PairJar

Your private PairJar

Privacy policy.

This policy explains what PairJar processes, why it is needed, what active circle members can see, and the choices you keep.

Effective September 8, 2026Updated September 8, 2026

1. Who and what this covers

PairJar is a private appreciation and connection service for invite-only circles of two or more consenting adults. It is operated by Peter Hlavatik ("PairJar," "we," "us"), who is the data controller for information processed to provide the service.

This policy covers the PairJar iOS app, this public website, support communications, and the hosted account and synchronization service. PairJar is not offered to anyone under 18. The photo and notification functionality described in this September 8 update is available only when supported by your installed app build and backend, with the required separate choices and consent. It is being evaluated through the existing private internal TestFlight group; this page is not a new external/public rollout announcement or proof of physical-device delivery. The account-deletion subscription-transfer language describes the contract when the separately gated service is available; separate Apple subscription-reconciliation credentials and rollout gates require verification.

This website has no account form, advertising, analytics SDK, tracking pixel, or marketing cookie. Vercel hosts the independent project website on its Hobby plan and may process basic request information such as IP address, browser headers, requested URL, time, and security logs to deliver and protect it. PairJar does not run website functions or write application logs. Vercel's standard Hobby runtime-log interface has a one-hour retention window; Vercel may separately retain platform security and usage records under its terms and policies.

2. Information PairJar processes

Account and circle information

  • Email address used as an unverified account identifier, display name, authentication user ID, policy acceptance, and account status. Supabase processes the password to authenticate the account; PairJar does not store the plaintext password in app storage.
  • Circle name, active member identities, membership state, roles needed for a reward, and relevant timestamps.
  • Circle-invitation state. Invite tokens are valid for seven days after issuance, can be used once, and are revoked when a replacement is issued. They are stored by the application backend as cryptographic hashes rather than readable tokens. Shared HTTPS invitations keep the token in a URL fragment, which is not sent in the normal request to the public website.

Content you choose to create

  • Immutable ordinary appreciation moments, including the sender, recipient, note, category, time, and whether the server bound that moment to an eligible reward at creation. Optional intimacy moments follow the sensitive-content erasure rule below.
  • Invitation text and reward proposals, exact proposal-version identifiers, titles, notes, stamp targets, approvals or declines, pause and removal state, and redemption time. PairJar conservatively discloses directed appreciation, invitation, and reward text as Emails or Text Messages as well as Other User Content in Apple's App Privacy form. PairJar has no public feed or general-purpose chat.
  • Your own optional intimacy-category setting and the aggregate result of whether that category is available. The category is available only while the circle has exactly two active members and both independently enable it. Your raw choice is not displayed to another member, although aggregate availability in a two-member circle may allow an inference.
  • Optional private sparks, notes, invitations, replies, and wish answers require exactly two current adult participants, current policy consent, and independent mutual enablement. A third member joining, either opt-out, a member leaving or blocking, or account deletion resets intimacy opt-ins and erases both participants' private content and wish answers from the active service, subject to the retention limits below. Content-free operation hashes may remain to reject delayed replay. Intimacy content is never attached to a reward or stamp.
  • In What we both like, browsing saves nothing. An explicit Yes, Maybe, or Not for me saves your answer with your user identity, circle, and wish key; Clear removes it. The backend returns your own answers and only ideas for which both current participants chose Yes. It does not return the other person's unmatched answers. A mutual Yes is an idea to discuss, not consent to an activity or an automatic plan. Wish answers and matches are not placed in notifications, widgets, Watch glances, or ordinary circle activity.
  • Private photos: both people in an exactly-two Intimacy Space must separately enable photos and compare a 128-bit safety code. Each profile has one active photo device; changed keys or context require reset and comparison again, without key recovery. You can deliberately take a still photo with the camera or select an image through Apple's PhotosPicker. The image is redrawn as a JPEG without source EXIF/location metadata and limited to 512 KiB and 1600 pixels. You review the prepared photo before choosing Send; taking or selecting it does not send it. The prepared photo is encrypted on your device before sending. The database receives encrypted bytes, a wrapped content key, public device keys, participant/device/context/media identifiers, and creation/expiry metadata, not private keys or plaintext. Photos or Videos and Sensitive Info are conservatively declared as linked App Functionality data, not tracking. Video, voice, general chat, automatic library saving, and plaintext export are not implemented. Separate default-Off photo alerts are described below.
  • Safety reports, blocks, report reason, and any optional details you deliberately submit.
  • Support messages and contact details you send when asking for help or exercising a legal right.

