Privacy policy

The short version

Everything you add to Bizarre Love Polygon (nicknames, places, dates, notes and your photo) is stored encrypted on your own device. We don’t have an account system or a database, and we never receive your data. The app shows ads from Google, and a few outside services help draw the map and find places; this page explains exactly what each one receives.

Who we are

Bizarre Love Polygon (lovepolygon.com) is made by nubuza. For anything about privacy, write to info@lovepolygon.com.

What stays on your device

• The people, places, dates, notes and photo you add are kept in your browser’s storage (IndexedDB), encrypted with AES-256 using a key that never leaves the device. With the app lock on, that key is itself encrypted with your PIN.
• A few settings are kept in your browser’s local storage, unencrypted and never sent anywhere: whether discreet mode is on, and whether Drive sync is connected (with the date of the last sync).
• Backup files you create are encrypted with your passphrase. We can’t open them.
• Share cards and timelapse videos are made on your device. They never include notes, and include nicknames only if you tick "Show names above the hearts". A small polygon can show streets; "Blur exact places" moves each heart. Nothing is uploaded unless you choose to share them yourself.
• "Delete everything" in Settings removes all of it, including the encryption keys.

Outside services and what they receive

• Cloudflare hosts the site. Like any web host it processes your IP address and technical request details to deliver the pages and protect against attacks. See Cloudflare’s privacy policy.
• OpenFreeMap provides the map tiles. It receives your IP address and the map area you are looking at, not your pins.
• Photon (by Komoot) powers place search. It receives only the text you type in the search box, and your IP address.
• Google provides Drive sync (if you turn it on) and ads (see below). It never receives your people, places or photo in readable form.

Visitor statistics

We count visits with Cloudflare Web Analytics, which sets no cookies, doesn’t fingerprint your device and doesn’t follow you across websites. It gives us aggregate numbers only (how many visits, which pages, the referring site, the country and type of device, page speed), never who you are or anything you add to the app. See Cloudflare Web Analytics.

Google Drive sync (optional)

If you turn on Drive sync, the app saves an encrypted copy of your data in your own Google Drive, in a hidden folder only this app can see (Google’s drive.appdata permission: it can’t see any of your other files). It is encrypted on your device with a random sync key before it leaves, so Google stores only unreadable data; without the key nobody can open it, not even Google or us. Each device keeps the key encrypted like your data (behind your PIN if the lock is on).

To add another device, the app shows the key as a QR code and a recovery code. The QR opens the app with the key in the part of the address after "#", which browsers never send to any server; the app reads it on arrival, keeps it only for that browser tab until you connect, and removes it from the address bar. Google gives the app a short-lived access token that stays in your browser’s memory; we never receive it. Disconnect any time in Settings, and delete the Drive copy in Google Drive → Settings → Manage apps.

Bizarre Love Polygon’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The app uses Drive only to store and read back your own encrypted backup: no ads, no AI training and no sharing with anyone.

Advertising and cookies

We use Google AdSense to show a few ads. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.

You can opt out of personalised advertising in Google’s Ads Settings, and opt out of some third-party vendors’ cookies at aboutads.info. See also how Google uses information from sites that use its services.

In the European Economic Area, the UK and Switzerland, Google’s consent message asks for your choice before personalised ads or advertising cookies are used, and you can change it later. The app itself sets no cookies.

The Android app

The Android app (Google Play) is the same app, kept on your phone: everything you add stays encrypted on the device, as on the web. What is different:

• Ads come from Google AdMob, which may use your device’s advertising ID and, if you allow it, show personalised ads. In the European Economic Area, the UK and Switzerland, Google’s consent message asks first; change your choice any time in Settings → Ad privacy choices. You can reset or delete the advertising ID in your phone’s settings (Google → Ads). See how Google uses data for ads.
• Location is only used when you ask the map to go to where you are; it never leaves the phone.
• Cards, videos and backups you save go to the Documents folder on your phone; sharing hands them to the app you pick.
• Drive sync works as on the web, except that you sign in with Google’s own account screen on the phone (Google Play services) instead of a browser popup. It asks for the same drive.appdata permission, and the access token stays in the app’s memory.

Donations and emails

If you donate, it happens on PayPal or in your own wallet, under their terms; we only see what PayPal shows any recipient. If you email us (for example a bug report), we receive what you send and use it only to answer you. Bug reports created by the app contain technical details only (app version, browser, screen size), never your people or places.

Your rights

Since your love-map data never reaches us, you control it directly: view, change or delete it in the app at any time. For anything we might hold (such as emails you sent us) you can ask us to access, correct or delete it at info@lovepolygon.com. You can also complain to your local data protection authority.

Age

Bizarre Love Polygon is for adults (18+). It is not meant for children.

Changes

If this policy changes, the new version is published on this page with a new date at the top. See also the terms of use.