DRAFT — NEEDS LEGAL REVIEW
Privacy notice
Exactly what Candor holds about you, why, and the only situation in which any of it is disclosed. We collect as little as possible and never sell data or run ads.
Data we hold about you
Your email address (including a provider-verified or relay email if you choose Google or Apple sign-in). We do not copy the provider's real name into your profile or use it as your handle. When SMS verification is configured: your SMS-verified phone number. Your chosen display handle (which must not be your legal name). Your account creation date and subscription status. An approximate location accurate to about one kilometre — only if you choose to set it, and only to power the audience-exclusion filter. For every protected image you view: a unique trace code, the time you viewed it, and a logged view session. Standard technical security logs, including your IP address and timestamps.
What we never collect
Government ID. Your contacts or address book. Your precise GPS location (coordinates are rounded to about one kilometre before they ever leave your device). Advertising identifiers or cross-site tracking data. We do not sell any data and we do not show ads.
Every image you view is watermarked to you
Before any photo reaches your screen, we embed a watermark containing a pseudonymous trace code unique to you and that view. It contains no name and no personal data. It exists so that if an image is shared outside Candor, we can trace which account received that exact copy. By using Candor you consent to this watermarking and tracing.
The only situation we would disclose your identity
There is exactly one situation in which Candor would ever disclose identifying information about you: if you shared another member's image outside Candor and a human moderator confirmed, after review and your right to respond, that the trace code resolves to your account. In the planned full product, the information disclosed to the affected member and, where appropriate, to authorities for a legal claim would be limited to what Candor actually holds and is necessary — for example your email, SMS-verified phone number (if collected), the trace code, the view timestamp, and the IP address you used — never your home address, ID document, payment details, or photograph, and never for public exposure. This disclosure mechanism is subject to legal review and is NOT operating during this pilot. We disclose nothing about you at any other time, to anyone, for any other reason.
Your rights
You can access, correct, or delete your data and close your account at any time from Settings. Deletion removes your profile, photos, feedback, location, and personal data. Narrowly, we retain evidence relating to a confirmed leak for the duration of any legal action, because it is being used to protect the person you harmed.
Where your data lives
In the EU (Supabase, Stockholm). Sign-in emails are sent from EU infrastructure (Resend, Ireland) under a data-processing agreement. Payment, if enabled, is processed by Stripe. These are our only processors.