Privacy Policy
Effective date: October 4, 2026
Capipi is a self-care app with a baby capybara who grows as you take care of yourself. We built it to be gentle, and we want to be just as clear about your data. This policy explains what we collect, why, who helps us run the app, and how you stay in control.
This policy applies to the Capipi iPhone app and to the website capipi.com.
1. Who we are
Capipi is developed and run by Cristiano Soares de Moraes, an individual (pessoa física) based in São Paulo, Brazil. He is the controller of your personal data under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) and, where it applies, the EU General Data Protection Regulation (GDPR). In this policy, "we", "us" and "our" mean him.
Privacy contact: crismoraes.work@gmail.com. The controller personally handles all privacy requests and acts as the point of contact for data subjects and the Brazilian data protection authority (ANPD).
2. The short version
- Your account is created anonymously. You don't need an email to use Capipi.
- No ads. No tracking SDKs. No analytics. We don't follow you across other apps or websites.
- We never sell your data, and we don't share it for advertising.
- Reminders are local notifications scheduled on your phone. We don't use push tokens.
- Your answers about support areas (like sleep or stress) may be health-related. Those questions are optional, and we use your answers only with your consent.
- You can delete your account and all your cloud data right inside the app.
3. What data we collect and why
3.1 Your account
When you open Capipi for the first time, an anonymous account is created automatically (using Supabase Auth). It's identified by a random ID, not by your name or email.
- Why: to save your Capipi and your progress, and to let your Capipi come back if you change phones.
3.2 Your Capipi and profile
- Your friend code
- Your Capipi's name, the pronouns and personality trait you picked, and the flower your Capipi was born from
- Your name, if you choose to give one (optional)
Why: to create your Capipi, show it in the app, and let friends recognize you.
3.3 Your onboarding answers
When you set up Capipi, we ask a few questions to tailor the experience:
- Your energy level
- Your support areas, for example sleep, stress and anxiety, eating, self-esteem, focus or physical activity
- Whether you want reminders, and at what times
- How you heard about Capipi
Why: to suggest goals and a tone that fit you, to set up your reminders, and, for "how you heard about us", to understand how people find the app.
About support areas: these answers may reveal something about your health or well-being, so we treat them as sensitive personal data (LGPD art. 11; GDPR art. 9). Answering is optional. If you answer, you're giving us your consent to store and use them for the purpose above. You can withdraw that consent at any time (see section 10).
3.4 Your game progress
- Your goals for the day, your oranges 🍊, the items you own, and in-app statistics
Why: this is the game itself. Without it, your Capipi couldn't grow or remember what you've done.
3.5 Friends
- Your friends list (the friend codes you're connected to)
Why: to show your friends' bushes in the swamp. See section 7 for what friends can see.
3.6 Email (optional)
If you choose Menu → Save my Capipi and link an email, we store your email address.
Why: only to let you sign in and recover your Capipi on another phone. Sign-in works with a one-time code sent by email. There's no password. We don't send newsletters or marketing to this address.
3.6a Sign in with Apple (optional)
If you choose Continue with Apple, Apple shares with us a unique identifier for your Apple Account and an email address. You can let Apple hide your real email, in which case we receive a private relay address from Apple. We don't ask Apple for your name.
Why: only to let you sign in and recover your Capipi on another iPhone. We don't send marketing to this address.
3.7 Language
Your app language is stored in your account metadata.
Why: so that sign-in emails reach you in the right language.
3.8 Subscription status
If you subscribe to Capipi Plus, payment is handled entirely by Apple. We never see your card or payment details. RevenueCat tells the app whether your subscription is active, using your anonymous account ID. It receives the subscription and purchase information that Apple provides, such as the product, trial and renewal dates, and transaction identifiers.
Why: to unlock Plus benefits and keep them working, including when you restore purchases.
3.9 Messages you send us
If you email us, we receive your email address and whatever you choose to write.
Why: to answer you and handle your request.
3.10 Technical data
Like any online service, the servers that run Capipi and capipi.com may process basic technical data, such as your IP address and request details, when your phone or browser connects to them.
Why: to deliver the service and keep it secure. We don't use this data to profile you.
3.11 Data stored on your phone
Your Capipi and progress are also saved on your device, so the app works smoothly and offline.
4. Legal bases
| What we do | LGPD (Brazil) | GDPR (EU) |
|---|---|---|
| Run your account, Capipi, game progress, friends, reminder settings, language and email sign-in | Performance of a contract (art. 7, V) | Performance of a contract (art. 6(1)(b)) |
| Use your support-area answers to personalize the app | Specific, highlighted consent (art. 11, I) | Explicit consent (art. 9(2)(a) and art. 6(1)(a)) |
| Check your Capipi Plus subscription | Performance of a contract (art. 7, V) | Performance of a contract (art. 6(1)(b)) |
| Learn how people heard about Capipi; keep the service secure | Legitimate interest (art. 7, IX) | Legitimate interest (art. 6(1)(f)) |
| Answer your messages and privacy requests | Performance of a contract and compliance with legal obligations (art. 7, V and II) | Performance of a contract and legal obligation (art. 6(1)(b) and (c)) |
| Keep or disclose data when required by law or to defend rights | Legal obligation; exercise of rights in legal proceedings (art. 7, II and VI) | Legal obligation; legitimate interest (art. 6(1)(c) and (f)) |
5. Who helps us run Capipi (processors)
We use a small number of service providers. They process data on our behalf and only to provide their service to us:
- Supabase: account authentication and the cloud database where your data is stored. Servers in the United States (AWS region us-east-1).
