Privacy Policy

Version 3.1.5 · Effective 24 September 2026

1. Who is responsible for your data

Convo Labs LLC, Lynnwood, Washington, is the controller of the personal data described here. Contact: support@convolabs.net.

We have not appointed a Data Protection Officer; the app processes little data and holds almost none of it. Privacy questions go to the address above and are answered by a person.

2. What is stored on your device

All of the following lives in a database on your phone, and we keep no lasting copy of it. When you ask for a suggestion, the parts it needs pass through our server (section 3), and our staff can open a job only while it is held, as section 3 describes. Section 2.2 lists separately what we do hold.

• People you add: name, age, gender, interests, the profile text you pasted, and your own notes about how you know them.
• Photos you add, and the written description the AI produced from each one.
• The openers and replies the app generated, with the situation, tone, and goal they were generated for.
• Your ratings, whether you sent a message, how it went, and any feedback note you wrote.
• Your plan, how many conversations you have used this month, and your app settings.

2.2 What is stored on our server

Creating an account creates a record on our server, hosted by Supabase. It holds:

• Your email address and, if you set one, a hashed password. If you sign in with Apple or Google, also the account identifier, email address and name they send us (for Google, a link to your profile picture).
• For the device you are signed in on: when that sign-in started and was last used, its IP address, and a string naming the app build and iOS version. Our admin tools can show these. If you use a second sign-in step, each check also records the IP address it came from. Sign-in events, with the IP address, also appear in our host's sign-in logs for 7 days.
• Your display name, your plan, and the date your paid plan started, which sets the day each month your allowance renews (for a free account, the date you signed up).
• Which version of these documents you accepted, and when, and which version of the AI-processing consent you gave.
• A notification token, if you allow notifications, and whether you set up a second sign-in step.
• One row per conversation you use: whether it was a photo read or a set of openers, whether it counted against your allowance, exactly when it happened, and an identifier for the person it was about. That identifier is a random number made on your phone, with no name and nothing else about them. It stays while your account exists: it is how a photo read and that person's first set of openers count as one conversation rather than two. The row also holds a one-way fingerprint of the request, used to stop one request being charged twice.
• Refunded conversations, re-read photos, and the kind of failure, where one happened.
• One row per suggestion job: the same random identifier for the person, when it ran, how long it took, whether it was retried, and whether it failed and why. Its content is erased as section 2.2.1 describes.
• If our staff act on your account: any suspension or ban and its reason, credits we added or removed and why, notes they write while handling your account, and a log of those actions.

2.2.1 What our server does not keep

Nothing about the people you add is stored on our server as a record: no saved people, no photo library, no notes, no history of openers, and no feedback you write. Your ratings are stored on your phone. When you ask for new openers, the earlier openers for that person, with your ratings and how they went, travel in the request (section 3.1) and are erased with it.

There is one temporary exception, and it exists so that a message still arrives when you close the app. Writing a suggestion is a job that runs on our server, so for the length of that job — seconds, normally — the server holds the request you sent, and then the finished suggestions until your phone collects them. Both are erased as soon as the job ends and your phone has the result. If your phone never collects them, they are erased within seven days.

So once a conversation is finished, we can tell that an account used one, and exactly when. We cannot tell who it was about, what was said, or what the message was.

Separately, our hosting providers keep request logs that record the account, the time, the IP address, and the app and iOS version of each request. They are kept for 7 days, and we use them only to run and secure the service.

Support email arrives in our support mailbox (Google Workspace), and our support desk keeps a plain-text copy of each message on our server, hosted by Supabase in the United States: the sender's address and name, the subject, the text, the names, types and sizes of any attachments (not the files), how many people were copied, whether the sender's address could be verified, our replies, and the status and labels our staff give a conversation. When the sender's address matches a Convo AI account, our staff see that account's details next to the message so they can help. Section 7 says how long this is kept.

When we answer, our staff can ask Anthropic to suggest a draft reply, or to improve the wording of a reply they wrote. It receives the conversation's text, your first name and, when improving a reply, that reply. We don't add your account details or email address to it, though it sees anything already written in the emails. We keep nothing from it on our server except the reply we send; our log records that it was used and how much text went in and out, never the text itself. Nothing is sent automatically: a person sends every reply.

2.1 Device backups

If you back your phone up to iCloud or a computer, that backup is made by Apple or by you and may include the app's data. It is covered by Apple's privacy policy, not this one, and we have no access to it.

3. What leaves your device, and who receives it

Apart from your account details and settings (section 2.2), one kind of thing leaves your device: the request that produces a suggestion. It goes to our server, which forwards it to Anthropic, PBC, whose model writes the text.

