Privacy

What we collect

To build your Love Page, we collect the couple's names, the date your relationship began, your message, your photos, and your email address.

If your order includes a keychain, we also collect the delivery address, so we know where to post it.

Who processes it

We use a small number of specialist companies to run LoveM8, and each one only sees what it needs to do its job: Supabase stores your data and photos, Stripe handles payment, Resend sends your emails, Vercel hosts the site, Cloudflare Turnstile checks you're not a robot, YouTube plays your song, and — only if you accept advertising cookies — Meta measures our ads.

Your page is public to anyone with the link

Your Love Page has its own web address, made of random characters nobody could guess.

But there's no password on it. Anyone with the link can open your page, so only share it with people you want to see it.

Cookies and advertising

We advertise on Facebook and Instagram, and we use Meta's advertising cookies to see which of our ads bring people here and which lead to a purchase. Nothing from Meta loads until you accept it: if you say no, or simply ignore the banner, no Meta cookie is ever set and nothing about your visit reaches them.

If you accept, Meta sets a cookie in your browser and learns that you visited our site, and — if you buy — the amount you paid. Like any website you visit, it also sees the address of the page, your network address and your browser. It never receives your name, your email, your photos, or anything you wrote on your page.

You can change your mind at any time with the "Cookies" link at the bottom of this page. We ask again after twelve months if you accepted, and after six if you declined.

Cloudflare Turnstile — the check that confirms you're not a robot — runs without any cookie at all, and we use nothing else to track you.

Music works differently, and it's worth explaining properly. When a Love Page has a song, we load the YouTube player the moment the page opens — before the heart is tapped, not after. That's deliberate, not an oversight: on an iPhone, a video can only start playing from inside the tap that starts it, so the player has to already be standing by, ready, when that tap happens — otherwise the music simply won't play. The trade-off we accept for that is that YouTube can tell the page was opened, whether or not the heart ever gets tapped.

The player itself runs through youtube-nocookie.com, YouTube's privacy-friendly variant — but the still image it shows before playback starts comes from a separate Google domain (i.ytimg.com), outside that privacy-friendly setup. We don't control what either domain does with that contact, and we won't pretend it doesn't happen.

How long we keep it

If you start a Love Page and don't finish paying for it, we delete that draft automatically after 7 days.

Once your page is published, we keep it until you ask us to delete it.

Your rights

You can ask to see, correct, or delete your data at any time — email help@lovem8.com.

Right now, we handle these requests by hand, and we reply within 30 days.