In short
- A photo and its secret message are erased from our servers as soon as every recipient has scratched them, and at the latest 7 days after sending.
- Nobody at Sweetin reads your messages, unless a recipient reports a sweet.
- No ads, no selling of data, no location. Your address book is only read if you ask, and numbers only leave your phone as encrypted fingerprints that are never kept.
- You can delete your account at any time in the app: your profile photo at the top of the home screen → Settings → Delete my account.
Last updated: October 3, 2026
This is a translation. The French version prevails in case of difference.
1. Who is responsible for your data
The Sweetin app is published by [Company name], [legal form and share capital], [registered office address], registered with the [city] Trade and Companies Register under number [SIREN] (“Sweetin”, “we”), the controller of your personal data.
For any question or request: team@sweetin.app. Data protection officer: [name or “not appointed”].
2. What data, why, and for how long
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email and password (stored as an irreversible hash), or your Apple or Google sign-in identifier | Create and secure your account | Performance of the contract (terms of use) | Until the account is deleted |
| Username | Let your friends find you and send you sweets | Performance of the contract | Until the account is deleted |
| Profile photo (optional) | Let your friends recognize you. It is checked automatically when uploaded (moderation) and refused if it is not acceptable | Consent (you choose to add it) | Until you change it or delete your account |
| Date of birth | Check that you are at least 16. Never displayed or readable by other users | Legitimate interest (protection of minors) and legal obligations | Until the account is deleted |
| Phone number (optional, verified by SMS) | Let friends who have your number find you. Never displayed | Consent (you add it yourself; can be turned off in Settings) | Until removed or the account is deleted |
| Encrypted fingerprints (SHA-256) of the numbers in your address book, if you start the search | Show which of your contacts are on Sweetin | Consent (contacts permission) | Not kept: compared, then immediately discarded. Your contacts’ names never leave your phone |
| Friends, blocked people, day streaks | Make sending sweets and blocking work | Performance of the contract | Until the account is deleted |
| Photo and secret message of a sweet, and its blurred 24-pixel thumbnail (shown in the inbox and widget) | Deliver them to the recipients you choose: friends, private link or story | Performance of the contract | Erased once every recipient has scratched them, at the latest 7 days after sending (24 hours for a story) |
| Sweet links: link token, opening, scratching, percentage, duration, number of story opens | Deliver the sweet to someone without an account, and tell you what happened to it | Performance of the contract | 90 days. We collect no identifying data about people who open a link |
| Referral: which friend invited you and how (link, QR code, sweet…) | Measure how people discover Sweetin | Legitimate interest | Until the account is deleted. Never visible to other users |
| Sweet traces: date, sender, recipients, percentage scratched, duration, reaction, screenshot attempt | Show you what happened to a sweet you sent (an app feature) | Performance of the contract | 90 days |
| Photo and message, sent to our automated moderation service when you send a sweet | Block illegal or dangerous content (nudity, violence, content targeting minors…) before it reaches anyone | Legitimate interest (user safety) and legal obligations | Not kept by Sweetin. A rejected sweet is erased immediately. The provider may keep them for up to 30 days to fight abuse |
| Reports: reporter, reported person, reason, copy of the reported message | Handle the report, sanction abuse, respond to authorities | Legitimate interest and legal obligations (EU Digital Services Act) | 12 months |
| Device notification token | Tell you when you receive a sweet, and for Sweet Hour | Performance of the contract | Until you log out or delete the account |
| Crash reports: device model, OS and app version, technical error details, technical account identifier | Fix bugs | Legitimate interest | 90 days |
| Anonymous usage statistics: actions in the app (e.g. “sweet sent”, number of recipients), device model, random identifier never linked to your account | Understand how the app is used in order to improve it | Legitimate interest. Can be turned off at any time: Settings → Anonymous statistics | 12 months |
| Technical connection data: IP address, date and time, device type | Service security, fraud prevention | Legitimate interest and legal obligations | [duration to confirm: 1 year under French decree 2021-1362] |
Statistics and crash reports never contain photos, messages, usernames or emails.
3. What we don’t do
- We show no ads and do not sell, rent or share your data for commercial purposes.
- We do not track you across other apps or websites.
- We do not access your location or your microphone. Your address book is only read when you start “Find your contacts”, and nothing from it is kept.
- Received photos are never saved to your photo library or your phone’s storage: they are displayed, then released.
- We make no automated decision with legal effects on you. A sweet rejected by automated moderation can be challenged (see the terms of use).
4. Who can see your data
- Your friends see your username. Recipients of a sweet see the photo and message once scratched.
- A sweet sent by link can be opened by anyone who has the link: once for a private link, by everyone for 24 hours for a story. You choose who you give it to.
- The sender of a sweet sees whether you scratched it, how long it took, your reaction, and whether a screenshot was attempted.
- The Sweetin team only accesses a sweet’s content if it has been reported.
- Our technical providers, who process data only on our instructions:
| Provider | Role | Data location |
|---|---|---|
| Supabase Inc. | Database, file storage and authentication hosting | European Union ([region to confirm: Frankfurt, Germany]) |
| 650 Industries Inc. (Expo) | Sending notifications | United States |
| Apple Inc. and Google LLC | Delivering notifications; Sign in with Apple or Google if you choose it | United States |
| OpenAI, L.L.C. | Automated moderation of sweets | United States |
| Functional Software Inc. (Sentry) | Crash reports | European Union ([to confirm]) |
| PostHog Inc. | Anonymous statistics | European Union (Germany) |
| [SMS provider: Twilio, MessageBird…] | Sending the phone verification code | [to complete] |
| [email provider] | Confirmation and password emails | [to complete] |
Notification text (for example “username sent you a sweet”) goes through Apple’s or Google’s services. It never contains the secret message.
We may also disclose data to authorities when required by law, in particular for child sexual abuse material, which we always report.
5. Transfers outside the European Union
Some providers are located in the United States. These transfers are covered by the European Commission’s standard contractual clauses and, where the provider participates, by the EU–US Data Privacy Framework. You can request a copy by writing to us.
6. Security
- Traffic between the app and our servers is encrypted (HTTPS).
- Photos are stored in a private space and are only accessible to the recipient, through a temporary link valid for 2 minutes.
- The secret message is stored separately and can only be read by the recipient when opening the sweet.
- Database access rules prevent any user from reading another user’s data.
- Screenshots are blocked on Android and reported to the sender on iOS. No technique can stop someone from photographing the screen with another device, though: don’t send anything you wouldn’t want kept.
7. Minimum age
Sweetin is for people aged 16 and over. Date of birth is requested at sign-up; under 16, the account cannot be used and must be deleted. If you believe a child under 16 is using Sweetin, write to us and we will delete the account.
8. Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to set instructions for what happens to it after your death.
- Delete your account: directly in the app, or by following these instructions.
- Turn off statistics: Settings → Anonymous statistics.
- Stop being findable by your number: Settings → Findable by my number.
- Turn off notifications: in your phone’s settings.
- Any other request: write to team@sweetin.app from your account’s email address, stating your username. We reply within one month.
If you believe your rights are not respected, you can complain to the French data protection authority, the CNIL (cnil.fr), or to the authority of your country of residence.
9. Phone permissions
- Camera: to take a sweet’s photo. Nothing is recorded without your action.
- Photos: only the picture you choose from your library.
- Contacts (optional): to find your friends, only when you ask.
- Notifications: to be told about sweets you receive and about Sweet Hour.
10. Changes
We may update this policy. For any significant change, we will let you know in the app before it takes effect. The last update date is shown at the top of this page.