Short version: Tintee stores a first name, a mood, your little monster and your groups, in Europe, for the people you chose, plus the month of your crew (one mood per day, 13 months), what you stick on your crew’s wall, your games and the other items in the table below. Game data is short-lived, and wall stickers stay about a week. No ads, nothing sold, no photos, and no tracking of you across other apps or sites. Nothing to pay during the beta: the shop is free. We count how the app is used, without anything you write, in Europe, and you can switch that off in “me”. Here is the long version.
Effective October 23, 2026 · policy version 1.4 (beta). Written in plain words on purpose: if something is not clear, write to us.
Tintee is an independent project run by its founder, based in France, who is the data controller. Legal entity details will be published here when the company is registered. Contact: hello@tintee.app.
| What | Details and purpose | How long |
|---|---|---|
| Account | A random identifier created by Firebase Authentication (anonymous sign-in). No email, phone number or password. | Until you delete your account, or automatically after a period without any sign of life: usually 90 days, up to 180 (see section 11) |
| Profile | The first name or nickname you type. Which groups you are in (four at most). The day you last opened the app (the date only, never the time, never how long). | Until you delete your account |
| Your tint | Your little clay monster: its family (one of seven), and a shape, eyes and a mark, each from fixed lists. Its colour is not stored: it comes from your mood. In season, a costume from a fixed list (for Halloween, a witch or a vampire), if you put one on. Your group sees your monster, in the app and on the widget. The ÉCHO crown is not part of it: it shows as a 👑 next to your first name. | Until you change it or delete your account |
| Recovery code | A 12-character code shown in “me” (help & account) that lets you get your account back after reinstalling or changing phones. We store only a one-way hash of it, never the code itself. Your phone keeps a copy in its secure storage, which your platform may sync to your own iCloud Keychain (Apple) or Google backup (Android) so that it follows you to a new phone. | Until it is used or replaced, or until you delete your account |
| Mood | Your current mood (one of ten) and when you set it. If you add them: a more precise word (from 160 fixed words), how strong it is (1 to 3) and a reason (from 36 fixed reasons). Earlier versions of the app could add a note of up to three words. Your group sees your current mood with these details. The widget can show the mood and how strong it is, never the word or the reason. From version 0.9.23 of the app, your mood also carries your phone’s time offset from UTC (for example “UTC+2”, never your city or your time zone’s name), kept with your current mood on your private profile and never shown to your group, so that our server files your mood under the day of your phone in the Sunday comic and in the month of your crew. It is replaced with each new mood and deleted with your account. | Until you change it |
| Mood history | A private diary of your own moods, one entry per day (the day of your phone). From version 0.9.20 of the app, a day keeps every mood you set that day, in order, repeats included, up to 24 (beyond that, the last one is replaced), each with its precise word when you picked one from the fixed list. The entry also holds the moment of its last change, used only to date its deletion: never the time of each mood, never how strong it was, the reason or the note, never anything you typed, never a group. Earlier versions kept only the last mood of the day and how many times you changed it; those days stay as they are until they expire. Only you can read it: never your group, never a parent. The app shows it to you in “my tints”, by week, month or year, with a short sentence that describes your week: never a number, a percentage, a score, an average or a comparison with another period. You can erase it at any time with “erase my tints” (in “my tints” and in “me” › privacy & safety): it is deleted from our server right away, and the moods you set afterwards start a new history. Your current mood stays on the wall. “Erase my tints” also removes your moods from the month of your crew and your rows from the Sunday comic, in all your current groups; the rest of the comic (the ÉCHO crowns, who wrote the same ÉCHO word, right guesses and signs received) expires on its own within 16 days (section 11). | 13 months, then deleted automatically; right away with “erase my tints” |
| ÉCHO answer | Your word of the day (one word for the three drawings), the language of your app, when you answered, and your phone’s time offset from UTC (for example “UTC+2”, never your city or your time zone’s name). Hidden from everyone until the reveal. Also kept: who you voted for (secret), and, for your group, who played, who wrote the same word as whom (without the word), the points and the crown. Details in section 3. | Time offset: until voting closes, the next morning. The rest: 8 days after the day of the game, then deleted automatically. The crown: until the next one |
| ÉCHO image for tomorrow | The image you pick for your group’s ÉCHO of the next day: one per person, from a fixed list of six, never any text, and how many times you changed it. Nobody sees who picked what: the app only shows how many people picked. Once your group plays that day, the trio it played is kept, without any name. | 8 days after the day of the game, then deleted automatically |
| Guesses (“Do you know me?”) | Who guessed, about whom, the kind of mood guessed (one of four families), when, whether it was right, and the start of the guesser’s day as the phone gave it (which reveals the phone’s time offset from UTC). Details in section 3. | An unanswered guess ends after 30 hours; every guess is deleted 8 days after it was made |
| “This Big” game | Your three answers of the day (how far you scaled the object, a whole number), the stars our server works out from them (0 to 3 each) and when you answered. No free text and no group are kept, and no time zone either. Your group sees your answers only once they have played the three rounds themselves, never if one of you blocked the other. Details in section 3. | Deleted automatically 8 days after the day; the group summary (who finished, who has the eye of the day) too |
