Privacy policy

Who is responsible

The controller is Ismael Romero Ortega, a natural person, in Spain. For anything about your data, write to hello@trypomelo.app. The rest of their details are in the legal notice: trypomelo.app/legal.

In short

• What you share in Pomelo is seen by your partner: that is what the app is for.
• We don't sell your data or show ads.
• Analytics never carry what you write or your photos.
• You can delete your account at any time in the app, and it is deleted right away.

What data we process and why

• Account. You sign in with Apple or Google. We keep your name and email (with Apple it may be an Apple relay address), the profile picture if Google provides one, your Apple or Google account identifier and the credentials they return, so you can sign in and link both. For each session we keep the IP address and the type of device and browser it was opened from.
• Profile. The name you type, your avatar (an illustration or a photo), your birthday if you add it, and your phone's language and time zone, to show you the right day and times.
• Pair. Your pair, invitation codes, your anniversary if you add it, the Moment's time, the topics you choose and the notices you want.
• What you create. Answers to Moments, packs, games and check-ins, messages and reactions, saved Moments, photos, drawings, journal memories (title, text, dates and, if you choose, a place) and special dates. Your partner sees them; your answers, only once you have both answered.
• Photos and drawings. The app removes each photo's metadata (location included) before uploading it, and the server refuses photos in which it finds metadata. They are stored privately and only shown through links that expire.
• Places. When you search for a place for a memory, the text you type goes from our server to Apple Maps, without your location or anything that identifies you. The app never asks for your location. The journal's map uses Apple Maps on iPhone and Google Maps on Android, which load the map from Apple or Google.
• Notifications. If you allow them, we keep your device's notification token and, on iPhone, the Live Activities one. Notifications carry short texts: your partner's name and, in date reminders, the title you gave the date; never your answers or the text of your messages. Expo sends them and Apple and Google deliver them. Widgets keep what they show on your phone.
• Subscription. It is bought on the App Store or Google Play: we never see your card. We keep the plan's status (product, until when, whether it is a trial, whether it renews). RevenueCat handles purchases with your Pomelo user id and also learns when the plan screen was shown to you.
• Feedback. If you write to us from Settings, we keep the message, its kind, the screenshot if you attach one, the app version, system, phone model, language, your email and your user and pair ids, to read it and answer you. It reaches us as an email to hello@trypomelo.app and as a task in Linear.
• Analytics. We count how the app is used (for example, that a Moment was answered or the plan screen was opened) with ids, kinds and numbers, your user and pair ids, the country set on the phone and the system and its version. Never answers, messages, photos, names, emails or the questions' text. No geolocation, no screen recordings.
• Errors. When something fails we send the error's type and where in the code it happened and, if the database fails, the query without its values and PostgreSQL's error code. Never the values or the error's message.
• Rating. We keep whether we have already asked you to rate the app, to ask only once.
• Waitlist. If you sign up on this website: your email, the store (iPhone or Android), the language and the date.
• Security. We use your IP address for a short time to limit attempts (signing in, invitation codes, the waitlist), and the server's technical logs keep errors for a few days.
• This website. It uses no cookies and loads nothing from other sites.

Why we can do it

• Contract (GDPR art. 6.1.b): your account, your profile, the pair, what you create, the notifications you ask for, the subscription and the feedback you send us.
• Consent (art. 6.1.a): the waitlist and the permissions you give on your phone (notifications, camera, photos). You can withdraw it at any time.
• Legitimate interest (art. 6.1.f): security, technical logs, analytics without content and error tracking, so the app works and gets better. You can object.
• Legal obligation (art. 6.1.c) and legitimate interest: keeping purchase records to handle refunds, the stores' claims and tax obligations.

Who we share it with

With your partner, what you share in the app.

Processors, who handle data on our behalf and only to provide their service to us:

• Cloudflare: the server, photo storage (in the European Union), forwarding the email to hello@trypomelo.app, attempt limits and technical logs.
• Neon: the database, in Frankfurt (Germany, European Union).
• PostHog (in the European Union): analytics and errors.
• RevenueCat: purchases.
• Expo: sending notifications.
• Linear: our task tool, where feedback arrives.

Independent controllers, who handle data under their own terms and privacy policies:

• Apple: Sign in with Apple, the App Store, delivering notifications on iPhone, place search (only the text, from our server) and the map on iPhone.
• Google: Sign in with Google, Google Play, delivering notifications on Android, the map on Android and Gmail, the mailbox of hello@trypomelo.app, where feedback and anything you write to us arrive, and from which we send the waitlist notice.

We do not sell your data or use it for advertising.

Outside the European Union

The database (Neon), photos (Cloudflare R2) and analytics (PostHog) are stored in the European Union. Some providers are in the United States or may process data there, with these safeguards:

• Cloudflare: it participates in the EU-US Data Privacy Framework and also uses standard contractual clauses.
• RevenueCat: standard contractual clauses, under its data processing agreement.
• Expo, Linear, Neon and PostHog: the safeguards in their data processing terms.
• Apple and Google, as controllers for sign-in, the stores, the maps and, for Google, the mailbox, apply their own.

You can ask us for a copy of these safeguards by writing to hello@trypomelo.app.

How long

Your data is kept as long as you have an account. You can delete it in the app (Us > Settings > Delete account) or, without the app, as explained at trypomelo.app/delete-account.

Deleting it removes what is yours right away: your account and sessions, your profile and photo, your answers, messages and reactions, your photos and drawings, the memories you created (with the photos your partner added to them), the dates you added, your feedback, your notifications and your plan. Your partner keeps the rest of what is theirs and the pair ends; if nobody is left, it is deleted entirely.

If you delete it from an iPhone with Apple linked, we also ask Apple to remove Pomelo's access to your Apple account; if Apple does not answer, the account is deleted anyway. From Android, or if the account is deleted another way, Apple is not asked: you can remove it yourself in your Apple account's settings.

Leaving the pair deletes nothing: your history together is hidden, and it comes back if the same two of you pair again. It is deleted with the account.

After the account is deleted, these are kept:

• Purchase records: RevenueCat's purchase id (which may be your former user id) and the subscription's history, without your name or email, and the customer RevenueCat keeps under that id. We keep them while a refund can be requested or a purchase claimed, and while tax obligations require; after that you can ask us to delete them.
• Database backups: they expire on their own within 30 days at most.
• Server technical logs: deleted on their own within 7 days at most.
• Feedback: the email in hello@trypomelo.app's mailbox and the Linear task of each piece, until it is resolved and for 12 months at most; then we delete them.
• Analytics: the events, which carry no content, until you ask us to delete them.

The waitlist is kept until the notice that Pomelo has arrived is sent, and then deleted; in any case, at most 12 months after you signed up.

Your rights

You can ask us to access your data, correct it, delete it, take it with you (portability), restrict or object to its use, and withdraw your consent at any time. Write to hello@trypomelo.app from your account's email; we answer within a month.

If you think we have not done it right, you can complain to the Spanish Data Protection Agency: www.aepd.es.

Age

Pomelo is for people aged 16 or over.

Security

Everything travels encrypted, photos are stored privately and only seen through links that expire, and access to data is limited to what each part of the service needs.

Changes

If we change this policy, you will see it here with its date. If the change is important, we will tell you before it applies.