Lore Privacy Policy

Last updated: 21 July 2026

The controller of your personal data is the operator of Lore, Finland. Contact us through the app or the support channel listed on the site.

We collect what the service needs to work and nothing more. We do not sell data, run ads, track you across the web, or use your content to train AI models.

1. What we collect

Account data. Name, email address, and password (stored as a hash).

Your content. Entries, media, letters, comments, reactions, and the sharing choices you make.

Payment data. Handled by our payment processor. We receive your subscription status and billing country, not your card number.

Technical data. Server logs (IP address, browser type, timestamps) and the usage records needed for billing and abuse prevention.

We collect no advertising identifiers, no behavioural profiles, and no third-party analytics.

2. Why, and on what legal basis

Purpose	Legal basis (GDPR art. 6)
Providing the service, including features you actively use	Contract (6(1)(b))
Billing and subscription management	Contract (6(1)(b))
Security, abuse prevention, debugging, enforcing usage allowances	Legitimate interest (6(1)(f))
Bookkeeping of payments	Legal obligation (6(1)(c))
Emails about material changes	Legitimate interest (6(1)(f))
Optional emails you opt into	Consent (6(1)(a)), withdrawable any time

We do not make automated decisions with legal or similarly significant effects about you.

3. Who can see your content

Your content is visible only to you and the people you explicitly shared it with. A share link exposes only the entries you included and can be revoked at any time.

Content is encrypted in transit and at rest. We do not read your content in the ordinary course of running Lore, and access it only where support, a report, a legal obligation, or fault-fixing requires it. Lore does not use end-to-end encryption, because some features require our servers to process your content.

4. Recipients

We use a small number of service providers under data processing agreements for hosting, storage, content delivery, payments, AI features, and email. We do not sell or rent personal data. We disclose data to authorities only when legally required. A current list of processors is available on request — contact us.

5. International transfers

Data is kept in the EU where possible. Where a provider processes data in the United States, transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

6. Retention

Your content and account data are kept as long as your account exists. Account deletion has a 30-day grace period, after which data is permanently deleted, with backup copies removed within 90 days. Individually deleted content is removed immediately and purged from backups within 90 days. Replies in another person's thread are deleted or anonymised with your account. Server logs are kept 90 days. Payment records are kept as long as Finnish bookkeeping law requires.

7. Your rights

You can access, rectify, erase, and port your data, restrict or object to processing based on legitimate interest, and withdraw any consent. Export (instant JSON and full zip with media) and account deletion are self-service in settings. For anything else, contact us. We respond within one month. You can lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.

8. Cookies

Only cookies and local storage necessary for signing in and remembering your settings. No advertising or third-party analytics cookies.

9. Children

Lore is for people aged 13 and over. If you believe a younger child has an account, contact us and we will delete it.

10. Changes

Material changes are announced by email or in the app at least 30 days before they take effect.

11. Contact

Lore
Finland

Operator legal name, address, and contact details can be updated here when finalized.