| Sunday comic | For each week and each member of the group: the most striking mood of each day (the mood, its precise word and how strong it was, never the reason, the note or the time), the ÉCHO crowns, who wrote the same ÉCHO word (without the word), how many right guesses each person made and how many signs each person received (never who sent them). A day is the day of your phone from version 0.9.23 of the app, the day in UTC with earlier versions. Kept by our server; the members of the group can read it. | Until 7 days after the week has ended everywhere in the world (16 days at most), then deleted automatically |
| Month of your crew | For each month and each member of the group: one mood per day, the same one the week of the comic shows (the most striking of the day). The mood only: never its precise word, how strong it was, the reason, the note or the time. A day is the day of your phone (see “Mood”); with earlier versions of the app, the day in UTC. Our server writes it from the moods you post in that group and keeps it; the current members of the group can read it, including someone who joins later, who also sees the months before they arrived. Nothing is written while you take a break in ghost mode, and the day of your current mood is removed from it when the pause starts. | The current month and the 12 before it (398 days at most): a month is deleted automatically when the 13th month after it begins. Your lines are deleted right away when you leave the group, delete your account or use “erase my tints” |
| Wall | The stickers (emotes) and short phrases you stick on your group’s wall: a sticker from fixed collections, or a phrase of one to six words from a closed list of words. Never free text. Stored with your account identifier, their place and the day (in UTC). Your group sees them. Details in section 3. | Shown for about a week, then removed; fully deleted within 14 days at most |
| Wall background | The background of your group’s wall, picked by a member from a fixed collection of walls. Only the name of the wall is stored, on the group, never who picked it. The whole group sees it, in the app and on the widgets. | While the group exists, or until a member picks another one |
| Shop | Wall backgrounds and stickers, all from fixed collections. During the beta, everything in the shop is free for everyone: nothing can be bought, and nothing is saved on your account when you use an item, except an anti-abuse counter deleted within 24 hours. When the beta ends, testers will keep everything: the list of items will then be saved on their account. Details in section 3. | Nothing during the beta; then, until you delete your account |
| tint+ waiting list | If you tap “notify me” on the tint+ screen: the date you tapped. It only counts interest. No payment, no card. | Until you delete your account |
| Signs | Who sent which little sign (✌️, 🫂, 🤗 or another one from the closed list), invitation (such as “☕ grab a coffee?”, one of eight fixed phrases) or reply to whom in your group, and when. Never a comment, never free text. An invitation lasts 24 hours and can be answered with one of three fixed replies (such as “I’m in!”; earlier versions also offered “another day?”, still shown when someone sends it); a reply records which sign or invitation it answers. No time offset of your phone is used for signs or invitations. | A sign or an invitation: shown 24 hours in the app; an invitation can be answered for 24 hours. Kept 7 days on our servers, then deleted automatically |
| Exchange history (on your phone only) | From version 0.9.13 of the app, on your phone only, the app keeps a history of your exchanges for 13 months: who sent which sign, invitation or reply, and when. They appear right away in “my tints”, and at the same time, for 24 hours, in “signs & invites”. From version 0.9.19, “signs & invites” becomes “activity”: they appear there for 48 hours, in the “activity” of the group they belong to, and the app also uses this history, on your phone, to show your last exchange with someone on their card and which of your signs a reply answers. This history never leaves your phone: it is never sent to our servers and is left out of your phone’s backups. The oldest exchanges of a very busy month may go earlier. It is lost if you reinstall the app or change phones, and it is erased when you delete your account on this phone or tap “erase my exchange history” in “me”. Exchanges you had with others stay in their own history, on their phone. | 13 months on this phone, then deleted automatically |
| Group | The group name, its type (friends / family / close ones), its members (8 at most; some older groups have up to 20) and its invite link. From version 0.9.20 of the app, any member can rename the group: our server checks the new name (30 characters at most, no word from our block list) and keeps the time of the last rename, so that a group can be renamed at most once a minute. We never keep who renamed it. The whole group sees the new name, in the app and on the widgets. | While the group exists |
| Device | A push notification token, the platform (iOS / Android) and the notification sound you picked in “me”, used to refresh your widget silently when a member changes mood, and for a few notifications you see: a sign or an invitation someone sent you (their first name as the title and the fixed phrase of the gesture or invitation as the text, such as “☕ grab a coffee?”, with the sound you picked in “me”, or silent), a reply to your invitation (their first name, the emoji of the invitation and the reply chosen, as one fixed phrase, such as “☕ I’m in!”), the fact that a friend you guessed about has just posted (a quiet notification titled “your bet”, with a fixed phrase and their first name: “Léa just posted — did you know your crew?”, never their mood or whether you were right), and the fact that friends guessed about you while you have not posted yet (a quiet notification titled “do you know me?”, with their first names in a fixed phrase, such as “Alex and Léa bet on how you’ll wake up 👀”, never what they guessed; only one at a time, replaced with each new guess). From version 0.9.19 of the app, a reply to any of your signs or invitations says which one it answers (such as “replied “thanks” to your ✌️”), and the notification of a sign also shows the name of the group and the neutral portrait of the sender’s little monster, never their mood (section 8). You can turn each of these four off in “me”: a reply to your invitation follows the switch for signs, and a guess about you the switch for bets. A parent’s green light, for a minor waiting for it, can’t be turned off in “me”. A notification never shows a mood or a note. | Until you sign out or delete the account |
