privacy
policy.

Comme ("we," "our," or "us") operates the Comme mobile application (the "App"), the website joincomme.com (the "Website"), and the Comme connector for AI agents (together, the "Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Services. It applies to all users worldwide, including users in the European Union (EU) and European Economic Area (EEA), where the General Data Protection Regulation (GDPR) applies. By using Comme, you agree to the collection and use of information in accordance with this policy.

Data Controller

For the purposes of the GDPR and other applicable data protection laws, the data controller responsible for your personal data is:

If you have questions about how your data is processed, or wish to exercise your rights, you may contact us at the email address above.

Information We Collect

Account and Profile

When you create an account and use Comme, we collect:

• Name and username
• Phone number, if you sign in with your phone. We also keep a one-way fingerprint (a hash) of it, so people who have your number in their contacts can find you on Comme
• Email address, if you sign in with email, Apple, or Google
• Profile photo, a short bio, Instagram and TikTok handles, your language, and any other optional profile details you choose to add
• Authentication data from Apple Sign-In or Google Sign-In (such as your name and email)

Your Contacts (only if you allow it)

If you give Comme access to your contacts, the App turns each phone number into a one-way fingerprint (a SHA-256 hash) on your device and sends only those fingerprints to our servers to find people you know who use Comme. We do not upload names or phone numbers from your address book, and we do not store the fingerprints after the lookup. We automatically follow the people we find. For large lookups we record how many numbers were checked, to prevent abuse.

What You Share in Comme

• Places you recommend, with the notes and photos you add. The people who follow you can see them, and your places for a city can be shared as a public link
• Asks you create (a city and an optional note) and the answers you give to other people's Asks
• The people you follow, block, or report, and feedback you send us

Answers From People Without an Account

Anyone with an Ask link can answer it on the Website without an account. We collect the name they enter, the places and notes they add, and, if they choose to give it, their phone number, which we store only as a one-way fingerprint so they can claim their answers after signing up.

Purchases

If you buy a paid guide, Apple or Google processes the payment and RevenueCat confirms it to us. We receive the purchase details (which guide, the price, the date, and the store transaction ID), never your card details. For creators who sell guides, we keep a record of sales and earnings.

Location Data

With your explicit permission, we use your device's location to show nearby places and to pick the city you are in. You can disable location access at any time through your device settings, though this may limit certain features of the App.

Usage Data

We collect information about how you use the App and the Website, such as screens and pages viewed and features used. On the Website this includes session recordings and ad measurement (see Third-Party Services below).

Connecting an AI Agent

Comme lets you connect an AI agent you use, such as Claude, ChatGPT, Meta Muse, or Grok, through a personal link you create in the App (Settings > Connect your agent). This is optional and only happens if you set it up. How it works.

Your Link

Your link contains a secret key. We show it to you once and store only a one-way fingerprint (a hash) of it, plus when it was created and last used. Anyone who has your link can use Comme as you, so keep it private. Generating a new link in the App stops the old one immediately, and deleting your account deletes it.

What Your Agent Can Access

Your agent can see the same information you can see in the App: your places and notes, your Asks and the answers to them (including the names and notes of the people who answered), the places the people you follow recommend and their notes, and Comme's own picks. It can create Asks and add places and notes to your list on your behalf. It cannot see phone numbers or email addresses, change your profile, delete content, or make purchases.

Your AI Provider

When your agent uses Comme, the information we return is sent to the AI service you connected and is processed by that provider under its own terms and privacy policy. That provider is not our service provider, and we do not control how it uses the information. Comme does not receive or store your conversations with your agent; we only receive the requests your agent makes to Comme.

Other People's Information

If someone who follows you connects an agent, the places and notes you have recommended (which they can already see in the App) may be sent to their AI provider. If you answer someone's Ask, your name, places, and notes may reach that person's agent in the same way.

Records We Keep

To keep agents within daily limits (for example, 20 Asks and 30 recommendations a day), we keep daily counts of each account's agent requests. Our hosting providers may keep technical request logs that can include your link's address. If you think your link was exposed, generate a new one in the App.

Legal Basis for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), we process your personal data only when we have a valid legal basis under the GDPR:

• Performance of a contract — processing your account, profile, recommendations, Asks, and purchases, and connecting an AI agent when you set one up, is necessary to provide the Comme service you signed up for (Article 6(1)(b)).
• Consent — we use your location and your contacts, and send non-essential communications, only with your explicit consent. You may withdraw consent at any time (Article 6(1)(a)).
• Legitimate interests — we process analytics and usage data to improve the Services and understand how features are used, and we keep limited records to prevent abuse, where such interests are not overridden by your rights (Article 6(1)(f)).
• Legal obligation — we may process data where required to comply with applicable laws, such as keeping purchase records (Article 6(1)(c)).

