Last updated: 1 November 2026
The short version: your conversations, photos, voice notes, and memories are end-to-end encrypted — our servers store only ciphertext, and we never read them. Some planning features (to-dos, dates, expenses) are stored readable on the server by design so reminders can work, and Board — the documents and scratchpad canvases you and your partner write in at the same time — is readable too, because something has to merge two people typing in the same paragraph. We say so plainly below. We show no ads, run no trackers, use no third-party analytics, and never sell data.
PairNook is a private couple app operated from India on single-tenant, self-hosted infrastructure (AWS Asia Pacific, Mumbai region). Contact: support@pairnook.com.
The following content is end-to-end encrypted on your device before it is sent. The server stores and relays ciphertext only, and we never read it. The encrypted key backup and the recovery-key escrow that let your history come back on a new device are listed in section 3 (see the Security Whitepaper for the full design):
| Data | Why |
|---|---|
| Account email, display name, password hash, avatar | To operate your account and show your partner who you are. |
| Your device's time zone and language/region setting | So reminders, birthday, to-do and settle-up notifications, the weekly recap and monthly limits follow your own clock. Updated when your device reports a change; never shown to your partner; deleted with your account. |
| Life & activity items — by design not E2EE: titles and content of to-dos, chores, groceries, reminders, important dates, calendar entries, expenses, notes, date plans, shared links and the watchlist, travel lists, photo captions, game boards and scores, and your answers to the daily Question for Two | So the server can send you reminders and notifications at the right time even when your app is closed, and coordinate shared activities between your devices. This is a deliberate trade-off, stated honestly: if you write it in Life planning or a daily answer, our server can read it. |
| Board — by design not E2EE: the text of your shared documents, the strokes on your shared canvases, their titles, and the first few lines kept as a list preview | A board is a document you and your partner write in at the same time, and something has to merge two people typing in the same paragraph: our server does. It holds the live document while either of you has it open, merges every edit, stores it, and keeps a short preview for your Board list. Live cursors and pen positions are relayed between your devices and never stored. A board is not one of the encrypted Documents in your vault — both hold documents, but they are different features. If something is sensitive, put it in chat or the vault, not on a board. |
| Encrypted media blobs | Storage and delivery of your photos/videos/voice notes/files — ciphertext only; we cannot view them. |
| Push notification tokens (APNs/FCM) | To deliver notifications to your devices. |
| Chat notification previews (ciphertext only) | Queued briefly for delivery; unreadable to us. |
| Couple link + device records, message routing metadata | Required to run an encrypted messaging service (who is paired with whom, which devices to deliver to). |
| Encrypted key backup + recovery-key escrow blob | So you can restore your message history on a new device. The backup is encrypted under your recovery key; a copy of that recovery key is also escrowed here, wrapped under a secret that we, the operator, hold. That is what makes recovery automatic — and it means a fully compromised server, or a malicious operator, could combine that escrowed key with your encrypted key backup to reach your message history. We treat this as a disclosed trade-off, not fine print: the Security Whitepaper (section 4) explains exactly what it means. |
| Nook thread (encrypted) | What you ask Nook, Nook’s answers and what was added are stored encrypted. PairNook holds the keys so your Nook works on all your devices; we don’t read it. Because we hold those keys, a fully compromised server or a malicious operator could combine them with the stored items to read your Nook history. We treat this as a disclosed trade-off, the same as the recovery-key escrow above; the Security Whitepaper (section 4b) explains it. |
| Location shares | Your position is kept only while a share is running, and only your partner can see it. When the share stops — because you stop it, or the time you chose runs out — your position is erased within an hour (at once when you stop it yourself). An SOS stores no position on our servers: your location reaches your partner only in the encrypted chat. If you set a home point for arrive-home alerts, that point is kept until you clear it. |
| Moderation reports | To act on abuse reports. A report holds the reason and any details you write, which chat it concerns, the email address of the person who filed it, and the email address and display name of the person it is about, where we have them. It is kept after either of you disconnects or deletes your account, so our team can still review it (see section 6). You can withdraw a report within 5 minutes of filing it. |
| Account, couple, and activity timestamps | When an account or a couple link was created or last updated — needed to operate and secure the service. |
| Assistant-request metadata | When you use the optional assistant, Nook, voice transcription or the Memorial companion, we keep metadata about each request — such as its type, a timestamp, how long it took, its size in tokens or seconds of audio, and an estimate of its cost — for reliability, abuse prevention and a usage limit per couple. The text or audio a request drew on is never stored (see section 5). |
Walkie clips are stored end-to-end encrypted on our servers in India (AWS Mumbai) for 7 days, then deleted, and they’re left out of our backups. PairNook can’t play them. To keep your own phone and watch in step, we store whether you’ve played a clip — never when — and your partner never sees it. A copy of each clip is also saved in your chat as a voice note, and it stays there like any voice note until you delete it. If you or your partner choose Transcribe on a clip, its audio is sent to our transcription provider and the text is saved, encrypted, where you both can see it. Memorial, if you turn it on, can include these voice notes like the rest of your chat.