| Parent approval | When a parent approves an account: the approval code, the approving account’s identifier, and timestamps. Never the age typed at sign-up, never a date of birth. | While the child’s account exists |
| Moderation notice | When a human at Tintee decides on a report or removes something: a message in the app of the person concerned (what was done, the rule, the date, how to contest) or of the person who reported (handled, with or without action). Fixed codes only: never the content, never who reported. | 183 days, then deleted automatically; deleted with the account |
| Report | When a member reports another member, an ÉCHO word or something on the wall: who reported whom, the group, the reason (from a short fixed list), and a copy of what was reported (a note, a wall item or the ÉCHO word) so that a human can check it. No other free text. | 90 days, then deleted automatically |
| Usage measurement | Events about what you do in the app, and a few facts about your use (platform, language, group size). Never what you write, never anything about your mood. Tied to your random account identifier, never to a name. Processed by PostHog on European servers. On by default; you can switch it off in “me” (“help improve tintee”) at any time, and nothing else changes when you do. Details in section 5. | At most 14 months |
| Availability (earlier versions) | A word you could show next to your color (“up for chat” or “taking it quiet”) in the group or groups you picked. You set it yourself: it is never guessed from your mood or your activity. Being retired: see section 13. | Shown for one hour, then deleted automatically within 24 hours |
| Word of the week (earlier versions) | On Sunday evening, if you wanted, one of the ten mood words for your week (never free text) and the day you chose it. Only the members of your group who chose theirs that week could see it. Replaced by the Sunday comic: see section 13. | Until 7 days after the week ends (14 days at most), then deleted automatically |
| Memories (earlier versions) | Off by default (“memories together” in the settings of those versions). When you asked to keep a sign you received and the person who sent it agreed: the gesture, who sent it to whom, and when. Never a mood, a note or a photo. Only the two of you can see it. Either of you can remove it at any time, for both, and nobody is told; it also goes if one of you blocks the other, leaves the group or deletes their account. Being retired: see section 13. | A request with no answer: 7 days. A kept memory: 365 days. Then deleted automatically |
About automatic deletion. When the table says “deleted automatically”, Google’s servers delete the item on their own after that date, usually within a day or so. Until then, the app no longer shows it.
The app never asks for your email, phone number, real name or date of birth (the first name or nickname you type is enough), and never collects your location, photos, contacts, or anything from other apps. It does not ask to use your camera, your photo library or your microphone. The app has no advertising SDK. Only the Android beta needs an e-mail address, that of your Google account, kept outside the app (section 12).
Every day, your group gets three drawings and each person writes one word for all three. After playing, each member can pick one image, from a fixed list of six, for the next day: the group’s picks make tomorrow’s trio, completed by the app. Nobody sees who picked what. Before anything is saved, our server checks the word in the language of your app: it refuses links, usernames, numbers, the names of messaging apps and the words on our block lists. It is the only free text in the app.
Your answer stays hidden, even from your group, until the reveal: when everyone active in the group has played, or at 8 pm your time. To know when 8 pm is for you, the app sends your phone’s time offset from UTC with your answer (for example UTC+2). We do not collect the name of your time zone or where you are. The offset is removed when voting closes, the next morning, and in any case with your answer after 8 days. Because your word appears at 8 pm your time, people in your group could roughly guess your time zone.
Only the members of your group who played see the words, and never the words of someone they blocked or who blocked them. The whole group sees who played, who echoed whom (without the word), the points and the crown of the day, which stays on the scene until the next one. Votes are secret. The ÉCHO card you can share is made on your phone: a number, colored squares and a count. Never a word or a name.
What the world said. If your word is in the dictionary of common words of your language, we add one to a worldwide count for that word, with no name, no account and no group. A word is shown only once at least 25 players gave it; words outside the dictionary are never counted, and neither are the words of a day when your group played a trio it picked itself. These counts are deleted 8 days after the day.
Moderation copy. If you leave a group or delete your account, a hidden copy of an ÉCHO word that other players could already see is kept for 72 hours at most, only so that a report can still be handled; then it is deleted automatically. A word nobody could see leaves no copy. When a parent withdraws their approval, no copy is made and the copies in the child’s current groups are deleted; a copy made in the 72 hours before, in a group the child had already left, expires on its own.
While a member of your group has not posted their mood yet today, you can guess which kind of mood they will post: full of energy and good, full of energy and bad, calm and good, or calm and low. You see your own guesses. The person you guessed about is told before they post, by a quiet notification with the first names of the people who guessed about them, in the order of their guesses (never what they guessed): “Alex bet on how you’ll wake up 👀”, then “Alex and Léa bet…”, up to three first names, then two and the number of the others (“Alex, Léa and 2 others bet…”). There is only one such notification at a time, replaced with each new guess, and someone they blocked or who blocked them is never named or counted. Once they have posted, they see in the app who guessed and whether they were right. When they post, you get a quiet notification with their first name, never their mood or whether you were right. You can turn both notifications off in “me”, with one switch. The Sunday comic shows the group how many right guesses each person made that week. A guess that gets no answer within 30 hours simply ends; every guess is deleted after 8 days.
