Privacy Policy

Welcome to Connecto ("we," "us," or "our"). We operate the website at https://getconnecto.app and the Connecto mobile application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using our Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

1. Information We Collect

We collect the following categories of personal information:

1.1 Information You Provide

• Account Information: Name, email address, and profile photo when you create an account. We do not use passwords: you sign in with a one-time link sent to your email, or with Google or Apple (see Section 1.8).
• Profile Information: What you choose to add to your profile, such as a headline, bio, skills, work experience (job title and company), education, links and social profiles (such as LinkedIn), and contact details such as a phone number you choose to show.
• Registration Answers: Your answers to an event's registration form. The event organizer decides which questions the form asks.
• User-Generated Content: Photos, files, notes, and other content you add to the Service.
• Event-Related Data: Event registrations, check-ins, attendance records, your role at an event, and participation history.

1.2 Information Collected Automatically

• Device Information: Device type, operating system, app version, and, if you allow notifications, a push notification token.
• Log Data: IP address, browser type, pages visited, time spent on pages, and access times.
• App Usage Data: How you interact with the app, including features used, screens viewed, and session duration.
• Location Data: If you allow it, your precise location while you are using the app, to show nearby people and events and to make your profile discoverable to people near you. Other users see only an approximate distance, never your exact location. We also derive an approximate location from your IP address. The app does not collect your location in the background.
• Bluetooth Proximity Data: If you turn on discovery, which nearby Connecto users your device detected over Bluetooth and how strong the signal was (see Section 1.4).
• Cookies and Similar Technologies: See Section 7.

1.3 Information from Mobile App

Our mobile application asks for access to the following only when you first use a feature that needs it:

• Camera: For profile photos and QR code scanning.
• Photos: To choose a profile picture or an image you want to share.
• Location (while using the app): To show nearby people and events and to make you discoverable to people near you.
• Bluetooth: To discover people near you at events and make you discoverable to them (see Section 1.4).
• Push Notifications: To send you event updates.
• Calendar (add only): To add an event you choose to your calendar. The app never reads your calendar.

You can withdraw any of these permissions at any time in your device settings.

1.4 Bluetooth Proximity

When discovery is on and the Connecto app is open on your screen, your device broadcasts an anonymous identifier over Bluetooth so that other Connecto users nearby can detect you, and it listens for theirs. The identifier is a random code issued by our servers that changes regularly (about every 15 minutes). It contains no name, email address, phone number, or account ID, and only our servers can match it to an account. We use the signal strength to estimate how close someone is, and we show you a nearby person only as their and your visibility settings allow.

The app does not broadcast or scan when it is in the background or when discovery is off. You can turn discovery off in Settings at any time, or deny the Bluetooth permission.

1.5 Smart Matching and AI Icebreakers

• Smart Matching: To suggest people worth meeting at an event, we process your profile information (headline, bio, skills, experience, and education) and the event you are attending, and rank nearby attendees. A reason shown to another user is built only from information already visible on your profile.
• AI Icebreakers: To suggest conversation openers, and to read the skills and interests in your profile, we send profile text to an AI model provided by OpenAI, through Cloudflare's AI Gateway. Your contact details (email address and phone number) are never sent. Under OpenAI's API terms, data we send is not used to train its models and may be retained by OpenAI for up to 30 days for abuse monitoring.

1.6 Notes and Action Items

Notes and action items you write in the app, and contacts you save, are stored on our servers so they are available on all your devices. They are private to you: they are never shown to the person they are about, to event organizers, or to other users. They are deleted when you delete them or delete your account.

1.7 Your QR Badge

Your badge in the app shows a QR code that holds only the link to your public profile (https://getconnecto.app/u/your-username). Anyone who scans it sees your public profile. An event organizer can scan it to check you in to their event, which records your check-in for that event.

1.8 Sign in with Google and Apple

• Google: Your name, email address, profile photo, and Google account ID.
• Apple: Your Apple account ID, and the name and email address you choose to share. If you choose Apple's "Hide My Email," we receive a private relay address that forwards to your real address, which we never see.

We never receive your Google or Apple password.

1.9 Finding People by Description

Event organizers can search the people on their own lists by description, for example "the robotics sponsor". To make this work, we send text to Google's Gemini embedding model, which turns it into a list of numbers we store (an "embedding"). The text is what the organizer's team can already see about a person on their list (name, organization, answers to the event's questions, tags and attendance) and, if you have a Connecto account, the sections of your profile that you made public. Your email address and phone number are never sent, and private profile sections are never sent. Only people with access to the organizer's list can search it, and answers marked restricted (such as dietary or accessibility needs) can only be found by team members allowed to see them. When a record is deleted or a section is made private, its embedding is removed or cleared at once. Under Google's paid API terms, the text we send is not used to improve Google's products and is kept only to detect abuse.

