Privacy Policy

Cibe is a mobile application operated by Intevion, Inc. It uses AI to generate light, entertainment-oriented observations about people you add to your Circle, and to help you think about how you communicate with them.

This Privacy Policy explains what information we handle, why, and what you can ask us to do with it. It applies to the Cibe app and to cibe.app. Sections 20 and 21 add rights that apply depending on where you live; everything else applies to everyone.

Intevion, Inc. is responsible for the personal information described here. Under the GDPR, we are the controller within the meaning of Article 4(7).

Representative in the European Union (Article 27 GDPR)

We have no establishment in the European Union. The following representative has been designated for all EU member states:

You can contact either us or our EU representative about anything in this policy. Our full company details are in the Legal Notice.

Cibe is for adults. You must be at least 18 years old, or older where your country sets a higher age of majority, to create an account. Our Terms of Service also prohibit uploading photos of, or creating profiles about, anyone under 18.

If you believe a minor has created an account or that a profile concerns a minor, contact us and we will look into it.

4.1 Information you provide

• Account information: when you sign in with Apple or Google we receive an authentication token, an account identifier and, where the provider supplies it, your email address. We do not offer username-and-password registration.
• About Me: an optional description of yourself used to make responses more relevant. It is stored on your device and included in requests to the AI provider.
• Chats and prompts: the questions you ask, the responses generated, and your conversation history. Stored conversations use placeholders in place of names.
• Profile information: notes and context you add about someone in your Circle, and the form of address you select for them.
• Photos: submitted for analysis. See section 5.
• Feedback: ratings, reports and comments you choose to send.
• Confirmation records: a record each time you confirm that you have the rights to a photo, or the permission to share a profile. See sections 5 and 10.
• Contact Form and email: see section 11.

4.2 Information collected automatically

• Web server logs: when you visit cibe.app our web server records the IP address, the request, the time, and standard browser information. These logs exist to keep the site running and secure. They are kept for 30 days.
• Application logs: our application servers log requests and responses exchanged with the app so we can find and fix faults. Where such content would contain a name, a placeholder is stored instead. These logs are deleted no later than seven days after the associated account is deleted.
• Device and technical data: device and operating system information, timestamps and security-related events needed to operate the service and protect accounts against abuse.

4.3 What we do not collect or store

• We do not store the photos you submit.
• We do not receive or store the names you assign to people in your Circle. They stay on your device.
• We do not use analytics, advertising or tracking tools, and we set no tracking cookies. See section 13.
• We do not receive your payment details. See section 15.
• We do not perform facial recognition and do not create facial recognition templates.

When you add someone to your Circle you submit a photo. The photo passes through our servers to our AI provider, which returns a text description of facial features. That description is what the rest of the app works from.

Photos are never stored by us. They are transmitted transiently for the purpose of generating the description and are not retained afterwards.

Photos are analysed only to produce that description. We do not attempt to identify anyone, we do not build or maintain facial recognition databases, and we do not use photos to detect or infer emotions.

Before submitting a photo of another person you confirm that you have the necessary rights, permissions or other legal basis to do so. You are responsible for that confirmation being accurate.

We record that confirmation

When you give it, we store a record of the confirmation: the time, which confirmation it was, the version of the terms it referred to, and the account and profile it belongs to. We do not store the photo itself.

We keep this record so that we can show, if we are ever asked, that the confirmation was requested and given. The legal basis is our legitimate interest under Article 6(1)(f) GDPR in being able to account for how the Services are used and to defend legal claims. The record is deleted with your account, under section 17.

A profile in your Circle may contain a name or label you assign, notes, the AI-generated description, and the conversation history connected to that person.

The name stays on your device. Requests sent to our servers and on to the AI provider contain a placeholder instead, and responses are stored with that placeholder. Your device substitutes the real name back in when displaying the text. We therefore do not know who is in your Circle.

Personalisation data you provide about yourself is stored on your device and included in requests so responses fit your situation.

You can edit or delete profiles at any time. A deleted profile is kept in a "Recently Deleted" folder on your device for 30 days so you can restore it, then removed. Server-side data associated with the profile is deleted as set out in section 17.

• To provide the app: creating and managing your account, generating descriptions and chat responses, and keeping your Circle and conversation history available.
• To keep the service working: fault diagnosis, stability, capacity and performance.
• To protect the service and its users: preventing abuse, fraud and unauthorised access.
• To answer you when you get in touch.
• To improve the app, including through feedback you send and the automated quality analysis described in section 8.
• To meet legal obligations.

The legal bases that apply to users in the EU and EEA are set out in section 21.

We analyse stored conversations to see how well the app is working: whether responses fail, where the AI produces poor or inappropriate output, which features are used, and how the service performs overall.

