Candid
Back to home

Privacy Policy of Candid

Effective: 30 September 2026 · Last updated: 30 October 2026

This Privacy Policy describes how the Candid mobile application (the "App") and the website at candid.contact (the "Site") handle information about their users ("User" or "you"). The short version: your gameplay stays on your device unless you choose to link with a partner (in which case only the notes you send travel, through your own iCloud accounts), and the Site collects nothing about you beyond the ordinary web server logs described in section 7. The App contains no advertising SDK and never asks to track you. Advertising is measured only through Apple's own privacy-preserving SKAdNetwork, set out in section 6.2. The longer version follows.

1. Owner and Data Controller

Owner: Joshua Gibbins (trading as Candid)
Owner contact email: [email protected]

The Owner is the controller of any personal data that may be processed in connection with the App, to the extent any such processing occurs.

2. Summary

3. Types of Data Collected

3.1 Data the Owner collects

From the App: nothing reaches the Owner's own systems. The Owner operates no server that the App talks to, and does not receive your name, email, location, contacts, photos, microphone or camera input, or any gameplay content.

Nothing from the App reaches Meta or any other advertising network directly. Advertising measurement goes through Apple's SKAdNetwork, which never identifies you (section 6.2).

From the Site: the web server keeps standard access logs, and Apple reports aggregate download counts for the Site's App Store links. Neither identifies you as an individual. Both are described in full in section 7.

3.2 Data processed locally on your device (not transmitted)

The following data is created and stored on your device by the App and is never transmitted to the Owner:

This data is stored in the App's standard system storage on your device (UserDefaults and the App's container). It is removed when you uninstall the App.

3.3 Data processed by Apple in connection with subscription purchases

When you purchase or restore a Candid Premium subscription, Apple processes the transaction on our behalf. Apple may collect and process information including, but not limited to: your Apple ID, payment method, country/region, device identifiers, and transaction history. The Owner does not receive this information; we only receive an anonymous on-device entitlement that tells the App whether your subscription is active.

Apple's processing of this information is governed by Apple's Privacy Policy.

3.4 Mandatory vs. optional data

There is no mandatory data the User must provide to use the App. Subscription purchases are optional, and the App is fully usable without one.

4. Mode and Place of Processing the Data

4.1 Methods of processing

The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of any data the App handles. Because the App does not transmit data to the Owner, the principal security boundary is your device's own security controls (passcode, biometric lock, sandboxing).

4.2 Place of processing

4.3 Retention time

5. The Purposes of Processing

The data described above is processed for the following purposes:

The Owner does not profile Users, build audience segments, or run behavioural or targeted advertising, and the App shares no data about you with any advertising network.

The Owner can also see how many people downloaded the App from a given promotional link, as an aggregate count carrying no information about who those people are (section 7).

6. Third-Party Services

The App integrates with the following services provided by Apple. The list is exhaustive: the App contains no third-party SDK of any kind — no advertising SDK, no analytics package, no social network integration, and no external tracker. Third-party services reached by the website are listed separately in section 7.

6.1 Apple App Store and StoreKit

Used to process in-app purchases of Candid Premium subscriptions and to validate subscription entitlement.

6.2 Advertising measurement (SKAdNetwork)

If the Owner runs an advertising campaign for the App, measurement is handled entirely by Apple's SKAdNetwork, a privacy-preserving attribution system built into iOS itself. This is not a third-party SDK: the App contains no advertising network's code, no advertising identifier (IDFA) is read, and you are never shown a tracking-permission prompt because of it.

How it works: the App's Info.plist lists the advertising networks it may be measured by (Meta's Facebook and Instagram). When you install the App after tapping an ad from one of those networks, Apple — not the Owner, and not the advertising network — observes the install and sends the network a report. The App also tells Apple, on your device, the furthest of five stages you have reached: installed; finished your first card; opened the subscription screen; started a free trial; or subscribed. Apple adds that stage to the same report. The report is delayed and, unless a campaign brings in many installs, reduced to "low", "medium" or "high" — by Apple's design, specifically so it cannot be tied back to you. It never carries card content, category, pack, Desires data, or the price you paid, and it never reaches the Owner directly — only the advertising network, and only as one input into an aggregate campaign report days later.