Our processors — the complete list: Amazon Web Services (hosting, Mumbai region, with encrypted backup copies and two operational secrets in Singapore for disaster recovery; see section 8); the Apple Push Notification service and Google Firebase Cloud Messaging (delivery of notifications to your devices — what they can read is set out just below); OpenAI (only for the explicit-request features described in section 5); and Expo (EAS Update — delivery of app updates to the mobile app; receives the platform/app version and a random per-install update-client identifier, never any content).
What Apple and Google see in notifications. Chat message previews pass through them encrypted; on an iPhone, a chat notification also carries your partner's display name, which is shown if the phone cannot decrypt the preview. Every other notification — reminders, calendar events, to-dos, groceries and other Life and Board updates, expenses and settle-ups, important dates, shared links and the watchlist, games, calls and SOS alerts — passes through them readable, with details such as an item's title, an event's location, an amount or your partner's name, so that it can appear while the app is closed. Notifications sent to a web browser are encrypted for that browser.
We may also disclose information if required by law.
Nook can answer questions about your shared Life and add or change things in it for you. Nook sends nothing until you have agreed to it, and each of you agrees for yourself. It reads your Life only when one of you asks or adds with Nook, never in the background.
When you ask or add with Nook, typed or by voice, we send our AI provider your words, both your first names, and your shared Life: lists, to-dos, chores, groceries, reminders, calendar, notes, boards, important dates, spending and budgets, the watchlist and travel, including what your partner added and who each item is for. For most couples that is all of it, including done and past items. If a question needs more, we also send matching older items or the full text of a note or board. When you speak to Nook, the recording goes to our AI provider to be turned into text, and we do not keep the recording. Each time you ask or add with Nook, we also send two codes, made from your account and from your couple, that don’t reveal your names or emails. Our provider uses the first to detect abuse and the second to answer faster.
Nook also sends your Little Things (sizes, likes and gift ideas you saved) so it can use them in answers. Your private gift ideas go only when you ask Just me; your partner’s are never sent.
Your Little Things can include food likes, dislikes and allergies. An allergy is health information. Like every shared Little Thing, it goes to our AI provider when either of you asks Nook, once the one asking has agreed. So your partner’s question can send it even if you have not agreed yourself. Either of you can Forget it at any time.
Nook never sends your chats, the vault or your Documents, photos, the journal, your daily answers, your location, or anything either of you keeps just for yourself, except your own gift ideas when you ask Nook something just for you.
When you ask Nook something just for you, it can also read the gift ideas you’ve saved about your partner, so it can help you plan. It never reads the gift ideas your partner keeps about you, and nothing you keep just for yourself is ever shown to your partner.
Nook can also suggest changes to things already in Life, like moving a time or marking something done. Nothing changes until you tick each change, and you can undo it for 24 hours. If a change is to one of your partner's items, Nook says so, tells your partner, and lets them put it back. Nook never deletes anything.
What we keep: the items Nook suggests, for up to 24 hours so you can add them (suggested changes for 2 hours); your last question and Nook's answer, for 10 minutes so you can follow up; and, after you apply a change, a copy of the item before and after it, until a day after the 24-hour undo ends. Then they are deleted. As with the assistant, we keep metadata about each request (see section 3); beyond that, what you asked and Nook’s answer are kept only in your encrypted Nook thread (below).