Purchase and entitlement information

If you use PairJar Plus, PairJar processes the product ID, transaction and original-transaction identifiers, an app-account token linked to your PairJar user ID, subscription environment and status, purchase, renewal, expiration, grace-period, revocation, and verification timestamps, and signed App Store transaction data needed for server verification. Apple processes the payment itself. PairJar does not receive your full payment-card or bank-account information.

Account-deletion subscription transfer record

After a purchaser's PairJar account is fully deleted, PairJar may retain a private, service-only tombstone so an eligible active subscription is not stranded or assigned to the wrong person. It contains the App Store environment; the raw original Apple transaction ID required by Apple's server API; one-way digests of a former or alternate appAccountToken; minimal claim, lifecycle, error, reconciliation, verified-expiry, signed, terminal, cleanup, and update timestamps and state; and a live target PairJar user UUID only while a transfer claim is active. It contains no email address, profile or circle content, appreciation or reward content, payment details, or signed transaction JWS. Ordinary app accounts cannot read it.

Operational diagnostics

Supabase and PairJar process short-retention IP and network request data, timestamps, function, database, and API logs, security events, and content-free replay-prevention state needed to authenticate requests, operate and protect the service, investigate abuse, and diagnose failures. PairJar discloses this as Other Diagnostic Data linked to your account for App Functionality. It is not used for behavioral analytics, advertising, or tracking.

Information PairJar does not seek

PairJar does not request your contacts, location, microphone, health data, payment-card or bank-account information, advertising identifier, or browsing history. Photo import uses the system picker for the item you select, not broad library access. Camera permission is requested when you choose to take a private photo or use Scan invitation QR. A captured still photo is prepared for your review and is sent only after you choose Send; it is not automatically saved to your library. The invitation scanner recognizes the invitation on your device without saving or uploading its camera frames. If Camera access is denied or unavailable, you can select a photo with the system picker or enter an invitation code or link instead. The separate optional photo feature processes captured or selected images as described above. PairJar does not use behavioral advertising or cross-app tracking.

PairJar declares an APNs device token as Device ID linked to the signed-in user, used only for App Functionality, and not used for tracking. A supporting app build can register with APNs after sign-in when the authenticated server reports the delivery gate available. Device-token registration and silent background invalidation do not depend on permission to show alerts. PairJar separately asks whether it may show visible alerts and play sounds; declining that optional permission leaves silent registration eligible but prevents PairJar from intentionally sending visible alerts to that installation.

Four independent notification choices

Silent notifications contain only a fixed refresh marker. Each profile on an iPhone installation has separate choices, synchronized with that installation's private device registration. They are not shared with the other participant and do not opt in another device. Enabling one choice does not enable the others.

