Privacy Policy — Love Angel Cards

Effective date: October 19, 2026

Love Angel Cards ("the app") is made by Mobio EOOD (Mobio Ltd.), 5 Sveta Irina str, ap. 10, Varna, Bulgaria, UIC 148023629 ("Mobio", "we", "us"). We are the controller of the personal data described here. You can reach us at info@mobioapps.com.

This policy explains what the app keeps on your phone, what leaves it, who receives it and why, and the choices you have. It applies to the iOS app. If you use the app on Android, its own privacy policy applies.

1. Information that stays on your device

These details are stored in the app's local storage on your iPhone or iPad:

• Your profile: your name, gender, birth date and relationship situation; the name, gender and birth date of the other person in your readings; and photos of you and of them, if you add them.
• Your readings and journal: the cards you drew, the topic, any question you typed, your notes, the written reading and its narration. Each saved reading keeps a copy of the profile it was read for, so it still shows the right names later.
• Your settings: for example, the time of your daily reminder.

Your zodiac sign, your compatibility and your personal cards are worked out on your device from these details.

We can't see this information. It is included in your device backups (iCloud or computer) according to your own backup settings, and is deleted when you delete the app.

Photos and camera. If you add a photo, you choose it with the iOS photo picker or take it with the camera, and only after you allow camera access. The photo is resized and stored only on your device. It is never uploaded, never sent to the AI service and never sent to analytics.

2. Information that leaves your device

2.1 AI readings (OpenAI and ElevenLabs, through AIProxy)

The written readings and messages in the app (your daily message, your spread readings, Love Card of the Day, and the reflection and card messages during setup) are written by OpenAI's language models. Their narration is spoken by ElevenLabs' text-to-speech.

Sent to OpenAI to write a reading:

• the cards drawn, with their meanings, and the positions in the spread;
• the reading's topic, today's moon phase and lunar day, and your app language;
• for personal readings: your gender, your relationship situation (for example "in a relationship" or "healing after a breakup"), who the other person is to you (for example "your partner"), and the first names you entered for yourself and for them;
• during setup only: the concern you chose and how often you said each of three statements is true for you.

Sent to ElevenLabs to narrate it: the text of the written reading, which may include the first names you entered.

Never sent to either: your birth dates, zodiac signs, photos, the questions you type, your journal notes, or any account, email or advertising identifier.

These requests pass through AIProxy, a relay service that keeps our service keys off your device and blocks abuse. AIProxy receives your device's vendor identifier (a random ID Apple assigns to our apps on your device) and an Apple DeviceCheck token, which confirms the request comes from a genuine copy of the app.

OpenAI and ElevenLabs process this data to return the reading and its audio. OpenAI doesn't use data sent through its API to train its models by default, and we have turned off ElevenLabs' use of our data to train its models. We ask OpenAI not to store our requests or the readings it writes; OpenAI may still keep requests for up to 30 days for abuse monitoring. ElevenLabs may keep the narrated text and its recordings as described in its own privacy policy. ElevenLabs receives no account, email, device or advertising identifier from the app.

2.2 Narration and content audio (our server)

Pre-recorded narrations (card meanings, moon days, your personal cards) are streamed from our server at mobioapps.com. Like any web server, it receives your IP address and the name of the recording requested. Some recordings are chosen by zodiac sign and gender, so the file name reveals the sign and gender it was recorded for. We don't link these requests to any profile. Server logs are deleted after 30 days.

2.3 Product analytics (PostHog)

We use PostHog (servers in the United States) to understand how the app is used and to improve it. PostHog receives:

• events such as screens viewed, setup steps completed, readings started, audio played (the kind of recording, such as a card meaning or a reading, never its title), and paywall and purchase steps, with product, price and currency;
• two of your setup answers: your relationship situation and your gender;
• the topic you choose for a reading, such as their feelings or healing a breakup, and the spread it is for;
• device and app information (model, iOS version, app version, language, approximate location derived from IP) and a random identifier PostHog generates in the app;
• from RevenueCat (2.6), your subscription events, such as a trial starting, a renewal, a cancellation or a refund, with product, price and revenue, together with the details RevenueCat holds for your device: its vendor identifier, IP address, the Apple Search Ads campaign that led to the install and, only if you allow tracking (section 3), your advertising identifier.

The app gives PostHog's random identifier to RevenueCat, so that your subscription events are matched with how you use the app. Because of that, the usage events above are linked to your device's identifiers in PostHog.

PostHog never receives your names, birth dates, zodiac signs, photos or the questions you type, nor any of your other answers, such as the other person's gender, the concern you chose, your ratings of the setup statements or the answers to your Yes or No readings.

2.4 Crash reports and attribution (Google Firebase)

We use Firebase Crashlytics to receive crash reports: the state of the app when it crashed, device model, iOS version and a random installation identifier. We use Firebase Analytics to measure app opens, paywall views and purchases, including which ad campaigns brought people to the app. If you allow tracking (see section 3), Firebase also receives your device's advertising identifier (IDFA), and Google's on-device conversion measurement may be used.

2.5 Advertising measurement (Meta)

We use the Meta (Facebook) SDK to measure the ads we run on Meta's platforms. It receives app activation, paywall views, and checkout, trial and purchase events with price, currency and product. If you allow tracking, it also receives your advertising identifier (IDFA). Meta uses this data under its own privacy policy.