The Nook tab. Nook now has its own tab, with a thread you can scroll back through. Your Nook thread (what you ask, Nook’s answers and what was added) is stored encrypted. PairNook holds the keys so your Nook works on all your devices; we don’t read it. Shared Nook items stay until the person who asked deletes them. Your partner can hide your shared items for themselves, but can’t delete them, and you can do the same with theirs. Your Just me items stay until you delete them, and you can delete all of them at once in Settings → Nook. Forgetting a Little Thing is the one exception: when either of you Forgets one, every Nook item that used it is deleted too, shared or Just me. Everything in Nook is deleted with your shared Life if either of you disconnects or deletes your account. If you pair again with the same person, your Nook starts fresh.
Just me changes who sees an item in the thread. A Just me question draws on the same shared Life as a shared one and goes to our AI provider the same way, and it can also read your own gift ideas. Nothing shows your partner whether you use Just me, except what Nook adds or changes in your shared Life, which is always marked as added or edited with Nook.
Your daily Nook card is made on our servers from your shared Life each morning, with no AI. We keep each card for 2 days. At most one Nook notification is sent a day, and only when something’s due. When a card contains anything private, the notification just says your card is ready. We keep a record of when each daily notification was sent (no content) for 14 days, so you never get two in one day.
Your phone keeps your most recent Nook items (the newest 500, or 90 days, whichever is more) in the app’s encrypted storage, so the thread opens offline. Older items are fetched when you scroll back and aren’t stored on the phone. The website keeps nothing after you close it. Signing out, deleting your account or ending the couple clears the phone’s copy.
If you report a Nook reply, we receive only that reply, never what you asked, and keep it for 90 days, even after an account is deleted.
Little Things are stored encrypted the same way. Both of you can see a shared Little Thing, and either of you can Forget it. Forget deletes it and any Nook answer that used it. A suggestion you haven’t reviewed yet is kept for up to 24 hours, like every Nook suggestion. A private gift idea you save about your partner stays until you delete it; your partner can’t see it or Forget it, and it’s deleted with everything else if either of you disconnects or deletes your account.
Pair Goals stay until you end them. A goal can list the expenses linked to it, in your couple’s currency, and who paid each one.
A Heavy Week, including its reason if you chose one, is deleted when it ends.
A surprise plan stays in the private part of your Nook, which only you can see, until the reveal. If you mark in PairNook that your partner has died, your surprise plans are deleted. It’s deleted with your shared Life if the couple ends first.
Each couple has one weekly AI allowance. The bar shows the total for both of you, never who used it, so a ‘just me’ question is never shown to your partner. The bar does move with both partners' use.
If one of you does not agree, the other's questions can still include shared Life and shared Little Things either of you wrote. You can withdraw at any time in Settings, and Nook stops sending anything for you.
Our AI provider is currently OpenAI. It does not use what we send it to train its models; it may keep it for up to 30 days to detect abuse, and then deletes it.
Deleting a Nook item, or Forget, can’t reach the copy our AI provider may keep for up to 30 days.
PairNook includes an optional assistant and voice-transcription feature. These use OpenAI's API only when you explicitly invoke them — e.g. when you ask the assistant a question or request a transcript. What is sent is the text/audio you submit for that specific request and, when you ask the assistant a question, what we add to answer it: the titles and times of your open shared to-dos, chores, groceries, reminders and plans (your partner's included, with who each one is for) and, for a money question, your settle-up balance. It is sent per request, and it is not used to train their models under our API terms. OpenAI may keep what it receives for up to 30 days to detect abuse, and then deletes it. Nothing is sent to OpenAI in the background. Before your first use, the app asks you to agree, names OpenAI, and says that a scan includes your partner's messages. Besides the assistant and transcription, one feature involves chat content: the optional Memorial companion (Remembrance, in the app) — offered only after you have said, privately in Settings, that your partner has passed away, and enabled only after your explicit, revocable in-app consent — sends excerpts of your decrypted chat history (style samples and your conversation with it) to OpenAI to generate its replies; we never store that text. What you say in Settings is stored with your account alone: whether it is set, and when it was set or undone. It is never shown or sent to your partner's account. After you mark this, your Nook starts on Just me. Your partner’s private Nook items are kept for 180 days and then deleted, unless their account is used again. You can undo it at any time, which also turns the companion off, and it is deleted when the couple ends or you delete your account. The assistant's scan-recent-messages action sends up to 25 recent decrypted messages — your partner's as well as yours — together in one request, to OpenAI for suggestion extraction, only when you tap Scan; the text is processed in memory and is never stored by us.
