Concierge
Privacy policy
In short: your data stays on your iPhone and in your iCloud. There are no ads, we don't track you and we don't sell anything to anyone. Only the few things needed for some features to work leave your phone, and you'll find them below.
Data controller
The data controller is Matteo Bulgac, who publishes the app under the name Bulgac Dev Studio. For any privacy question write to [email protected].
What stays on your iPhone
Schedule, activities, reminders, goals, journal (texts, photos, voice notes, places and mood), statistics, settings and profile photo are saved on your iPhone. We don't see them.
If you turn on iCloud backup, a copy goes to your private iCloud storage, managed by Apple. Only you can read it, with your Apple ID.
What leaves your phone, and why
| What | Where it goes | Why |
|---|---|---|
| Title, times and location of upcoming activities (the next few hours at most), plus an anonymous device code | Our server on Cloudflare (European Union and other countries, with appropriate safeguards) | To start and update live activities in the Dynamic Island and on the Lock Screen even when the app is closed (Gold). Past activities are deleted. |
| The app version | Our server on Cloudflare | To tell you when an update is needed. |
| What you choose to show your Members: name, profile photo, today's ring, streak, keys, plate; the requests and gifts you send | Concierge's public iCloud database (Apple) | The Concierge Club. In the app, only the Members you accepted can see it. The profile is stored in Apple's public iCloud database: anyone who knows your code could read it, so you choose what to show (Profile › Privacy › Your Member profile) and it's best not to share your code with strangers. |
| If you report a Member: your Club code, the reported person's Club code and name, the reason, any text you add, date and time and, if notifications are on, a device notification code | Our server on Cloudflare; a notice is sent to the studio's mailbox, run on Google Gmail. For the first automatic check, the reported profile's name and the reason also go to Anthropic (Claude) | To review the report within 24 hours and tell you the outcome. Details in the section below. |
| If you write to [email protected]: your email address and what you write | The studio's server on Cloudflare, the studio's mailbox (Google Gmail) and, to prepare the reply, Anthropic (Claude) | To reply to you. Details in the "If you write to support" section. |
| Your location, when you use weather or travel time | Apple (Weather and Maps) | To show the weather and work out when to leave. We don't store it. |
| Purchases | Apple (App Store) | Subscriptions and in-app purchases are handled by Apple: we never see your payment details. |
Reporting and blocking in the Club
To keep the Concierge Club safe you can report or block a Member (how it works is explained in the Concierge Club rules).
- What we process. When you send a report: your Club code; the reported person's Club code and name; the reason you chose; any optional text you add (up to 500 characters); date and time. If notifications are on, also a device notification code, used only to tell you the outcome. To decide, we look at the reported Member profile as it appears in the Club.
- Why. To keep the Club safe, and to meet our legal obligations and the App Store rules, which require apps with profiles visible to others to offer reporting and blocking and to act on reports within 24 hours.
- Legal basis. Our legitimate interest, shared by all Members, in a safe Club (Art. 6(1)(f) GDPR). This applies both to the person reporting and to the person reported.
- Where. On our server on Cloudflare (European Union and other countries, with appropriate safeguards). For each report an email is sent to the studio's mailbox, run on Google Gmail (Google may also process data outside the EU, with appropriate safeguards).
- Hidden profile and first check. While we check a report, the reported profile may be hidden from the Club straight away. A first automatic check, with the help of an artificial intelligence service (Anthropic, Claude), can remove clearly offensive names (photos are always checked by a person): to do this we send it the reported profile's name and the reason for the report. Anthropic uses them only for this check and does not use them to train its models. Every decision can be reviewed by a person at the studio, and you can contest it through the Contact page.
- Who sees it. Only the data controller, Matteo Bulgac, plus the artificial intelligence service for the first check. We never tell the reported person who reported them.
- How long. Up to 12 months, after which the report is deleted, along with the notice email.
- Moderated profiles. If we remove a name, a photo or a profile, it goes on a list the app reads to hide or reset that content. The list contains only the Club code and the action taken: no names, photos, reasons or reports.
- Blocking. The list of people you block stays on your iPhone: it isn't sent to us and the blocked person isn't notified. If you've turned on iCloud backup, it's included in the copy in your private iCloud, like the rest of the app's data.
If you write to support
- How it arrives. Emails sent to [email protected] are received by the studio's server on Cloudflare and end up in the studio's mailbox, run on Google Gmail.
- Automatic replies. We read them with the help of an artificial intelligence service (Anthropic, Claude), which answers common questions by itself and prepares the other replies. Automatic replies are marked as such.
- Always a person. Questions about money, refunds, deleting data, reports or legal matters are always handled by a person.
- What goes to Anthropic. The text of the email, only to prepare the reply. Anthropic does not use it to train its models and may process it outside the European Union, with appropriate safeguards.
- How long. Emails stay in the studio's mailbox for as long as needed to handle the request, up to 24 months.
- Legal basis. Answering what you ask us (Art. 6(1)(b) GDPR) and our legitimate interest in replying quickly (Art. 6(1)(f) GDPR).
Permissions the app may ask for
- Notifications: for activity, journal and quote alerts.
- Location (only while using the app): weather and travel time.
- Camera and Photos: profile photo, background and journal photos.
- Microphone: journal voice notes.
- Health: read-only access to sleep hours. Health data never leaves your iPhone and is never used for advertising.
- Face ID: to protect the app and the journal. iOS does the check: the app never receives your face.
Every permission is optional and can be turned off at any time in your iPhone Settings. Without a permission, only the related feature won't be available.
Legal basis
We process data to provide the features you ask for (performance of a contract, Art. 6(1)(b) GDPR) and, for phone permissions, with your consent, which you can withdraw at any time. Reports and moderated profiles are based on our legitimate interest in a safe Club (Art. 6(1)(f) GDPR), as explained above.
How long
- On the server: activities are deleted as soon as they're over; the anonymous device code stays as long as you use live activities.
- Reports: up to 12 months, then deleted. Moderated profiles list: as long as the action stays in place.
- Emails to support: as long as needed to handle the request, up to 24 months.
- In the Club: until you ask us to remove it. Delete all data in the app erases everything on the phone, but not your Member profile or the iCloud backup: to remove those, write to us from the Contact page and we delete them within 30 days. An in-app button will come in a future update.
- On your phone and in your iCloud: until you delete it.
What we don't do
- No ads and no tracking across apps or websites.
- No selling or sharing of your data.
- This website uses no cookies or analytics tools.
Your rights
You can ask us to access, correct or delete your data, restrict its use, receive it in a readable format or object to its processing, by writing to [email protected]. Inside the app you'll also find Delete all data, which erases the data on the phone; for your Member profile and the iCloud backup, write to us and we delete them within 30 days. If you ask for the data of a report about you, we won't tell you who made it: that's someone else's personal data. If you think your data is mishandled, you can contact the Italian data protection authority (garanteprivacy.it) or the one in your country.
Children
If you are under 16 (or the age of digital consent in your country), use the Concierge Club only with a parent's permission.
Changes
If this policy changes, we update the date at the top and, for important changes, we'll tell you in the app.