The fact that you installed Candid after seeing an ad, and how far you got, can itself say something private about you. That is why Candid relies on SKAdNetwork alone: Apple, not Candid or Meta, decides what is reported, and no party — including Apple — can link a report to you.

Earlier versions (1.4 to 1.6). These versions contained Meta's advertising SDK (FBSDKCoreKit). It ran only for people who said yes on Candid's own consent screen and allowed Apple's tracking prompt. For them it sent Meta app opens and closes, an install signal, the first card finished, the subscription screen opened, a free trial started, each subscription payment with its price, basic device information, and the device's advertising identifier. It never sent card content or anything between partners. Updating the App removes the SDK, and nothing further is sent. Data Meta already received is held by Meta under its own Privacy Policy; the Owner cannot access or delete it, but will help you contact Meta — see section 10.3.

7. The candid.contact Website

This section covers the candid.contact website, which is separate from the App. The App does not talk to the website, and nothing described here reaches your gameplay data.

7.1 No cookies, no analytics, no tracking scripts

The Site sets no cookies and uses no local storage. It runs no analytics package, no tag manager, no advertising pixel, no session recorder, and no social media trackers. There is nothing on the Site that follows you to any other site, and no profile of you is built or held anywhere.

7.2 Web server logs

The Site is hosted on shared web hosting. As with essentially every web server, it records a line for each request: your IP address, the date and time, the page requested, the referring page, and your browser's user-agent string. These logs exist so the host can keep the server running and investigate abuse or faults. They are rotated and deleted on the hosting provider's ordinary schedule, are not analysed for marketing, are not sold or shared, and are never linked to anything you do in the App.

7.3 Fonts and other third-party requests

The Site loads nothing from anyone else. Its typefaces are served from candid.contact itself rather than from Google Fonts, so opening a page here does not reveal your IP address to Google. There are no external scripts, stylesheets, embeds, iframes or images on any page. Every file your browser requests to display the Site comes from the Site.

Some pages link out to other websites — Apple's Privacy Policy, for example, or the App Store. Those are ordinary links: nothing is requested from them unless you choose to follow one, and where you go next is your decision.

The Site offers short links — candid.contact/app, /download and /get — that redirect you to Candid on the App Store. Requests to them are logged like any other page, as described in 7.2.

Promotional links may additionally carry a campaign tag: a short label such as instagram attached to the App Store address so that Apple can tell the Owner which promotion a download came from. To be precise about what this is and is not — the tag describes the link, not you. It sets no cookie, runs no script, and contains no identifier of any kind. Following a tagged link places nothing on your device and sends nothing about you to the Owner.

What the Owner receives is Apple's App Analytics report: aggregate counts, of the form "47 downloads from the Instagram link on this date". Apple does not reveal who those people are, and the Owner has no means of connecting a download to a person, a device, or any activity inside the App. Apple's own handling of the underlying data is governed by Apple's Privacy Policy.

8. Two-Device Sync

Candid is built for two people, and some features work better when both partners' phones are in sync. None of the methods below involves a server the Owner operates, and none gives the Owner access to anything you share.

8.1 Same-room, local peer-to-peer connection

Certain in-person features (for example, the guided-play "how far tonight" setting) let two phones connect directly over Wi-Fi or Bluetooth, using Apple's Multipeer Connectivity framework. This connection is encrypted, stays entirely on the local network between the two devices, and involves no internet connection, no account, and no Owner or Apple server of any kind — nothing exchanged this way ever reaches the Owner. The App requests local-network access the first time this is used; declining it only disables direct phone-to-phone features.

Daily Notes let each partner send the other one short note a day. This is the only feature in the App whose purpose is to move content from your phone to someone else's, so it is off until you turn it on and works as follows.

Linking is an explicit choice. Nothing is shared with anyone until one partner taps Invite my partner, reads a summary of what linking means, and sends an invitation through Apple's standard iCloud sharing sheet — and the other partner opens that invitation and confirms Apple's own "join" prompt.

Where notes are stored. The notes live in a private area of the inviting partner's own iCloud account (Apple's CloudKit service), which the other partner is invited into — comparable to a shared photo album. The Owner operates no server, holds no account for you, and has no access to this area at any point: we cannot see, read, list, or delete what is in it.