If you allow tracking (section 3), RevenueCat (2.6) also reports your subscription events to Meta: a trial starting, a subscription starting, a trial turning into a paid subscription and each renewal, with product and revenue. With them it sends your advertising identifier, the identifier the Meta SDK gives your device, your device's vendor identifier and IP address, basic device details (such as model and iOS version) and a scrambled (hashed) form of RevenueCat's random user ID, so that Meta can match the events to our ads. It never sends your Apple Search Ads details. If you don't allow tracking, RevenueCat sends Meta nothing.

2.6 Subscriptions (Apple and RevenueCat)

Payments are handled by Apple. We never see your payment details. We use RevenueCat to check whether your subscription is active and to manage trials and offers. RevenueCat receives your App Store purchase receipts, a random user ID it generates, your device's vendor identifier and IP address and, if you allow tracking, your advertising identifier.

We also use RevenueCat to measure our ads on the App Store (Apple Search Ads). The app passes RevenueCat an attribution token from Apple, and Apple tells RevenueCat whether you installed the app after tapping one of our App Store ads and, if so, which campaign, ad group and search keyword it was. This needs no advertising identifier and works whether or not you allow tracking; only if you allow it does Apple also share the date of the ad tap. RevenueCat keeps this with your subscription record, and we use it only to see which of our ads work.

RevenueCat sends your subscription events (a trial starting, a renewal, a cancellation, a refund) to our product analytics, PostHog, together with the identifiers and Apple Search Ads details above, so that we can see how subscriptions relate to the use of the app (2.3).

2.7 Notifications

Daily reminders and the trial reminder are local notifications, scheduled on your device. No notification content is sent through our servers, and they never contain your names.

3. Tracking and your advertising identifier

When you first open the app, iOS asks whether you allow the app to track you. Only if you allow it do Firebase, Meta and RevenueCat receive your device's advertising identifier (IDFA), to measure which ads led to installs and purchases (RevenueCat passes it on to PostHog with your subscription events, 2.3, and reports those events to Meta, 2.5), and does Apple add the date of the ad tap to its Apple Search Ads attribution (2.6). You can change this at any time in Settings → Privacy & Security → Tracking. Declining doesn't limit any feature of the app.

4. Why we use your data (legal bases)

If you are in the European Economic Area or the UK, we rely on these legal bases:

• Performance of a contract: writing and narrating your readings (2.1), streaming audio (2.2), and providing and verifying your subscription (2.6). The readings during setup, before you subscribe, are steps you ask us to take before entering into a contract.
• Legitimate interests: making your readings personal with the details you enter for them (names, gender, relationship situation and setup answers) (2.1), product analytics (2.3), crash reporting (2.4), measuring our advertising without your advertising identifier (2.4, 2.5 and 2.6), and protecting our services from abuse (AIProxy). These help us make your readings personal, improve the app, keep it working and understand which of our ads work. You can object as described in section 7.
• Consent: your advertising identifier, which Firebase, Meta and RevenueCat (and, through RevenueCat, PostHog) receive, and the subscription events RevenueCat reports to Meta (2.5), both only if you allow tracking when iOS asks (section 3). You can withdraw consent at any time in Settings → Privacy & Security → Tracking.

5. International transfers

OpenAI, ElevenLabs, AIProxy, PostHog, Google, Meta and RevenueCat may process data in the United States and other countries outside the EEA. Where they do, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

6. How long data is kept

• On your device: until you delete it in the app or delete the app.
• AI services: we ask OpenAI not to store our requests or its readings; OpenAI may still keep requests for up to 30 days for abuse monitoring. ElevenLabs may keep the narrated text and its recordings as described in its own privacy policy.
• Analytics (PostHog, Firebase): 12 months in PostHog and 14 months in Firebase Analytics.
• Crash reports: 90 days (Firebase Crashlytics default).
• Subscription records (RevenueCat): for as long as needed to provide your subscription and meet our legal and accounting obligations.

7. Your choices and rights

In the app:

• Delete a reading: swipe it away in the Journal.
• Clear your profile: in the Profile tab. Today's message from the angels is written again without your names. Readings you saved earlier keep their own copy of the names and photos they were read with; delete those readings too if you want them gone.
• Remove a photo: from the photo editor.
• Delete everything on your device: delete the app.
• Tracking: Settings → Privacy & Security → Tracking.
• Notifications: turn them off in the app or in Settings.

Your rights: depending on where you live, you can:

• ask for access to your personal data, or for its correction, deletion or a portable copy;
• restrict or object to its processing;
• withdraw consent at any time.

Because the app has no accounts, the data held by our providers is linked only to random identifiers, and we may not be able to find your records unless you help us identify them. Write to info@mobioapps.com and we'll help.

If you are in the EEA, you can also complain to a data protection authority. Ours is the Bulgarian Commission for Personal Data Protection (cpdp.bg).

8. Children

The app is not directed at children under 16, and we don't knowingly collect personal data from them. If you believe a child has used the app and provided personal data, contact us and we'll help remove it.

9. Security

Data sent by the app travels over encrypted connections (HTTPS), and our AI service keys are not stored in the app. Data on your device is protected by iOS's own data protection. No method of transmission or storage is completely secure, but we work to protect your information.

10. Changes to this policy

When the app's handling of personal data changes, we'll update this policy and the effective date above. For significant changes we'll also let you know in the app or on its App Store page.

11. Contact

Mobio EOOD — info@mobioapps.com

See also our Terms of Use.