pauci

Privacy Policy

Last updated 11 November 2026

Pauci is made by [OPERATOR] ([ADDRESS]), the controller of your personal data. Contact: hello@pauciapp.com. This policy says what we collect, why, who helps us, how long we keep it and what you can do. Pauci is available worldwide; the sections near the end add what applies in the EU and EEA, the UK, Switzerland, Brazil and Australia.

What we collect

• Account: your Apple sign-in identifier, the email address Apple gives us (often a private relay address), your display name, username and time zone.
• Age: your year of birth (to keep Pauci 16+) and, where Apple provides it, your age range. We keep the age band, not your birthday.
• What you do: your reactions to each sentence (Holds true / Not sure / Disagree), your lines, your evening answers, lamps, the cards you share, friends, friend requests, invites, blocks and reports.
• Device: a push notification token, and Apple DeviceCheck signals used only to stop banned people coming back (no device fingerprinting).
• Purchases: whether you have Pauci Plus, its plan and renewal state (from Apple through RevenueCat). We never see your card details.
• Usage and crashes: anonymous counts (for example how many people opened an invite) linked to your Pauci user id, and crash reports. Never the text you write, never names. In the EU and EEA, the UK, Switzerland and Brazil (and when the app cannot tell where your phone is set to) both are off until you turn them on in Settings > Privacy. Elsewhere they are on and you can turn either off there.

We do not use advertising, we do not track you across other apps or websites, and we do not sell or share your data for advertising.

Your reactions and evening answers

How you react to a philosophical sentence and how you answer the evening questions can show your beliefs or your mood. We treat them as sensitive data and ask for your explicit consent on a separate screen when you sign up. Without consent you can still read the sentence and see the picture, but you cannot react or write.

You can withdraw consent at any time in Settings > Privacy > Withdraw consent. Your reactions and evening answers are then deleted and your account becomes read-only.

Why we use it (legal bases)

• To run Pauci for you (contract; GDPR Art. 6(1)(b)): your account, circle, cards, lamps, notifications, Plus.
• Your explicit consent (GDPR Art. 9(2)(a) and Art. 6(1)(a)): reactions and evening answers; the safety check of your texts by OpenAI. [lawyer: confirm whether the OpenAI check of lines needs consent or rests on legitimate interest]
• Your consent (GDPR Art. 6(1)(a); ePrivacy rules on reading and storing data on your phone): usage counts and crash reports in the EU and EEA, the UK, Switzerland and Brazil.
• Our legitimate interest in a safe service (GDPR Art. 6(1)(f)): the safety filter, reports, blocks, ban-evasion checks, and, outside the places above, crash reports and anonymous counts (you can turn those off).
• Legal obligations (GDPR Art. 6(1)(c)): tax records for purchases, answering lawful requests.

Safety check of what you write (OpenAI)

Before a line, evening answer, name or username is shared, it is checked by our own word lists and by OpenAI's moderation service. Only the text is sent, without your name or account details. OpenAI may keep it for up to 30 days to monitor abuse and then deletes it; OpenAI does not use it to train its models. Texts that are refused are not shared.

Who helps us (processors)

Each works only on our instructions, under a data processing agreement.

• Cloudflare (USA, global network): hosting of the app's server, website, images and shared cards.
• Supabase ([confirm: region]): database and sign-in, holding your account and everything listed above.
• Apple (USA): Sign in with Apple, push notifications, DeviceCheck, App Store purchases.
• Expo (USA): delivery of push notifications to Apple.
• RevenueCat (USA): subscription status for Pauci Plus.
• OpenAI (USA): moderation of texts, kept up to 30 days.
• Resend (USA): emails we send you (for example about a data request).
• PostHog (EU, Frankfurt): anonymous usage counts by Pauci user id.
• Sentry ([confirm: EU or USA region]): crash reports.

Some processors are outside your country, including in the USA. See "Transfers outside your country" below.

Who else sees it

Your friends in your circle see your lines, evening answers, lamps and reactions for each day. The "world" numbers are totals only. Cards you choose to share can be opened by anyone with the link. Moderators see reported content and the reasons for a report. We disclose data to authorities only when the law requires it.

How long we keep it

• Your account and what you wrote: until you delete it or your account. Pauci Plus does not delete anything older than 7 days; it only shows it.
• Deleting your account removes it at once from Pauci, and we ask RevenueCat, PostHog and Sentry to delete your records, revoke Sign in with Apple, and delete your shared card images. Encrypted backups roll over within [confirm: backup period, e.g. 30] days.
• Reports and moderation decisions: up to 1 year after the case closes (longer if the law requires), so banned people cannot return.
• If we remove an account for breaking the rules, we keep a one-way hash of its Apple sign-in identifier (never the identifier itself) while the ban stands, so the same Apple ID cannot sign up again.
• Purchase records: as long as tax law requires.
• OpenAI: up to 30 days.

