Privacy Policy

Last updated: 11 October 2026

In short

We collect what the app needs to work: your account, your username, what you post (takes, replies, contests and rebuttals), the seals you award and the reports you make.
What you post is public, shown with your username. Your email address is never shown to anyone.
Every text is checked automatically before it's published, and translated when someone reads it in another language. Both are done by OpenAI, in the United States, which receives the text but not who wrote it.
Our database and backend are in the European Union (Belgium).
We don't sell your data, show ads or use advertising identifiers.
Anonymous usage statistics (Google Analytics) are only collected if you allow them. You can change that at any time in Profile → Settings → Share usage data.
You can delete your account in the app at any time. Your profile, username and takes are deleted; your replies in other people's threads stay, without their text and shown as "Deleted".
Questions or requests: hello@opinable.app.

1. Who is responsible

Opinable is run by João Carvalho, an individual based in Portugal, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR).

For anything about your data, write to hello@opinable.app.

2. What we collect and why

We only collect what the app needs. The legal basis for each use is shown next to it.

Data	Why	Legal basis
Account: your email address, and your password if you sign up with email (held by our sign-in provider, never readable by us), and whether your email is verified. If you sign in with Google: the name, email and profile photo of your Google account. They're kept in your sign-in record only; the app doesn't show your name or photo. If you sign in with Apple: the email address Apple shares with us (your own, or a private relay address if you choose Hide My Email) and an ID for your Apple Account; we don't ask Apple for your name.	To create your account, sign you in and keep it secure.	Contract: providing the service you signed up for (Art. 6(1)(b) GDPR).
Browsing without an account: a random visitor ID, created when you open the app without signing in. It's not linked to any name or email.	So you can read takes and replies, which our database only serves to the app.	Legitimate interest in letting people try Opinable before signing up, and in keeping our database closed to scripts (Art. 6(1)(f)).
Profile: your username (chosen once, it can't be changed), the number of takes and replies you published, your reputation (the Good Points and Changed My Minds you received, and from how many different authors) and when you joined.	To show who wrote what, and your record as an arguer.	Contract.
What you post: your takes (with their category), replies, contests and rebuttals; for each one its text, the language it's written in, its translations, its dates and its status (pending, published, not published, in review or removed, with the reason). Also the seals you award as the author of a take, and those your replies receive.	To publish what you write, run the exchange (one reply, one contest, one rebuttal) and show the seals.	Contract.
Settings and app state: your app language, your phone's time zone, whether notifications are on, your answer about usage data, your Activity list (replies, contests, rebuttals and seals about you) and how many of its items are unread.	To show the app and notifications in your language, keep quiet hours in your time zone, and keep your choices on all your devices.	Contract.
Daily take limit: how many takes you posted in your current day, when it resets, how many of your takes were blocked recently and, if so, until when posting is paused.	To apply the daily take limit and the short pause after repeated blocked takes (see the Terms).	Contract, and legitimate interest in preventing abuse.
Device tokens: a token for each phone where you allow notifications, and whether it's an iPhone or an Android phone.	To send you push notifications (see Notifications).	Contract. Your phone also asks for your permission first.
Reports: what you reported, the reason, your optional note, and that you reported it. The person you report is never told who reported them.	To review reported content, and to allow one report per person per text.	Legitimate interest in keeping Opinable safe (Art. 6(1)(f)), and our legal duties as a hosting service under the EU Digital Services Act (Art. 6(1)(c)).
Moderation records: for a text that a person has to look at, a copy of it with an automatic translation and an AI note on its context (see Automatic check of texts), and a log of each decision (what was decided, why and when, without the text).	To decide on held and reported texts, and to be able to explain and review those decisions.	Legitimate interest in keeping Opinable safe, and our duties under the Digital Services Act.
Translation suggestions: if you use "Suggest a translation fix", the app text you saw, where you saw it, your suggestion and the app language. Not linked to your account.	To fix the app's own translations.	Legitimate interest in improving the app.
Usage limits: how many requests your account sent recently to each part of the service (for example replies or reports per minute).	To prevent spam and abuse.	Legitimate interest in preventing abuse.
Product statistics from our own data: daily totals (for example how many takes, replies and seals there were), and a few records with your account ID: the first and last day you replied, and markers that stop one action being counted twice. When you open someone else's take or expand an exchange, a counter on that take goes up by one, to help pick the take of the day; who read it is not stored.	To learn whether Opinable works (for example how often people come back to reply), without tracking you in the app.	Legitimate interest in understanding and improving the service.
Technical data: your IP address and a random ID for this installation of the app, sent whenever the app talks to our services. To prove requests come from the real app, the app also sends an integrity check: from Google Play on Android phones, and from Apple (App Attest or DeviceCheck) on iPhones. When the app fetches its settings (Remote Config, see Google Firebase), the request includes the app version, your phone's operating system version, language and region setting, and time zone. Our servers' logs record each request with its IP address and, when a request fails or is refused, your account ID. The Firebase components in the app also send Google technical diagnostics about how they work (for example errors and timings), not linked to your account.	To deliver the service and keep it secure.	Contract, and legitimate interest in keeping the service secure.
App usage and device data, only if you allow it: when you open the feed (and which category), open a take (its ID and where you opened it from), open the reply box and leave it without posting (only whether you had typed something, never the text), and open the app from a notification. Also what Google Analytics collects by itself: when you open the app and for how long, your phone's model, operating system version, app version, language, and approximate location (country, region and city) worked out from your IP address. Collected by Google Analytics for Firebase under a random ID for this installation of the app. Not linked to your account, username or email, and no advertising ID.	To find problems and improve the app.	Your consent (Art. 6(1)(a) GDPR). Storing and reading that random ID on your phone needs it too, under the ePrivacy rules (in Portugal, Lei 41/2004, art. 5). Without your consent, nothing is collected.