Our server is in that path for one reason. The key that authorises a request to Anthropic cannot be shipped inside an app — anyone can extract a string from an installed app in minutes, and a leaked key is billed to us and usable by whoever took it. So the key lives on our server, and your request is passed through with the key attached. Our server checks that you are signed in, that you agreed to this, and that you have a conversation left, and then sends your request onward unchanged. It checks the request's shape and takes a one-way fingerprint of it, to stop one request being charged twice, and uses its contents for nothing else. While a job is held, our staff can open it only to investigate a specific problem, after signing in again and giving a reason, and every opening is logged. Once the job's contents are erased, there is nothing left to open.

It does hold it, briefly. Writing runs as a job on our server rather than on your phone, so that locking the phone or closing the app does not throw away a message you have already paid for. While that job runs the server holds your request; when it finishes the request is erased and the suggestions are held until your phone collects them, then erased too. The request is held for seconds, normally; the suggestions until your phone collects them, and never more than seven days. This is the only time our server holds what you wrote.

3.1 What the request contains

The details you entered about the person, the photos you chose (or, once a photo has been read, the stored description instead of the image), the situation, goal and tone you picked, any message of theirs you asked for a reply to, and the openers already written for them, with your ratings, whether you sent them and how they went, so the next set can learn from them. So the new openers sound like you, it also carries up to five of your highest-rated openers, written for other people.

A photo is sent once. The app keeps the model's written description and sends that text on later requests, so the same picture is not uploaded again every time you generate.

3.2 What Anthropic does with it

Anthropic processes what we send it (the request described in 3.1, and, when our staff ask, the support email text described in 2.2.1) to return a response, and acts as our processor in doing so. Under Anthropic's commercial terms, inputs and outputs sent through the API are deleted within 30 days of being received or generated, other than material flagged by trust-and-safety systems or kept because the law requires it, and are not used to train Anthropic's models.

Their handling is governed by their own terms and privacy policy in addition to our agreement with them, and those commitments give your data protection equivalent to what this policy describes.

3.3 What does not leave your device

There is no analytics SDK, no advertising identifier, no crash reporter, no attribution framework, and no third-party library that phones home. The app makes network requests to our own server, for the reasons above and in section 2.2. The one other host is Google's sign-in service, and only if you choose to sign in with Google; Sign in with Apple and notifications run through iOS.

Your feedback notes are never sent anywhere. A note you write when rating an opener is your own text about a specific person; it stays on the device and is not included in any request or record.

3.4 Who processes data on our behalf

These companies, and no others:

• Anthropic, PBC — writes the suggestions, and helps our staff write replies to support email. Receives the request described in 3.1 and, for a support reply, the text of the email conversation, the sender's first name and, when staff ask it to improve their wording, the reply they wrote. Under its commercial terms it deletes what it receives within 30 days, unless it must keep it longer for safety or legal reasons, and does not train on it.
• Supabase, Inc. — hosts our server: the account database and the functions that run each suggestion. It holds what sections 2.2 and 2.2.1 describe, including the temporary jobs, our staff's records about accounts, and the support desk's copy of support email.
• Resend — sends account emails, such as sign-in codes and password resets. It receives your email address and the message.
• Google (Google Workspace) — hosts our support mailbox. It holds the email you send us and our replies.
• Cloudflare, Inc. — hosts our internal admin tools and the sign-in check in front of them. When our staff look up an account, a job or a support message, when the support desk collects new support mail, and when staff ask Anthropic for a draft reply or to improve one, that data passes through Cloudflare, whose logs are kept for up to 7 days.

3.4.1 Apple

Apple handles purchases and, if you use it, Sign in with Apple. Apple is not our processor — it acts as a controller in its own right under its own policy, and we receive which plan you bought and whether it is active and, for sign-in, the identifier, email address and name Apple gives us.

If you allow notifications, Apple's push service delivers them. A notification carries a fixed message and internal ids, never a name or any content.

4. Why we process it, and on what legal basis

For people in the UK and EU, the lawful bases under the GDPR are:

• Photos, and the details you enter about another person — your consent (Article 6(1)(a)), asked for before the first photo is ever sent and withdrawable at any time. Where a photo happens to reveal something the GDPR treats as a special category, that consent is explicit consent under Article 9(2)(a).
• Generating openers and replies from what you gave us, and keeping your ratings so later suggestions improve — performance of our contract with you (Article 6(1)(b)).
• Holding your account — your email address, your plan, and the count of conversations used — and answering your support email: performance of our contract with you (Article 6(1)(b)), and our legitimate interest in running the service and in keeping records of what we were asked (Article 6(1)(f)).
• Keeping a record of which version of these documents you accepted, and when — our legitimate interest in being able to show what was agreed (Article 6(1)(f)), and compliance with our own legal obligations (Article 6(1)(c)).
• Blocking romantic content about someone who may be a minor, and responding to reports of misuse — our legitimate interest in preventing harm, and compliance with legal obligations (Article 6(1)(c)).

