Privacy Policy

1. Information we collect

We collect the following, tied to your account:

• Account info: your email address and password (your password is never stored in plain text), and, if you enable it, a two-factor authentication secret used only to verify your login codes.
• Profile info: your username, optional display name, bio, profile picture, and a pasted music-embed link, if you add one.
• Content you post: post images and captions (including unpublished drafts), and comments you write.
• Your interactions: posts you like, comments you like, posts you save or pin to your Supporting tab (and any note you attach to a pin), users you block, reports you file, and messages you send or receive (a one-way way to send someone a post, with a read/unread inbox).
• Profile view activity: we log, once per day, that you viewed a given profile. See section 3 for who can actually see this.

2. How we use this information

We use what we collect to:

• Operate core features — your feed, profile, comments, and notifications.
• Enforce limits and rules built into the Service, such as the 10-like daily limit and honoring blocks between users.
• Let you know when someone likes, comments on, pins, or mentions your content.
• Review reports filed against a post, comment, or account.
• Automatically screen images you upload for policy violations before they're stored (see Section 4).
• Keep the Service secure, including detecting abuse of the reporting or blocking systems.

We don't sell your information, and we don't use it for advertising.

3. Who can see what

con10tos is built so that several things are visible to other users by design, and a few things deliberately aren't — enforced in the database itself, not just hidden in the app:

• A post's total like count is public, but the list of who liked it is visible only to that post's owner.
• Comment likes — including who liked them — are fully public.
• A draft post is visible only to you until you publish it. An archived post is hidden from the feed and your profile, but you can still see and unarchive it.
• Posts you've saved are visible only to you — no one else can see your saved list.
• A message is visible only to its sender and its recipient.
• A paused account and everything on it becomes invisible to everyone else until you log back in.
• Your profile-view count (how many times your profile has been viewed) is visible only to you. The detail of who viewed it, and when, isn't shown to anyone — including you — except an administrator of the Service.
• If someone blocks you, your posts and comments stop appearing to them, and you can no longer like, comment on, or pin their content. They aren't notified that you've been blocked.
• Reports you file are visible only to administrators.

4. Where this is stored, and who else processes it

con10tos runs on Supabase, a third-party provider that hosts our database, authentication, and image storage. Supabase processes data on our behalf under its own security and privacy commitments; we don't operate our own servers. Access to your data within our database is restricted by row-level security rules scoped to each table — for example, the rule that only a post's owner can read its list of likers is enforced there, not just in the app's interface.

We also use a small number of other processors for specific tasks:

• Resend delivers account emails (such as signup confirmation and password reset) on our behalf.
• OpenAI automatically screens images you upload — for a post or profile picture — for policy violations before they're stored, using its Moderation API. Per OpenAI's own API data policy, images sent to this endpoint aren't used to train its models and aren't retained by OpenAI afterward.

5. Third-party embeds

If you add a background song to your profile, it's rendered as an embedded player from the link you paste (for example, Spotify or SoundCloud). Visiting a profile with one loads that third party's player, which is subject to that provider's own privacy practices, not this one.

6. How long we keep it

We keep your information for as long as your account is active. Pausing your account doesn't delete anything — it just makes it invisible to others until you log back in. Deleting your account removes your posts, comments, likes, pins, saves, messages, uploaded images, and profile information from con10tos. A small amount of data may briefly persist in backups before it cycles out, or be retained longer where we're required to by law.

7. Your choices

You're in control of most of this directly from the app:

• Edit your bio, avatar, and profile music at any time.
• Unpin, unlike, unsave, or edit/remove a pin note whenever you like.
• Block or unblock another user.
• Turn two-factor authentication on or off.
• Pause your account temporarily, or change your password or email, or delete your account entirely, from account settings.

For anything else — such as asking what data we hold about you — email cvillalobosr3@gmail.com.

8. Children's privacy

con10tos isn't intended for children under 13, and we don't knowingly collect information from them.

9. Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page.