2. How We Use Your Information

We use your personal information for the following purposes:

• Providing the Service: To create and manage your account, process event registrations, check you in to events, and enable networking features.
• Proximity and Matching: To show you people nearby, suggest people worth meeting, and suggest conversation openers, as described in Sections 1.4 and 1.5.
• Communications: To send service-related communications (confirmations, updates, security alerts) and, with your consent, marketing and promotional messages.
• Personalization: To personalize your experience and provide content and features relevant to your interests.
• Networking Features: To display your profile to other event attendees and facilitate connections between users.
• Analytics: To analyze usage patterns, improve our Service, and develop new features.
• Security: To detect, prevent, and address fraud, abuse, and security issues.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

3. How We Share Your Information

We may share your personal information with the following parties:

3.1 Service Providers

• Cloud and Hosting Providers: To store and process data: Cloudflare (our servers, file storage, and network), Neon (our database), Upstash (cache and sign-in links), and Vercel (our website).
• AI Providers: OpenAI, for smart matching and icebreakers (see Section 1.5). Event organizers' AI assistant uses Anthropic, OpenAI, or Google, and may process event and attendee information an organizer works with. Google, to let organizers find people by description (see Section 1.9).
• Analytics Services: PostHog, to analyze usage and improve our Service (see Section 7).
• Crash Reporting: Sentry, to find and fix crashes and errors.
• Communication Services: Resend, to send emails; Expo, to deliver push notifications through Apple and Google.
• Maps: Mapbox and Google Maps, to show event venues on a map.
• Authentication Providers: Google and Apple, to enable sign-in with those accounts.

3.2 Event Organizers

When you register for an event, we share your registration information with the organization hosting the event. This may include your name, email, profile information, registration answers, and attendance data. Organizers can see their event's attendee list, check attendees in by scanning their QR badge, and keep notes about the people at their event that only the event's organizing team can see. Event organizers may use this information in accordance with their own privacy policies.

3.3 Other Users

When you join an event, your profile appears on that event's attendee list, where other attendees and the organizer can see it. Your profile and event participation may also be visible to other users of the Service to facilitate networking. You can control certain visibility settings in your account.

3.4 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect our rights, privacy, safety, or property.

3.5 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

3.6 No Advertising or Sale

We do not sell your personal information, and we do not share it with advertisers, advertising networks, or data brokers.

4. Data Retention

We retain your personal information as follows:

• Active Accounts: We retain your information for as long as your account is active or as needed to provide you the Service.
• Notes and Action Items: Until you delete them or delete your account.
• Account Deletion: When you delete your account, we will delete or anonymize your personal information within 30 days, except as required for legal compliance.
• Analytics Data: Aggregated and anonymized analytics data may be retained indefinitely.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit using TLS/HTTPS.
• Encryption of data at rest.
• Passwordless sign-in, so there is no password of yours for us to store or lose.
• Access controls limiting who can reach personal data.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. International Data Transfers

Our servers are located in the United States. If you access our Service from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland: We transfer personal data to the United States and other countries using appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data processing agreements with our service providers that ensure adequate protection.

We use Cloudflare for edge computing, which means your data may be processed at edge locations globally to improve performance.

7. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Essential Cookies: Required for the Service to function (authentication, security, load balancing).
• Functional Cookies: Remember your preferences and settings.
• Analytics Cookies: Help us understand how users interact with our Service.

First-Party Analytics: We use PostHog for product analytics in the website and the app. It runs through our own server, so your browser and app send analytics to our domain, and PostHog processes the data only as our service provider. We do not share analytics data with third parties for advertising. Our website also uses Ahrefs for cookieless, aggregate traffic counts.

Your Choices: You can manage cookies through your browser settings, and turn off product analytics at any time from Settings → Account → Privacy ("Share usage analytics"). Note that disabling essential cookies may affect the functionality of our Service. For the mobile app, you can adjust settings in your device's privacy settings.

8. Mobile App Privacy (App Store & Play Store)

This section provides additional disclosures required by Apple App Store and Google Play Store policies.

8.1 No Tracking or Advertising

We do not track you across other companies' apps or websites. The app does not show ads and does not collect the advertising identifier (IDFA on iOS, Google Advertising ID on Android), so it never asks for App Tracking Transparency permission.