We don't sell your data, show ads, build advertising profiles or use advertising identifiers (such as Apple's IDFA or Google's advertising ID). We don't ask for your location, contacts or photos.

Usage data and your consent: the app includes Google Analytics for Firebase, and it's off until you allow it. The app asks you once ("Share usage data?"); closing the question without answering counts as no. You can change your answer at any time, just as easily, in Profile → Settings → Share usage data. When you turn it off, collection stops at once; what was collected before stays until its retention period ends (see How long we keep it). Even with your consent, Analytics collects no advertising ID and nothing is used for ads: advertising storage and signals stay off. Your answer, its date and the version of this policy you answered are kept on your phone. Your answer is also copied to your account, but each phone asks for its own: allowing on one phone never turns collection on on another. If we change what Analytics collects, we'll ask you again.

3. Automatic check of texts

Opinable is for light, friendly debate, so every text (take, reply, contest or rebuttal) is checked before anyone else can see it. Until then, only you see it, marked as pending. We rely on our legitimate interest in keeping Opinable free of personal attacks, hate and off-topic content (Art. 6(1)(f) GDPR). The check looks at the original text, never a translation, in two steps:

Safety: the text is sent to the OpenAI Moderation API, which scores it for hate, harassment, threats, sexual or violent content, self-harm and illegal activity.
Community rules: an OpenAI language model reads the text to decide whether it attacks a person or is outside Opinable's topics, as described in the Terms. It also detects the language the text is written in.

Your name, username, email and account are never sent. The outcome is one of three: the text is published; it's not published, and the app tells you why; or it's held for a person to read and decide. A text is also held when the check can't run.

A blocked text never uses up your turn: you can write the reply, contest or rebuttal again, and a blocked take gives you your daily take back. After three blocked takes within 24 hours, posting new takes is paused for 30 minutes. If you think the check got it wrong, write to us and a person will look at it again (see Reporting and moderation).

When a person has to decide on a text, an AI model also translates it for the reviewer and adds a short note on its context (for example slang, irony, or a word that means something else in another country). The same is done for texts that people report, together with the reasons chosen in the reports (never the reporters' notes or who reported).

