ConnectedMe2

Privacy Policy

Last updated: October 31, 2026.

This is a translation provided for convenience. The French version is the only legally binding version and prevails in case of any discrepancy.

ConnectedMe2 is a messaging app: to deliver your messages and display your profile, we need to keep certain data on our servers, which are hosted in the European Union. This page sets out exactly which data, why, for how long, and who has access to it.

Who is responsible

The data controller is the publisher of the app, Elysio Manuel Martins, 11 rue Saint-Thibault, 77160 Provins, France (see the legal notice). Contact: [email protected].

What we use, and why

Your account

Your profile

Your username, your first name, your gender (you can choose “Prefer not to say”), and whatever you choose to add: last name (only its initial is displayed), city, photos, bio, hashtags, languages you speak (up to 5), voice intro, a link to a Spotify song (with its title and cover art). They are used to present you to other members; your age, gender and city are also used for the Discover filters of ConnectedMe2+ members. The languages you speak are suggested from the languages set on your iPhone, and you can change or remove them at any time. They are also used in Discover: everyone sees the people who share one of their languages first, and can filter by language (a filter open to all). A “Prefer not to say” gender is neither displayed nor filterable.

Your conversations

Your presence

The time of your last activity, to show “online” in Discover if you have chosen to appear there. Other members only see whether you are online, active in the last 24 hours or during the week, never the exact time.

Your settings and safety

Subscription and purchases

The status of your ConnectedMe2+ subscription, the boosts purchased and used, and the number of anonymous conversations started during the day (to apply the free limit). Payment is processed by Apple: we never see your bank details.

Referrals

Your invite code, the number of friends who joined with it and, if you used a friend's code, the link between your two accounts (shown to nobody). So that an invite works only once per person, we keep an irreversible fingerprint (SHA-256) of your Apple sign-in identifier, including after your account is deleted: it can neither identify nor contact you.

Profile verification (optional)

If you ask for the “verified profile” badge, three photos of you taken live with the app (facing the camera, head turned right, head turned left). Only the moderation team sees them, to compare them with your profile photos: they are never shown to other members. No facial recognition and no biometric data: a person compares the photos. They are deleted within an hour of the decision; we only keep the outcome (verified or not, the date and, if declined, the reason).

Verification requested by the team

If the team has serious doubts about your profile (photos that don’t seem to be yours, for example), it can ask you to get it verified. Your profile photos are then set aside: kept for 30 days and seen only by the team, for the comparison. Your stories are deleted and your profile is removed from Discover. Your photos come back as soon as your verification is approved; otherwise, they are deleted after 30 days.

Messages from the official account and proof of age

The team can write to you from the official “ConnectedMe2” account, and it reads your replies. If we have doubts about your age, it can ask you for a photo of an ID document showing your photo and your date of birth (you can hide everything else, such as the document number). It is only used to check that you are 18 or older. Only the team sees it, and it is deleted as soon as it has been checked, at the latest 7 days after you send it. We only keep the outcome. Without proof of age, the account may be suspended.

Games

Notifications

If you allow notifications, your device's token, to let you know about a new message. You can turn them off at any time in your iPhone's Settings → Notifications → ConnectedMe2.

Technical data

As with any online service, our servers briefly record technical logs (IP address, date, request), for security and troubleshooting.

Anonymous messages: what is hidden, and from whom

What other members see

Our service providers

They act on our behalf, according to our instructions, and only to make the app work.

Supabase: database, files, sign-in

Your account, profile, messages, media and stories are stored with Supabase (Supabase Pte. Ltd.), in the European Union, in Paris (eu-west-3 region, on Amazon Web Services infrastructure). If Supabase's teams need to access them from abroad for maintenance, this transfer is governed by the European Commission's standard contractual clauses.

Cloudflare: displaying photos, videos and voice messages

So that they load faster, a copy of your photos, videos and voice messages (profile, stories, conversations, groups) is kept with Cloudflare (Cloudflare, Inc., United States), in storage located in the European Union (Cloudflare R2, EU jurisdiction), from which the app downloads them. These copies are private: each one opens only with a temporary link, which the app obtains after your access rights are checked (for example, only the two participants in a conversation can open its media). They are erased at the same time as the original, within a few minutes at most. View-once photos and profile verification photos are not copied: they stay with Supabase only. If Cloudflare's teams need to access these copies from abroad, this transfer is governed by the European Commission's standard contractual clauses and/or the Data Privacy Framework.