Every day, everyone gets the same three rounds: two objects side by side, and you make one of them as big as it really is next to the other. The objects are pictures that come with the app: the game never uses your camera or your photos. Each answer is sent before you see the truth; our server keeps your three answers and works out your stars. Your play counts for all your groups. The members of a group see each other’s answers and stars only after playing the three rounds themselves, never those of someone they blocked or who blocked them; the group sees who has finished and who has “the eye of the day” (best total, the first to finish wins a tie). Your play and the group summary are deleted automatically 8 days after the day, and right away if you delete your account; if you leave a group, you disappear from its summary. The card you can share is made on your phone: a number and stars. Never an object, a score or a name.
During the week, our server keeps a short summary for the group (the items listed in the table), and on Sunday the app turns it into a comic. The members of the group can read it for 16 days at most. A person who leaves the group or deletes their account is removed from it.
“Keep in the album” saves the comic on your phone only: up to 52 comics, with the moods and words shown in the panels and the account identifiers of the people in them (never their names, which the app looks up when you open the album). It stays until you empty the album, sign out or delete your account, even if someone in it later deletes theirs; phone backups may keep a copy. “Share my panel” makes an image of your own panel only, on your phone; we never receive it.
From version 0.9.23 of the app, the members of a group can look back at its months: for each person, one colour per day (the day of their phone), the mood that the week of the comic showed for that day. Our server keeps the current month and the 12 before it (398 days at most): the mood only, never the word, how strong it was, the reason, the note or the time; and the current members of the group can read them, including someone who joins later, who then also sees the months before they arrived. A day without a mood stays blank: the month never counts days, never compares people and never ranks anyone. The app shows no line for someone taking a break in ghost mode, while the pause lasts. A person who leaves the group, deletes their account or uses “erase my tints” is removed from it right away; ghost mode removes the day of their current mood and writes nothing while it lasts, and their earlier days stay; when they come back, their current mood counts for that day.
In short: your crew’s monsters stand on a shared wall, and what you stick on it stays about a week. In detail: the wall shows the stickers (emotes) and short phrases the group stuck on it. A sticker comes from fixed collections; a phrase is one to six words from a closed list of words: there is no free text on the wall. A group has 12 items at most, and each person between 2 and 6, depending on the size of the group; when you are at your limit, your new item replaces your oldest one. An item is shown until the start of the seventh day after it was stuck (days counted in UTC), so between six and seven days, not a guaranteed 168 hours. Expired items are removed when the wall changes; the shared record can last up to 14 days after an older item’s day, and physical deletion is asynchronous. You can remove your own item, and the person who created the group can remove any item. You can report an item.
The wall background. Any member can pick the background of the group’s wall from a fixed collection of walls. Only the name of the wall is kept, on the group (never who picked it), and the whole group sees it, in the app and on the widgets. The shelves your crew’s monsters stand on are drawn by the app: nothing about where your monster stands is stored.
“My magnets” keeps your 60 newest items privately on your phone, with the time you stuck each one, but without group references, names or other people’s items. A local account hash binds this gallery to you. There is no fixed time limit: items stay until newer ones replace them, you clear the gallery, or you change or delete your account. Removing an item from the wall does not remove this local copy, and clearing the gallery does not remove the item from the wall. Tintee does not sync the gallery between devices; phone backups may keep ordinary local storage, and a storage failure may leave copies behind.
In short: during the beta, the shop is free for everyone and nothing can be bought. In detail: the shop has wall backgrounds and stickers, all from fixed collections. During the beta, every item is free for everyone: there is no price, no buy button, and the app does not connect to the App Store or Google Play to sell anything. Using a free item saves nothing on your account, except an anti-abuse counter deleted within 24 hours (section 13): a wall background is stored on the group (above), a sticker with the wall item. When the beta ends, testers will keep everything: the list of items will then be saved on their account, until they delete their account.
Purchases are planned for later, through the App Store or Google Play only: they handle the payment, and we would never see your card. Before any sale opens, this policy will be updated to say exactly what is kept.
tint+ is a future option for the whole group. For now, it is only a waiting list: if you tap “notify me”, we store the date you tapped on your account, to count how many people are interested. There is no payment and no card.
On tintee.app/echo, anyone can play the day’s ÉCHO in a browser, without an account.
To know whether Tintee actually works for people, the app records events about what you do in it, as each feature is switched on. For example: whether you signed up alone or with a parent’s approval (never your age), an account was created, deleted or recovered, a group was created or joined, a mood was posted (never which one), a precise word was picked (not which one), a guess was made or turned out right, ÉCHO was played, revealed, voted on or its card shared, “This Big” was played or its card shared, the Sunday comic was opened or a panel shared, something was stuck on the wall, “notify me” was tapped for tint+, the look of a tint was changed, an invite link was opened or sent, a widget was added, a sign was sent, a push notification arrived, ghost mode was turned on or off, a streak milestone was reached, someone was reported (with the reason from the fixed list) or blocked. Each event also carries your platform (iPhone or Android), the language of the app, the size band of your group and whether you use a widget or a bubble.
