Candor Privacy

We are the controller within the meaning of Art. 4(7) GDPR insofar as we decide on the purposes and means of a processing operation. Where Apple or Google processes data for its own purposes in connection with their stores or a purchase, their own notices apply in addition.

We have not appointed a data protection officer, because on the present scale the processing is not large-scale within the meaning of Art. 37(1)(c) GDPR and the conditions of § 38 BDSG are not met either. We reassess this as circumstances change. Address data protection enquiries to the contact above, where they are handled directly by the management.

The first time Candor talks to our server, it creates an anonymous account for you: a random user ID with no name, no email address and no password. That is what lets your rehearsals and progress be saved and protects our AI services against abuse. The session token is stored securely on your device.

On iOS, you can optionally connect the account with Sign in with Apple to keep your progress across devices. We then receive a token from Apple that identifies you to our service and, if you choose to share it, your email address or an Apple relay address. We never see or store a password. You can always continue without connecting an account. Android does not currently offer account linking.

What we store in your account

• Profile from onboarding: the name you want to be called, your stage as a manager, the goals and struggles you picked, your self-ratings (for example how comfortable you are giving feedback or saying no), your chosen strength and how many minutes a day you want to practise;
• Rehearsals: which scenario or lesson you practised, the transcript of the conversation (your answers and the counterpart’s replies as text), the feedback and score you received, and how long the rehearsal took;
• Usage counters: how many AI requests your account made per day, so we can keep fair limits and control costs;
• Technical account data: user ID, creation and sign-in timestamps, and for accounts connected with Sign in with Apple the email or relay address Apple shares.

Access to this data is restricted by row-level security, so each account can only read its own records.

Replying in character and writing your feedback is Candor’s core function. Candor sends your rehearsal to an AI model on our server only after you have agreed to it in the app. You can withdraw that consent at any time under You › Settings › AI replies and feedback (OpenAI). While it is off, nothing from your rehearsals is sent to OpenAI: a coach built into the app plays the counterpart and writes your feedback on your device. We describe the AI path in full.

What is sent

When you answer in a rehearsal, the app sends the text to our server at Supabase in the EU (Frankfurt), which sends the following to the programming interface (API) of OpenAI: our fixed instructions, the scenario (for example “a direct report keeps missing deadlines”), the conversation so far, your latest answer as text, and, where it shapes the feedback, the stage and goals from your profile. The model returns the counterpart’s next line as text and, at the end, your feedback. Our server makes the request, not your device, so OpenAI does not learn your IP address or device. No audio, email address or Apple ID is sent.

Storage and training

OpenAI acts as our processor under a data processing agreement. Data sent through the API is not used to train OpenAI’s models by default. OpenAI may retain API data for up to 30 days for abuse monitoring, or longer where legally required. See OpenAI’s data controls.

Please rehearse with pseudonyms

Rehearsals are about real situations, but they do not need real names. Use first names you make up, leave out company secrets, health details or other sensitive information about colleagues, and describe the situation rather than the person. What you do not say cannot be transmitted.

Limits of the result

The counterpart and the feedback are generated by an AI or, with AI replies off, by the on-device coach. They can be wrong, one-sided or miss context. The feedback is a practice aid about how you phrased something; it is not an assessment of you as a person. No automated decision with legal or similarly significant effect under Art. 22 GDPR takes place.

Candor uses the microphone only after you grant permission, and only for your own answers: it listens only while you are answering in a rehearsal. You can always reply by text instead.

• Speech to text: your spoken answer is transcribed by your device's speech recognition service. On Android, the provider may process audio online if on-device recognition is unavailable. Candor does not upload or store audio itself. Only the resulting text becomes part of your rehearsal.
• No voice output: the counterpart answers in text only. Candor does not turn text into speech.

We do not use your voice to build a voice profile, and we do not clone voices.

Your settings (appearance, AI replies, reminders), lesson progress and streak are stored on your device. The optional daily reminder is scheduled locally on the device; Candor uses no push service. With AI replies off, the rehearsal coach runs on the device. Candor embeds no advertising identifier, no analytics or crash-reporting SDK, and no social media component.