Apple: sign-in, payments, notifications, translation

Apple provides Sign in with Apple, sells and bills subscriptions and boosts, and delivers notifications (Apple Push Notification service). Apple processes this data under its own privacy policy.

The “Translate” button (messages and bios) uses Apple's translation, on your iPhone: neither the text to be translated nor its translation is sent to ConnectedMe2 for this. Apple provides this service under its own terms and privacy policy.

RevenueCat: subscriptions and purchases

To know whether your subscription is active and to credit your boosts, the app uses RevenueCat (RevenueCat, Inc., United States), which receives a pseudonymous account identifier (not your name, your username or your email) and your purchase history sent by Apple (product, date, price, country, currency). The transfer to the United States is governed by the European Commission's standard contractual clauses and/or the Data Privacy Framework.

Expo: notifications and app updates

Notifications go through the push service of Expo (650 Industries, Inc., United States), which receives your device's token and the content of the notification: the sender's name (or their alias for an anonymous message) and the beginning of the message (or “Photo”, “Video”, “Voice message”). At launch, the app may also check with Expo whether an update to its content is available (IP address, model and version of the app). The transfer to the United States is governed by the European Commission's standard contractual clauses and/or the Data Privacy Framework.

Spotify: only if you add a song

When you paste a Spotify link into your profile, the app asks Spotify for the song's title and cover art, which is then displayed from Spotify's servers. Spotify then receives the device's IP address, but no data from your ConnectedMe2 account.

Legal bases

Retention periods

DataPeriod
Account, profile, settings, blocksUntil your account is deleted
Hidden contentUntil the content is deleted (24 hours for a story) or your account is deleted
Stories (photo or video, views, likes)Visible for 24 hours, then deleted within the following hours (files included)
Conversation messages and mediaAs long as the conversation exists: it disappears when one of the two participants deletes their account
Group messagesAs long as the group exists (7 days in the official France and English groups); they disappear when their author deletes their account
Karma details (points gained or lost)60 days; the score itself until the account is deleted
Presence (“online”)Replaced with each activity
Reports and reported itemsAs long as necessary for moderation and our legal obligations, one year at most (unless legal proceedings are ongoing)
Moves played in a game30 days
Results, ratings, trophies, daily challenge and practice gamesUntil your account is deleted
Challenges between contactsAs long as the conversation exists
Notification tokenUntil you sign out or the account is deleted
Referrals (code, link with the member who invited you)Until your account is deleted
Identifier fingerprint (referrals)As long as the referral program exists, so that an invite cannot be used twice
Profile verification photosUntil the team's decision, then deleted within an hour (one day at most for photos never sent to the team)
Verification outcome (badge, date, reason if declined)Until your account is deleted
Profile photos set aside (verification requested by the team)30 days at most; returned to your profile if your verification is approved
Photos and videos sent to the official account (including proof of age)Deleted as soon as they have been checked, at the latest 7 days after they were sent
Purchases and subscriptionFor the duration of the subscription, then the period required by our accounting obligations
Technical logsA few days

When you delete your account (Profile → Settings → Delete my account), your profile, stories, photos and conversations are erased; the files (photos, videos, voice messages, along with their copies at Cloudflare) and your record at RevenueCat are erased shortly afterward by an automated task. Only the reports, the referral fingerprint and what the law requires us to keep remain, for the period indicated above.

Security

Communications with our servers are encrypted (HTTPS) and the data is encrypted on the servers. Each file and each row of the database is only accessible to the people concerned, under rules enforced by the database itself. Messages are not end-to-end encrypted: this is what makes it possible to moderate reported content. The moderation team only opens a conversation to handle a report, to protect the safety of members (harassment, fraud, a minor) or to meet a legal obligation; each opening is logged with its reason, as is every moderation action.

Screenshots are blocked in the app, but nothing stops someone from photographing their screen with another device: only send what you would be OK with seeing passed around.

What we don't do

Adults only

ConnectedMe2 is only for people 18 and older. We do not knowingly collect data from minors: an account belonging to a minor is deleted as soon as we become aware of it. If in doubt, the team may ask you for proof of age (see above).

Your rights

You can access your data, correct it (most of it directly in the app), erase it (by deleting your account), ask for its portability, object to processing based on our legitimate interest or ask for it to be restricted. You can also set instructions on what happens to your data after your death.

Write to [email protected] and include your username. We reply within one month. If you believe your rights are not being respected, you can file a complaint with the CNIL, the French data protection authority.

Changes

If the app changes (for example a new service provider or a new type of data), this page is updated before the release of the version concerned, with its date. A significant change is also announced in the app.