Measurement contains no information about your mood: not which mood you posted, not whether it was a happy, calm or dark one, not how strong it was, not your reason. These events never contain your name, anything you write or pick as a word (mood words, reasons, ÉCHO words), the person you guessed about, what is on your wall, or any message. No advertising identifier, no screen recording, no location. They are tied to your random account identifier and to a code derived from your active group (never its name or its members), so that we can compare groups with each other. They are processed by PostHog on servers in the European Union, set to discard IP addresses, and kept 14 months at most.
Measurement is on by default. You can switch it off at any time in “me” (“help improve tintee”), in one tap; nothing else changes in the app. It starts only after the age check: a refused age is never counted, and a parent’s phone that only gives a green light is never counted. On iPhone, versions before 0.9.6 send none of these events; from version 0.9.6, the iPhone app sends them like the Android app, under the same switch. From version 0.9.6, the events also say that a game was opened (and whether there was still something to play that day), that a round of “This Big” was played, that a game showed you again something you had already seen (never what: only roughly how many days apart, compared on your phone), that an ÉCHO picture was chosen for the next day, and which form of question a guess used; and each event carries how long ago your account was created, by band (for example “between 8 and 13 days”), never the date. On Android, versions 0.4.0 and earlier record the broad family of a posted mood (positive, neutral or dark) and, from version 0.3.13, that of the word of the week, until they are updated; version 0.4.1 and later no longer do, and what was already recorded stays until the end of its retention. When you delete your account, events already sent are not deleted at PostHog: they stay until the end of their retention (one year today), tied to an identifier that no longer points to anyone.
Installation source (Android). When an account is created, and only after the age check and any required parent approval, the app may count the installation source once if usage measurement is enabled. It sends only a category from a fixed list (invite, TikTok, Instagram, YouTube, Reddit, creator, site, other, organic or unavailable), never the raw installation information, campaign code or invitation identifier. Joining a group can also be counted by route: link, typed code, installation or paste.
On the invitation page, tapping “INSTALL WITH MY INVITE” sends the invitation identifier to Google Play with the installation link. Before that tap, it stays in the part of the Tintee link after #, which is not sent to our website server or link previews. On Android, at first launch, the app asks Google Play for installation information (Play Install Referrer). It looks only for a Tintee invitation and a broad source category. The app does not persist the raw referrer, its source or campaign strings, or the invitation identifier from this hand-off, and never logs or sends those values to measurement. The invitation is held in memory to offer joining the group; accepting it sends the identifier to our group-joining service as usual. Google Play handles and retains the installation information under its own rules.
The app reads the clipboard only when you tap “PASTE”, never at launch. Depending on your system and settings, your phone may ask permission. You can also type or paste the invitation yourself, or tap the received link again after installing. The age check and any required parent approval still happen before joining.
Campaign links on this website can contain a short campaign code. On the home and audience pages, a valid code is added to the Google Play installation button in your browser, and is sent to Google only when you follow that link. This website stores no campaign information, sets no cookies and sends no audience measurement. The code is not carried to other pages.
If the app crashes or hits an error, a technical report can be sent to Firebase Crashlytics (Google), so that we can fix the problem. It contains: where in our code the error happened, the type of error, the app version, the time, the phone model and system version, the battery level, whether the phone is rooted or jailbroken, whether the app was on screen or in the background and, on Android when the app froze, what each part of the app was doing at that moment. It is tied to the Firebase installation identifier of the app on your phone (the same one used for notifications); Google sees your IP address when the report arrives.
A crash report never contains your account identifier, your first name, your moods, your words or your group. We commit to never matching a crash report with an account. Crash reports follow the same switch as usage measurement: on by default, off in one tap in “me” (“help improve tintee”), and nothing is sent before the age check. Switching it off also deletes the reports waiting on your phone. Crashlytics keeps reports 90 days; since they are not tied to your account, deleting your account does not delete them, and they disappear at the end of those 90 days.
When you sign up, the app asks your age, and never stores it. On iPhone (Apple’s Declared Age Range) and on Android (Google’s Play Age Signals), it can also ask the App Store or Google Play for the age range they know, and, for a supervised teen, whether a parent approved. The app uses the answer on your phone only, to decide: sign up alone, ask a parent, or not now. It never stores the age range, how it was declared or any store identifier, and never sends them to us or to measurement. If the answer is “under 13”, the phone only remembers that it must wait 24 hours before asking again.
On Google Firebase (Google LLC and Google Ireland Ltd, as our processor), in the europe-west1 region (Belgium). Google may process some data outside the EU under the European Commission’s standard contractual clauses. Push notifications go through Apple (iOS) and Google (Android) notification services; they never carry a mood or a note. Most are a silent signal to refresh the widget. The ones you see are a sign or an invitation (the sender’s first name and the fixed phrase of the gesture or invitation, with the sound you picked), a reply to your invitation (the first name, the emoji of the invitation and the reply chosen, such as “☕ I’m in!”), a guess (the friend’s first name in a fixed phrase, never their mood or whether you were right), a guess about you (the first names of the people who guessed, in a fixed phrase, never what they guessed) and a parent’s green light. Your recovery code lives in your phone’s secure storage; if you use iCloud Keychain (Apple) or Google backup (Android), your platform syncs it under your own account so that it follows you to a new phone. We never see that copy.
