Who is responsible
The data controller is Giancarlo Cormio. For privacy, support or requests about your data: contacts@getconte.app.
Data we use
Account: email, user ID, chosen name, personal code, 2D avatar, clothing and preferences. With Apple or Google sign-in we receive only authorised sign-in data; Apple may provide a private relay email. We do not receive Apple or Google passwords. Your chosen character is not a declaration of your sex.
Relationships and content: friends, requests, blocks, groups and logos, thought type, text, photos and voice messages you share, timestamps, read status and replies. Photos and audio are optional. We do not import your phone’s address book or access GPS.
Purchases: GEM balance, unlocks, ledger entries, transaction identifiers and subscription status/expiry. Apple handles iOS payments: CONTE does not receive card numbers. We also process push tokens, device type, technical logs and diagnostics, reports and support requests.
Why we use it
We use necessary data to provide accounts, messaging, widgets, purchases and support (GDPR Article 6(1)(b)), for security and abuse/fraud prevention based on legitimate interests (6(1)(f)), and to comply with legal obligations (6(1)(c)). Where required, advertising activities rely on consent (6(1)(a)). Photo, microphone and notification permissions are optional and can be withdrawn in device settings; without them the related features may be unavailable.
Who can see your content
Thoughts are visible to the selected recipients and group members, who may save a copy. A widget may display names and content on the device’s Home Screen: you can manage its privacy in settings. Access by the controller and technical support is limited to service, security and report-handling needs.
Providers and transfers
We use Supabase for authentication, databases and files; Resend for sign-in emails; Expo, Apple Push Notification service and Google Firebase Cloud Messaging for notifications; Firebase Hosting for the website and invitations; Apple and Google for sign-in, Apple for iOS purchases; Microsoft 365 through GoDaddy for support email. Google AdMob and UMP handle ads and consent. Providers may process data outside the European Economic Area; where necessary, adequacy decisions or safeguards such as standard contractual clauses apply, depending on the service and its agreements. Provider privacy policies are linked below.
Advertising and rewarded videos
Rewarded videos are optional. Where required, UMP presents choices before the advertising service starts; reopen them under Profile → Settings → Ad preferences. The current configuration requests non-personalised ads and does not request ATT permission or IDFA. Ad availability also depends on your choices.
The advertising SDK may process IP addresses (and approximate location derived from them), device or installation identifiers, technical information, ad interactions and diagnostics for delivery, measurement and fraud prevention. We do not send thought text, photos, voice messages, friends’ names or emails to Google for advertising. A random video-session code enables server-side reward verification; CONTE links it to your account for credits and fraud limits. Beta versions may use test ads and test GEMs without advertising revenue. Consent can be withdrawn in preferences.
Retention and deletion
We retain data while the account is active or content is needed to provide the service. Delete your account in settings or contact support. Some minimal records may remain for legal obligations, disputes and fraud prevention; backups follow providers’ retention cycles. Copies saved independently by recipients are outside our control. Deleting your account does not cancel an Apple subscription: manage it separately in store settings.
Internal statistics, announcements and gift codes
Authorized administrators see aggregate statistics about accounts, friendships, groups, thought counts, subscriptions and GEM transactions. The dashboard does not show private text, photos or voice recordings. We add no analytics SDK, advertising profiling or cross-app tracking. Statistics use service data and the last activity signal linked to the account identifier (GDPR Article 6(1)(f): understanding and improving the service); you may object by contacting contacts@getconte.app.
In supported versions, the foreground app sends a signal about once a minute. An account is considered online when its last signal is less than 90 seconds old. We keep only the latest signal, not browsing-screen history; it is deleted after 30 inactive days by daily cleanup. Online status is not shown to other users.
Administrators may send service communications, news and CONTE’s own offers to online accounts, with text or an image, and give free GEMS. Delivery links the account to the announcement; dismissal status avoids repetition. Announcements expire after 15 minutes and delivery records are deleted after 30 days. This feature sends no promotional email or push notifications. Essential communications and gift credits provide the service; news and first-party offers rely, where permitted, on legitimate interests, with an objection right through support. Where consent is legally required, it must be obtained before promotional sending.
Gift codes are free promotions. We record the redeemed code, account, date and GEM transaction to provide the gift and prevent duplicate redemption (GDPR Articles 6(1)(b) and 6(1)(f)). Expired-code records and administrative audit records are kept for up to one year; wallet records follow account retention and the anti-fraud obligations described above. Dashboard access uses Google and an authorized-administrator list. Necessary login session data is stored in the browser and removed on sign-out or when the tab closes.
Your rights
You may request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests, as provided by law. Email contacts@getconte.app: we may proportionately verify account ownership without asking for passwords or one-time codes. You may complain to the Italian data protection authority or your country’s competent authority.
Security and this website
We use TLS connections, private storage and access controls. We do not claim end-to-end message encryption. A lexical filter checks text; images are not automatically analysed. We do not make automated decisions with legal effects on you.
This website does not use advertising cookies or analytics tools. Firebase Hosting may process IP addresses and technical data needed to deliver and protect pages. Your language choice is saved locally in your browser and is not sent to an analytics service. Store and provider links open external services with their own privacy policies.