PairJar support.

Exactly one stamp is added when you explicitly send eligible non-intimate appreciation to a reward owner, you are that reward's chosen contributor, and the reward is active, unpaused, below its target, and approved by both participants. PairJar shows the expected outcome before you confirm and preserves the appreciation without an extra stamp if another device fills the last slot first.

The thank-you stays in your private appreciation history. It is not lost, but it does not become a stamp and is never banked for a later reward.

No. Each reward has one owner and one chosen contributor. It activates only after those two people approve the same version. Either participant can choose Not now, pause, revise, or remove it. A revision requires fresh approval.

No. An appreciation QR opens a pre-addressed composer; you still write and confirm the moment. A circle-invitation QR opens a preview before the invited adult chooses whether to join. Scanning alone never creates appreciation or a stamp.

Intimacy Space is optional and requires exactly two current adult participants, current policy consent, and independent mutual enablement. Tender, Flirty, Hungry, and Curious are moods inside that one space. Private sparks, invitations, notes, and wishes never become rewards or add stamps. Either person can opt out without penalty. A third member joining, either opt-out, a member leaving or blocking, or account deletion resets intimacy opt-ins and erases both participants' private content and wish answers from the active service. A live private spark expires after two hours. These actions cannot erase screenshots, copies another person retained, or notifications already in transit; see the retention limits.

In What we both like, browsing saves nothing. Yes, Maybe, and Not for me explicitly save your answer; Clear removes it. You see your own answers and ideas you both marked Yes, not the other person's unmatched answers. A mutual Yes is an idea to discuss, not consent to an activity or an automatic plan. Answers and matches never appear in ordinary circle activity, notifications, widgets, or Watch glances. Matching refreshes when you open or refresh the space or return to the app; it is not a live-read or delivery receipt.

Text and wishes are backend-access-controlled, not end-to-end encrypted. The service processes them to authorize sharing and calculate mutual Yes ideas. Ordinary appreciation details, if explicitly enabled, also pass through Apple; private alerts use fixed waiting copy only.

The separate photo implementation encrypts prepared images on device with AES-256-GCM and authenticated HPKE for a manually verified recipient device. With correctly compared safety codes and uncompromised devices, the service cannot decrypt photos, though linked delivery metadata remains. Photo keys and trust records use non-synchronizing WhenUnlockedThisDeviceOnly Keychain storage, not App Groups or UserDefaults; this is not a blanket no-backup guarantee. Photo availability depends on your installed build and separately enabled sharing settings. PairJar cannot prevent screenshots, other cameras, compromised devices, or retained recipient copies.

Photo v1 requires exactly two current adults, mutual Intimacy Space enablement, separate photo opt-in from both people, and manual comparison of a 128-bit safety code. There is one active photo device per profile; reset or a changed key/context requires reverification, with no key recovery. You can deliberately take a still photo or select an image with the system picker. The captured or selected image is redrawn without source EXIF/location metadata as a JPEG up to 512 KiB and 1600 pixels. You review it before separately choosing Send; taking or selecting it does not send it. The prepared photo is encrypted on your device before sending. Only ciphertext and linked delivery metadata go to the database.

A sent photo expires after 24 hours. One atomic opening consumes the encrypted packet, so a lost response or interruption can use up the opening without displaying it. The received-photo viewer closes within 60 seconds and hides on inactivity, App Lock, or detected capture. This cannot prevent a screenshot or another camera. No read receipt is sent; the sender's card keeps its fixed expiry. Limits are eight active metadata cards and 20 sends per circle per UTC day. There is no automatic library save, plaintext export, video, voice, or general chat. Separate photo alerts default Off and permit only Discreet fixed waiting copy. Opt-out/reset or consent/membership loss invalidates active photos, not copies someone already retained. Use a supporting internal-beta build to try these features; this page is not a new public-rollout announcement.

When you choose to take a private still photo or use Scan invitation QR. Taking a photo opens a preview for your review, not an automatic send: you can retake it, cancel, or separately choose Send. The prepared photo is encrypted before sending and is not automatically saved to your library. If Camera access is denied or unavailable, you can select an image with Apple's PhotosPicker without broad library access. PairJar does not request microphone access.

The invitation scanner recognizes the invitation on your device without saving or uploading its camera frames. You can deny Camera access and enter an invitation code or link instead.

The person who owns the reward can record its redemption after the target is reached. Redemption marks the milestone; it never creates an obligation or entitlement.

Supporting current builds make all features temporarily free, without a new-purchase prompt. Commercial limits on ordinary circle members and open rewards are disabled during this period. Safety, privacy, resource limits, and the exact-two, mutually enabled Intimacy Space rules are unchanged. This does not promise permanent free access or mean that Apple subscription products were removed.

The standard Free limits of two active adults and three concurrently open rewards apply only when paid enforcement is enabled; they are dormant during the temporary free period. Appreciation, stamps, QR shortcuts, reward progress, redemption, plans, and history are not commercially metered.

You do not need a new Plus purchase for the temporarily free features in supporting current builds. Under the dormant paid-enforcement model, Plus permits larger circles and unlimited concurrently open rewards; one active subscriber sponsors that subscriber's current circle. Plus never buys stamps, progress, consent, or a reward outcome. The historical monthly/yearly plan terms remain relevant to existing subscriptions and if purchasing is offered again, not as a current purchase requirement.

Your existing circle members, rewards, stamps, and history stay available. Supporting current builds keep temporary free feature access even if Plus ends; commercial expansion limits are disabled during this period. If paid enforcement is enabled again, a new member or reward above the standard Free limits may require Plus. During an Apple billing grace period, a verified Plus entitlement may remain active. Temporary free access does not cancel an existing Apple subscription; manage or cancel it in Circle → Account or the App Store.

