Celo scan reports, app detections, app icons, app reviews, risk scores, policy summaries, and recommendations are AI-assisted outputs. They can hallucinate, misidentify apps, show the wrong icon, miss policy details, or recommend an imperfect alternative. Verify important decisions independently.
1. Who we are and what this notice covers
This Privacy Policy explains how Innovation 4 3veryone, LLC ("Company," "we," "us," or "our") collects, uses, stores, discloses, and deletes information when you use Celo, a website available at https://celo.fyi and related pages, accounts, scan reports, checkout, referrals, newsletter settings, and support channels (collectively, the "Services").
Celo helps users upload screenshots of app icons, identify likely apps, review public privacy-policy text and app metadata, and receive AI-assisted privacy risk reports and safer-app suggestions. The Services are hosted and operated from the United States.
2. Notice about AI-generated app analyses
Celo scan reports, app reviews, risk scores, summaries, issue flags, app-icon displays, app-name matches, policy interpretations, and alternative-app recommendations are AI-assisted product outputs. They are generated from screenshots, detected visual elements, public privacy-policy text, app metadata, third-party sources, and model analysis. These outputs can be wrong.
AI systems and automated matching tools can hallucinate, misidentify an app, show the wrong app icon, confuse similarly named apps, miss an app shown in a screenshot, include an app that was not actually on your device, misunderstand or summarize a privacy policy incorrectly, miss policy changes, rely on stale or incomplete source material, overstate or understate risk, or recommend an alternative that is not appropriate for your needs.
Celo reports are informational only. They are not legal, privacy-compliance, cybersecurity, financial, insurance, employment, medical, parental-control, or safety advice. You should independently verify important information with the app publisher, the applicable app store, the current privacy policy, qualified counsel, or another appropriate professional before relying on a report.
3. Notice at collection: information we collect
We collect information you provide directly, information generated when you use the Services, and limited information collected by service providers that help us run the Services.
- Account information: email address, user ID, password authentication data handled through Supabase Auth, full name if provided, account creation and update timestamps, scan-credit balance, and account-deletion request status.
- Uploaded screenshots: screenshots you choose to upload for scanning. The browser compresses supported PNG, JPEG, or WebP screenshots before upload. Screenshots may include app icons, folders, widgets, usernames, notifications, wallpaper, photos, contact names, or other visible content if those items appear in the screenshot you submit.
- Scan and report data: scan status, detected apps, app names, app icon sources, privacy-policy URLs, policy-fetch status, risk scores, issues, summaries, recommendations, report timestamps, errors, and related metadata.
- Payment and credit data: RevenueCat app user ID, purchased package identifiers, credit grants, entitlement status, purchase status, customer email passed to checkout where applicable, and RevenueCat webhook/event records. We do not intentionally receive or store full payment-card numbers or card security codes.
- Referral and newsletter data: referral codes, referral visitor identifiers, referral claims, newsletter subscription preference, and related credit grants.
- Device, log, and analytics data: IP address, browser and device type, operating system, referrer, public page URL, timestamps, errors, and operational logs. Vercel Analytics and Speed Insights are configured not to send events from private routes such as account, dashboard, checkout, login, API, auth, newsletter, and referral redirect pages.
- Cookies and local storage: Supabase session cookies for sign-in, referral cookies named `celo_referral_code` and `celo_referral_visitor`, RevenueCat localStorage under `celo.revenuecat.anonymousAppUserId` when anonymous checkout identity is needed, and similar strictly necessary browser storage.
4. Sensitive information
Screenshots and scan reports may contain sensitive personal information if you include it in an upload or if app privacy-policy analysis reveals sensitive categories such as location, health, biometrics, contacts, children-related app usage, or financial app usage. Do not upload screenshots that contain information you are not authorized to share.
Celo is a general-audience service. It is not directed to children under 13, and children under 13 may not create accounts or use the Services. A parent or legal guardian who scans a child device is responsible for having the authority to upload the screenshot and review the resulting report.
5. How we use information
We use information for the following purposes:
- Create, authenticate, secure, and maintain accounts.
- Compress, upload, validate, process, and delete screenshots.
- Detect apps, fetch or associate privacy-policy text, create AI-assisted scan reports, show risk scores, and recommend alternatives.
- Provide scan credits, paid credit packs, checkout, billing status, refunds or payment support where available, and fraud-prevention or purchase-verification workflows.
- Operate referral links, newsletter preferences, support, account deletion, abuse prevention, rate limits, troubleshooting, service reliability, security monitoring, and legal compliance.
- Send transactional, administrative, service, security, account, billing, policy-change, product-update, privacy-awareness, recommendation, and marketing emails where permitted by law and your communication preferences.
- Improve the Services using aggregated or deidentified operational metrics where practical.
6. AI processing and report limits
To generate reports, Celo may send screenshot-derived data, detected visual elements, app names, public privacy-policy text, app metadata, prompts, and related report context to AI model providers, backend workers, or other processors that help operate the scan pipeline. We do not use your uploaded screenshots to advertise to you or sell your personal information.
