devo Privacy Policy
devo (“we”, “our”, “the app”) is a daily reflection journal you share with your friends, or a group you choose. This policy describes what data we collect, why, and how it is stored.
TL;DR
- We collect your email address (for sign-in), your phone number (so friends can find you), the reflections and photos you choose to post, and your friend / group connections.
- If you allow it, we read your phone's contacts to find which of them are on devo. Only one-way hashes leave your device, never names.
- We use Supabase (a third-party cloud database) to store your data.
- We send push notifications when friends interact with your posts. You can turn this off in settings.
- We do not sell your data. We do not run ads. We do not share your data with anyone outside the service providers listed below.
- You can delete your account at any time from Settings → Delete account. Deletion is immediate and permanent.
Information we collect
Account information
- Email address (required for sign-in via Supabase Auth)
- A handle / display name you choose
- Optional profile picture you choose to upload
- Phone number in E.164 format (collected during signup so friends can find you on devo). We store both the number and a one-way SHA-256 hash of it. You can toggle “Discoverable by phone” off in Settings without removing the number.
Phone numbers
When you sign up, we ask for your phone number so that other people you know can find you on devo. We store the number in E.164 format and a one-way SHA-256 hash of it. Your number is never shared with third parties beyond the storage providers listed below. You can change your number or turn off “Discoverable by phone” in Settings at any time. Deleting your account removes the phone number permanently.
Contacts (optional, with permission)
If you allow devo access to your contacts, we read the phone numbers from your device contact book on-device, hash each one with SHA-256, and send only the hashes to our server to check which of them are on devo. We do not store your contact list. We never transmit names, email addresses, or any contact field other than the phone hashes. The hashes are queried against our database and discarded, not persisted. You can revoke this permission at any time in your phone’s Settings.
Content you create
- Daily reflections (text)
- Photos you attach to reflections (taken with the camera or chosen from your photo library)
- Comments and reactions you leave on others’ reflections
- Mentions of friends in your reflections
Social graph
- Friend requests you send and accept
- Group memberships
- Audience selection (which friends or groups can see each post)
Device information
- Push notification token (Apple/Google-issued, used to deliver push notifications)
- Notification preferences (which categories of pushes you have enabled)
We do not collect
- Location data
- Contact names, emails, or any contact field other than phone-number hashes (see “Contacts” above)
- Browsing history outside the app
- Health, financial, or biometric data
- Tracking identifiers for advertising
How we use your information
- Sign you in and keep your session
- Display your reflections to the audience you chose (specific friends, groups, or yourself only)
- Send push notifications when friends react to, comment on, or mention you in a reflection
- Maintain your reflection archive and streak
Where your data is stored
- Supabase (
supabase.com): primary database, file storage (your photos), authentication - Apple Push Notification Service: iOS push delivery
- Firebase Cloud Messaging (Google): Android push delivery
- Expo / EAS: over-the-air app updates
These providers process data on our behalf under their own terms. They do not have permission to use your data for any other purpose.
Sharing
We do not share your personal data with third parties for marketing or advertising. The only sharing that happens:
- Reflections you post are visible to the friends or groups you select as the audience.
- Comments and reactions you leave on a friend’s reflection are visible to that reflection’s audience.
- Mentions notify the mentioned friend.
You control all of this in the app.
Your rights
You can:
- Edit or delete your reflections at any time (Archive screen)
- Remove friends or leave groups (Friends / Groups screens)
- Disable push notifications (Settings)
- Change your phone number or toggle “Discoverable by phone” (Settings)
- Revoke contacts access in your phone’s Settings
- Delete your account from Settings → Delete account. Deletion is immediate and permanent. Your auth record, profile, reflections, photos, friend connections, and phone number are removed from our database at the moment you confirm.
Children
devo is not intended for children under 13. If you believe a child under 13 has created an account, contact us and we will remove it.
Changes
We may update this policy. Material changes will be announced in-app. The “Last updated” date at the top will always reflect the current version.
Contact
Email: support@devo.fyi