Open Circle → Account to restore purchases or open Apple's subscription management, even while features are temporarily free and the paywall is hidden. Only the purchaser controls the Apple subscription. Temporary free access, deleting PairJar or your PairJar account, or leaving a circle does not cancel it. When the separately gated release-candidate restore service is available, you can sign in to a new PairJar account with the purchasing Apple Account after full account deletion and tap Restore purchases. An eligible active subscription bought directly-not through Family Sharing-can transfer only after PairJar confirms that the former account is gone, Apple reassigns the appAccountToken, newly signed Apple state matches the new account, and the server projects the verified entitlement. If the service or verification is unavailable or uncertain, restoration does not grant a verified Plus entitlement and you can retry; temporary free feature access is separate. Separate Apple server credentials and rollout gates must be activated and verified before this path is live. Cancel through the App Store at least 24 hours before the current period ends to avoid the next renewal. Submit App Store refund requests through Apple's Report a Problem service.

Open Circle, choose Account, then choose Leave this circle. Your access ends immediately without requiring another member's permission. Other current members keep the circle and unrelated content; open invitations and rewards involving you become non-actionable history.

To create an account, enter an email address and choose a password of at least 10 characters. To sign in, use your existing email address and password; the new-password minimum is not reapplied at sign-in. Signup is immediate. PairJar's private no-op authentication hook discards every sign-in code, magic link, and recovery email instead of sending it through SMTP. The email is an unverified account identifier, so check it carefully. PairJar currently has no email password recovery; save the password in a trusted password manager. Push notifications cannot sign you in or recover the account. If you lose both the password and every signed-in device, you may need to create a new account and be invited again.

Open Circle, choose Account, then choose Delete account and review the dedicated deletion screen. For protection, PairJar asks for the current password again and creates a fresh password-authenticated session before deletion. Deletion removes your Auth user, profile, consent, ordinary hosted entitlement rows, and circle access. Other current members keep the circle and unrelated content; ordinary shared history may remain for integrity under the Privacy Policy. To keep an eligible direct Apple subscription recoverable without assigning it to the wrong person, PairJar may retain a private service-only transfer tombstone with the raw original Apple transaction ID, one-way former or alternate account-token digests, minimal lifecycle, error, and timestamp state, and a live target UUID only during an active claim. It contains no email, profile or circle content, appreciation or reward content, payment details, or signed transaction JWS, and ordinary app accounts cannot read it. The record remains while Apple state may be active or uncertain; verified terminal state schedules cleanup 180 days later through private maintenance. Account deletion does not cancel an Apple subscription; manage that separately in the App Store. When the separately gated restore service is available, you can sign in to a new PairJar account and use Restore purchases for an eligible direct subscription after deletion finishes. If you cannot access the app, contact the support email above for a privacy request; support cannot send a password or sign-in code.

Yes, when the installed build and backend support them. Push is optional and best effort. Signed-in registration depends on hosted availability; visible-alert/sound permission is separate from content-free refresh. There is no Supabase Realtime or repeating refresh poll. Launch, foreground return, and explicit refresh each perform a recovery read when Apple delays or omits delivery.

Four choices are independent for each profile on each iPhone installation:

• Ordinary appreciation: Discreet by default. Explicit Show names and notes opt-in permits the sender's name and note for appreciation directed to you. Other ordinary alerts stay generic.
• Private sparks: Off by default, or Discreet: A private spark is waiting. No selected phrase, name, or custom text appears. The iPhone mode also governs its widget; Watch app/complication glances have a separate local Off/Discreet mode.
• Private invitations and replies: Off by default, or Discreet: a private invitation or reply is waiting. No title, note, answer, name, or response action is included. There is no Text-preview choice in the updated policy; older revealing choices cannot authorize source-text disclosure. Editing, pausing, resuming, withdrawing, completing, or expiring a plan sends no new private alert.
• Private photos: Off by default, or Discreet with title PairJar and body A private photo is waiting. No image, name, source text, IDs, URL, or action is included. The photo-alert backend is deployed and read back; physical-device delivery remains unverified.

Opening only refreshes or opens the currently authorized app area. It never signs you in, accepts or replies, opens a composer or private photo automatically, or sends anything.

Apple processes the selected alert text through APNs. Anyone who can see your Lock Screen or connected devices receiving mirrored notifications may read it, even while PairJar App Lock is on. iOS controls when previews appear; mirrored notifications follow the iPhone's choice and Apple's controls, not the Watch app's local spark setting.

Turning a preview off or making it less revealing removes applicable delivered PairJar notifications on that iPhone and attempts to synchronize the new choice. If synchronization fails, the app shows an error and the previous server preference may remain until reconnection. No setting can recall a notification already authorized and in transit or guarantee removal of a copy on another device. Appreciation details, private sparks, invitation/reply alerts, and photo alerts request immediate-only delivery; generic ordinary alerts may be retained by APNs for up to 24 hours. Arrival, read status, and exact deletion times are not guaranteed.

Open Circle, choose the relevant member, then use Report a concern or Block and leave. PairJar shows the effect before you confirm, and the action does not require the other member's permission. Reports are not monitored continuously.

No. If someone may be in immediate danger, contact local emergency services or a trusted local support organization. Leave the app and device if doing so is safer.

Feature availability depends on the installed app build and backend. The photo, wish, and notification functionality described in this September 8 update is being evaluated through the existing private internal TestFlight group, not announced as a new external/public rollout. Physical-device notification, widget, Watch, App Lock, photo, scanner, accessibility, subscription, and routing checks are explicit internal-beta tests and remain unverified. This page describes supported behavior, not proof of Apple approval or end-to-end delivery.