What you type, and where it lives

Everything you type into Ciao! belongs to you: the names of your friends, how often you want to be in touch, when you last talked, birthdays, phone numbers, your notes and reminders, and your own first name.

It is stored on your iPhone and, if you are signed into iCloud, in your own iCloud too, so it is not lost with your phone. A new iPhone signed into the same iCloud gets it all back.

That copy sits in your own iCloud, in your Apple Account, and we cannot read it. If you are not signed into iCloud, the app works the same way, using only your iPhone.

Meetups are the one exception. The part about them, below, says what leaves your phone.

Contacts

If you add friends from Contacts, iOS asks you first. Ciao! then shows your contacts on your phone so you can pick, and saves only the name, birthday and phone number of the people you tick. Nobody else is saved, and nothing is sent to us. You can turn this off in iOS Settings, under Ciao!.

Meetups

You can plan a meetup in Ciao! and send a link to the people you want to see. They tell you which days they are free, on a web page or in Ciao!. Nobody needs an account to answer.

For this, a copy of the meetup is saved in Ciao!’s shared space in Apple’s iCloud, not in your private iCloud. Before it leaves your phone, Ciao! locks the days, the hours, the names of the people you invited and the day you pick. The key that opens them is in the link you send, after the “#”, and that part of a link never reaches a server. Without the link, nobody can read them, us included.

Two things are not locked: the name of the meetup and your first name. That is so a chat app can show “Simone is planning Christmas dinner” when you paste the link. Anyone with the link can see these two. So can the chat app, and so can we.

Each answer is locked on the guest’s phone or in their browser, with a key only you have. It says who is answering (a name from your list, or the name they typed) and which days work for them. It goes through a small function on getciao.app, which saves it, still locked, next to the meetup. The function keeps no copy and never logs what is in it. Only you can open the answers, in Ciao!. Guests never see each other’s answers.

So that Ciao! can tell you when someone answers, or when the host picks the day, the function also keeps your iPhone’s push address with the meetup. That is a code Apple gives each app on each phone so it can get notifications. It is not your name or your number, and it says nothing about your answer. It is deleted with the meetup.

Your own copy, with the answers you have read, is in your private iCloud, like your friends. If a guest answers in Ciao!, the invite and their answer are in their own private iCloud.

A meetup is deleted 30 days after its day, or after the last day it asks about, and at most 180 days after it was made. If you delete it in Ciao!, the link stops working at once.

If you answer on the web page, your browser keeps your answer to that meetup (who you are and your days), so you can change it later. It stays in your browser. The page sets no cookies and counts no visits. It loads its fonts from Google Fonts, so Google sees your IP address, and Vercel, which hosts the page, sees it too.

Plans and purchases

You pay through Apple, so we never see your card. To know which plan you have, Ciao! uses RevenueCat, a service for in-app purchases. RevenueCat gets your Ciao! purchases from Apple, whether you can have the free week, which plans you were shown, a random ID it makes for this install, and basic facts like the app version, iOS version and your App Store country. While Share usage data is on, it also gets which version of the first screens you saw: we are trying a long one and a short one.

It never gets your friends, your notes or anything you type. Plans cannot work without it, so the Share usage data switch does not turn it off.

Seeing how the app is used

Ciao! uses Mixpanel, an analytics service, to see which parts of the app people use and where they get stuck, so the app can get better. Each install gets a random ID that Mixpanel makes up. The app sends which screens you open and what you do there, only as numbers, yes or no, and words from a fixed list. For example: that you logged a talk with a friend (where in the app, and whether it was today, yesterday or earlier), added, changed or deleted a friend, saved a note, set or moved a reminder, opened a notification or a widget, or answered a permission question. It also sends small facts such as how many friends you have, how often a friend should come up, and which animal and colour you picked. During setup it sends which setup screens you saw, which version of setup you got (a long one or a short one, as a test) and, if you answer the setup questions, the option you tapped. On the plans screen, it sends which plan you looked at, picked, bought or restored, and whether it worked. Later, it sends when your plan changes: your free week turns into a paid plan, you turn off renewal, or the plan ends. Mixpanel also adds basic facts about the phone (app version, iOS version, model). Every event also says which language the app is showing. When you open the app, it says whether the app closed normally the last time, so we can spot crashes. It also sends how many of Ciao!’s notifications reached your phone since then, and of which kind (a birthday, a reminder, the Sunday note), never what they said. It never sends your name, email or phone number, your Apple Account or payment details, your advertising ID, your contacts, your friends’ names, numbers or birthdays, your notes, or anything you type.

This data is kept on Mixpanel’s servers in the EU. Mixpanel uses your connection’s IP address to guess your country and city, then throws the IP address away. None of it is used for ads, shared with advertisers or linked to who you are. It is on by default. To stop it, turn off Share usage data in Ciao!’s Settings. That switch covers Mixpanel, and the setup version RevenueCat gets.

Counting installs from our ads

Ciao! includes Meta’s software kit for one reason: to know how many people install Ciao! after seeing one of our ads on Instagram or Facebook. When you open the app, the kit tells Meta “the app was opened”, with basic facts about the phone (model, iOS version, language, time zone) and a random ID the kit makes up. It never sends your friends, your notes or anything you type. It does not read your advertising ID, and Ciao! never asks to track you. The Share usage data switch does not turn this off.

We also run ads in App Store search. If you install Ciao! after tapping one of them, Apple tells RevenueCat which ad it was: the campaign and the search words. RevenueCat keeps that with the random ID it made for this install, so we can see which ads bring people who try Ciao!. Apple sends this without your advertising ID, so here too Ciao! never asks to track you. The Share usage data switch does not turn this off. Ciao! also asks Apple this once, itself, and sends Mixpanel the answer as numbers: whether one of these ads brought the install and, if so, the ID numbers of the campaign, the ad group and the search words. The Share usage data switch does turn this one off.

Contact support

If you write to us from Settings, under Contact support, your message and the email address you type are sent to the founder, with the app version, iOS version and app language. A small function on getciao.app passes them to a private Slack channel, and the website keeps no copy. Your email is only used to reply.

This website

This website counts visits with Vercel Web Analytics. Vercel is the company that hosts it. It sees which page you opened, which site sent you, your country, and what kind of device and browser you use. It sets no cookies, keeps nothing that says who you are, and does not follow you to other sites.

When you tap a “Get Ciao!” App Store button, the page also counts that tap with PostHog, on servers in the EU. The count says which page you were on, its language, where on the page the button was, and which message the page is testing. It sets no cookies, stores nothing in your browser, carries no ID, and PostHog does not keep your IP address for it.

The App Store buttons on this site tell Apple which page you tapped them on. Apple then shows us how many downloads each page brought, only as totals.

Notifications

Almost every note is written and scheduled on your own iPhone. Meetups are the exception. When someone answers yours, or the host picks a day for one you answered, the small function on getciao.app sends your iPhone a push, through Apple’s push service. The push carries the name of the meetup, the host’s first name and locked data, nothing else. Ciao! opens it on your iPhone and writes the note there.

Deleting your data

Delete the app. To delete the copy in your iCloud too, open iOS Settings, tap your name, then iCloud, find Ciao! in your iCloud storage and delete its data. There is no account to close.

To take a meetup away before its 30 days are up, delete it in Ciao!.

Ciao! gives RevenueCat, Mixpanel and Meta only random IDs, never your name. If you have a question about the data they hold, write to us.

Privacy policy