4.1 Withdrawing consent

You can withdraw consent at any time in Profile → Security & Privacy, as easily as you gave it. Because everything the app does is sending what you enter to the AI service, an account without that consent cannot use the app at all — so withdrawing it deletes your account and everything in it on your device, and your account records on our server (section 2.2), at once and permanently; backups, request logs, support email and our log of staff actions are handled as section 7 sets out. The app tells you this before you confirm. It does not undo processing that already happened, which was lawful when it happened, and it does not refund a membership (see the Terms of Service, section 6.4).

5. Photos of other people

Most photos added to this app are of somebody else, and that person has not agreed to any of it. That is the sharpest privacy question the app raises, and it deserves a direct answer rather than a clause.

What we do about it: the image is sent to one AI processor and to nobody else (while the request is held, for seconds, our staff could open it only to investigate a specific problem, as section 3 describes); it is read once rather than repeatedly; it is deleted by that processor within 30 days; it is never used to train a model; and the app instructs the model not to record anyone's ethnicity, religion, health, sexuality, or appearance, and to describe only what is written in the image and what is plainly going on in it — a dog, a mountain, a bio.

What we cannot do: give that person a say before you add their picture. Add only images you are comfortable sending to an AI service on someone else's behalf.

5.1 If a photo of you was added by someone else

Write to support@convolabs.net. We will tell you what the app does and does not retain, and help where we can. Be aware of what we honestly cannot do: the image is on another person's phone. When they ask for a suggestion, it passes through our server, which erases it as soon as the suggestion is written; the text our AI wrote about it is erased once it reaches their phone, within seven days at most. Copies in our encrypted backups expire within 7 days, and our AI provider deletes its copy within 30 days. We keep no lasting copy, so there is no picture of you for us to remove.

6. Biometrics: what the app does not do

The app does not perform facial recognition. It does not extract, generate, store, or compare a scan of face or hand geometry, a fingerprint, an iris or retina scan, or a voiceprint. It does not attempt to identify a person from an image, match them against any database, or link them to any other record.

This is stated separately and plainly because laws such as the Illinois Biometric Information Privacy Act draw the line exactly here: an ordinary photograph is not a biometric identifier, but a face-geometry scan derived from one is. The app stays on the photograph side of that line, and nothing in it is designed to cross it.

The app does look at a photo to judge whether the person may be under 18, and only for that purpose. It is treated as a signal, never a verdict: an age you enter always wins, and where there is no recorded age the app stops and asks you rather than deciding for itself.

7. How long anything is kept

• On your device: until you delete it. Deleting a person deletes their photos, openers, ratings and notes on your phone at the same time. Deleting the app removes your people, photos, openers, ratings and settings from the phone. A few sign-in items the app keeps in the iOS Keychain can stay on the phone afterwards; they contain nothing about the people you added, and a new install does not sign you back in with them.
• On our server: for as long as your account exists. Deleting your account deletes the account records in section 2.2 at once, with no grace period during which you could restore it. See section 10.
• What deletion does not remove at once: request logs and sign-in logs (they expire after 7 days); our encrypted backups (7 days); support email (below); and our log of actions our staff took on your account, such as a credit adjustment, a plan change or a suspension, which keeps your account's internal ID, what was done and why, for security and accountability.
• Requests on our server, and the suggestions they produce: the request is erased when the job ends; the suggestions once your phone has collected them, and within seven days if it never does. The job's row, without its content, stays while your account exists.
• At Anthropic: inputs and outputs are deleted within 30 days, other than material flagged for safety or retained because the law requires it.
• Support email: a conversation our staff move to Deleted is erased 30 days later; any other is erased 24 months after its last message. Erasing it removes the support desk's copy and moves the copies in our mailbox to its trash, which Google empties within 30 days. Our support desk also moves anything in the mailbox older than 24 months, spam included, to its trash. We erase your support email sooner if you ask: the desk's copy, and every copy in the mailbox, spam and trash included, gone within 30 days. Our staff log records that an erasure happened, with the reason and the address's domain, not the address. If we have blocked an address, we keep it on a block list for up to 24 months, even after erasing its mail, so the block keeps working. Deleting your account does not delete support email; write to support@convolabs.net.
• Backups: our database provider keeps a daily encrypted backup for 7 days. Anything deleted from our server stays in those backups until they expire. We do not restore from them to bring back data you deleted.
• Purchase records: held by Apple, under Apple's own retention rules. We keep which plan you are on and the date your allowance renews (section 2.2).