Notifications of signs, from version 0.9.19. The notification of a sign shows the sender’s first name, the name of the group, the gesture or invitation and, for a reply, the sign or invitation it answers. It also shows the neutral portrait of the sender’s little monster, drawn on your phone from its family alone, never their mood. To be delivered, it goes through Apple and Google, as before. The message carries the first name, the gesture and two opaque references (scrambled codes, the one for the group different for each person) that let your phone find the group and avoid showing the same sign twice: never an account, group or sign identifier in clear, and never a mood. The name of the group and the portrait are added on your phone. On iPhone, the notification shows as a conversation: iOS keeps it on your Apple devices and may use it there, for example for suggestions or to announce notifications; you can limit this in your iPhone settings, in Tintee’s Siri options (Settings › Apps › Tintee › Siri on recent iOS), and the conversation display and Announce Notifications are set in the iPhone’s Notifications settings. On Android, the app draws the notification itself, one conversation per person and group, and remembers on your phone, for 8 days, which signs it already showed, by their opaque references only. When you leave a group, the app erases its notifications from your phone and asks iOS to erase its conversations; if the app was closed, this happens the next time you open it. When you sign out or delete your account, the app erases all of them and asks iOS to erase all its conversations.
Other companies that process data for us.
Our server functions run on Google Cloud (Cloud Run), in Belgium. Like almost every web service, Google writes a technical log line for each request that reaches them: from the app, from a widget refreshing, or from the ÉCHO web page. That line contains the IP address of your phone or browser, the time, the address requested and the type of device or browser. These logs are kept 30 days, then deleted. We use them only to keep the service running and secure, not to follow what you do.
This website. It is hosted by Firebase Hosting (Google). Its fonts (Archivo Black and Space Grotesk) are served by this website itself: no page loads anything from Google Fonts or from another company.
To recover from an accident, Google keeps daily backups of our database for 14 days, and can restore it to any moment of the last 7 days. A backup is a frozen copy: an account or an item deleted today can still exist in the backups until they expire, 14 days at most, then it is gone. We only use a backup to repair the service, and if we ever restore one, we delete again what had been deleted.
Tintee is for people 13 and older, everywhere: we do not accept users under 13. In the European Union, users below their country’s age of digital consent (15 in France) can only use Tintee after a parent or legal guardian approves the account with a one-time code; the parent can withdraw that approval at any time, which deletes the account. The age typed at sign-up is never stored, and neither is the age range given by the app stores (section 6).
You can ask to access, correct, export or delete your data, or object to a processing, by writing to hello@tintee.app. We answer within 30 days. Deleting your account removes your profile, monster, moods, mood history, signs and invitations, ÉCHO answers, votes and picks for tomorrow, the guesses you made and the ones about you, your “This Big” plays, your lines in the Sunday comic and in the month of your crew, your wall items, the shop items on your account, your waiting-list date, words of the week, availability, memories, moderation notices, device tokens, recovery code and, if you are a minor, the parent approval. Only exception: a moderation copy of ÉCHO words others already saw, deleted within 72 hours (section 3). A wall background you picked stays on your group’s wall: it does not say who picked it. The app also clears its copies on your phone (the comic album, “My magnets”, the exchange history, the notifications of signs and, on iPhone, the conversations iOS kept from them); phone backups may keep old copies. Usage events already sent to PostHog are not deleted: they stay until the end of their retention, tied to an identifier that no longer points to anyone (section 5). Crash reports are not tied to your account and disappear after 90 days (section 5). Server logs are deleted after 30 days, and database backups after 14 days at most (section 8). You can also complain to your data protection authority (in France, the CNIL).
Erasing your mood history only. From version 0.9.20 of the app, “erase my tints” (in “my tints” and in “me” › privacy & safety) deletes your whole mood history from our server right away, every day of it, whatever version of the app wrote it. It also removes your moods from the month of your crew and your rows from the Sunday comic, in each of your current groups. Nothing else is erased: your account, your current mood on the wall and your groups stay. The rest of the comic of the week (the ÉCHO crowns, who wrote the same ÉCHO word, right guesses and signs received) is not erased: it expires on its own within 16 days, and your lines in it are deleted with your account. Comics that members already kept in the album of their phone (local copies) are not erased either. Database backups may keep a copy for 14 days at most (section 8). The moods you set afterwards, on any of your phones, start a new history. A request to access or export your data by e-mail includes your mood history (for each day, its moods in order, with their words), your days in the month of your crew and the time offset kept with your current mood.
Uninstalling the app does not delete your account. Your first name and last mood would otherwise stay visible to your group. So: an account that shows no sign of life for 90 days (not opened, no mood published, no sign-in refresh) and has no device still registered for notifications is deleted automatically, with everything attached to it. A device that stayed silent for 180 days no longer counts as registered, so in practice deletion happens between 90 and 180 days. To keep your account when you reinstall or change phones, use the recovery code from “me”. A parent account that still covers a child’s account is never deleted automatically.
