Privacy Policy
Last updated 1 November 2026
COMMON is a community network. We collect what we need to run it and nothing more. We don't sell your data, we don't show ads, we don't use trackers, and we don't use your posts, comments or messages to train AI models.
Who is responsible
The data controller is TestardStudios. For anything about your data, write to privacy@testardstudios.it.
What we collect
- Account: your email address, a hashed password (we never see the password itself), your username and when you accepted these terms.
- Profile: anything you add: display name, bio, avatar and banner.
- What you post: posts, comments, images, polls, and your votes, saved posts, follows and community memberships.
- Private messages between you and other users. Only you and the other person can read them in the app. We don't read them, except where the law requires it.
- Safety records: reports you file or that concern your content, and moderation actions such as removals, bans and suspensions.
- Technical data: your IP address and browser details appear in our providers' server logs when you use the site. We use them only to keep the service running and secure.
Your email address is never shown to other users. Your username, profile, posts, comments, votes counts and community memberships are public.
Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and showing your content | Contract, art. 6(1)(b) |
| Sending account emails: confirmation, password reset, email change | Contract, art. 6(1)(b) |
| Moderation, spam and abuse prevention, security | Legitimate interest, art. 6(1)(f) |
| Answering legal requests and keeping records the law requires | Legal obligation, art. 6(1)(c) |
We don't profile you for advertising. Feeds are ranked by votes and time with formulas that are public; your data isn't sold or shared with advertisers or data brokers.
Emails
We only send emails you need for your account. We don't send newsletters or marketing. If that ever changes, we'll ask first and every such email will have an unsubscribe link.
Who processes it for us
We use a small number of providers, bound by data processing agreements:
- Supabase, Inc.: database, sign-in, file storage, real-time updates and account emails. European Union (Frankfurt, Germany).
- Vercel, Inc.: hosting the website and running its server code. Server code in the European Union (Frankfurt, Germany); static files served from a global network.
See the full list on the subprocessors page. Where a provider may access data from outside the EU, the transfer is covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
- Your account data stays until you delete your account.
- When you delete your account, we immediately erase your email, profile, images, votes, saves, follows, memberships, messages and notifications. Your posts and comments either stay without your name or are erased, as you choose.
- Moderation records may be kept without your name to protect communities from repeat abuse.
- Server logs and backups held by our providers are deleted on a rolling basis.
Your rights
You can use these rights at any time, free of charge:
- Access and portability: download all your data from Settings → Your data.
- Correction: edit your profile, username and email in Settings.
- Erasure: delete your account from Settings → Delete account.
- Restriction and objection: write to privacy@testardstudios.it.
We answer requests within one month. You can also complain to the Garante per la protezione dei dati personali or to the data protection authority where you live.
Cookies
We only use the cookies needed to keep you signed in. No analytics, advertising or third-party cookies. Details are on the cookies page.
Age
You must be at least 14 to use COMMON. If we learn an account belongs to someone younger, we delete it.
Changes
If we change this policy in a way that matters, we'll tell you on the site before it takes effect. The date at the top shows the latest version.