4. Translation

Everyone writes in their own language and reads in theirs. When someone reads a published text in a language other than the one it was written in, the text is sent to an OpenAI language model to be translated into that language. The translation is stored with the text and shown to every reader of that language, with "See original". Only the text is sent, never who wrote it. Translating what you post is part of the service you sign up for (contract), and the Terms give us the licence to do it.

5. What other people can see

Opinable is a public space, so some of your data can be seen by anyone using the app:

Your username, your reputation and how many takes and replies you published.
Your published takes, replies, contests and rebuttals, with their translations, and the seals they received or that you awarded.

Your email address, settings, Activity list, reports and anything not published (pending, blocked or in review) are private: other users never see them. Only write what you're happy for anyone to read, in any language.

6. Notifications

If you allow notifications on your phone, we send push notifications only about you: replies to your take, contests and rebuttals, seals you received, and a reminder when a rebuttal deadline is close. We hold them during quiet hours (22:00 to 08:00 in your time zone) and limit how many we send. Each one also appears in your Activity list. You can turn them off in Profile → Settings → Notifications, or in your phone's settings. They're delivered by Firebase Cloud Messaging, and on iPhones through Apple's push service.

7. Services we use

Opinable relies on these providers:

Google Firebase and Google Cloud (Google Ireland Limited): sign-in (Firebase Authentication), our database (Cloud Firestore), backend code (Cloud Functions), app settings (Remote Config), push notifications (Firebase Cloud Messaging), the check that requests come from the real app (App Check, with Google Play Integrity on Android), this website (Firebase Hosting), and usage statistics, only if you allow them (Google Analytics for Firebase, see Usage data and your consent). Google acts as our processor under its data processing terms.
OpenAI (OpenAI, L.L.C., United States): the automatic check of texts and their translation (see Automatic check of texts and Translation). It receives only the texts (and, for a reported text, the reasons it was reported), never who wrote them. OpenAI acts as our processor: it doesn't use this data to train its models, we ask it not to store our requests, and it keeps abuse-monitoring logs for up to 30 days. See OpenAI's privacy policy.
Google Sign-In, if you choose "Continue with Google". Google's own privacy policy applies to your Google account. While you sign in, Google's sign-in component also sends Google your IP address, the approximate location it works out from it, and device information, linked to your Google account.
Sign in with Apple, on iPhones, if you choose "Continue with Apple". Apple's own privacy policy applies to your Apple Account.
Apple, on iPhones: push notifications are delivered through the Apple Push Notification service, and App Attest or DeviceCheck confirms that requests come from the real app. For these, Apple processes data on our behalf.

We may also share data when the law requires it, for example with a court or authority, and only to the extent required.

8. Where your data is stored

Our database and backend code run in Google Cloud data centres in the European Union (Belgium).

Texts are checked and translated by OpenAI in the United States. This transfer is covered by the Standard Contractual Clauses in OpenAI's data processing addendum.

Some Google services, including sign-in, push notifications and Google Analytics, may process data outside the European Economic Area, including in the United States. These transfers are covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Google is certified, and by the Standard Contractual Clauses in Google's data processing terms.

On iPhones, Apple may also process data for sign-in, push notifications and App Attest outside the European Economic Area, including in the United States, with the safeguards described in its privacy policy.