This analysis is automated. No one at Intevion reads your conversations for this purpose. It runs on the stored conversations, which contain placeholders rather than the names you assign, so the analysis does not tell us who you were talking about.

What comes out of it are aggregate figures and error reports — not a profile of you. We do not use the results to make decisions about individual users.

Legal basis and your right to object

This processing rests on our legitimate interests under Article 6(1)(f) GDPR: keeping the service working, finding faults, and improving the quality of what the app produces.

You can object at any time under Article 21 GDPR, on grounds relating to your particular situation. Write to ai (paste "at" for mails here) cibe.app and we will exclude your conversations from this analysis unless we can demonstrate compelling legitimate grounds that override your interests.

Personalisation of responses is a different thing and is not affected by this. It uses information stored on your device.

You can rate or comment on AI-generated output. We use that feedback to judge and improve output quality. Sending feedback is voluntary.

Please do not include personal information about other people in feedback unless you are entitled to share it.

You can share a profile summary or an invitation code with someone else using the sharing functions in the app. When you do, you confirm that you have the permission of the person concerned.

Before sharing, you confirm that the person concerned has given permission. We store a record of that confirmation in the same way and for the same reason as described in section 5: time, type of confirmation, terms version, account and profile. We do not store what you shared or who you shared it with.

What you share, and with whom, is your decision and your responsibility. Shared output is generated for your situation and is not meant for a general audience. Our Terms of Service prohibit sharing profiles of minors or sharing output in a way that could harm, embarrass or discriminate against the person described.

If you write to us through the Contact Form on cibe.app, we process the name, email address, topic and message you enter, in order to answer you. The form sends your message to our mailbox; we do not store the content anywhere else.

To stop the form being abused for spam, our server keeps a short-lived counter of submissions. It stores a daily-rotating cryptographic value derived from the visitor's IP address and the times of recent submissions, never the IP address itself. These counters are removed automatically within two days.

We keep correspondence for as long as needed to deal with your enquiry and any follow-up, then delete it, unless a retention obligation applies.

You can subscribe to our newsletter with your email address. We use a double opt-in: after you sign up you receive a confirmation email, and the subscription only starts once you confirm.

You can unsubscribe at any time using the link in any newsletter or by contacting us. We then remove your address from the list.

We do not run analytics, advertising pixels or tracking tools on cibe.app or in the app. There is no Google Analytics, no Meta Pixel and no comparable service.

Our website sets no cookies and stores nothing on your device for tracking purposes. Fonts are served from our own server, so loading the site sends no data to third-party font or CDN providers.

Because we do not track you, "Do Not Track" and global privacy control signals make no difference to what we do — there is nothing for them to switch off.

We do not operate social media accounts under the Cibe or Intevion name. If that changes, we will update this policy before it does.

We use third-party providers to run the service. We have data processing agreements in place with them and share only what each function needs.

Photos go to the AI provider only, only transiently, and only to produce a text description. Names are never shared with any AI provider, because requests carry placeholders. None of these providers is told who is in your Circle.

Subscriptions are sold and billed by the Apple App Store and Google Play. We do not operate a web checkout and do not sell directly.

We therefore never receive your card number, bank details or other payment credentials. We receive only the metadata the stores pass on, such as whether a subscription is active and when it renews.

Cancellations and refunds are handled by the store you bought through, under that store's terms.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

We disclose information only:

• to the service providers listed in section 14, for the functions described there;
• where you direct us to, for example when you use a sharing function;
• where we are legally required to, or where it is necessary to establish, exercise or defend legal claims;
• to a successor entity in a merger, acquisition or similar transaction, in which case this policy continues to apply until it is replaced with notice to you.

We keep personal information only as long as the purpose requires, unless a longer period is legally required.

• Account data: kept until you permanently delete your account.
• Conversation history: deleted within seven days of permanent account deletion.
• Application logs: deleted no later than seven days after the associated account is deleted.
• Photos: never stored, so nothing to delete.
• Deleted profiles: kept for 30 days in the "Recently Deleted" folder on your device so you can restore them, unless you remove them sooner. This is local to your phone, not a server-side copy.
• Confirmation records: kept while the account exists; deleted within seven days of permanent account deletion, like all other server-side data.
• Web server logs: 30 days.
• Correspondence: kept while your enquiry is open and for any follow-up, then deleted.

We may ask for information to verify your identity before acting on a deletion or access request.

Cibe lets users create profiles about other people. Where we determine the purposes and means of that processing, we are the controller for it.

We receive this information only from our users. Depending on what a user provides it can include a photo (transient, never stored), notes, AI-generated descriptions and conversation content. The names users assign are not transmitted to us.

