Nekuvo · iPhone · Private beta
Nekuvo app privacy
This page explains the information used by the current Nekuvo private beta and the choices available to you.
Controller
Nekuvo is published by Jonathan Benay, a French sole trader operating as Hangeul Studio, SIREN 993 713 460, 61 rue de Lyon, 75012 Paris, France.
General questions: support@nekuvo.com
Privacy questions: privacy@nekuvo.com
Information used
- Account and profile: technical Sign in with Apple identity, internal ID, username, chosen name, kitten, preferences and account state.
- Conversations: encrypted text, private photos, expressions, backgrounds, scenes, replies, reactions and receipts. The service also stores participants, identifiers, dates and technical information needed for delivery.
- Message protection: device public keys, activation state and an encrypted backup. Your recovery code and private keys are not sent to the server in plain text.
- Connections and safety: invitations and contact requests, blocks, evidence you choose to report, related decisions and appeals.
- Device and service: session, random installation ID per account and environment, generic device model, iOS/app versions, last technical activity, notification token and preference.
- Purchases: Apple product and transaction identifiers, account-binding token, dates, refund state and associated entitlements. The signed receipt is verified to deliver content; it is not stored in the purchase ledger.
- Age and country: you select your country of residence. On compatible devices, you can share an age range through Apple; when the service permits, a declaration in Nekuvo is also available. Only a range leaves the app, with its source and the information needed to check access, including any communication limits supplied by Apple. Apple sign-in does not automatically reveal your age. A declaration is neither identity verification nor parental authorization. The server applies age and country restrictions and, where necessary, requires parental authorization before access to conversations.
- Support: your email address and the information you choose to provide when contacting us.
- Optional usage statistics: in supported versions, confirmed adult accounts see an optional choice in the Discussions home screen, with Accept and Decline. Declining leaves every feature available. The choice is saved for that account on this device and can be changed in Me → Privacy. Firebase Analytics receives screens visited, book creation and exports, kitten changes, sessions and technical data with an app instance identifier. The SDK may also measure purchases and approximate network-derived location. No messages, photos, usernames, Nekuvo account IDs or themes inferred from chats. No advertising use. Withdrawing consent stops collection and clears local Analytics data; it does not automatically delete events already received by Google.
- Beta diagnostics: the private beta enables fatal-crash reporting through Crashlytics without an in-app switch. Firebase may receive its installation identifiers, the crash stack, app/iOS version and technical device characteristics. Nekuvo adds no account identifier or conversation content.
The app does not ask Apple for your name or email address for authentication. If you email support, your email provider sends the address and information you choose to include.
The current app does not upload your address book, location or voice recordings to Nekuvo.
Dictation, exports and kittens
Dictation is optional. Nekuvo only accepts it when speech recognition runs on the device: the app does not record that audio or send it to Nekuvo or Runway. Text becomes a message only when you send it.
Private photos in messages: sending and opening them in Nekuvo requires an age of at least 18 to be confirmed for both accounts in the conversation. If either person is a minor or their age is unconfirmed, Nekuvo blocks new downloads and hides photos already in the conversation. Text, kittens and scenes remain available under the other access rules. A copy already received or saved on a device cannot be recalled.
When you select a photo for a message, the app normalizes it and removes metadata, including EXIF and location, then encrypts it on the device. Supabase stores only the encrypted file. Its key stays inside the end-to-end encrypted message so your correspondent can open it; the key is never sent separately to the server.
To match the comic to your exchanges, Nekuvo analyzes only the text of selected, authorized panels on this iPhone. Apple Intelligence runs on the device when available, with local rules as a fallback. This analysis shapes titles, decorations, effects and musical passages without changing your messages. Private photos and hidden messages are excluded; no analyzed text is sent to an AI service, logged or kept in an analysis session.
Comic exports are created locally on your iPhone. One recap per week can be kept in a private library on this device; replacement waits until the new recap is ready. Free creations spanning 1 to 7 days have their own slots. The studio can load your chats without marking them as read; rendering stays local and excludes private photos. You can also invent panels within the studio without sending messages to your contacts. Optional automatic creation runs while the app is open, using conversations already available locally. It never shares automatically. The weekly comic can produce PNG pages, a PDF album or a vertical MP4 video composed using selected moments, installed animations and their voices. It exports no protected source media or clips, layers, or isolated artistic assets. Nekuvo does not upload the export: it leaves the app only when you explicitly choose a destination in the iOS Share Sheet; the receiving app then applies its own rules. Kitten packs contain artistic assets and no conversations. Downloading them requires authorized access. Downloading them may generate technical network data at the hosting provider.
Purposes and recipients
We use this information to authenticate your account, deliver and display conversations, synchronize devices and receipts, apply settings, distribute kittens, prevent abuse, handle reports and respond to your requests. Precise lawful bases will be approved per purpose and territory before public launch.
