Privacy policy

Last updated 13 October 2026

Convo is run by Convo Sdn Bhd, a company registered in Malaysia. This page says, in plain words, what we collect, why, who sees it, and what you can do about it. It describes what the app actually does today.

What we collect

Account: your email, a hashed password (we never store the password itself), and your date of birth. The date of birth is permanent: it decides whether you are in the teen or adult side of Convo.
Profile: the display name you choose (a made-up name is fine), a short bio, languages, timezone, availability, the personality sliders, topics, your stance on debate topics, and what kind of conversation you want. Other people see your display name, bio, rating and age group. They never see your email, date of birth, or your answers to the profile questions.
Conversations: text messages in community rooms are stored so both people can read them and so reports can be reviewed. Voice notes are kept for up to 90 days and then deleted. Messages in 18+ rooms are not stored on our servers at all.
Ratings, friends and streaks: the stars and tags people leave after a conversation (the rater is never shown), friendships you both agreed to, and whether you both wrote each day.
Invitations: if you load your contacts to invite people, the list stays in your browser. When you ask us to send an invitation by email, we keep only a one-way fingerprint of that address so we never email it twice and can honour an unsubscribe. We never store the address itself or your contact's name.
Age verification: when verification is switched on, a verification provider checks your age. We receive only the result (verified, the method used, and the date), never your document or selfie.
Safety records: reports you make or receive, automated moderation findings, and appeals.
Technical: your network address is used briefly to limit abuse of login and sign-up. Your browser keeps your session and a few preferences in local storage. We do not use advertising or analytics cookies.

What we use it for

Matching you with someone to talk to, live and through the nightly introductions.
Running your conversations, friendships, streaks and notifications.
Keeping people safe. Messages in community rooms are scanned automatically for harassment, sexual content, threats, and anything that endangers a minor. When a 13 to 17 year old is in a conversation, voice notes are transcribed so the same checks can run; adult-to-adult voice notes are not transcribed. In 18+ rooms only the always-on protections for minors, non-consent and illegal content run.
Sending the invitations you ask us to send, in your name, once.
Understanding how Convo is used, as daily counts only. We never read conversations to do this.

Teens

You must be at least 13 to use Convo. Members under 18 are matched only with other members under 18, or with adults we have verified as mentors or teachers. Invitations never connect a teen with an adult. We do not show advertising to anyone. A parent or guardian can contact us about a child's account at any time.

Who we share it with

Service providers that run Convo for us: Vercel (the website), Render (the engine, in the United States), Resend (email), OpenAI (automated moderation and, for teen conversations, transcription, when enabled), an age verification provider (when enabled), and Google only if you choose to import your Google Contacts, which happens in your browser.
The other person in a conversation sees what you write to them, your display name, bio and rating.
Authorities when the law requires it, or when we believe someone is in danger.

We do not sell personal data and we do not share it with advertisers.

How long we keep it

Your account and profile: until you delete the account.
Messages: until you delete the account, except messages our safety systems flagged, which may be kept for review.
Voice notes: up to 90 days.
Safety reports and moderation records: as long as needed to handle the report and meet legal duties.
Invitation fingerprints and unsubscribe requests: kept so we never email that address again.

Your choices

Edit your profile at any time.
Download everything we hold about you from your Profile page (“Download my data”).
Delete your account from your Profile page. Your profile is emptied, your messages are removed, your friends are told the line has closed, and the account can never be used again.
Block or report anyone from inside a conversation, and appeal a moderation decision from the Safety page.
Under the Malaysian Personal Data Protection Act and similar laws you can ask us to access, correct or delete your data, and you can complain to your data protection authority.

Security

Passwords are hashed with scrypt. All traffic is encrypted in transit. Access to production systems is limited to the people who operate Convo. No system is perfectly secure; if we learn of a breach that affects you we will tell you.

Where data lives

Our servers are in the United States. By using Convo you agree that your data is processed there with the protections described on this page.

Changes and contact

If this policy changes in a way that matters, we will say so in the app before it takes effect.

See also Privacy, Terms, Community guidelines.