When you tap a link out of the app, for example to this page or to email support, your device connects to that provider itself.

Candor Pro is sold as an auto-renewing subscription through the App Store or Google Play, depending on your device. The store handles payment; we never see your payment details. To check, manage and restore your subscription we use RevenueCat, which receives a random app user ID, the purchase and its transaction data (product, price, currency, dates, trial status), and basic device and app information such as app version, operating system and storefront. RevenueCat receives no rehearsal content.

We have Art. 28 GDPR agreements in place with our processors. No data is passed to third parties for their own purposes, and we do not sell or share data for advertising.

This legal page itself is served through Cloudflare Pages. For that and for contacting us, see the website privacy notice.

• Art. 6(1)(b) GDPR, performance of a contract: providing your account, rehearsals, feedback, saving your progress, handling Candor Pro, and support;
• Art. 6(1)(f) GDPR, legitimate interests: usage limits, abuse prevention, security and error logs; our interest lies in running Candor securely and affordably;
• Art. 6(1)(a) GDPR, consent: sending your rehearsal text to OpenAI for AI replies and feedback, which you agree to in the app and can withdraw at any time under You › Settings › AI replies and feedback (OpenAI); microphone and speech recognition access and reminders, which you can withdraw in your device settings at any time;
• Art. 6(1)(c) GDPR, legal obligations: commercial, tax and data protection records.

Do you have to provide this data?

No. There is no statutory obligation. AI replies are optional; without them, the on-device coach runs your rehearsals. Your name and the onboarding answers are voluntary; they only make the practice more personal. Voice is optional; you can always type.

Minimum age

Candor is for people aged 16 and over; see section 02 of the terms. We do not knowingly process data from children under 16. If we learn that such data has reached us, we delete it.

• Account, profile and rehearsals: until you delete your account;
• Audio: not stored or uploaded by Candor; your device's speech recognition provider may process it online, see section 04;
• Data at OpenAI: only as long as its processing and legally required abuse monitoring require, see section 03;
• Usage counters: until your account is deleted, at most as long as needed for limits;
• Security and operational logs: only as long as troubleshooting and abuse prevention require;
• Purchase status: for the term of the subscription, and afterwards as long as a restore or a tax and commercial record requires;
• Data on the device: until you reset your progress or remove the app.

You delete everything yourself, at any time: in the app under You › Settings › Delete Account & Data. That permanently deletes your account together with your profile, rehearsals and usage counters on our server, and clears the data on your device. Reset Progress in the same place only clears progress on the device. Deleting your account does not cancel a subscription; that is done in your Apple Account or Google Play settings, depending on your device.

We choose EU regions where available: our Supabase project runs in Frankfurt. OpenAI, RevenueCat and Supabase belong to US groups, and data may be processed in the United States.

Where no adequacy decision under Art. 45 GDPR applies, we base such transfers on the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR, which form part of the respective data processing agreements, together with supplementary measures such as encryption in transit and data minimisation. Where a provider is validly certified under the EU-U.S. Data Privacy Framework, we additionally rely on the corresponding adequacy decision.

A copy of the Standard Contractual Clauses and details of the sub-processors used are available on request at [email protected].

Subject to the statutory conditions you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR), and withdrawal of consent with effect for the future (Art. 7(3) GDPR).

To exercise them, write to [email protected]. If you use Candor without a connected account, we cannot link an email to your data; the fastest route is then the in-app deletion described in section 09. We never ask for a copy of an identity document.

Without prejudice to other remedies, you may lodge a complaint with a supervisory authority (Art. 77 GDPR). Ours is the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany, lfd.niedersachsen.de. You may also contact the supervisory authority of your habitual residence.

We apply risk-based technical and organisational measures under Art. 32 GDPR: TLS-encrypted transfer throughout, session tokens in secure storage on the device, row-level security in the database, AI keys held only on the server, daily usage limits and data-minimising logs. No system is entirely without risk; please also protect your device and store account.

We update this notice when features, recipients or the legal situation change. Material changes, such as a new AI provider, will be made transparent in the app before they take effect. Where a new consent is needed, we will ask for it separately.