Encryption. Note content (text, the day's prompt, the name you sign with, and timestamps) is stored using CloudKit's encrypted fields, which are designed so that the keys are held only in you and your partner's iCloud Keychains and so that neither the Owner nor Apple can read them. This depends on iCloud Keychain being turned on for both of your Apple accounts and on Apple's own implementation, which the Owner does not control. The share is invite-only, which is the condition under which Apple states it cannot read these fields. On each phone, notes are encrypted a second time as described in section 3.2.

What is shared — and what is not. Linking shares your Daily Notes and any Through Your Eyes summary you explicitly choose to send. Your Desires, custom cards and settings are never shared. Your play history (cards completed and skipped) stays on your phone unless you separately turn on Sync play history in Settings → Privacy & sharing.

Unsend, expiry and read receipts. You can unsend a note at any time; it is removed from iCloud and disappears from your partner's phone the next time it syncs (if they have already opened it, they will have seen it). Notes expire after the retention period each of you chooses. The App does not send read receipts — your partner is never told whether or when you opened a note.

Notifications. When a note arrives, iCloud wakes the App with a silent, content-free signal through Apple's push service; the App then fetches and decrypts the note on your phone. The notification you see says only that a note has arrived — not who from or what it says — unless you turn on Show note previews. An optional daily reminder is scheduled entirely on your device, like the App's other optional reminders (section 5).

Unlinking. Settings → Privacy & sharing → Partner link → Unlink and delete notes removes every note from your phone and withdraws your consent to share. If you created the link, the shared iCloud area and everything in it is deleted; if you joined your partner's link, you leave it. Copies already on your partner's phone remain there until their retention period deletes them or they unlink.

Data stored in iCloud is otherwise governed by Apple's Privacy Policy, and counts against the storage of the partner who created the link (a negligible amount, as notes are short text).

8.3 Through Your Eyes and on-device summaries

Through Your Eyes is a pass-the-phone game in which each partner answers questions about the other. Answers exist only in the App's memory on the phone being played on, and are discarded when the game is closed; they are not saved, synced, or sent anywhere unless you tap Send … as a note, in which case the summary is sent as a Daily Note under section 8.2.

On devices that support Apple Intelligence, the end-of-game summary is written by Apple's on-device language model (the Foundation Models framework). This processing happens entirely on your phone: your answers are not sent to Apple, to the Owner, or to any other party. On other devices the summary is assembled from your answers by the App itself.

9. Children

The App is intended for users aged 18 or older. The optional Adults Only content pack is additionally gated behind an explicit in-app age confirmation and a per-session consent prompt. The Owner does not knowingly collect personal data from children, and the App's advertising measurement is not directed at anyone under 18.

If you believe a child has nevertheless transmitted information to the Owner (for example, through a support email), please contact the Owner immediately and any such information held by the Owner will be deleted, and the Owner will help you contact Meta about anything an earlier version of the App may have sent (see section 6.2).

10. Rights of Users

10.1 Rights under the EU GDPR and UK GDPR

If you are located in the European Union, the European Economic Area, or the United Kingdom, you have the following rights with respect to any personal data the Owner processes about you:

The Owner does not collect or store your gameplay or notes on its own systems, so there is nothing of that kind to access, correct, port or delete. For data Meta may hold from earlier versions of the App that contained its SDK, the Owner will act as your first point of contact: on request it will confirm what those versions sent, help you use Meta's own tools, and pass your request on to Meta. To exercise rights regarding data Apple processes in connection with your subscription, contact Apple directly.

10.2 Rights under the California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected about you, to request deletion, to opt out of the "sale" or "sharing" of personal information, and to non-discrimination for exercising these rights. Sharing for advertising. The current App shares no personal information with any advertising network; SKAdNetwork reports (section 6.2) do not identify you. Versions 1.4 to 1.6 sent Meta, only for people who agreed on Candid's consent screen and allowed Apple's tracking prompt, the events and advertising identifier described in section 6.2. Meta may use them for its own advertising, which is likely to count as "sharing" personal information for cross-context behavioral advertising under California law, and possibly as a "sale". The Owner received no payment for it. Categories. In the last 12 months, earlier versions of the App made available to Meta, for advertising measurement and only with that consent: identifiers (device identifier and advertising identifier); commercial information (each subscription payment, including renewals, and its price and currency); and internet or app activity (app opens, first card completed, subscription screen viewed, free trial started). No sensitive personal information as defined by California law is intentionally collected, and the Owner does not use or disclose it for purposes beyond those the law permits. The Owner keeps none of this data on its own systems. Opting out. Updating the App stops anything further being sent. You can also contact [email protected], and the Owner will pass your request on to Meta. Otherwise the Owner does not sell personal information.