  • Ordinary appreciation: Discreet is the default, and other ordinary activity alerts remain generic. Explicitly enabling Show names and notes permits appreciation addressed directly to you to show the sender's display name and note. The heading distinguishes reward-bound Stamp from from unbound Appreciation from. It contains no reward title, total, account/circle/event ID, or invitation token.
  • Private sparks: Off is the default; the only other choice is Discreet, which says A private spark is waiting. Notifications and incoming widget/Watch glances do not show the sender's selected phrase, name, or custom text. Earlier Spicy choices cannot disclose private source text under the updated policy. Spark Off does not turn off separately enabled invitation notifications.
  • Private invitations and replies: Off is the default; the only other choice is Discreet, which says A private invitation is waiting. or A private reply is waiting. There is no invitation title, note, answer, sender name, source ID, or response action. Earlier Text-preview choices cannot enable revealing content under the updated policy. Editing, pausing, resuming, withdrawing, completing, or expiring an invitation sends no new private alert.
  • Private photos: a separate Off/Discreet setting defaults Off. Discreet says A private photo is waiting. under the title PairJar. It contains no image, name, title, note, ID, URL, or action. A tap only opens the currently authorized photo area and never consumes or opens a photo. It does not inherit another setting; its backend is deployed and read back, while physical-device delivery remains unverified.

Apple processes the selected alert text through APNs. Anyone who can see the Lock Screen or a connected device receiving mirrored notifications may read it, even while PairJar App Lock is on. iOS controls when previews appear. Tightening or turning off previews removes applicable delivered PairJar notifications on that iPhone and attempts to synchronize the new preference. A failed synchronization is shown in the app and may leave the previous server preference active until reconnection. PairJar cannot recall a notification already authorized and in transit or guarantee removal of a copy on another device. Immediate-only delivery is requested for appreciation details, private sparks, invitation/reply alerts, and photo alerts; generic ordinary alerts may be retained by APNs for up to 24 hours. No exact arrival or deletion time is guaranteed.

The iPhone spark setting also governs its widget. The Watch has a separate local Off/Discreet setting for its app and complication; mirrored notifications follow the iPhone choice and Apple's controls. Incoming glances contain no spark phrase, appreciation details, private invitation text, wish answers/matches, or photos. Waiting state is redacted when expiry or loss of authorization is known; an offline device may not learn of a remote change immediately. Opening only routes to the currently authorized app area for review and confirmation. It never authenticates, recovers an account, approves, sends, replies, adds a stamp, or opens a private photo by itself.

Apple controls APNs delivery. A silent update may be delayed, throttled, or not delivered, including while the app has been force-quit. PairJar therefore also reads authorized state once when a session launches, when the app returns to the foreground, or when you explicitly refresh. Those lifecycle- or user-triggered reads are correctness fallbacks, not continuous polling.

Push is an optional, event-driven channel, not a continuous polling or guaranteed-delivery service. Preview text is resolved only from the currently authorized source and receiving device's choice. Private outbox rows contain transient source references rather than copied names, notes, titles, or answers; references are redacted when their private source is invalidated. This description does not establish physical-device APNs verification or availability in every installed build.

Where information comes from

Information comes from you, other circle members, and service-generated state needed to operate PairJar. A circle member may create appreciation addressed to you, name you as a reward owner or contributor, invite you to a circle, or submit a safety report that identifies you. The service generates identifiers, timestamps, approval state, reward binding, progress, and security records from those actions.

3. Why the information is used

We process information only as needed to:

  • authenticate you and keep each private space limited to its current invited members;
  • synchronize reward proposals, exact-version approvals, immutable appreciation history, eligible reward-bound stamps, progress, and redemptions;
  • recognize invitation QR codes on your device and open QR routes safely without treating a scan as appreciation or awarding a stamp automatically;
  • verify and restore PairJar Plus, apply Free/Plus limits, give the subscriber's current circle Plus access, and prevent transaction replay or purchase fraud;
  • safely reconnect an eligible direct subscription after full account deletion only when you initiate Restore purchases, the former PairJar account is gone, Apple replaces the subscription's appAccountToken, newly signed Apple state matches the new signed-in account, and the server projects that verified entitlement; Family Sharing transactions are not eligible, and uncertain or incomplete verification does not grant Plus;
  • enforce circle membership, reward-participant choice, blocking, content, and safety rules;
  • secure and maintain the service, investigate abuse, respond to reports, and comply with law;
  • process account deletion and answer support or privacy requests.

We do not sell personal information, build advertising profiles, or share information for cross-context behavioral advertising.