Users must confirm, before submitting a photo of someone else, that they have the necessary rights, permissions or other legal basis. Our Terms of Service make the user responsible for that confirmation.

We do not send individual notices to the people concerned, relying on Article 14(5)(b) GDPR. We normally have no relationship with them and hold no contact details for them — names stay on the user's device — so contacting each of them individually would involve disproportionate effort. We publish this policy instead.

If you believe a Cibe user has submitted information about you, contact us at ai (paste "at" for mails here) cibe.app and we will act on your rights to the extent we can identify the relevant data. You also have the right to complain to a supervisory authority.

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong;
• delete your information;
• stop sending you the newsletter.

Write to ai (paste "at" for mails here) cibe.app or use the Contact Form. We answer within the time your law allows, and in any case without undue delay. We will not treat you differently for exercising these rights.

Sections 20 and 21 add further rights depending on where you live.

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, you have the rights below. Terminology differs between states; the substance is broadly the same.

• Know and access: what we collect, why, and who receives it, plus a copy in a portable format.
• Delete: ask us to delete personal information we hold about you.
• Correct: ask us to fix inaccurate personal information.
• Opt out of sale or sharing: we do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We have not sold or shared personal information in the preceding 12 months.
• Limit use of sensitive personal information: we do not use it to infer characteristics about you.
• Non-discrimination: we will not deny service, charge a different price or provide a lesser quality of service because you exercised a right.
• Appeal: in states that provide for it, you may appeal a refusal by replying to our decision. If we deny the appeal, you may contact your state Attorney General.

Categories under the CCPA/CPRA

In the preceding 12 months we have collected the following categories: identifiers (account identifier, email address, IP address); internet or network activity (technical logs); and, in the form described in this policy, information you or other users provide through the app. We collect this for the purposes in section 7, keep it for the periods in section 17, and disclose it for business purposes to the providers in section 14.

You can use an authorised agent to make a request. We may need to verify the request before acting on it.

If you are in the European Union or the European Economic Area, this section applies in addition to the rest of this policy. The controller is Intevion, Inc.; our Article 27 representative is named in section 2.

Legal bases

• Article 6(1)(b) – performance of a contract: creating and running your account, generating descriptions and chat responses, profile management, subscriptions.
• Article 6(1)(f) – legitimate interests: security, abuse and fraud prevention, log data, fault diagnosis, handling feedback, and the automated quality analysis in section 8. Our interest is in operating a service that is reliable and safe to use.
• Article 6(1)(a) – consent: the newsletter (section 12). It is optional and can be withdrawn at any time with effect for the future.
• Article 6(1)(c) – legal obligation: where the law requires the processing.

For photos and other personal data relating to people in your Circle, the processing rests on the consent of the person shown, which the user confirms they have obtained before submitting the photo. See section 18.

Your rights

• Access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20).
• Objection (Article 21): you may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f). We will then stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves legal claims.
• Withdrawal of consent (Article 7(3)): at any time, without affecting the lawfulness of processing carried out beforehand.
• Complaint: you may lodge a complaint with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.

Write to ai (paste "at" for mails here) cibe.app to exercise any of these. We respond within one month, extendable by two further months for complex requests, in which case we will tell you.

We are based in the United States and several of our providers are too, so your information is processed there and may be processed in other countries where we or our providers operate. Data protection law in those countries may differ from that in your own.

For transfers of personal data from the EU or EEA to a recipient outside it: where the recipient is certified under the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision. Where no adequacy decision applies, we rely on the European Commission's Standard Contractual Clauses together with supplementary measures where these are needed. Only where neither mechanism is available and the statutory conditions are met do we rely on your explicit consent under Article 49 GDPR.

We do not make decisions about you, or about anyone in your Circle, that are based solely on automated processing and produce legal effects or similarly significant effects, within the meaning of Article 22 GDPR.

What the app produces is entertainment. The observations are generated by AI from visual patterns and from what you write, are not scientifically validated, and are a starting point for your own reflection rather than a statement of fact about anyone. Our Terms of Service prohibit using the output to make decisions about people — in hiring, housing, credit, insurance, medical or psychological assessment, education, legal matters or law enforcement — and prohibit using it for surveillance or background checks.

We use administrative, technical and organisational measures appropriate to the risk, including encryption in transit, access controls and monitoring. Not storing photos, and keeping names off our servers entirely, are themselves security measures: data we never hold cannot be breached.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We update this policy when our processing changes. The version published here is the one that applies, and the effective date is shown at the top.

If a change materially affects how we handle your information, we will tell you through the app or by email before it takes effect.

For anything in this policy, including requests about your rights:

Users in the EU and EEA may also contact our Article 27 representative, named in section 2.