10.3 How to exercise your rights

To exercise any rights under this section, or to ask any question about your data, contact: [email protected].

To stop sharing with your partner and delete every Daily Note from your phone, use Settings → Privacy & sharing → Partner link → Unlink and delete notes. To remove all on-device data immediately, uninstall the App.

To cancel your subscription or request a refund, open Settings → [your name] → Subscriptions on your device, or visit reportaproblem.apple.com.

The current App sends nothing to Meta. Advertising measurement is Apple's SKAdNetwork alone, and it does not identify you. If you used versions 1.4 to 1.6 and allowed advertising measurement there, updating the App stops anything further being sent. For data Meta already holds, the Owner cannot itself access, correct or delete Meta's records, but it will help you: contact [email protected] and the Owner will pass your request to Meta and follow it up, or you can use the tools in Meta's Privacy Policy directly.

10.4 Australian privacy law

The Owner is based in Australia. To the extent the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to the Owner, you may ask for access to, or correction of, personal information the Owner holds about you by contacting [email protected]. The Owner will respond within a reasonable time, and no later than 30 days. Earlier versions of the App (1.4 to 1.6) may have disclosed personal information about you to Meta (United States and Ireland), as described in section 6.2. Personal information may be disclosed overseas to Apple as described in section 6.1. If you are unhappy with the Owner's response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Additional Information

To the extent any personal data is processed in connection with the App, the legal basis is one or more of the following: (a) consent, where you have provided it (including, in versions 1.4 to 1.6, your answers on Candid's advertising-measurement consent screen and Apple's tracking prompt), which you may withdraw at any time; (b) performance of a contract, where processing is necessary to provide a paid subscription you have purchased; (c) legitimate interests of the Owner, where these are not overridden by your fundamental rights and freedoms; (d) compliance with a legal obligation.

The Owner reserves the right to use any data the App handles to establish, exercise, or defend legal claims, including in case of disputes regarding the use of the App.

11.3 System logs and maintenance

For operation and maintenance purposes, the App and any third-party services it relies on (Apple's StoreKit, the operating system itself) may collect files that record interaction with the App. These logs are not collected by the Owner.

11.4 Information not contained in this Policy

More details concerning the collection or processing of data may be requested from the Owner at any time using the contact details above.

11.5 Changes to this Privacy Policy

The Owner reserves the right to make changes to this Privacy Policy at any time by notifying Users on this page and, where appropriate, within the App. It is therefore advised to check this page regularly. The "Last updated" date at the top of this document indicates when the latest changes were made.

If material changes are made, the Owner will give additional notice where practicable (for example, an in-app notice on the next launch), and will not apply a material change to data already collected without giving you a chance to object.

Personal Data (or Data) — Any information that directly, indirectly, or in connection with other information allows for the identification or identifiability of a natural person.

Usage Data — Information collected automatically through the App (or third-party services employed in the App), which can include: the IP addresses or domain names of the computers utilized by the User who uses the App, the URI addresses, the time of the request, the method utilized to submit the request, the size of the file received in response, and similar parameters about the device operating system.

User — The individual using the App who, unless otherwise specified, coincides with the Data Subject.

Data Subject — The natural person to whom the Personal Data refers.

Data Processor (or Data Supervisor) — The natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller, as described in this Privacy Policy.

Data Controller (or Owner) — The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of the App. The Data Controller, unless otherwise specified, is the Owner of the App.

The App — The Candid mobile application, the means by which the Personal Data of the User is collected and processed (where such processing occurs).

Service — The service provided by the App as described in the relative terms (if available) and on the App.

European Union (or EU) — Unless otherwise specified, all references made within this document to the European Union include all current member states to the European Union and the European Economic Area, and reference to the EU is also taken to include the United Kingdom unless context requires otherwise.

This Privacy Policy is prepared on the basis of provisions of multiple legislations, including Art. 13/14 of Regulation (EU) 2016/679 (General Data Protection Regulation), the UK Data Protection Act 2018, the Australian Privacy Act 1988 (Cth), and the California Consumer Privacy Act of 2018, as amended.

Contact: [email protected]