- RevenueCat: subscription status for Capipi Plus, linked to your anonymous account ID.
- Apple: App Store distribution, payment processing for subscriptions and, if you use it, Sign in with Apple. Apple acts under its own privacy policy for your Apple Account and purchases.
- Resend: sends the emails that contain your sign-in code.
- Vercel: hosts the website capipi.com.
- Google (Gmail): our contact address currently runs on Gmail, so emails you send us are stored there.
We don't sell, rent or share your personal data with anyone for advertising. We only disclose data beyond these providers when the law requires it, for example in response to a valid order from a competent authority.
6. International transfers
Our main servers are in the United States, and some of our providers are based outside Brazil and outside the European Economic Area. This means your data is transferred internationally.
We make these transfers only as allowed by LGPD (art. 33) and GDPR (Chapter V), relying on the safeguards these providers offer in their data processing terms, such as standard contractual clauses, and on the other mechanisms the law provides. You can contact us to learn more about the safeguards that apply.
7. What your friends can see
Each person has a friend code. Anyone who has your code can use it to connect with you. Friends see only:
- your Capipi's name,
- your name, if you added one,
- your Capipi's flower, and
- your friend code.
Friends don't see your goals, your onboarding answers, your support areas, your email or your subscription. Share your code only with people you want in your swamp.
8. Notifications
Morning and evening reminders, and the reminder that your free trial is about to end, are local notifications. They are scheduled on your iPhone and never go through our servers. We don't collect push tokens. You can change or turn off reminders in Menu → Notifications, or block them in your iPhone Settings.
9. How long we keep data
- Account, Capipi, game, friends and email: for as long as your account exists. When you delete your account, they are deleted from our cloud: profile, game and friendships.
- Backups: deleted data may remain for a limited time in our provider's routine backups until they are overwritten.
- Subscription records: Apple and RevenueCat keep records of purchases under their own policies, including tax and accounting rules. In RevenueCat, these records are linked only to an anonymous ID. If you'd like us to ask RevenueCat to delete the records linked to your account, email us.
- Emails you send us: for as long as needed to handle your request, and afterwards only if needed to show we handled it or to meet a legal obligation.
- Data on your phone: stays on your device until you delete your account in the app or delete the app.
10. Your rights
Under LGPD (art. 18) and, where applicable, GDPR (arts. 15 to 22), you can:
- Confirm whether we process your data, and access it
- Correct incomplete, inaccurate or outdated data
- Delete your data, or ask for data that is unnecessary or excessive to be anonymized or blocked
- Port your data to another service
- Withdraw consent at any time, for example for your support-area answers. Withdrawing doesn't affect processing that already happened. The only consequence is that the app won't use those answers to tailor your experience.
- Object to processing based on legitimate interest, and ask us to restrict processing (GDPR)
- Get information about who we share data with, and about what happens if you don't consent
- Complain to a data protection authority: in Brazil, the ANPD (Autoridade Nacional de Proteção de Dados, gov.br/anpd); in the EU, the supervisory authority of the country where you live or work
Some settings, such as reminders and language, can be changed directly in the app. For anything else, email crismoraes.work@gmail.com. To help us find your account, write from the email linked to it, or include your friend code. We may ask for information to confirm that the request really comes from you. We'll respond within the deadlines set by law (LGPD: up to 15 days for a full response; GDPR: up to one month).
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
11. How to delete your account
In the app: go to Menu → Save my Capipi → Delete my account, then confirm. This deletes your Capipi, goals, friends and oranges from our cloud and from your phone. It can't be undone.
By email: write to crismoraes.work@gmail.com with the subject "Delete my account" and include your friend code or write from your linked email.
Important: deleting your account doesn't cancel a Capipi Plus subscription, because Apple handles billing. Cancel it in your iPhone Settings → [your name] → Subscriptions.
12. Children
Capipi is not directed to children under 13, and we don't knowingly collect data from them. If you believe a child under 13 has used Capipi, contact us and we'll delete the account.
If you're under 18 in Brazil, or under the age of digital consent in your country (up to 16 in some EU countries), please use Capipi with the knowledge and permission of a parent or guardian, especially before answering the optional support-area questions. Any processing of teenagers' data is done in their best interest (LGPD art. 14).
13. Security
We use encrypted connections (HTTPS) between the app and our servers, we rely on the security measures of established providers, and we limit access to the data to what's needed to run Capipi. No system is perfectly secure, though. If a security incident could create relevant risk or harm to you, we'll notify you and the competent authorities as required by law.
14. The website capipi.com
capipi.com is hosted by Vercel. It doesn't use tracking cookies or analytics. As with any website, the hosting provider may process technical data, such as your IP address, to deliver the pages and protect against abuse.
15. Changes to this policy
If we change this policy, we'll publish the new version here with a new effective date. If the changes are significant, for example a new use of your data or a new type of data, we'll also tell you in the app, and we'll ask for your consent again where the law requires it.
16. Contact
Cristiano Soares de Moraes, São Paulo, Brazil Email: crismoraes.work@gmail.com
Uí uí! Thank you for trusting Capipi. 💛