Reports are based on available inputs at the time of processing. App behavior can differ from privacy-policy text, policies can change, policies can be unavailable or misleading, app stores can show duplicate or similar apps, icon sources can be wrong, and model outputs can be incorrect. We do not guarantee that any report identifies every app, uses the correct app icon, describes every privacy practice, detects every tracker, or recommends the best possible replacement.
7. Payment providers and RevenueCat
Celo uses RevenueCat Purchases JS for web checkout and entitlement management. RevenueCat may work with payment processors such as Stripe depending on checkout configuration. RevenueCat identifies customers with an app user ID. For signed-in Celo users, we use the Supabase user UUID as the RevenueCat app user ID so purchases and scan credits can be associated with the correct account. Where anonymous RevenueCat identity is needed before sign-in, the browser may store a generated anonymous RevenueCat ID in localStorage.
RevenueCat and payment processors may collect or receive technical identifiers, device/browser information, IP-derived location, transaction information, receipts, purchase tokens, email, fraud-prevention signals, and payment details as needed to process payments, prevent fraud, confirm that you are the purchaser, restore purchases, manage entitlements, calculate taxes, and provide support. We do not control those providers privacy practices.
8. Cookies, tracking, and analytics
We use cookies and similar technologies for authentication, referrals, checkout identity, security, fraud prevention, basic functionality, and aggregated public-page analytics. Referral cookies are HTTP-only, same-site lax cookies and last up to 30 days. Supabase auth cookies keep you signed in and refresh sessions. RevenueCat localStorage helps associate checkout activity with the correct purchaser or anonymous purchase flow.
Vercel Analytics and Speed Insights are used only on public pages as configured in the application. They are blocked from private routes in our layout code. We do not use Celo to display behavioral advertising, and we do not sell personal information for targeted advertising.
9. Email notices, newsletters, and marketing
If you create an account, request support, purchase credits, subscribe to the newsletter, opt in to product communications, or otherwise provide an email address, we may use that email address to send messages related to the Services. These messages may include account notices, authentication and password emails, billing or credit information, service-status updates, security alerts, legal or policy notices, product changes, feature updates, privacy-risk education, app-privacy recommendations, privacy-protection tips, awareness campaigns, surveys, promotional offers, and other marketing communications.
By subscribing to the newsletter or opting in to marketing communications, you consent to receive marketing and educational emails from Celo. You may unsubscribe from marketing or newsletter emails by using the unsubscribe mechanism where provided or by contacting us. Even if you unsubscribe from marketing, we may continue sending non-marketing transactional, security, account, billing, legal, and service-related notices that are necessary to provide, administer, protect, or enforce the Services.
11. Retention and deletion
Uploaded screenshots are intended to be temporary processing inputs. Screenshots are deleted within 7 days after upload unless a shorter deletion occurs, a deletion fails and requires retry, or we are legally required to preserve data. The database tracks `image_deleted_at` and cleanup errors so deletion can be monitored.
Scan reports, detected app metadata, account information, credit history, RevenueCat event records, referral records, newsletter settings, and security logs may be kept while your account exists and for as long as reasonably necessary for service operation, fraud prevention, tax/accounting, dispute resolution, legal compliance, backups, and enforcement. When we no longer need personal information, we delete, deidentify, or isolate it according to operational constraints.
You can request account deletion from the account page. Once requested, we will deactivate or delete account data from active systems subject to fraud-prevention, security, accounting, legal, backup, and dispute-resolution exceptions. Some third-party providers may retain transaction or security records under their own legal obligations.
12. Your choices and rights
You may access the dashboard to view scans and credits, use the account page to request account deletion, change newsletter preferences from the newsletter page, reject or delete browser cookies through browser settings, and contact us about access, correction, deletion, portability, opt-out, or appeal requests.
Depending on where you live, including certain U.S. states, you may have rights to know whether we process personal data, access data, correct inaccuracies, delete data, obtain a portable copy, opt out of targeted advertising, sale, certain profiling, or sensitive-data processing, limit certain sensitive-data uses, and appeal a denied request. We do not sell personal information, and we do not use Celo scan data for targeted advertising.
To exercise a privacy right or appeal a denied privacy request, use the account page where available or email innovation43veryone@gmail.com. We may need to verify your identity or authority before completing a request, and we will respond as required by applicable law.
13. Security
We use reasonable technical and organizational measures designed to protect personal information, including authenticated Supabase access, row-level security policies, private storage for scan uploads, route-level protections, input validation, and provider security controls. No website, storage provider, model provider, payment system, or internet transmission is perfectly secure. You use the Services at your own risk and should avoid uploading screenshots containing unnecessary sensitive information.
14. International users
The Services are operated from the United States and use providers that may process information in the United States and other jurisdictions. By using the Services, you understand that your information may be processed outside your state, province, or country, where privacy laws may differ from those where you live.
15. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date shows when it was last revised. Material changes may be announced through the Services, email, or another reasonable method.
16. Contact
Contact Innovation 4 3veryone, LLC about this Privacy Policy or privacy requests at innovation43veryone@gmail.com or by mail at 9218 Mill Circle, Tampa, FL 33647, United States.