1. Who we are (data controller)
Canduo is based in Israel and operates Canduo Essentials. For the purposes of GDPR and similar laws, Canduo is the "data controller" responsible for your personal data collected through the Services.
You can reach us at any time at privacy@canduo.app for any privacy question or request.
2. Information we collect
We collect as little as possible, and only what a specific feature actually needs. The categories below cover everything the Services may collect.
2.1 Sign-in information
The Services use "Sign in with Apple" for authentication. Depending on the choice you make at sign-in, we receive a unique, app-specific identifier for your Apple ID, and either your real email address or a private Apple relay email address. We never see or store a password, because Apple handles authentication.
2.2 Purchase information
Purchases are billed entirely by Apple. We do not receive or store your payment card details. We may receive limited transaction information from Apple (such as a transaction identifier and product purchased) solely to validate your purchase and unlock the app you bought.
2.3 Device and diagnostic data
Like almost all apps, the Services automatically generate limited technical data as you use them: device model, operating system version, app version, language/locale, general crash and performance logs, and aggregated, anonymized feature-usage statistics. This data helps us fix bugs and understand which features are useful — it is not used to build an advertising profile of you.
2.4 Permission-gated data (feature-specific)
Some features within the app may request access to sensitive device data, such as your Photo Library or Camera, Contacts, Location, Microphone, or Health data. Each such request:
- is triggered only by a specific, clearly-labeled feature that needs it — never collected in the background,
- requires your explicit approval via the standard iOS permission prompt, which explains why it’s being requested,
- is used only to provide that feature, and is not repurposed for advertising or shared with data brokers, and
- can be reviewed or revoked at any time in iPhone Settings for the app.
2.5 Information you choose to send us
If you contact support or email us, we collect whatever you include in that message (such as your name, email address, and the content of your message) so we can respond to you.
3. How we use information
We use the information described above to:
- provide, operate, and maintain the app and its features;
- authenticate you and keep your purchase and app access in sync across your devices;
- diagnose crashes, fix bugs, and improve performance and reliability;
- understand aggregate feature usage so we can prioritize what to build next;
- respond to support requests and communicate with you about the Services; and
- comply with legal obligations and enforce our terms.
We do not use your information to serve third-party advertising, and we do not build cross-app advertising profiles.
4. Legal bases for processing (GDPR)
If you are located in the European Economic Area, the UK, or another jurisdiction with similar requirements, we rely on the following legal bases under Article 6 GDPR:
- Performance of a contract — to create your access to the app you purchased and provide the features you request;
- Consent — for permission-gated data (e.g. Photos, Location, Microphone), which you grant via the iOS system prompt and may withdraw at any time;
- Legitimate interests — for diagnostic and aggregated usage data used to keep the Services secure, reliable, and improving, in a way that does not override your rights; and
- Legal obligation — where we must retain or disclose information to comply with the law.
6. Data retention
We keep personal information only for as long as needed for the purposes described in this policy: for example, sign-in and purchase records for as long as your account is active (so you can restore purchases on new devices), and diagnostic logs for a limited rolling period sufficient to debug issues. When you request deletion (see Section 9), we delete or anonymize your information within 30 days, except where we must retain limited records to comply with legal, tax, or accounting obligations.
7. Data security
We use reasonable technical and organizational measures designed to protect information against unauthorized access, alteration, disclosure, or destruction, including relying on Apple’s platform security for authentication and payments and restricting internal access to data on a need-to-know basis. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
8. International data transfers
Canduo is based in Israel. Any service providers we use may process data in other countries, including the United States and the European Economic Area. Where we transfer personal data internationally, we use appropriate safeguards required by applicable law (such as standard contractual clauses or reliance on an adequacy decision) to protect that data.
9. Your privacy rights
Depending on where you live, you may have some or all of the following rights regarding your personal information. To exercise any of them, email us at privacy@canduo.app. We will respond within the time required by applicable law (generally within 30 days).
9.1 If you are in the EEA, UK, or a similar jurisdiction (GDPR)
You have the right to:
- access the personal data we hold about you;
- request correction of inaccurate or incomplete data;
- request erasure of your data ("right to be forgotten");
- request restriction of, or object to, certain processing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing that already took place; and
- lodge a complaint with your local data protection supervisory authority.
9.2 If you are in Israel
Under Israel’s Protection of Privacy Law, 5741-1981, as amended, you have the right to inspect the personal data we hold about you and to request that we correct or delete data that is incorrect, incomplete, unclear, or outdated. You may also object to your information being used for direct-mail marketing purposes (we do not currently engage in such marketing).
9.3 If you are a US resident
If you live in a state with a comprehensive consumer privacy law (such as California’s CCPA/CPRA, or comparable laws in other states), you generally have the right to know what personal information we have collected about you, request deletion of that information, correct inaccurate information, and opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising.
We do not sell or share personal information as those terms are defined under these laws, so there is no "opt out of sale" mechanism needed. We will not discriminate against you for exercising any privacy right.
10. Account and data deletion
Because sign-in uses Sign in with Apple, you can revoke the Services’ access to your Apple ID at any time from your iPhone, under Settings > [your name] > Sign-In & Security > Sign in with Apple. To request that we also delete any data we hold about you on our side, email privacy@canduo.app from the address associated with your account. We will confirm your identity and complete deletion within 30 days, except for limited information we are legally required to retain.
11. Children’s privacy
The Services are not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If we learn that we have inadvertently collected personal information from a child, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@canduo.app.
12. Tracking, advertising, and App Tracking Transparency
The Services do not include third-party advertising SDKs and do not track you across apps or websites owned by other companies for advertising purposes, as defined by Apple’s App Tracking Transparency framework. Because we do not engage in such tracking, the Services do not display an App Tracking Transparency permission prompt. This policy will be updated, and the appropriate consent mechanisms added, before that ever changes.
13. Third-party services and links
The Services rely on Apple for authentication, payments, and distribution, and may link out to third-party websites (for example, Apple’s own support pages). Those third parties operate under their own privacy policies, which we encourage you to review — this Privacy Policy does not cover their practices.
14. License to use the app
We have not published a custom End User License Agreement, so your use of Canduo Essentials is also governed by Apple’s Licensed Application End User License Agreement (the "Apple Standard EULA"), available at apple.com/legal, together with the App Store Terms of Service you agreed to when creating your Apple ID.
15. Changes to this policy
We may update this Privacy Policy from time to time as the Services evolve. If we make material changes, we will update the "Last updated" date above and, where required by law, provide additional notice (such as an in-app notification). We encourage you to review this page periodically.
16. Contact us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us at privacy@canduo.app. For general support, use support@canduo.app or the Support page.