebase: Google Sign-In and push-notification delivery via Firebase Cloud Messaging;
RevenueCat, Inc. (USA): subscription entitlement and subscription-status management. RevenueCat stores customer data on AWS servers located in the United States, and we have a Data Processing Addendum with RevenueCat incorporating the EU Standard Contractual Clauses for international transfers.
Every provider we use is bound by written terms that form part of our agreement with them and that govern how they may handle personal data. Under those terms, each provider may process the data only to provide its service to us and on our behalf; must keep it confidential; must apply technical and organisational security measures appropriate to the risk, including encryption in transit and at rest; and may not use Smooch user data for its own purposes, sell it, share it, or use it to train artificial-intelligence models. Our hosting provider publishes its own sub-processor list, naming each sub-processor's location and purpose. Where a provider offers a data-processing agreement, we enter into it. Taken together, these terms require every third party that receives Smooch user data to protect it to a standard equal to the one described in this Privacy Policy. We do not share user data with any parent, subsidiary, or other related entity, and we do not share it with advertisers.
We may disclose information if required by law, legal process, court order, or a valid governmental request. We may also disclose information where reasonably necessary to protect users, our rights, or the security of Smooch.
We do not sell personal data and do not share it with advertisers for targeted advertising.
8. International transfers
Smooch may be used internationally, and some service providers may process data outside Ukraine or your country of residence. Where applicable law requires safeguards for international transfers, we will use an appropriate mechanism, such as an adequacy decision, standard contractual clauses, or another legally recognised safeguard.
Smooch's own application data — the database, file storage, and uploaded files — is hosted in the European Union, in Frankfurt, Germany, and is not moved outside the EU for hosting purposes.
RevenueCat processes data on AWS servers in the United States under a Data Processing Addendum incorporating the EU Standard Contractual Clauses.
Apple and Google operate globally. According to their published terms, transfers of personal data outside the European Economic Area in connection with their services rely on their own transfer mechanisms, including the EU Standard Contractual Clauses.
9. Shared couple data
When you join a couple space, information created in that shared space may be visible to your connected partner. You are responsible for deciding what to write in shared areas.
Surprises are an exception to this. When you mark a plan as a surprise, it is hidden from the partner it is intended for until the date of the event, and then becomes visible to both of you automatically. This is a visibility rule applied inside Smooch, not encryption: a surprise is stored in the same way as any other entry in your space, we are technically able to access it, and it is not hidden from anyone who has access to your unlocked device.
If you delete your account while paired, the pairing is dissolved immediately:
your profile, and all wishes, plans, gifts, and notes you created, are permanently deleted;
your device tokens, notifications, pairing history, and avatar image are deleted;
your partner is notified in-app that the pairing has ended;
your partner's account, content, and space are not affected — their space becomes an individual space, with a new invite code, and they keep full access to everything they created.
If the couple space has an active subscription, it stays with the remaining partner and continues until the current billing period ends, since Apple manages the subscription independently of either individual account (see Section 11).
If you were not paired at the time of deletion, your entire space and all of its content are deleted outright.
You can also unpair from your partner without deleting your account (a separate action in Settings). In that case, both of you keep your own accounts, and content created by each user stays with that user in their own individual space.
Where an entry was created by one partner and later edited by the other, the entry belongs to the partner who created it. If that partner deletes their account, the entry is deleted with it, including any edits the other partner made to it. Entries each partner created remain with that partner.
If you become inactive, the information remains stored until it is deleted, anonymised, or otherwise handled according to our retention rules.
10. Retention
We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide Smooch, maintain security, resolve disputes, enforce agreements, and comply with legal obligations.
Retention schedule:
Account data: deleted immediately when you delete your account in Smooch. Deletion is permanent — there is no recovery period, no hidden “soft delete”, and no restore from a bin. This covers your profile, your avatar, your notification records, your pairing history, and your sign-in record.
Couple content: entries you created — important dates, goals, wishes, gifts, and notes — are deleted together with your account. Entries your partner created stay with your partner, and their space continues as an individual space. Content that is not deleted is kept while the account that created it remains active.
Subscription status: the free-week and subscription status held for a couple space is deleted together with that space. Transaction-level subscription records are held by Apple and by RevenueCat under their own retention rules, not in Smooch's backend.
Technical hosting logs: Smooch keeps no separate log table. Our hosting provider retains technical logs for a short period — currently about five days — and in any case no longer than 30 days.
Support correspondence: kept for up to 24 months from the last message in the thread.
Anonymous usage events: kept for up to 24 months. Because these events are not linked to you or to your couple space, they are unaffected by account deletion and cannot be retrieved, corrected, or deleted in response to an individual request — there is no way for us to tell which events came from you.
Push-notification tokens: deleted when you sign out of Smooch and when you delete your account.
Backups: our backend is backed up daily, and those backups are retained for about 14 days, and in any case no longer than 30 days. Data you have deleted disappears from backups as those backups age out.
Financial and tax records: accounting records that we are required to keep under Ukrainian tax law are retained for 1825 days from the submission of the relevant tax reporting, in line with Article 44.3 of the Tax Code of Ukraine.
11. Your rights
Depending on your location and applicable law, you may have the right to:
request access to personal data;
request correction of inaccurate data;
request deletion;
request restriction of processing;
object to processing based on legitimate interests;
request portability of data you provided;
withdraw consent where processing relies on consent;
complain to a relevant data-protection authority.
To make a request, email hello@barbash.design. We may need to verify your identity before responding. We will respond within the period required by applicable law.
You can delete your account directly within Smooch, in Settings. Account deletion is permanent and removes your personal data as described in Section 10 (Retention), subject to the shared couple-space handling described in Section 9.
Deleting your account does not cancel an active App Store subscription. Apple manages subscription billing independently of any individual Smooch account. If you are paired, the subscription stays with the couple space and your remaining partner keeps access to it; if you want to stop being charged for a subscription you manage, cancel it separately via iPhone Settings → [your name] → Subscriptions → Smooch.
12. Age requirement
Smooch is intended for users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18, and Smooch does not offer a parental-consent flow for younger users.
If we learn that someone under 18 has created an account, we will take reasonable steps to close the account and delete the associated personal data. If you believe a minor has created an account, contact hello@barbash.design.
13. Security
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, and disclosure. No online service can guarantee absolute security.
The infrastructure on which Smooch runs is operated by a provider that maintains ISO/IEC 27001:2022 certification and a SOC 2 Type II report.
If we become aware of a personal-data breach, we will assess it and notify affected people or authorities where required by applicable law.
14. Third-party services and links
Smooch may rely on or link to third-party services. Their processing is governed by their own terms and privacy policies. We are not responsible for the privacy practices of services we do not control.
15. Changes to this Policy
We may update this Privacy Policy when our processing changes or when required by law. We will update the “Last updated” date and provide additional notice for material changes where appropriate.
16. Contact and complaints
For privacy questions, requests, and general support:
You may also have the right to complain to the data-protection authority in your country of residence. For Ukraine, the relevant supervisory framework includes the Ukrainian Parliament Commissioner for Human Rights.
In Ukraine, the supervisory authority is the Ukrainian Parliament Commissioner for Human Rights, through the Department for Personal Data Protection of its Secretariat: 21/8 Instytutska Street, Kyiv 01008, Ukraine; hotline 1678 (within Ukraine) or +380 44 299 74 08; hotline@ombudsman.gov.ua.
Effective date: 16 September 2026
Version: 1.9