Privacy Policy

Effective date: July 3, 2026

Arlo ("we", "us", "our") operates the Arlo mobile application and website at followarlo.com. This Privacy Policy explains what data we collect, how we use it, and your rights.

1. Who We Are

The data controller for Arlo is João Pedro Martinho Bento (individual developer), operating the Arlo app and followarlo.com. For any privacy question or request, contact support@followarlo.com.

2. Data We Collect

Account Information

Name, email address, and profile photo (provided during sign-up)
Phone number (optional — only if you add it to your profile)
Your home city — chosen manually, or matched from your device location if you allow location access (your coordinates are used only on your device to find the nearest supported city and never leave it; we store only the matched city). Location access is optional — denying it simply means you pick your city manually. We do not derive your location from your IP address.
Authentication data from third-party sign-in providers (Google, Apple)

Content You Create

Product listings, descriptions, and images (for sellers)
Shop, market, and event locations you add to your profile, including street addresses (for sellers)
Chat messages exchanged with other users
Favorites and saved items

Automatically Collected Data

Device type, operating system, and app version
Usage analytics (screens viewed, features used, search queries) — only with your consent. The app asks on first launch; you can change your choice anytime in Profile > Privacy & security. Declining does not limit the app in any way.
Crash reports and performance data (strictly necessary diagnostics — collected to keep the app working reliably)
Device push token — collected only after you grant notification permission, used solely to deliver push notifications to your device. Removed when you sign out or revoke notification permission.

3. How and Why We Use Your Data

We process your data on the following legal bases (GDPR art. 6):

Performance of a contract — provide, maintain, and improve the Arlo service: your account, listings, favorites, and communication between buyers and sellers
Your consent — optional usage analytics, withdrawable at any time in Profile > Privacy & security
Legitimate interests — crash diagnostics, service security, and detecting or preventing fraud and abuse
Legal obligation — complying with applicable law

4. Third-Party Processors

We share data with the following processors, solely to operate the service. Each processor receives only the data necessary for its function and is bound by a data processing agreement.

Processor	Purpose	Data Shared	Data Location
Supabase	Database and authentication	Account data, all app content	EU (Frankfurt)
Stream	In-app messaging	User IDs, display names, chat messages	EU (EU West)
Cloudflare	Image storage and share pages	Uploaded media, object metadata	EU
Sentry	Crash and error reporting	Device info, stack traces, user IDs	EU
BetterStack	Logging and uptime monitoring	Server logs, including user IDs	EU
Apple (APNs)	Push notification delivery	Device push token, notification content	Apple infrastructure
PostHog	Product analytics (opt-in)	Usage events, device info, pseudonymous user ID — only with your consent	EU

Signing in with Apple or Google involves those providers as independent controllers under their own privacy policies. For a detailed breakdown of data flows and retention per processor, contact support@followarlo.com.

5. Data Retention

We retain your data for as long as your account is active. Deleting your account (in the app: Profile > Privacy & security > Delete account) immediately and permanently removes your profile, listings, messages, uploaded media, and analytics identity from our systems. Residual copies in encrypted backups expire within 30 days. Data we are legally required to keep is retained for the mandated period only.

Analytics events (collected only with your consent) are retained for up to one year.

6. Your Rights

Under the GDPR, you have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data — or delete your account yourself in the app (Profile > Privacy & security > Delete account)
Export your data in a portable format
Withdraw consent for optional data processing at any time — for analytics, use the toggle in Profile > Privacy & security
Object to or restrict processing based on legitimate interests
Lodge a complaint with a supervisory authority — in France, the CNIL (cnil.fr), or your local data protection authority

To exercise any of these rights, contact us at support@followarlo.com. We respond within one month.

7. Cookies and Tracking

The Arlo mobile app does not use cookies. Our website does not use cookies at all — not even essential ones. We do not use third-party advertising trackers. In-app analytics run only after you opt in (see section 2) and are never used for advertising.

8. Children's Privacy

Arlo is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. Data Security

We use industry-standard measures to protect your data, including encryption in transit (TLS) and at rest. However, no method of transmission over the internet is 100% secure.

10. International Transfers

Our services are hosted in the European Union. Where a transfer outside the EU occurs (for example, when you sign in with Apple or Google), it is protected by appropriate safeguards such as adequacy decisions, the EU–U.S. Data Privacy Framework, or Standard Contractual Clauses.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email. Continued use of the service after changes constitutes acceptance.

12. Contact Us

If you have questions about this Privacy Policy, contact us at:
support@followarlo.com