Reports. A report is kept for 90 days so that a human can act on it, then deleted automatically. It holds a copy of what was reported (a note, a wall item or an ÉCHO word) for that check. Each report also sends us an alert e-mail that contains only the report’s identifier and reason. Never the content, never who is involved. A report is not deleted when the reporter or the reported person deletes their account: it is the trace of a moderation, not part of a personal profile. Reports and appeals sent by e-mail are kept 6 months after our decision, then deleted from our mailbox.
On Android, the closed test needs the e-mail address of your Google account, the one you use on Google Play. That address is kept in the tester list of the Google Play Console and in the Google group described below (never in the app’s database or in our code), and it is deleted when the beta ends. On iPhone, you join the test yourself through Apple’s public TestFlight link (see the steps on the home page): you do not give us an e-mail address. Apple handles the sign-up, and we only see what App Store Connect shows us about testers there. If you write to us, your message stays in our mailbox. Google and Apple handle the tester lists of the Google Play Console or App Store Connect under their own privacy policies. Nothing else about you changes: inside the app, you are an anonymous account like everyone else.
On Android, you join the test yourself (see the steps on the home page) through the Google group tintee-testers. Its member list is visible only to the group’s managers (us): members cannot see each other, and nobody but the owners can post or read in it. Google hosts the list, and Google’s own rules apply to it. We remove the addresses from the group when the beta ends, or sooner on simple request to hello@tintee.app. You can also leave the group yourself to leave the test.
In short: old features fade out on their normal schedule, and a few things are kept only on your phone. The details below are more technical.
Earlier versions of the app had weekly games, the word of the week, availability and memories. Version 1 replaces them with ÉCHO and the Sunday comic. While earlier versions are still in use, the rows of the table and the details below still apply, and existing data expires on its normal schedule. Version 1 no longer shows memories: to remove one before it expires, block the person, delete your account, or write to hello@tintee.app.
Weekly games (a shared phrase, a rebus, an intruder game, a duel and a cooperative game) require an explicit opt-in each week and use closed choices, with collective outcomes and no named results, participant counts or ranking. No move is made for an absent person. The group sees the calendar and collective cards; separate server-only data holds participation, choices and who contributed what, so contributions can be filtered or removed. Game clues can still allow deductions: this is not a promise that roles cannot be guessed. Play closes on Monday at 00:00 UTC; weekly data expires seven days after that week ends, and physical deletion is asynchronous. Leaving a game removes your participation and contributions.
Signature. Earlier versions let you pick a pattern and a stamp from a fixed set. It can no longer be changed; the current one stays on your profile and group board, with no history, until you delete your account.
Private, bounded usage counters and retry receipts prevent abuse and duplicate actions. Wall and game receipts are retained for a 48-hour retry window, up to 480 each per account; a wall quota expires 48 hours after the last accepted item, a game quota 48 hours after the last counted call. Removing content does not immediately remove its retry receipt. Changing the wall background goes through a shop counter that keeps only the times of your recent calls, deleted within 24 hours. Alert e-mails about reports contain only moderation metadata.
In short: the person you show on your widget is chosen on your phone and stays there; nobody is told. In detail: “My person” is a private choice on the phone: one member per current group, up to four group selections, bound to the account by local hashes. The person is not notified. It adds no cloud data, targeted network lookup or measurement event. Native widgets use local pseudonymous handles rather than account identifiers. iOS uses the active group and one display choice for all its widgets; Android can choose the display per widget. You can clear the choice; account change, account deletion and local reset try to purge it. Unknown, unavailable or expired data gives a neutral widget at the next render; a cache or the last image drawn by the operating system can remain until the operating system redraws it. Storage failures and phone backups limit physical erasure guarantees.
In short: from version 0.9.19, the widget shows the real gesture a member sent you, and a few memories stay on your phone so that nothing shows twice. In detail: the widget shows the gesture a member of the group sent you above their monster, with how long ago they sent it, for 24 hours at most and until you see it in the app, and “↩ Jo replied” in its header, for 2 hours at most and also until you see it in the app; on Android, the bubble also lists the last exchanges of the group shown, sent and received, for 48 hours at most, three lines at most (the rest is in the app). Anyone who sees your home screen, or your bubble on Android, can see them, like the rest of the widget; the lock screen widget on iPhone does not show them. These sign marks hold first names, gestures, invitations and replies, never a mood or an account identifier; they are not written while you take a break in ghost mode, and are erased when you sign out, change account or delete your account. To find a group from a notification, your phone keeps the opaque references of your groups and, on iPhone, a small directory of your groups (the group’s identifier, its name, and the first name and monster family of each member) that the notification extension reads; a group you leave is removed from it. “Activity” remembers on your phone, for 3 days, which received lines you already saw, so that its dot goes out: the sender is never told. Phone backups may keep old copies of some of these items.
Data is encrypted in transit and at rest. Access rules are enforced on the server for every read and write: a member can only read their own group, only the account owner can change their profile, and hidden game data (ÉCHO answers before the reveal, other people’s guesses) is readable by no app at all. Rules are tested automatically before every release.