8. International transfers

Anthropic, PBC is established in the United States, so a request made from the UK or the EU is transferred there. That transfer is covered by the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) in our agreement with them, together with the deletion and no-training commitments in section 3.2.

Our own server is hosted by Supabase, Inc. in a United States region, so the account data in section 2.2 is stored there and a request from the UK or the EU passes through the United States on its way to Anthropic. That transfer relies on the same clauses in our agreement with Supabase.

9. Security

App data is stored in the app's own container, protected by your device passcode and by iOS file protection. Every request travels over TLS. Your sign-in tokens are held in the iOS Keychain, never in the app's files and never in a support email.

On the server, each account can read only its own rows, enforced by the database itself rather than by the app asking politely. The key that authorises requests to Anthropic exists only on the server and is never sent to your phone.

No system is perfectly secure, and the largest risk to this data is physical access to an unlocked phone. Use a passcode.

10. Your rights

If you are in the UK or the EU you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time.

Because the app stores your people, photos and messages locally, most of those rights you exercise directly and immediately: everything the app holds about a person is visible on their screen, editable there, and deletable there. There is no queue and no request to make.

For what our server holds, Profile → Security & Privacy → Delete account erases the account and the records in section 2.2 at once; request logs, backups and our log of staff actions are handled as section 7 sets out. To correct your display name, write to support@convolabs.net. Where you want something else we hold — support correspondence, for instance — write to support@convolabs.net and we will answer within one month.

You also have the right to complain to a data protection authority: the Information Commissioner's Office in the UK, or the authority in the EU member state where you live. We would rather you came to us first, but you do not have to.

11. California

The categories of personal information the app handles, under the CCPA as amended by the CPRA:

• Identifiers and personal records — a name, an age, and the profile text you enter about another person. Stored on your device; sent to our AI processor to generate a suggestion.
• Visual information — photos you add. Stored on your device; sent once to our AI processor, which deletes them within 30 days.
• Identifiers we hold — your email address, the identifier Apple or Google gives us if you sign in with one of them, a notification token if you allow notifications, and your IP address, in the record of the device you are signed in on, in any second-step sign-in check, and in our hosting providers' request logs (7 days). Stored so that you can sign in and so that we can run and secure the service.
• Commercial information — your plan and how many conversations you have used. Stored on your device and on our server.
• Sensitive personal information — your account sign-in (email address and password, the password stored only as a hash), used only to let you sign in. Nothing else sensitive is asked for. A photo you add may incidentally reveal something sensitive about the person in it; the app instructs the model not to record it and does not use it to infer characteristics about anyone.

11.1 We do not sell or share

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. We never have. There is no "Do Not Sell or Share My Personal Information" link because there is nothing for it to switch off.

We do not use or disclose sensitive personal information for any purpose beyond what is needed to provide the app, and we offer no financial incentive in exchange for personal information.

11.2 Your California rights

You have the right to know what is collected and why, to delete it, to correct it, to opt out of sale or sharing (there is none), and not to be discriminated against for exercising any of them. As above, the app puts almost all of this directly in your hands because the data is on your device, and Delete account removes what our server holds. For anything else, write to support@convolabs.net.

12. Automated decision-making

The app generates text suggestions. It does not make decisions that produce legal effects or similarly significant effects about anyone, and there is no profiling of you within the meaning of Article 22 of the GDPR.

There is one automated refusal: the app declines to write romantic content where the person described is, or may be, under 18. It restricts what the app will write rather than making any decision about you. An age you typed can't be edited afterwards; if it was entered by mistake, you can delete the person and add them again with the right age.

13. Children

Convo AI is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has used the app, write to support@convolabs.net and we will act.

Separately, and more importantly for what this app does: the app refuses to write romantic or flirtatious messages about a person recorded as under 18, or where the photos suggest it may be reading one, in any situation and whatever tone was asked for.

14. What we would like to collect, and do not

The app builds a record of which situation, goal, tone, risk level, and research principles produced a well-rated opener. It contains no names, no message text, no photos, and no free text of any kind — only fixed categories and a rating, with no link back to you or to any person.

Nothing transmits those records in this version. If that changes it will be opt-in, off by default, and this policy will say so before a single record is sent. You can read exactly what such a record contains in Profile → What gets shared.

15. Changes to this policy

The effective date and version at the top say when this last changed. Where a change materially affects how your data is handled we will tell you in the app before it takes effect, and where the change requires your consent we will ask for it rather than assume it.

16. Contact

Privacy questions, requests, and complaints: support@convolabs.net. We aim to reply within two working days, and to resolve a formal data request within one month.

Privacy Policy · version 3.1.5. Effective 24 September 2026. Questions about anything here go to support@convolabs.net.