Your rights

You can ask for a copy of your data (also in a portable format), correction, deletion, restriction, or object to our use of it, and withdraw consent at any time. Write to hello@pauciapp.com; we answer within 30 days, free of charge. You can delete your account yourself in the app. You may also complain to your data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK). Residents of Türkiye: see also our KVKK information notice at pauciapp.com/legal/kvkk.

Age

Pauci is for people aged 16 and over, everywhere (in Australia this is also the legal minimum age for social media). You confirm your year of birth when you sign up and, on newer iPhones, Apple may tell us your age range. If we learn that someone younger has an account, we delete it. Pauci has no advertising, no public profiles and no public feed for anyone, whatever their age; a 16 or 17 year old's invite links always need their approval. [lawyer: confirm the age assurance needed in Australia, the UK and Brazil]

Security and breaches

Data is encrypted in transit; access is limited to the people who run Pauci. If a breach puts your data at risk we notify the authority (within 72 hours where required) and you.

Transfers outside your country

We store and process data with the processors above, some of them in the USA. For data from the EU and EEA we rely on the European Commission's standard contractual clauses (GDPR Art. 46(2)(c)) and, where a processor is certified, the EU-US Data Privacy Framework (Art. 45). For data from the UK we use the UK International Data Transfer Addendum to those clauses (or the UK Extension of the Data Privacy Framework); for Switzerland, the clauses as adapted for Swiss law. For Türkiye we use the standard contracts of the Personal Data Protection Authority, notified as the law requires; for Brazil, the standard contractual clauses of the ANPD (LGPD Art. 33). You can ask us for a copy of the safeguards at hello@pauciapp.com. [lawyer: confirm each processor's mechanism]

If you are in the EU or EEA (GDPR)

• Controller: [OPERATOR], [ADDRESS]. Contact: hello@pauciapp.com.
• Our representative in the EU (GDPR Art. 27): __FILL_ME__ (name, address and contact). You may write to them instead of us about anything in this policy.
• Your rights: access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and withdrawal of consent at any time without affecting what was done before (Art. 7(3)). We answer within one month (extendable by two months for complex requests, and we tell you why).
• Automated decisions: our safety filter can refuse a text automatically before it is shared. It has no legal or similarly significant effect on you, and a person reviews every appeal (hello@pauciapp.com). [lawyer: confirm Art. 22 does not apply]
• You may complain to the data protection authority of the EU country where you live or work, or where you think the problem happened.

If you are in the UK (UK GDPR)

• Our representative in the UK (UK GDPR Art. 27): __FILL_ME__ (name, address and contact).
• You have the same rights as listed for the EU above, under the UK GDPR and the Data Protection Act 2018. You may complain to the Information Commissioner's Office (ico.org.uk).
• Online safety: you can report illegal or harmful content in the app or at pauciapp.com/report, and complain about how we handled a report at hello@pauciapp.com. Our community guidelines explain what is not allowed.

If you are in Switzerland

The Swiss Federal Act on Data Protection gives you the same rights as above; you may complain to the Federal Data Protection and Information Commissioner (FDPIC). [lawyer: confirm whether a Swiss representative is needed]

If you are in Brazil (LGPD)

• We process your data to perform our contract with you, with your specific and highlighted consent for reactions and evening answers (sensitive data, LGPD Art. 11), with your consent for usage counts and crash reports, for our legitimate interest in a safe service, and to meet legal obligations (LGPD Art. 7).
• Your rights (LGPD Art. 18): confirmation and access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about who we share with, and withdrawal of consent. Write to hello@pauciapp.com; you may also complain to the National Data Protection Authority (ANPD).
• Our data protection officer (encarregado, LGPD Art. 41): __FILL_ME__ (name and contact), reachable at hello@pauciapp.com. [lawyer: confirm whether the ANPD's small-agent rules exempt us]
• People aged 16 and 17 (Brazil's ECA Digital, Law 15.211/2025): Pauci has no advertising, no public profiles and no public feed, and their invite links always need their approval. [lawyer: confirm the age verification ECA Digital requires]

If you are in Australia

We handle personal information in line with the Australian Privacy Principles where the Privacy Act 1988 applies to us. [lawyer: confirm whether the small business exemption applies] You may complain to us first and then to the Office of the Australian Information Commissioner (oaic.gov.au). Pauci is not for people under 16 (Online Safety Act 2021, social media minimum age); complaints about harmful content can also go to the eSafety Commissioner (esafety.gov.au).

Changes

We will tell you in the app before an important change to this policy applies.