Your correspondent sees information needed for your exchange. Supabase provides authentication, database, realtime, encrypted private-photo storage and artistic asset storage. Apple provides Sign in with Apple, APNs, in-app purchases and TestFlight/App Store distribution. Cloudflare performs private verification of Apple transactions and routes Nekuvo email; Google hosts the Hangeul Studio mailbox. Google Firebase Crashlytics receives fatal-crash diagnostics from configured Beta and Release/TestFlight builds; Debug keeps it disabled. Google Firebase Analytics receives the usage statistics described above only with your consent and confirmed adult eligibility. Runway is used only to create artistic assets in the studio: your conversations are not sent to it.
The service’s Supabase database is located in eu-west-1. That region does not establish that all logs, functions, support access and subprocessors remain in the European Union. Contracts, transfer safeguards and actual service settings still need review for the current distribution and public launch; the database location alone does not establish them.
Message encryption
The current beta requires you to finish setting up protection before accessing messaging. Once activated, the content of new exchanges is end-to-end encrypted. Text, scene elements and private-photo keys are encrypted on the device before sending. The server delivers and stores this content in encrypted form without holding the private keys needed to read it.
This encryption does not hide all service data: accounts, profiles, conversation participants, identifiers, dates and technical connection information are still needed to operate the service. TLS also protects data in transit, and session tokens are stored in the iOS Keychain.
Backup and recovery code
Keep your code somewhere safe and confirm it in the app to finish activation. It lets you recover the history covered by your latest encrypted backup after signing in again or changing iPhones. Backup is not continuous: use the backup action in message protection settings to update it.
Hangeul Studio cannot resend this code or decrypt your backup for you. If you lose both the code and access to your signed-in device, your protected history may become unrecoverable. Old unencrypted test messages were removed when switching to this system. Activation and recovery flows are still being validated in this private beta.
What you choose to share
A comic export consists of readable PNG pages, a PDF album or a readable vertical MP4 video: the person or app receiving it can keep and share it. The export stays on your iPhone until you explicitly use the iOS Share Sheet. When reporting, the app previews the selected message and asks for your consent to send its readable text to moderation, along with the reason and necessary references. For a photo, supported versions also offer a reduced preview with separate consent, off by default. Only that preview becomes readable by authorized moderators; neither the original nor its metadata is sent. Evidence expires after 30 days and is removed by maintenance. This does not give access to other messages or encryption keys.
No advertising or marketing analytics SDK is active, and we do not use conversations to train AI. Crashlytics is crash-only: Nekuvo adds no account identifier, message, photo, URL, token, free-form log, screenshot or attachment. Hangeul Studio personnel must only access data when an operational purpose requires it.
Your settings
Notifications are generic and say “New message.” without a text preview. Both iOS authorization and the in-app preference control them. Read receipts are off by default for minors. You can block or unblock someone and report an accessible message. Nekuvo does not show a public last-seen status.
Fatal-crash reporting is always active in the private beta and there is no in-app switch. Nekuvo adds no account identifier, message, photo, URL, token, free-form log, screenshot or attachment. Product analytics requires separate optional consent from confirmed adult accounts; advertising tracking remains disabled. Debug keeps Crashlytics disabled. Configured Beta and Release/TestFlight builds use this separate diagnostic channel. Reports already sent cannot be recalled.
Retention and deletion
Messages currently have no automatic expiry. They remain linked to the account until they are deleted under the service’s rules. Evidence selected for a report normally expires after 30 days; Apple revocation events after 40 days; push requests after 24 hours and their terminal states after 7 days. Moderation metadata and audits are designed for longer retention. These technical periods and actual purge operation will be reviewed before public launch.
Support correspondence is deleted no later than 90 days after closure, unless a legal duty or dispute justifies limited retention. Production periods for other logs, inactive accounts and backups are not yet finalized.
Firebase states that crash traces and associated identifiers are kept for 90 days before removal starts. Crashlytics is a global service that may process data wherever Google or its agents maintain facilities.
Analytics statistics have a retention period separate from crash reports. The exact period configured for the beta’s Google Analytics property remains to be confirmed; it must not be equated with Crashlytics’ 90 days. You can withdraw consent in Me → Privacy and contact us to request erasure of data already sent.
After account deletion, the purchase ledger detaches your profile but retains pseudonymous transaction and binding identifiers to prevent purchase replay or reassignment to another account. Their retention period still needs to be set before public launch.
You can request deletion under Me → Delete my account. Access closes, then that account’s profile and messages are erased. The other participant’s messages remain; your identity is removed from retained scenes and the conversation becomes read-only. A server process continues Apple revocation and technical deletion. A copy already exported or held by someone else cannot be recalled remotely. Uninstalling the app does not delete the account.
You can also delete a conversation for your account: its history disappears from your devices and pending messages are cancelled. The other participant keeps their copy. A new exchange may bring the conversation back, showing only new messages on your side.
Your rights
Under Me → Download my data, you can prepare a copy of account data available from the service. This export is separate from your comic and does not replace an encrypted recovery backup. The server cannot provide readable text from encrypted messages whose keys it does not hold.
Depending on your circumstances, you may request access, correction, erasure, restriction, objection and portability, and withdraw consent where processing relies on it. A proportionate identity check may protect a request made outside your session. Never send a password, sign-in code or private key. We normally respond within one month; any extension permitted by law is explained within that period.
Email privacy@nekuvo.com or write to the postal address above. You may also contact the CNIL or your competent supervisory authority.