← Back to home

Privacy Policy

Updated on 06/09/2026. This document explains how Disclose processes your personal data.

Data controller

The data controller is:

Data collected

Only the data necessary for the service:

  • Account: email, username, profile picture
  • Recovery email (optional)
  • Published content: photos, videos, drawings, audio, text
  • Metadata: publication date/time, group
  • Interactions: reactions, comments
  • Preferences: theme, language, notifications
  • Technical: push token, session identifier

No location data and no advertising identifiers. No commercial profiling.

Use of your data

Your data is used exclusively to:

  • Manage your account and authentication
  • Operate groups, reveals and archives
  • Display reactions and comments within your groups
  • Send push notifications related to your activity
  • Personalize your experience (theme, language, reminders)
  • Ensure security and prevent abuse

Legal bases (GDPR): performance of the contract (art. 6.1.b); legitimate interest (art. 6.1.f) for security; consent (art. 6.1.a) for notifications.

Data sharing

Your data is never sold. Your content is visible only to members of your group.

Technical subprocessors:

  • Supabase Inc. — database and authentication (servers in Europe, Frankfurt, Germany)
  • Cloudflare Inc. — media file storage (R2)
  • Expo Inc. — push notification infrastructure

These providers act on our instructions in compliance with the GDPR. Any transfers outside the EU are governed by standard contractual clauses (SCCs) approved by the European Commission.

Data retention

  • Active data: kept for the entire duration of your account
  • Account deletion: all your data erased within 30 days
  • Reveal archives: available as long as your account is active
  • Session and push tokens: deleted on logout

Security

  • Encryption of all communications (HTTPS/TLS)
  • Media access controlled at the group level
  • Secure authentication via Supabase Auth
  • Row Level Security on all tables

Your rights (GDPR)

In accordance with Regulation (EU) 2016/679 (GDPR), you have the following rights as an EU resident:

  • Access (art. 15): obtain a copy of your data
  • Rectification (art. 16): correct inaccurate information
  • Erasure (art. 17): delete your account and all your data
  • Portability (art. 20): receive your data in a standard format
  • Objection (art. 21): object to processing based on legitimate interest
  • Restriction (art. 18): temporarily restrict a processing operation
  • Withdrawal of consent: disable notifications from the settings

To exercise your rights: hello@disclose-app.com

You can also lodge a complaint with the CNIL (www.cnil.fr).

Minors

Disclose is reserved for people aged 16 or over. If a minor under 16 has created an account, contact us at hello@disclose-app.com so that their data is deleted.

Changes to this policy

We may update this policy at any time. In the event of a substantial change, you will be notified in the application or by email. Continued use constitutes acceptance.

Digital Services Act (EU 2022/2065) — DSA

Disclose qualifies as a “small platform” within the meaning of the DSA (fewer than 45 million monthly active users in the EU). As such, some of the DSA’s enhanced obligations do not apply, but Source Studio is committed to complying with the basic obligations:

  • Provide a single point of contact for authorities (see contact details below)
  • Set up a mechanism for reporting illegal content
  • Handle reports diligently and non-arbitrarily
  • Inform users of moderation decisions
  • Not use dark patterns to deceive users
  • Protect minors from inappropriate content

To report illegal content, use the form available in Profile → Settings → Help and support → Problem.

Consumer rights (Directive 2011/83/EU)

Disclose is a free application. No subscription fee is charged without prior explicit consent. In the event of a future in-app purchase:

  • The total price will be clearly displayed before confirmation
  • A 14-day right of withdrawal applies to digital purchases that have not started
  • Specific conditions will be communicated at the time of purchase

Accessibility (EU Directive 2019/882)

Disclose is committed to progressively improving the accessibility of its application in accordance with the European directive on the accessibility of digital products and services, applicable to new applications from June 28, 2025.

  • Compatibility with screen readers (VoiceOver / TalkBack)
  • Color contrasts meeting WCAG 2.1 AA recommendations
  • Theme and accessibility options in the settings
  • Subtitles coming soon for audio and video content

Cookies and trackers

The Disclose mobile application does not use cookies. The technical identifiers (session tokens and push tokens) are strictly necessary for the operation of the service and do not require prior consent within the meaning of the ePrivacy directive.

No advertising cookies, no browsing trackers, no data sharing for advertising targeting purposes.

Contact and supervisory authority

For any question regarding your personal data:

Competent supervisory authority for France:

  • CNIL — Commission Nationale de l’Informatique et des Libertés
  • 3 Place de Fontenoy, 75007 Paris
  • www.cnil.fr — 01 53 73 22 22

European online dispute resolution (ODR) platform: ec.europa.eu/consumers/odr