Privacy policy
Draft for legal review. This text is not final.
Ciaone writes breakup messages. This policy explains what personal data we use to do that, why, who helps us, how long we keep it and what you can do about it.
Who we are
Ciaone is run by [Your full legal name or company name], [Business address, Italy], [Partita IVA]. Email: [privacy@ciaonechat.site]. We are the data controller for the personal data described here. For anything about your data, write to [privacy@ciaonechat.site].
What we collect
A random device ID, stored in a cookie, so your free breakup, credits and passes stay with you. It is not linked to your name unless you sign in.
What you type to get a message: a first name, how long it lasted, what went wrong and any reply you paste. We use it only to write your message and do not store it on our server; your current draft stays in your browser until you close the tab.
Your email address, only if you sign in, so we can send you a sign-in link and keep your purchases on every device.
Purchases: which plan you bought, when it runs out and a Stripe customer ID. Stripe handles your card details; we never see them.
Usage events linked to your device ID: visits and the website or campaign you came from, messages written, shares, replies and purchases, with the plan and language. We use them to count what works, not to profile you.
Technical data: our server processes your IP address and browser details to deliver the site and keep it secure. We do not store your IP address.
Messages you submit to the weekly page, with the name replaced by an initial.
If you invite friends: a random invite code linked to your device ID, and which new device joined through it, so both of you get your free breakup.
About the other person
What you type is usually about someone else. Enter only a first name and the situation, never surnames, contact details, addresses or anything else that identifies them. Our filter blocks phone numbers, emails, addresses and links, and we do not store what you type.
We process this small amount of data on the basis of our legitimate interest, and yours, in providing the service, and keep it to the minimum a single message needs.
Why we use it and on what legal basis
To write your messages, run your account and deliver what you paid for: performance of our contract with you (Art. 6(1)(b) GDPR).
To prevent abuse and keep Ciaone secure with rate limits, the content filter and fraud checks: our legitimate interest (Art. 6(1)(f) GDPR).
To understand what works using our own counts instead of third-party trackers: our legitimate interest (Art. 6(1)(f) GDPR). You can object at any time.
To publish messages you submit on the weekly page: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
To keep accounting and tax records: legal obligation (Art. 6(1)(c) GDPR).
The weekly page
If you press Submit to Most savage, your message joins a pool. Every Monday we pick up to eight messages from the last four weeks at random and publish them on the weekly page. We replace the name you typed with an initial, but the rest of the text is published as written, so only submit messages that don't reveal who the other person is.
When fewer than eight messages come in, Claude writes examples with invented situations, labelled as Ciaone examples.
To withdraw a submission, use Delete my data or email us.
Who helps us
Anthropic PBC (United States) writes the messages with its Claude models. It receives what you type for that purpose only, does not use it to train its models and deletes it after a short period, unless it must keep it longer for safety or legal reasons.
Stripe (Ireland and United States) processes payments. For payments and fraud prevention, Stripe also acts under its own privacy policy.
Supabase (servers in the European Union) stores our database and sends sign-in emails.
Our hosting provider runs our server in Denmark, in the European Union.
We do not sell your data, share it for advertising or use advertising trackers.
Transfers outside the EU
Anthropic and parts of Stripe are in the United States. These transfers are covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's Standard Contractual Clauses.
Cookies and browser storage
Ciaone's own cookies are only the ones it needs to work, so they need no consent: ciaone_id (your device ID, 400 days), ciaone_18 (your 18+ confirmation, 1 year), ciaone_lang (your language, 1 year) and, if you sign in, ciaone_acct (400 days).
Your browser's session storage keeps your current draft and notes your visit until you close the tab. If you sign in, the sign-in service keeps a sign-in token in your browser's local storage until you sign out.
No advertising or third-party analytics cookies. If we ever add them, we will ask you first.
How long we keep it
Credits, passes and your account: while you use Ciaone, or until you delete them.
Invite codes and who joined through them: while you use Ciaone, or until you delete your data.
What you type to get a message: not stored on our server.
Usage events: 13 months, then deleted automatically.
Weekly-page submissions: those not picked within four weeks are deleted after five; published ones stay until you delete your data or ask us to remove them.
Payment records: 10 years, as Italian tax law requires.
Security
Ciaone runs over HTTPS. Tokens kept in your browser are signed or encrypted, our database cannot be reached from the browser, and only we can use the admin tools.
Automated decisions
Our filter and the AI automatically refuse some requests, for example threats or personal details. This only decides whether a message gets written; it has no legal or similarly significant effect on you.
Your rights
You can ask to access, correct or delete your data, restrict or object to its use, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
To erase everything, open Account (the person icon) and choose Delete my data, or email us. We answer requests within one month.
You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live.
Age
Ciaone is for adults only. We do not knowingly collect data from anyone under 18; if you think we have, email us and we will delete it.
Changes
If we change this policy we will update this page and its date, and tell signed-in users about important changes by email.