privacy notice

1. Who we are

This diary service (“Dear the Stars”, “we”, “us”) is operated by Vlera Sejdaj (the “Operator”). Payment transactions are processed by Paddle.com Market Ltd. as Merchant of Record on behalf of Urtina Sejdaj, the Paddle account holder. The Operator is the data controller for personal data processed through the service. Contact us any time at the support email listed inside the app.

This website was built and is hosted using Lovable, a software platform that provides the underlying infrastructure, database, authentication, and deployment services for the app.

2. What we collect

• Account data — email, display name, username, avatar, bio, theme preference.
• Diary content — the letters you write and any replies you receive.
• Authentication data — login credentials (managed by our auth provider) and session tokens.
• Usage / device data — IP address, browser/device type, and basic telemetry for security and reliability.
• Support data — anything you send us when you contact support.

3. Why we use it & legal basis

• To create your account and provide the diary service — performance of a contract.
• To keep the service secure and prevent abuse — legitimate interests.
• To respond to your support messages — performance of a contract / legitimate interests.
• To improve the product — legitimate interests.
• To meet legal obligations (tax, accounting, lawful requests) — legal obligation.

4. Who we share it with

We share personal data only with the categories of recipients below:

• Lovable — the platform that builds, hosts, and runs the app. Lovable provides the database, authentication, server functions, and deployment infrastructure that process your data on our behalf.
• Service providers / subprocessors — hosting, database, authentication, email delivery, and analytics providers acting under contract.
• Paddle.com Market Ltd. (“Paddle”) — our Merchant of Record. Paddle handles the sale of subscriptions, payment processing, tax compliance, invoicing, and customer service related to payments.
• Professional advisers — legal, accounting, and similar advisers under a duty of confidentiality.
• Authorities — where required by law.

We do not sell your personal data.

Your letters stay between you and me — Vlera Sejdaj. The content of your letters is not shared with anyone, is not used for advertising, and is not used to train AI models. Hosting and database providers store the data on my behalf under contract and cannot read it for their own purposes.

5. How long we keep it

We keep account data while your account is active and for a reasonable period afterwards to handle legal, tax, and dispute-resolution obligations. Diary content is deleted when you delete your account. Backups are rotated on a rolling basis. When personal data is no longer needed, we delete or anonymise it.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to data portability, and to withdraw consent. You can also lodge a complaint with your local data protection authority. To exercise any right, contact us through the support email in the app.

7. International transfers

Some of our providers may process data outside your country. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

8. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and row-level security in our database — to protect your personal data. No system is 100% secure, but we take this seriously.

9. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to remember your theme preferences. We do not use advertising cookies. Our payment provider may set its own cookies when you check out.

10. Changes

We may update this notice from time to time. Material changes will be communicated through the app. The “last updated” date at the top will always reflect the current version.