4. What active circle members can see

Active members can see the circle name, member profiles, ordinary appreciation history with sender and recipient, shared reward proposals and states, which eligible moments counted toward reward progress, and recorded redemptions.

Each reward has one owner and one chosen contributor. Their role and approval state are visible as shared reward activity, but only those two participants control that reward. An eligible stamp is created only by appreciation from its chosen contributor to its owner.

Other members cannot see your raw intimacy opt-in value or device-preview choices. PairJar shares aggregate availability in an exactly-two circle, which may allow an inference. Private wishes return each viewer's own answers and mutual Yes ideas; a shared idea therefore reveals the other participant's Yes for that idea, but not unmatched answers. Intimacy stays separate from ordinary circle activity, cannot be a reward, and never adds a stamp. Notification text follows the receiving device's independent settings and the display/recall limits above.

Leaving, blocking, or deleting ends the departing member's access. The other current members keep the circle and content unrelated to the departing member. Open invitations and rewards involving that member become non-actionable historical records. Ordinary shared history may remain stored for integrity, but PairJar does not return an item as current-member content when its participants are no longer current members.

5. Service providers and transfers

Apple operates the App Store and StoreKit, processes subscription payments and refund requests, and provides PairJar with signed transaction and subscription-status information. Apple also operates APNs delivery to a registered device when PairJar's enabled server path and the receiving Apple device permit delivery. Physical-device delivery has not yet been verified end to end. Apple's storefront pricing, payment methods, tax handling, retention, and other processing are governed by Apple's terms and privacy policy. PairJar links a verified transaction to the signed-in PairJar user so one active subscriber can sponsor Plus for their current circle.

Vercel hosts this public website and processes technical request data to deliver and protect it.

Support and privacy messages sent to p.hlavatik@gmail.com are processed through Google's Gmail service under Google's privacy policy. This can include the message and attachments, sender and recipient details, timestamps, and technical metadata, and Google may process that information on servers in different countries. Do not email passwords or live circle-invitation tokens.

PairJar uses Supabase for authentication, hosted PostgreSQL, the Data API, and Edge Functions, including account deletion, subscription verification, wish matching, and notification dispatch. Permitted appreciation details and fixed private waiting alerts are prepared for APNs. The photo implementation uses database-stored ciphertext and linked metadata, not public photo URLs or a photo storage bucket. There is no Supabase Realtime or repeating refresh poll. The recorded development project uses Supabase Free with its primary database in eu-west-2, London, United Kingdom; unrelated provider settings were not freshly audited for this update. Subscription enforcement and transfer have separate rollout gates.

Supabase may use subprocessors and process limited information outside that primary database region. Covered international transfers are addressed through Supabase's applicable data-processing terms and safeguards, which may include the European Commission's Standard Contractual Clauses. Those safeguards do not mean every provider operation occurs only in the United Kingdom or EEA.

PairJar uses auto-confirmed email/password signup. New passwords require at least 10 characters; sign-in uses the existing password without reapplying that minimum. The entered email is only an unverified account identifier. PairJar configures no custom SMTP or outbound authentication-email provider. Supabase routes every attempted authentication email through PairJar's private no-op Postgres Send Email hook, which discards confirmation, sign-in-code, magic-link, recovery, email-change, and notification events without sending or storing their token-bearing payload. The app exposes no OTP, magic-link, confirmation-email, email-change, or password-recovery flow. Save the password in a trusted password manager; losing it together with access to every signed-in device may require a new account and invitation.

We may also disclose limited information where required by law, to respond to a serious safety risk, to investigate abuse, or if PairJar is transferred to a new operator, subject to appropriate notice and safeguards.