Deleting your account also deletes the couple's shared data — for both of you. PairNook is built for exactly two people, so a couple cannot continue with one partner gone. Either of you can do this alone, and it does not need the other's agreement. Your partner keeps their own account and anything already saved on their devices.
Deleting your account (Settings → Delete account; if you are not paired, Delete account is at the bottom of the Pair up screen, or of your saved chat if your partner left) permanently removes your account record, your couple link, the couple's Life planning items, the metadata records for your shared photos, push tokens, key backups, and escrow blobs from our servers, and deactivates and erases your messaging identity. Deletion runs immediately; there is no waiting period.
To be precise about the encrypted part: your messages and media are stored as ciphertext on our messaging server. Deleting your account signs you out everywhere, removes you from your shared room, and erases your messaging profile, so nothing further can be sent or read from your account. The encrypted messages and media themselves are not purged when you delete your account: the ciphertext stays stored on our messaging server. We have never read it, and we never will.
You can also disconnect from a partner without deleting your account. That ends the couple and likewise deletes the couple's shared server-side data for both of you. For step-by-step instructions, see our Account & Data Deletion page.
Nook is deleted the same way. Disconnecting or deleting your account deletes everything in Nook for both of you: the thread, Just me items, Little Things and private gift ideas, goals, Heavy Weeks and the Nook keys. Each of you keeps only your own Nook settings, such as your card time. Deleted items leave our encrypted backups within about six weeks. If you report a Nook reply, we keep that reply for 90 days, even after an account is deleted.
When one of you deletes their account or disconnects, the other can still read your past chat, read-only, in the app. For that, and so the chat can reconnect if the same person comes back, we keep with the remaining partner's account: the leaving partner's display name, the date and way they left, and a one-way fingerprint of their email address (a keyed hash, not the address itself). The name and the fingerprint are cleared 12 months after the exit, or sooner if the remaining partner closes the chat, pairs with someone else, or deletes their account. Someone who signs up again with that email address must confirm it by email before the chat reconnects; that is the only time we ask to confirm an email address, and we record when it was confirmed.
We may retain a minimal set of records for longer where required for legal, security, or fraud-prevention purposes — for example, to comply with a legal obligation. Any such records are kept only as long as necessary and then deleted. Safety reports are one such record: a report you filed, or one filed about you, is kept after a disconnect or an account deletion so that it can still be reviewed.
The apps ask your phone for a few permissions. None of them send any new data to our servers. Everything below happens on your device, and each one is optional and revocable in your device settings.
READ_MEDIA_IMAGES, READ_MEDIA_VIDEO) are
explicitly blocked in our app manifest — PairNook cannot browse, enumerate
or read your library.PairNook runs in the AWS Mumbai (ap-south-1) region, on infrastructure we operate ourselves (single-tenant, no shared SaaS databases), and all user data in use is stored there. Our nightly backups (encrypted, and private to us) are kept in Mumbai and, so that a regional outage can’t lose your data, copied to AWS Singapore (ap-southeast-1). Each backup is deleted after 30 days, and every copy is gone within about six weeks. Two operational secrets are also kept in AWS Parameter Store in Singapore for disaster recovery: the key that wraps recovery-key escrow blobs and the key that wraps Nook’s keys (see the Security Whitepaper, sections 4 and 4b). Neither is kept in the backups. Walkie clips are never backed up. All traffic uses TLS 1.2+ (TLS 1.3 preferred). Encryption design details, including exactly what is and is not end-to-end encrypted, are documented in the Security Whitepaper.
You may access, correct, export, or delete your data. Most of this is self-serve in the app; for anything else, email support@pairnook.com and we will respond within 30 days. Settings → Nook → Save a copy of my Nook saves everything you can see in Nook as a file, made on your phone. The file isn’t encrypted, so keep it somewhere private. We comply with India's Digital Personal Data Protection Act, 2023, and honour equivalent rights for users elsewhere.
PairNook is for adults (18+). We do not knowingly collect data from minors; if we learn we have, we delete it.
We will announce material changes to this policy in the app or by email before they take effect.