8.2 Apple App Store - Data Collection Summary

In accordance with Apple's App Store requirements, here is a summary of the data our iOS app collects:

8.3 Google Play Store - Data Safety

In accordance with Google Play's Data Safety requirements, here is information about our data practices:

• Data Collected: Personal info (name, email, phone), location, photos, notes, app activity, and app diagnostics.
• Data Shared: We share data with the organizers of events you join and with the service providers described in Section 3. We do not share data with advertisers or data brokers.
• Data Encrypted: Yes, data is encrypted in transit and at rest.
• Data Deletion: You can request deletion of your data. See Section 8.4 below.
• Families: Our app is not directed at children under 13.

8.4 Account and Data Deletion

Both Apple and Google require that we provide a way for you to delete your account and data. You have the following options:

• In-App Deletion: Go to Settings > Account > Delete Account in the mobile app. This will initiate deletion of your account and associated data.
• Web Deletion: Log in to your account at https://getconnecto.app, go to Account Settings, and select "Delete Account."
• Email Request: Send an email to connecto@ibyo.com with the subject "Account Deletion Request" from the email address associated with your account.

What happens when you delete your account:

• Your profile, event registrations, notes, action items, and user-generated content will be deleted within 30 days.
• Anonymized analytics data may be retained.
• Data already shared with event organizers is subject to their privacy policies.
• You will receive an email confirmation when your account is deleted.

8.5 Third-Party SDKs

Our mobile apps integrate the following third-party software development kits (SDKs):

• Analytics SDKs: PostHog - collects usage data and device information for product analytics, sent through our own server.
• Crash Reporting SDKs: Sentry - collects crash logs and device diagnostics, linked to your account ID so we can fix problems you run into.
• Authentication SDKs: Google Sign-In, Sign in with Apple - handle sign-in with those accounts.
• Push Notification SDKs: Expo Notifications, which delivers through Apple Push Notification service and Google's Firebase Cloud Messaging - collects a device push token.
• Maps SDKs: Google Maps (Android) - shows event venues on a map.

Each SDK provider has its own privacy policy governing their data collection and use.

Our website uses PostHog for product analytics and Ahrefs for privacy-friendly, cookieless web analytics. You can turn off product analytics for your browser at any time from Settings → Account → Privacy ("Share usage analytics").

9. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at connecto@ibyo.com. If we discover that we have collected personal information from a child under 13, we will delete that information promptly.

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

10.1 General Rights

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information.
• Portability: Request a copy of your data in a portable format.
• Objection: Object to certain processing of your information.
• Restriction: Request restriction of processing in certain circumstances.
• Withdraw Consent: Withdraw consent where processing is based on consent.

10.2 For European Users (GDPR)

If you are in the EEA, UK, or Switzerland, you have rights under the General Data Protection Regulation (GDPR), including those listed above. Our legal bases for processing your data include:

• Performance of our contract with you (providing the Service).
• Your consent (for marketing communications, location, and Bluetooth discovery).
• Our legitimate interests (security, fraud prevention, analytics).
• Legal obligations.

You also have the right to lodge a complaint with your local data protection authority.

10.3 For California Residents (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request information about the categories and specific pieces of personal information we collect, use, and disclose.
• Right to Delete: Request deletion of your personal information.
• Right to Correct: Request correction of inaccurate information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

We do not sell or share your personal information, as those terms are defined in the CCPA, including for cross-context behavioral advertising.

California Shine the Light: California residents may request information about disclosure of personal information to third parties for direct marketing purposes by contacting us at connecto@ibyo.com.

10.4 For Users in Other Jurisdictions

Users in Brazil (LGPD), Canada (PIPEDA), Australia, and other jurisdictions with privacy laws may have similar rights. Please contact us to exercise your rights.

10.5 How to Exercise Your Rights

You can exercise your privacy rights by:

• In-App Settings: Access, correct, or delete your information through your account settings. You can delete your account directly in the app.
• Email Request: Contact us at connecto@ibyo.com with your request.

We will respond to your request within 30 days. We may need to verify your identity before processing your request.

11. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you by email as soon as reasonably practicable. Where required by law (such as GDPR), we will also notify the relevant supervisory authorities within 72 hours of becoming aware of the breach.

12. Third-Party Links

Our Service may contain links to third-party websites, apps, or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date.
• Sending an email notification to registered users.
• Displaying a prominent notice in our Service.

Your continued use of the Service after such changes constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

We will respond to your inquiry within 30 days.