9. How long we keep it

Account, profile, what you post, settings and Activity: until you delete them or your account.
Texts that weren't published: a blocked take stays visible only to you until you delete it or your account. A blocked reply, contest or rebuttal is replaced when you write it again.
Visitor IDs (browsing without an account): deleted automatically 30 days after they're created.
Usage limit counters: deleted automatically once the period they count has passed.
Product statistics: the markers with your account ID are deleted automatically after 30 days, or with your account; the first and last day you replied are kept until you delete your account. Daily totals have no personal data and are kept.
Moderation records and reports: kept for as long as needed to moderate the content and handle any dispute about it. A report is deleted when the account that filed it is deleted; the moderation records about a text are deleted when its author's account is. A note you add to a report is also copied into the moderation record of the reported text, where it can stay, without your account ID, after you delete your account.
Child safety records: when the automatic check detects possible child sexual abuse or exploitation in a text, or someone reports a text for child safety, we keep a copy of the original text with its author's account ID, even after the account is deleted, for as long as the law requires and so we can pass it to the authorities.
Device tokens: until you sign out on that phone, turn off notifications for Opinable in the phone's settings, the token stops working, or you delete your account.
App usage data (Analytics, only if you allow it): deleted automatically by Google after 14 months at most.
Server logs: deleted automatically by Google Cloud after 30 days.
OpenAI: abuse-monitoring logs for up to 30 days.
Backups: we keep automatic backups of our database so we can recover from errors: one a day, kept for 7 days, and one a week, kept for 28 days. Data you delete, or that is deleted with your account, stays in these backups until they expire (28 days at most) and is used only if we have to restore the database; if we ever do, we delete again everything that was deleted after the backup was taken. The database also keeps earlier versions of data for one hour. After that, Google deletes it from its systems within the periods set in its data processing terms (up to about 180 days).

10. Deleting your account

You can delete your account at any time in the app: Profile → Settings → Delete account. For your security, you may be asked to sign in again. You can also delete a take that wasn't published.

If you no longer have the app, write to hello@opinable.app from the email address of your account (or tell us your username) and ask us to delete it. We'll confirm it's you and delete it in the same way within one month.

Opinable's debates are conversations between several people, so deleting your account removes what's yours without breaking other people's threads:

Deleted: your sign-in account and email, your profile, settings, device tokens and Activity list, your username (which becomes free for others), your takes, your replies, contests and rebuttals that weren't published, the reports you made (a note you added to one can stay in the moderation record of the reported text, without your account ID), and the moderation records about your texts. If you signed in with Apple, we also ask Apple to remove Opinable's access to your Apple Account.
Kept without their text: your published replies, contests and rebuttals stay in place in other people's threads, so the conversation still makes sense, but their text and translations are deleted and they show "Deleted" instead of your username, with a note that the author deleted their account.
Kept as counts: the seals your replies received and the seals you awarded stay as numbers, so other people's reputation doesn't change. These counts don't contain your name, email or any text.
Kept for legal reasons: a copy of any text of yours that was detected or reported for child safety (see How long we keep it).

After that, nothing left on Opinable shows your username or your words. Be aware that someone may have read or copied what you posted before you deleted it.

11. Your rights

Under the GDPR you have the right to:

Access your personal data and get a copy of it.
Rectification: have wrong data corrected.
Erasure: have your data deleted (you can also do this yourself in the app).
Restriction of how we use your data in some cases.
Object to uses based on our legitimate interests.
Portability: receive the data you gave us in a common, machine-readable format.
Withdraw your consent to usage data at any time, in Profile → Settings → Share usage data. This doesn't affect what was collected before you withdrew it.
Ask a person to review a decision made by the automatic check of texts, and give your point of view.

To use any of these rights, write to hello@opinable.app from the email address of your account. We'll answer within one month. We may ask you to confirm it's you before acting.

If you think we've handled your data unlawfully, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority in the EU country where you live or work. We'd appreciate the chance to sort it out with you first.

12. Children

Opinable is not meant for children. You must be at least 16 to create an account. If you believe a child under 16 has created an account, write to us and we'll delete it.

13. Security

Data is encrypted in transit and at rest. Access is limited by security rules: only you can read your private data, and everything you post, seals, reports and usernames can only be written through our backend, which checks them. Requests must come from the real app. Deleting your account requires a recent sign-in. No system is perfectly secure; if a breach affects your data, we'll act as the GDPR requires, including telling you when it's likely to put you at high risk.

14. This website

opinable.app sets no cookies, has no trackers and loads nothing from other websites. It's served by Firebase Hosting, which processes your IP address to deliver the pages.

15. Changes to this policy

When Opinable changes what it collects or how, we'll update this page and the date at the top. For significant changes, we'll also tell you in the app before they apply.