We post every change here, with its date at the top of the page.
This update (October 23, 2026, version 1.4) adds the month of your crew, from version 0.9.23 of the app: our server keeps, for each group, one mood per day and per member (the mood only) for the current month and the 12 before it, readable by the current members of the group, including someone who joins later. Until now, the moods of the crew were kept 14 days at most, in the Sunday comic. It says that your phone’s time offset from UTC is now sent with your mood and kept on your private profile, so that the comic and the month follow the days of your phone, and that “erase my tints” also removes your moods from the month and your rows from the Sunday comic; the Sunday comic is now kept 16 days at most instead of 14 (sections 2, 3, 7, 9 and 11).
The update of October 22, 2026 (version 1.3) says that, in “Do you know me?”, the person someone guesses about is now told before they post, by a quiet notification with the first names of the people who guessed (up to three, then two and the number of the others), never what they guessed or whether they were right. There is only one such notification at a time, replaced with each new guess, and the switch for bets in “me” turns it off too. Nothing new is stored (sections 2, 3, 8 and 9).
The update of October 17, 2026 (version 1.2) described your mood history from version 0.9.20 of the app: a day now keeps every mood you set, in order, with their precise words, up to 24 (still without the time of each mood, the note or anything you typed, still for you alone, still 13 months), and the app shows it by week, month and year with a descriptive sentence, never a number or a comparison. It added “erase my tints”, which deletes your mood history from our server right away, but not the Sunday comic of the week, which expires within 14 days; it said that any member can now rename a group, and that the server keeps only the time of the last rename. It also corrected the number of precise words (160) and of reasons (36) (sections 2, 7 and 11).
The update of October 16, 2026 (version 1.1) described the signs of version 0.9.19 of the app. Their notifications show the name of the group, the neutral portrait of the sender’s little monster (never their mood) and, for a reply, the sign it answers; they carry opaque references, never an identifier in clear; on iPhone they show as conversations that iOS may use on your Apple devices, which you can limit in Tintee’s Siri options (Settings › Apps › Tintee › Siri on recent iOS), and which the app asks iOS to erase when you leave a group, sign out or delete your account. It also says that the widget shows the real gesture and “↩ Jo replied”, that “activity” shows the exchanges of the last 48 hours, that an invitation now offers three replies, and what stays on your phone for this (sections 2, 8, 11 and 13).
The update of October 14, 2026 (version 1.0) described the app as it is in the beta, version 0.9.15: your tint is a little clay monster, whose colour comes from your mood, and the ÉCHO crown is a 👑 next to your first name; the wall takes stickers and phrases from a closed list of words, 12 per group at most and 2 to 6 per person, and its background is picked from a fixed collection; the shop is free during the beta and nothing can be bought; in ÉCHO, everyone writes one word for the three drawings and the group can pick tomorrow’s images; “This Big” never uses your photos; ÉCHO on the web counts 30 games a day per connection; ghost mode is kept on your phone only (sections 2, 3, 4, 9 and 11).
The update of October 13, 2026 (version 0.9) said that an invitation now lasts 24 hours for everyone, without using your phone’s time offset, that it can be answered with one of four fixed replies, which a notification shows with the invitation’s emoji, and that, from version 0.9.13 of the app, your phone keeps a 13-month history of your exchanges that never leaves it (sections 2 and 8).
The update of October 9, 2026 (version 0.8) explained the Android invitation hand-off to Google Play, installation source measurement and clipboard access only on a gesture (section 5).
The update of October 9, 2026 (version 0.7) says that, from version 0.9.6, the iPhone app sends usage measurement like the Android app, under the same switch, and adds to section 5 the new game events (a game opened, a round of “This Big” played, a content seen again, an ÉCHO picture chosen for the next day, the form of a guess’s question) and how long ago the account was created, by band. It also adds to the table of section 2 the image you can pick for your group’s next ÉCHO: one per person, from a fixed list, kept 8 days.
The update of October 6, 2026 (version 0.6) said that this website now serves its own fonts: no page loads anything from Google Fonts anymore (section 8). It also said more precisely what the app never asks for, and that only the Android beta needs an e-mail address (section 2).
The update of October 6, 2026 (version 0.5) described the iPhone beta, which you join yourself through Apple’s public TestFlight link, without giving us an e-mail address (section 12).
The update of October 5, 2026 (version 0.4) described notifications as they are: a sign or an invitation shows the sender’s first name and the fixed phrase of the gesture or invitation, with the sound you picked; the nudge no longer exists; an invitation ends at midnight for its sender (sections 2 and 8).
The update of October 4, 2026 (version 0.3) described the Android beta that you join through the Google group tintee-testers (section 12).
The update of September 29, 2026 described version 1: your tint, the details of a mood, ÉCHO in the app and on the web, “Do you know me?”, the Sunday comic, the wall, the tint+ waiting list, moderation notices, age checks by the app stores, server logs and beta testers. It explained the legal basis more precisely, corrected the description of measurement (pseudonymous counts, on by default, and not yet sent from iPhone) and listed the features being retired.