7. Retention and deletion

  • Account and active-circle information is kept while needed to provide the account and circle.
  • Verified purchase and ordinary hosted entitlement records are kept while needed to provide or restore Plus. Account deletion removes those ordinary entitlement rows. Apple separately retains its own App Store purchase records under its policies.
  • The private account-deletion subscription-transfer tombstone is kept while Apple reports that the subscription may remain active or its ownership or lifecycle state is uncertain. A verified terminal Apple state sets cleanup for exactly 180 days after the terminal timestamp. PairJar's private maintenance deletes a due available or completed tombstone once no reconciliation lease is active; a claimed or failed record is retained until uncertainty is resolved. If a completed transfer's current owner later deletes their PairJar account, PairJar rotates the proof to a one-way digest of that current appAccountToken for a possible next restore, clears the earlier claim and target UUID, and does not preserve the earlier account UUID in raw form.
  • Unclaimed invitations are valid for seven days after issuance, can be used once, and are revoked when a replacement is issued. Claimed, revoked, or expired invite-token hashes are scheduled for removal within one day.
  • Leaving or blocking ends the departing member's access. Other current members keep the circle and unrelated content. Open invitations and rewards involving the departing member become non-actionable historical records. Ordinary shared history may remain stored for integrity, but it is not returned as current-member content when its participants are no longer current members.
  • Account deletion requires a fresh password sign-in for the same PairJar user and ends that person's access. It removes the Supabase Auth user, PairJar profile, consent rows, and ordinary hosted entitlement rows. The limited service-only transfer tombstone described above may remain, without email, content, signed transaction JWS, or the deleted account's raw UUID. The circle and unrelated content remain available to other current members under the same lifecycle rule above. Deleting a PairJar account or app does not cancel an Apple subscription; the Apple Account holder must manage or cancel it in the App Store, and Apple retains its own purchase records under its policies. When the separately gated restore service is available after deletion fully finishes, you may sign in to a new PairJar account and initiate Restore purchases for an eligible active subscription bought directly rather than through Family Sharing. Plus remains unavailable unless Apple reassigns the appAccountToken, newly signs matching state for the new account, and PairJar's server projects the verified entitlement.
  • Safety reports are retained for no more than 90 days from submission, unless applicable law requires a longer period.
  • Optional intimacy requires exactly two current participants, current consent, and both opt-ins. A private spark stops being returned by the service at its two-hour expiry and is removed by the expiry/maintenance path. A third member joining, either opt-out, a member leaving or blocking, or account deletion resets intimacy opt-ins and erases private sparks, notes, invitations, and both participants' wish answers from the active database. The old wish context is invalidated so a delayed choice cannot repopulate a later re-enabled space. You can also clear an individual wish answer. Content-free operation hashes may remain to reject delayed replay. This does not erase screenshots, exported copies, notifications already in transit, or information another person retained.
  • In photo v1, photos expire 24 hours after sending. One atomic opening removes the active encrypted packet before delivery: a lost response or app interruption can consume the only opening without showing the photo. The viewer closes within 60 seconds and hides on inactivity, App Lock, or detected capture. There is no sender read receipt; the sender's card keeps its fixed expiry even after opening or recipient removal. Sender removal deletes the active card and packet; recipient removal discards the packet without changing that card. Opt-out, reset, or consent/membership loss invalidates the photo context and deletes its active packets/cards. Limits are eight active metadata cards and 20 sends per circle per UTC day; daily-limit/replay records can outlast a packet or reset. Expired photos are unavailable to app reads and removed by cleanup, not guaranteed erased from every provider copy at that instant.
  • After confirmed account deletion, the app attempts to remove that profile's photo identity and all saved trust records on this device. A local Keychain cleanup failure is surfaced without reversing successful server deletion. Sign-out alone does not delete device identity/trust. This does not erase another device's keys or retained copies.
  • Support communications are kept only as long as needed to resolve the request and meet applicable legal obligations.
  • PairJar permits at most five device registrations per account, attempts removal or reassignment during sign-out, account change, and token rotation, and handles invalid tokens on the server. Terminal delivery metadata is purged after seven days. The outbox contains source references, not copied preview text; private invitation source invalidation or invitation-preview Off redacts pending and terminal private invitation references and invalidates their leases. Claims are terminal before the APNs call, with no polling retry. Turning the database delivery gate off deletes every registration and outbox row; devices must register again after re-enable. These operations cannot recall an APNs notification already in transit.
  • On the current Supabase Free plan, API and database logs available to the project are retained for one day. Provider security, abuse-prevention, or compliance records may follow separate retention rules under the provider's terms.
  • The recorded Supabase Free configuration has no automatic database backups. Active-database erasure is not a guarantee of immediate deletion from every provider backup, operational log, or independently retained copy. Provider retention and any backup configuration must be checked separately; PairJar will update this policy if those arrangements change.

