Privacy.
Understand what you share, what stays private and how to exercise your rights.
Effective 2026-09-14
1. Who is responsible
Confess is an Oceanbyte product. The controller responsible for personal information covered by this notice is OceanByte, City Gate, Bldg 1000, Mahon Crescent, Co. Cork T12 W7CV.
For privacy enquiries, email privacy@oceanbyte.ie or use our contact form. General support is available at support@oceanbyte.ie.
2. What this notice covers
This notice covers the Confess app, its supporting services, this website, and contact messages and reports submitted to us. A Sinnername separates your public identity from private account details. It does not make you untraceable. What you write, your profile and information shared by other people can identify you.
3. Information we use
- Account and profile information: email, authentication identifiers, Sinnername, birthdate, gender, entered city, account status and records of accepted terms.
- Community information: confessions, comments, content identifiers, reports, moderation decisions and appeals.
- Contact information: the name or Sinnername you provide, reply email, selected topic, message and subsequent correspondence.
- Report information: category, content location, explanation, relevant country, good-faith statement and any contact details you provide.
- Technical and security information: IP address, request times, browser or app information, authentication events and anti-abuse signals processed by our hosting and security services.
We receive information from you, the services you use to access Confess, technical systems that operate the service, and people who report content or behaviour. Form fields marked optional can be left blank. Without required information, we may be unable to provide an account, respond to an enquiry or locate reported content.
Confess uses Supabase for authentication and its database. You can sign in using email and password, Sign in with Apple or Google sign-in. When you choose Apple or Google, we receive the account identifier and information that the provider shares to create or authenticate your Confess account. We do not receive your Apple or Google password. We do not use audience analytics in the app.
Do not include passwords, verification codes, identity documents or unnecessary information about other people in a message. To report prohibited material, provide its location; do not copy or attach the material.
4. Why we use information
| Purpose | Legal ground |
|---|---|
| Accounts, authentication, posting, discussion and account support | Performance of our contract with you, where the information is necessary to provide the requested service. |
| General enquiries and feedback | Our legitimate interest in answering questions and improving the service. |
| Security, community rules and reviewing reports | Our legitimate interests in protecting people and preventing abuse; compliance with a legal obligation where a specific duty applies. |
| Data rights requests, valid legal orders and statutory reporting duties | Compliance with the relevant legal obligation. |
| Establishing, exercising or defending legal claims | Our legitimate interest in protecting legal rights, subject to applicable safeguards. |
Where we rely on legitimate interests, we consider the necessity of the processing and its effect on your rights. You can object as explained below. Contacting us or submitting a report does not subscribe you to marketing.
Confess does not require you to provide health, political, religious, sexual-orientation or other special-category information. A confession may nevertheless contain sensitive information that you voluntarily choose to make public. We process special-category information about you that you intentionally publish where it has been manifestly made public by you, and only as needed to host and moderate the content. Do not publish another person’s sensitive information or identifying details. Sensitive information contained in a private report is used only to assess the concern, protect users, comply with applicable legal duties, or establish, exercise or defend legal claims. Where another legal condition is required, we will seek it or will not process the information for that purpose.
5. Public information and confidential correspondence
Your Sinnername, displayed age, gender, city, confessions and comments can be visible to other users. Public content may be copied or shared outside Confess. Deleting it from Confess cannot retrieve every external copy.
Your login email, exact birthdate and private support correspondence are not displayed as part of your public posts. Access to support and report information is limited to people and providers who need it to handle the matter or operate the service.
We do not routinely disclose a reporter’s name or email to the person reported. Relevant allegations or content may need to be explained when giving reasons for a decision. Information may also need to be disclosed under a valid legal requirement or to protect someone from serious harm. We consider confidentiality and disclose only what is necessary.
6. Providers and international transfers
Cloudflare hosts and protects this website and provides Turnstile, which checks form submissions for automated abuse. Resend transmits contact and report emails, including report acknowledgements where an email address is provided. Authorised support and moderation staff use the receiving mailboxes to handle submissions.
Supabase provides the app’s authentication and database services and processes account, profile, content and report information on our behalf. Apple and Google process sign-in requests when you choose their sign-in services; they provide Confess with an account identifier and information authorised through that service. Cloudflare hosts and protects the website and processes technical and security information. Resend transmits website contact and report emails, which are delivered to monitored OceanByte mailboxes. These providers may process limited information outside Ireland or the EEA. Where personal data is transferred to a country without an applicable adequacy decision, we rely on the provider’s data-processing terms and recognised safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. You can request more information about applicable safeguards through the privacy contact address.
We may also disclose relevant information to professional advisers, competent authorities or courts where necessary for a legal duty or claim. If ownership of the service changes, personal information may transfer as part of that transaction with appropriate safeguards and notice.
7. How long we keep information
| Information | Retention |
|---|---|
| Account and associated Supabase data | Until account deletion or earlier removal. Deleting your account removes the account and all associated data from the app’s Supabase backend, including your profile, confessions, comments and associated moderation/report records. |
| Routine security records | Normally 90 days. |
| Ordinary reports and appeals | Normally 12 months after the matter closes, or sooner where associated Supabase records are removed through account deletion. |
| Support correspondence | Normally 24 months after the matter closes. |
We may preserve a limited record for longer where required by law or reasonably necessary to address a serious safety incident, an unresolved dispute or a legal claim. The period depends on the applicable legal requirement, the status of the matter and the relevant limitation period. Access is restricted, and records are removed when the reason for keeping them ends.
8. Account deletion
In the app, open Sinner ID → Edit Profile → Delete Account. If you cannot access your account, use Contact and choose “Delete my account”. We may ask for proportionate verification before acting.
Deleting your account permanently removes the account and all associated data from the app’s Supabase backend, including your profile, confessions, comments and associated moderation/report records. Your account cannot be recovered through Confess after deletion.
We do not maintain separate database exports or scheduled off-site backups.
9. Your rights
Subject to the conditions in applicable law, you can request access, correction, erasure, restriction and portability of your personal data. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Use our contact form or privacy@oceanbyte.ie. We normally respond to a data rights request within one month. If a permitted extension is needed because a request is complex or there are multiple requests, we explain the reason within that first month. We may ask for enough information to confirm identity and protect the account concerned.
You can complain to the supervisory authority where you live, work or believe an infringement occurred. In Ireland, contact the Data Protection Commission. UK users can contact the Information Commissioner’s Office. You do not have to contact us first.
10. Cookies, security and automated review
This website does not use advertising or audience-analytics scripts. The forms do not save message contents in cookies, local storage or session storage. Turnstile and Cloudflare process technical signals to distinguish legitimate requests from automated abuse and protect the website.
Our Cookies Policy explains the cookies and similar technologies used on this website, their purposes and duration, and the controls available in your browser. We ask for consent before introducing non-essential cookies or tracking technologies. Reading this policy or accepting our Terms does not give consent to optional tracking.
We use secure connections, access controls and server-side checks. No service can guarantee absolute security. Report a suspected security issue through Contact, without exposing passwords or another person’s data.
Confess content moderation is carried out manually by human reviewers. To ask us to review a moderation decision, use the contact form and choose “Appeal a decision”. Automated security checks used to protect sign-in and website forms are separate from this manual content-review process.
11. Children and changes
Confess accounts are for people aged 18 or older. If you believe a child has an account or is at risk, use Report a concern. You do not need an account to raise a safety concern.
We update this notice when our practices or legal obligations change. The effective date appears at the top. We provide additional notice of material changes where required.