On your phone

• A sign-in token, kept in the iOS Keychain or the Android Keystore through Expo SecureStore. A web development build keeps it in localStorage under wedfold.token. The app sends it as a bearer token. The server stores only a SHA-256 hash of it.
• A 10-character recovery code in the same secure store, under wedfold.recovery. It is not an email address. The server stores only a SHA-256 hash. Settings can show the code.
• An unsent answer, under wedfold.pending, only if a submit fails because the phone is offline. That copy is deleted after a successful send.
• Preferences in AsyncStorage under wedfold.prefs: text size, whether a reminder is on and what time it uses (the default is 8:00 PM), and two dismissed-hint flags. iOS may include AsyncStorage in a device backup. Android backup of the app is off.
• Attribution in AsyncStorage under wedfold.attribution: organic, paid, referral, or partner, plus an optional campaign string from the link that opened the app.
• A local reminder, only if you turn it on. The notification title is Wedfold and the body is “Today's question is here when you both have a minute.” No push token is created, and none is sent to the server.
• Questions, devotionals, date ideas, and the cited World English Bible verses are part of the app itself. Preview-partner replies are not in that bundle.

On Cloudflare

The API is deployed. Cloudflare is the processor. The service is the Cloudflare Worker wedfold-api and the D1 database wedfold.

D1 stores the phone’s account: a UUID, the token hash, the recovery hash, the first name you typed (1–24 characters), the couple it belongs to, whether the row is the sample partner, and created and deleted times. For the couple it stores an 8-character invite code, an IANA timezone name (America/Chicago if the phone’s zone cannot be used), whether a membership is active and which product and person granted it, and the streak count and last streak date. It also stores which question the couple was assigned on a date, without the answer text.

Answers you write are stored, up to 2000 characters. Prayers are stored, up to 500 characters, including when one was marked answered and by whom. Date marks store which date-idea ids you marked done. The idea text stays in the app, not in D1.

Rate-limit rows record join attempts by device id, and recovery attempts by the connecting IP address (or the string “local” in development). Rows older than one hour are deleted.

A Cloudflare Durable Object named CoupleRoom keeps one integer counter so two joins or two prayers cannot race. It does not store names, answers, or prayers.

Request logs, when observability is on, are JSON with the event, method, path, status, and duration in milliseconds. They do not include bodies, tokens, answers, or codes. Besides those logs, the Worker records traces for 10% of requests. Traces do not include request bodies or answers.

What we do not collect

Wedfold does not ask for your email, phone number, postal address, contacts, photos, precise location, advertising id, date of birth, gender, or a password. There is no analytics SDK, no crash reporter, no advertising, and no AI in the shipping app. There is no Sign in with Apple, no Google sign-in, and no email link. We do not sell personal information.

Pairing and the preview partner

Creating a device returns the device id, the token, and the recovery code once. Creating a couple returns an invite code. Joining with that code adds the second person. A third real person cannot join.

You can try a day with a preview partner named Jordan. Jordan is not a real person, and those replies are sample text. When you submit the daily question, the server adds Jordan’s reply in that same request, and then both answers are shown. Jordan does not answer extra prompts. Joining a real invite code while a practice couple is still open deletes that practice couple, including its answers, and then joins. Removing the preview deletes the sample answers and assignments, removes sample devices, and resets the streak. It keeps the couple, the invite code, and prayers.

Answers stay hidden

Each phone sends its answer to the server. The server does not overwrite an answer that was already stored. You can see your own text. Your partner’s text is omitted until both of you have answered that question. While it is waiting, the app checks about every 8 seconds. If the network fails during submit, the answer stays on the phone and is sent on the next refresh. The couple’s timezone decides which calendar day is today. Either person can set that timezone to the phone’s current zone from Settings.

Other services

• Cloudflare Workers, D1, and Durable Objects, for the account, the couple, answers, prayers, date marks, and the membership flag. Wedfold does not use Workers AI.
• Expo SecureStore and AsyncStorage, for the token, the recovery code, and preferences.
• Expo Notifications, for the optional local reminder. There is no remote push, and no push device token is stored.
• RevenueCat, only if its public SDK keys are set, and only on iOS or Android. In this version those keys are empty, so the SDK is not configured and nothing is sent. When the keys are set, RevenueCat receives the device UUID as the app user id, store receipts, and optional subscriber attributes for the attribution source, the campaign, and the last event name. It does not receive answer text, prayers, or the invite code.
• Apple App Store and Google Play, for payments once products exist. No purchase is possible until those products and the RevenueCat keys exist. Prices are shown in the App Store or Google Play before you purchase.
• If you tap a Lampstead promo, the phone opens lampstead.app. If you tap Lampstead Groups, it opens groups.lampstead.app/start/couples. Wedfold does not create a Lampstead account.

Leaving and deletion

Leaving the couple deletes that phone’s answers and the prayers that phone authored. If that phone granted the membership, the membership flag is cleared. The phone stays signed in. If no real member remains, the couple, its answers, assignments, prayers, date marks, and sample devices are deleted.

Deleting the account does that same content deletion, then marks the device row so it cannot be reused: the deleted time is set, the couple is cleared, the name becomes “Deleted,” and the token and recovery hashes are replaced. The row stays so the id is not reused. That person’s answers are gone. The phone deletes its token, recovery code, and unsent answer. A spouse who stays keeps their own answers. If they were the only real member, the couple is deleted. Recovery after deletion does not work, because the old recovery hash is gone.

The app has no tool that exports a couple’s archive. Email to support@montgomeryappworks.com is a separate inbox. The app database is not that inbox.

How long we keep it

• Answers, prayers, and date marks are kept until the author leaves or deletes the account, or until the couple is deleted because no real member remains.
• A deleted account leaves the blank device row described above, without the original name or answer text.
• Rate-limit rows last at most one hour.
• The Durable Object counter has no personal data. It lasts as long as Cloudflare keeps that object, and it is not used to identify a person.
• A device backup may still contain the local token until you delete the app or delete the account from this phone. Deleting the account clears the local secrets.
• Server logs follow Cloudflare’s included Workers logs retention. They do not contain answer bodies.

Age

Wedfold is for adult couples, including engaged adults. The first screen says it is not for children. There is no age field and no children’s mode. It is not directed to children under 13. The planned store age rating is 17+ because some questions are about closeness in a marriage. Those questions are not explicit.

Contact

Montgomery Appworks LLC, Oklahoma

support@montgomeryappworks.com