“Candour
Privacy Policy
Last updated 28 August 2026
Candour is an app for sharing genuine personal experiences anonymously. This policy explains what we collect, why, and who else sees it. It is written to be read, not to be survived.
Candour is operated by Hai Nam Nguyen, based in Victoria, Australia. If you have a question about anything here, write to [email protected].
Who Candour is for
Candour is for people aged 18 and over. You confirm your age when you create an account. We do not knowingly collect information from anyone under 18. If you believe a child has created an account, write to [email protected] and we will remove it.
What we collect
When you create an account: your email address, and a password (stored only as a cryptographic hash — we never see it). If you sign in with Apple or Google instead, we receive your email address and, on your first sign-in only, your name. Apple's "Hide My Email" gives us a relay address rather than your real one; that works fine.
The name you choose: a display name and, optionally, a short bio. These are yours to change at any time.
What you write: your posts and reflections, and which category or open question each belongs to.
What you do: the posts you like, save, pin or file into albums; the accounts you block; the content you report.
Your settings: how you sign your entries (anonymously, as initials, or with your full name), notification preferences, and widget preferences.
Technical information: if the app crashes, our crash-reporting provider records what went wrong. See "Crash reports" below.
We do not collect your contacts, your photos, your precise location, your advertising identifier, or your activity in other apps. Candour contains no advertising, no analytics tools, and no third-party tracking of any kind.
How your identity works
Every post and reflection carries one of three signatures, chosen by you at the moment you write it:
- – Anonymous — shown to everyone as "a stranger".
- – Initials — shown as an abbreviation of your display name.
- – Full name — shown as your display name, and readers can open your profile.
The signature is stored with the writing, so changing your default later does not retroactively re-sign anything you have already published. Your email address is never shown to other users under any of the three.
Anonymity applies between users, not between you and us. We can associate your account with what you have written, because we have to in order to let you delete it.
Who else sees your information
Candour relies on a small number of service providers. Each receives only what it needs.
Supabase hosts our database, authentication and storage. Your account and everything in it lives there.
OpenAI and Anthropic provide the automated moderation that runs before anything is published. When you submit a post or reflection, its text — the title and body only, with no name, account identifier or other detail attached — is sent to OpenAI's moderation service. If that check is inconclusive, the same text is sent to Anthropic for a second, context-aware review. When you set a display name or bio, that text alone is sent to OpenAI. Neither provider is given your account identifier, your email address, or anything about you beyond the text itself — though a display name you have chosen may of course be your real name. Neither is permitted to use this text to train their models.
Sentry receives crash reports. See below.
Apple and Google handle sign-in if you use it, under their own privacy policies.
Resend delivers our emails (verification codes and password resets).
We do not sell your information, and we do not share it with advertisers or data brokers. We will disclose information if we are legally required to.
Crash reports
If the app crashes, we receive an automated report so we can fix it. Before it is sent, we remove your account identifier, network request details and any recorded activity trail, and we redact long text and email addresses from error messages.
The report still contains your device model, your operating system version, the app version, and — because our crash-reporting provider derives it from your IP address at the moment the report arrives, after our own filtering has run — an approximate location, at city level. We have asked Sentry not to store IP addresses, and it does not; the approximate location remains. We are telling you this because we cannot remove it.
Crash reports do not contain your posts, reflections, display name or email address, and are kept only for a limited period set by our crash-reporting provider before being deleted automatically.
Push notifications
If you turn on push notifications, we store a device token so that notifications can reach your phone. It contains no personal information and is deleted with your account. You can turn notifications off at any time, in Candour's settings or your device's.
How long we keep things
We keep your information for as long as your account exists. When you delete your account, your posts, reflections, likes, saves, albums, display name, bio and login credentials are permanently deleted, immediately and without a recovery period.
One thing survives, and it is not yours: if you liked or replied to someone else's post, the notification they received about it remains in their inbox, with your name removed — it simply reads "a stranger". We keep it because it belongs to them.
Your choices
- – Change what you show. Your display name, bio and default signature are editable at any time from your profile.
- – Delete a post or reflection. Long-press it and choose delete. It is removed for everyone.
- – Delete your account. Settings → Delete Account. This is permanent and cannot be undone.
- – Ask us anything. Write to [email protected] and we will answer. If you would like a copy of your information, or want it corrected or deleted and cannot do it in the app, that is the address.
Depending on where you live, you may have additional rights over your information — to access it, correct it, delete it, or object to how it is used. We will honour those requests regardless of where you are.
Security
Your data is stored with access controls that limit every account to its own rows. Passwords are hashed, never stored in readable form. Connections to our servers are encrypted. No system is perfect, and we will tell you promptly if something goes wrong that affects you.
Where your information is held
Candour is operated from Australia, but our service providers store and process data overseas. Our database and authentication are hosted by Supabase, and crash reports are stored by Sentry in the United States. Moderation requests are processed by OpenAI and Anthropic, also in the United States. Using Candour means agreeing to your information being handled in those places, under those providers' safeguards as well as ours.
Changes to this policy
If this policy changes in a way that matters, we will say so in the app before it takes effect. The date at the top always reflects the current version.
Contact
[email protected]
Victoria, Australia