In short
- We only collect the data Celebrate needs to work: your account, your friends and the wishes you send each other.
- No ads, no tracking, no third-party analytics. We don't sell or hand over your data.
- Your email isn't visible to other users. Only your friends can see your profile photo; only you and the recipient can see your messages.
- You can delete your account and your data at any time from the app, or ask us from this page.
- This policy applies to the Celebrate app on iPhone and Android.
1. Data controller
The data controller is Luca Botturi, who publishes the Celebrate app on the App Store and Google Play.
For any privacy question or to exercise your rights, write to support@veleno.studio.
2. What data we process
| Data | What it's for | Who can see it |
|---|---|---|
| Name and username | Showing you to your friends and letting people find you in search (your username is unique, so people can tell you apart from others with the same name) | Signed-in users |
| Date of birth | Working out your birthday, reminders and age | Day and month: signed-in users. The year (and so your age): only your friends. |
| Your phone's time zone (e.g. “Europe/Rome”) | Letting your friends know when your birthday starts and ends where you are, and not disturbing you at night: between 10 PM and 8 AM notifications arrive silently | Only your friends |
| Email and password | Signing in, verifying your account, recovering your password. Your password is handled by Firebase Authentication and we never see it. | Only you. It is never shown to anyone and can't be used to search for you: friends find you only by name or @username. |
| Profile photo (optional) | Letting your friends recognize you | Only your friends |
| Friendships, friend requests and blocked users | Managing your friends list and protecting you from people you don't want to hear from | Friendships and requests: you and the other person. Blocks: only you. |
| Birthday messages (text, meme, theme, gifts) | Sending and receiving wishes, and keeping them on your wall | Only the sender and the recipient |
| Invites (the friend code you used and who invited you) | Sending your friend request to whoever invited you and, once they accept it, giving them their Cake, only once | You and whoever invited you |
| Reports | Moderating content and enforcing the Terms of Use | Only us |
| Your phone's push notification token | Letting you know right away when you get wishes or friend requests (you can turn this off in Profile) | No one |
| App attestation (Firebase App Check with Apple App Attest on iPhone and Google Play Integrity on Android) | Checking that requests come from the genuine Celebrate app and blocking abuse. It doesn't identify you or your device to third parties. | No one |
| In-app purchases | Adding the gifts, themes and memes you bought, and preventing double credits or fraud | Only you |
For purchases, Apple (on iPhone) or Google Play (on Android) only gives us the transaction details: product, order or transaction ID, date, quantity and, to verify it, a purchase token. With every purchase the app adds an anonymous code derived from your Celebrate account, so a purchase can only be credited to you. We never receive your payment details, which stay with Apple or Google.
Some information stays on your device only and is never sent to us: your notification preferences, birthday reminders (scheduled by your phone at 9:00 AM; on Android the app keeps your friends' names and birth dates on the device for this purpose only) and the list of gifts you've already opened. Photos in your library or gallery are only read when you choose a picture for your profile. On Android the app doesn't back up its data to the cloud.
3. Why we process it (legal bases)
- Performance of a contract (Art. 6(1)(b) GDPR): to provide the service you signed up for, meaning your account, friends, wishes, notifications and purchases.
- Legitimate interest (Art. 6(1)(f) GDPR): to keep the app secure, prevent abuse and purchase fraud, and moderate reported content.
- Legal obligations (Art. 6(1)(c) GDPR): when the law requires us to keep or disclose data.
We don't use your data for profiling, advertising or automated decision-making.
4. Who we share it with
We use a few providers that process data on our behalf, only to make the app work:
- Google Firebase (Google Ireland Ltd / Google LLC): Authentication for accounts, Cloud Firestore for app data (in data centers in the European Union), Cloud Functions to verify purchases and deliver gifts and notifications (in Belgium), Cloud Messaging to deliver push notifications (on iPhone through Apple's service), and App Check to block requests that don't come from the app. Some Google services, such as authentication, may process data outside the EU, with the safeguards required by the GDPR: standard contractual clauses and the EU-US Data Privacy Framework.
- Apple (App Store) and Google (Google Play): handle in-app purchase payments under their own privacy policies. On Android, Google Play Integrity confirms to us that requests come from the app downloaded from Google Play.
- Imgflip: when you use a classic meme, the app downloads the template image from imgflip.com's servers, which receive your device's IP address as with any website. Celebrate's original memes are drawn on your phone and don't contact anyone.
We don't sell, rent or hand over your data to anyone. We may disclose it to the authorities only if the law requires it.
5. How long we keep it
- Your account data is kept until you delete your account.
- From Profile › Edit › Delete account (on iPhone and Android) you can delete, at any time, your profile, photo, friendships, requests, blocks, sent and received messages, gifts and unlocks. Your sign-in account is then deleted too. If you no longer have the app, you can ask us to delete it from this page.
- After deletion we only keep:
- a minimal purchase record (order or transaction ID and product), to handle refunds and disputes;
- reports already submitted, for as long as needed to handle them (a copy is also emailed to the moderation inbox).
- Our providers' backup copies are overwritten automatically on their own schedules.
6. Your rights
Under the GDPR you can ask us at any time to:
- access your data and get a copy of it (portability);
- correct it (you can also edit your name and date of birth yourself in the app);
- delete it;
- restrict its processing or object to processing based on legitimate interest.
Write to support@veleno.studio: we'll reply within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or the authority in your country.
7. Minimum age
Celebrate is only for people aged 14 and over. If we find out an account belongs to someone younger, we delete it. If you think a child under 14 has given us their data, please contact us.
8. Security
All communication between the app and the servers is encrypted (HTTPS/TLS). Server-enforced access rules make sure each user only sees what they're allowed to. Purchases are verified with Apple or Google Play before they're credited.
9. Changes to this policy
If we change this policy we'll update the date at the top. If the changes are significant, we'll let you know in the app.