How We Use Your Information

We use the information we collect to:

• Provide and operate the Services — sign you in, show places and the recommendations of people you follow, and run Asks, sharing, and paid guides
• Connect you with people you know — match your contacts' fingerprints to find friends on Comme
• Act on your requests through AI agents you connect
• Personalize your experience — show you places for the city you are in or looking at
• Improve the Services — understand usage patterns to fix issues, develop new features, and enhance overall quality
• Communicate with you — send verification codes, respond to support requests, and share important service updates
• Maintain security — protect against unauthorized access, fraud, and abuse

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

Third-Party Services

We use the following service providers to operate and improve Comme:

• Supabase — authentication, database, file storage, and server functions. Your account data and content are stored on Supabase's infrastructure.
• Twilio — sends sign-in codes to your phone by SMS or WhatsApp.
• Google Maps Platform — maps, place search, and place details. Your location data may be processed by Google in accordance with its privacy policy.
• Google Gemini API — reads the text of a list you paste into the App to find the places in it, and helps fill in public details about places (such as opening hours).
• RevenueCat — processes and verifies in-app purchases of paid guides with Apple and Google.
• Mixpanel — analytics in the App and on the Website, including session recordings on the Website.
• Meta Pixel — on the Website, to measure visits and app downloads that come from our ads.
• Vercel — hosts the Website and the address your AI agent connects to.
• Apple Sign-In — if you choose to sign in with Apple, Apple provides us with your name and email (or a relay email) according to Apple's privacy practices.
• Google Sign-In — if you choose to sign in with Google, Google provides us with your name, email, and profile photo according to Google's privacy policy.

AI agents you connect (such as those from Anthropic, OpenAI, Meta, or xAI) are not our service providers. They act for you under their own terms; see Connecting an AI Agent.

We do not sell your personal information to third parties. We only share data with the service providers listed above, solely for the purposes described in this policy.

International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our service providers (such as Supabase, Twilio, Google, Mixpanel, RevenueCat, Vercel, and Meta) operate.

When we transfer data outside the EEA, we ensure appropriate safeguards are in place as required by the GDPR, including:

• Transfers to countries with an adequacy decision by the European Commission
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other legally recognized transfer mechanisms

You may request more information about the safeguards in place by contacting us at hello@joincomme.com.

Data Security

We take the security of your data seriously and implement appropriate technical and organizational measures to protect it, including:

• All data is transmitted over secure, encrypted connections (HTTPS/TLS)
• Database access is controlled so that people only see what they are allowed to: their own data and the recommendations of people they follow
• Sign-in uses one-time codes sent by SMS, WhatsApp, or email, or Apple or Google Sign-In; we never store passwords
• Phone numbers from your contacts are turned into fingerprints on your device, and AI agent links are stored only as fingerprints

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to using commercially reasonable safeguards.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Services. Specifically:

• Account data (name, phone number, email, profile) — retained until you delete your account
• Your content (recommendations, notes, photos, Asks, and answers) — retained until you delete it or your account. One exception: the places and notes in a paid guide you sold stay available to the people who bought it, without your name or photo, until none of them has an account
• Answers from people without an account — retained until the Ask is deleted or the person who asked deletes their account
• AI agent link (its fingerprint and when it was created and last used) — retained until you replace it or delete your account
• Purchase and earnings records (price, date, and the store's transaction number) — retained as long as required for accounting and tax obligations, up to 10 years. If you delete your account, they are kept without anything that identifies you
• Analytics data — retained in anonymized/aggregated form for up to 24 months
• Location data — used in real time; not stored persistently on our servers

If you request deletion of your account, we will delete or anonymize your personal data within 30 days, except where we are required by law to retain certain information.

Your Rights

You have the following rights regarding your personal data. If you are located in the EEA or UK, these rights are guaranteed under the GDPR:

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can update or correct your personal information through the App's settings, or by contacting us
• Right to erasure — you can delete your account through the App (Settings > Delete Account) or by emailing us. We will remove your data within 30 days
• Right to data portability — you can request a copy of your data in a structured, commonly used, machine-readable format
• Right to restrict processing — you can request that we limit the processing of your personal data in certain circumstances
• Right to object — you can object to our processing of your data based on legitimate interests
• Right to withdraw consent — where we rely on consent (e.g., location or contacts), you can withdraw it at any time through your device settings or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal
• Right to lodge a complaint — if you believe we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority. If you are in the EU, you can find your local authority at edpb.europa.eu

To exercise any of these rights, please contact us at hello@joincomme.com. We will respond to your request within 30 days.

Children's Privacy

Comme is not intended for use by children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at hello@joincomme.com.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the App or by email. We encourage you to review this policy periodically to stay informed about how we are protecting your data.

Contact Us

If you have any questions or concerns about this Privacy Policy, our data practices, or wish to exercise your data protection rights, please contact us at:

hello@joincomme.com