Privacy Policy
Advent Dares ("the app") is made by Zembraa Digital, a company registered in Tunisia ("we", "us"). This policy explains what we collect, why, who helps us, and the choices you have. Questions: support@zembraa.com.
The short version
- We collect only what the app needs: your account, the calendars you make or receive, and the proof photos you take.
- Proof photos are private. Only the two people in a calendar can see them, through links that expire after 60 minutes.
- The creator can only share real photos of the recipient if the recipient allows it. Otherwise the photos are blurred.
- No ads, no analytics or tracking SDKs, and we never sell your data.
- You can delete your account and data at any time in the app.
1. What we collect
- Account: your email address, or the identifier and (if you choose) name from Sign in with Apple or Google; a display name; your time zone.
- Calendars: titles, the recipient's first name, start dates, the dares you write, and their status.
- Proof photos: the photos the recipient takes in the app, plus the AI's verdict and comment for each.
- Purchases: the store transaction ID for each calendar you send. Payment is handled by Apple or Google; we never see your card details.
- Notifications: a push token for your device and your notification settings. Door reminders are scheduled on your device and never contain the dare.
- Safety: reports you submit and people you block.
- Technical logs: limited server logs (for example errors and request times) to keep the service running. We do not log photos or full dare texts.
2. Why we use it (and our legal basis)
- To provide the app (contract): sign you in, deliver calendars, unlock one door a day in the recipient's time zone, store and show proofs, send notifications you turned on.
- To keep people safe (legitimate interest): check dares and photos for harmful content, handle reports and blocks, prevent abuse and cheating.
- To process purchases (contract): confirm a send was paid for and never charge twice.
- Photo sharing (consent): the recipient decides if the creator may share their real photos, and can change this at any time.
- Legal obligations: for example keeping purchase records where the law requires.
3. AI processing
We use Anthropic's Claude AI, through our own servers, to check that dares are safe, to suggest dares, and to decide whether a proof photo shows the dare. To do this, the dare text and the proof photo are sent to Anthropic. Anthropic processes them only to return a result to us and does not use them to train its models. If a photo is flagged as unsafe, we delete it immediately and never show it to anyone. The AI can make mistakes; a recipient can still send a proof for the creator to judge.
4. Who can see what
- The creator sees the calendar, every dare, and the recipient's proofs and their AI comments (except flagged photos).
- The recipient sees each dare only once its door has opened, and their own proofs.
- Nobody else can see a calendar. Invite links and our web pages never reveal titles, names or dares.
- Sharing: when you share a card, you choose where it goes. Shared images include our logo and a link to the app.
5. Service providers
We use these providers to run the app. They process data on our behalf and under contracts that protect it:
- Supabase: database, sign-in, photo storage and server functions.
- Anthropic: AI moderation, suggestions and photo verification.
- Google Firebase Cloud Messaging: push notifications.
- RevenueCat, Apple and Google: in-app purchases and sign-in.
- Resend: delivering sign-in codes by email.
- Vercel: hosting this website.
Some providers are located outside your country, including in the United States. Where data leaves the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Your account and calendars: until you delete your account.
- Flagged photos: deleted immediately.
- When you delete your account, we delete your profile, the calendars you created with all their photos, and the photos you uploaded to other people's calendars. Copies may remain in encrypted backups for a short period before they are overwritten.
- Records we must keep by law (for example purchase records) are kept only as long as required.
7. Your rights
Depending on where you live (including under the EU/EEA GDPR), you can ask to access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time. You can delete your account in the app under Settings → Delete account. For anything else, email support@zembraa.com; we answer within 30 days. You can also complain to your data protection authority (for example Datatilsynet in Norway, or the INPDP in Tunisia).
8. Age
Advent Dares is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor is using the app, contact us and we will delete the account.
9. Security
Data is encrypted in transit. Access is restricted by strict database rules, so each person can only read what they are allowed to see, and photos are only reachable through short-lived links. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.
10. Changes
If we change this policy, we will update the date above and, for important changes, tell you in the app.
Contact
Zembraa Digital · support@zembraa.com