You can start account deletion in PairJar from Circle > Account > Delete account. If you cannot access the app, use the contact in Section 11.

8. Your privacy rights

Depending on where you live, you may request access to, correction of, export of, restriction of, objection to processing of, or deletion of your personal data. You may withdraw consent for optional processing without affecting earlier lawful processing.

We may need to verify your identity before completing a request. We will respond without undue delay and within the period required by applicable law.

If you are in the EEA, you may complain to the competent data-protection authority, including the Office for Personal Data Protection of the Slovak Republic where applicable. California residents may request access, correction, or deletion and will not be discriminated against for exercising privacy rights. PairJar does not sell or share personal information for cross-context behavioral advertising.

9. Security

The hosted service uses TLS in transit, row-level database authorization, membership checks, explicit API grants, hashed single-use invitation tokens, authenticated server functions, fresh-password reauthentication for account deletion, server verification of signed App Store transaction data, replay-resistant entitlement updates, and protected local iOS storage. The iOS client contains only a modern Supabase publishable key; secret, service-role, and APNs-provider keys are not shipped in the app bundle. Camera-based invitation recognition stays on the device, saves or uploads no imagery, and has a manual code-or-link fallback. QR opening and notification opening never create appreciation, approve an action, or add a stamp by themselves; an authenticated eligible circle member must explicitly confirm an action in the app.

Text and wish storage is backend-access-controlled, not end-to-end encrypted (E2EE). The service processes it to authorize sharing and calculate mutual Yes ideas. Explicitly enabled ordinary appreciation details also pass through Apple; private spark and invitation alerts contain fixed waiting copy only. App Lock does not protect information already displayed by the operating system.

The separate photo implementation uses a fresh AES-256-GCM content key and authenticated CryptoKit HPKE wrapping for the manually verified recipient device. With correctly compared codes and uncompromised devices, the service cannot decrypt the photo, but linked delivery metadata remains visible to the service. Profile-device private keys and compared trust records use separate, non-synchronizing WhenUnlockedThisDeviceOnly Keychain items, not App Groups or UserDefaults. This is not a blanket no-backup guarantee. Photo plaintext is not deliberately persisted for caches, offline retry, export, or library saving. PairJar cannot prevent screenshots, another camera, a compromised device, or recipient copies; it does not guarantee memory zeroization or deletion from every backup/log. There is no key recovery after identity loss/reset, and retained ciphertext is not guaranteed safe if the corresponding private key is later compromised.

Ordinary app accounts cannot browse safety reports or another purchaser's transaction details. No transmission or storage system is perfectly secure. If you believe an account or data is at risk, contact us promptly.

10. Adults only and policy changes

PairJar is for people aged 18 or older. We do not knowingly offer the service to minors. Contact us if you believe a minor created an account so we can investigate and delete it where appropriate.

We may update this policy as PairJar changes. The current version will remain available at this URL, with its effective and last-updated dates. We will provide appropriate notice before a material change takes effect where required.

11. Contact

Data controller and operator: Peter Hlavatik

Project status: Independent project based in Slovakia

Privacy and support email: p.hlavatik@gmail.com

Data-protection authority: Office for Personal Data Protection of the Slovak Republic

Website: https://pairjar.vercel.app/