Version 1.0 of 3 November 2026, effective on publication. Any material change is announced at least 30 days in advance. When the company operating ERERE is incorporated, its name will replace the current one, with the same notice. This is a translation: the Italian text prevails.
Francesco Salustri, an individual, owner of ERERE. Contact: fishmania@pec.it (certified email).
ERERE analyses your history inside ERERE (the choices you make and the events you tell us about) to explain why you choose as you do and to answer in a way that suits you. It does this only for you: no selling, no advertising, no scores, no comparison with other people. The analysis is on from sign-up and you can turn it off at any time in Settings › Consents: ERERE stops and deletes the descriptions of your events. Under 14, a parent's authorisation is required; a minor's history stays theirs alone.
Your email is not stored in clear text: with Google or Apple the system keeps only a cryptographic fingerprint of it. The Diary, True Face photos and the Archive are encrypted; Archive files and messages are encrypted on your phone and the server cannot read them. No advertising cookies, no profiling for third parties.
Today ERERE does not process health data or biometric data (such as voiceprints). If we offer features that use them in the future, they will be optional, active only with your explicit and separate consent, after an impact assessment, and this policy will be updated at least 30 days in advance. The face or fingerprint you use for passkeys stays on your device and never reaches us.
If you use a passkey we store only its public part, an anti-cloning counter, the device type and the dates it was added and used. The private part stays on your device; your face or fingerprint never leaves the device and never reaches us.
If you share Archive storage with your family, we store who the organiser is, who the members are, the name each member chooses to be recognised by (optional) and the joining date; for invitations, only a fingerprint of the code and its expiry. The organiser sees that name and the storage each person uses, never their files or account identity. Legal basis: performance of the contract. Deleting your account removes you from the family.
When you share a file or folder, the server stores only which files, how long the link is valid and how many times it was opened; for a folder, also the file keys wrapped with the link's key, which open nothing without the link. The key that opens the file is in the link, after the # sign, and never reaches the server.
When you carry other people's messages, your phone briefly stores encrypted envelopes it cannot read. The server sees only counts, never sender, recipient or content. SOS messages and your location, if you share it, reach only your emergency contacts.
The up-to-date list of providers, with location and safeguards, is available from the contact above.
Some providers (for example Stripe for payments) may process data in the United States or other countries. This happens only with GDPR safeguards (Articles 44–49): an adequacy decision, including the EU–US Data Privacy Framework for certified providers, or the European Commission's standard contractual clauses. You can ask for a copy at the contact below. Encrypted content (Archive, messages) stays unreadable wherever it is.
United Kingdom: you have the same rights under the UK GDPR and can contact the Information Commissioner's Office. California and other US states: we do not sell or share your personal data for targeted advertising and do not use sensitive data to infer characteristics about you; you have the right to know what data we hold, to correct it, to delete it and not to be discriminated against for exercising these rights: use the same tools described above. Other countries: we apply the same protections plus the mandatory ones of your law.
Below the minimum age of digital consent you cannot sign up. Minors' data never enters the commercial circuit or aggregated data.
We use only strictly necessary technical cookies: the session (erere_session) and protection against forged requests (erere_csrf). The browser's local storage keeps preferences such as theme and language. No profiling or third-party cookies: that is why no consent banner is needed.
The IO that does it for you first uses ERERE's own model, on ERERE's own machine; if that is not enough, only artificial intelligence providers whose contract excludes using the data to train their models (ERERE constitution, article C16). We do not keep your requests to the IO unless you choose to teach. Collective knowledge: if you choose so for a certified Consulta answer, we keep the question and answer with no reference to you, to answer others; questions containing personal data are not kept. Community learning (adults only, legitimate interest, GDPR art. 6(1)(f)): ERERE learns from the community, never from the individual. Your requests to the IO, the answers, your ratings and corrections are kept for at most 90 days only to be counted together with everyone else's; only what at least 5 different people expressed in the same way enters ERERE's model, without names. You can object at any time with one tap from the IO page (art. 21): what you gave is deleted immediately.
ERERE's model also learns from open texts (Wikipedia, public-domain books, openly licensed web collections and open web pages read by ERERE-bot). Your data in ERERE never enters this collection. If personal data appears in public texts, we process it on the basis of legitimate interest (GDPR art. 6(1)(f)): emails, phone numbers, IBANs, tax codes and IP addresses are masked, and sites that object are excluded. Site owners can object at any time: everything is explained on the ERERE-bot page, together with the public summary of the training data.
ERERE does not take decisions with legal effects on you solely by automated means. When the I.O. answers, it is stated that it is an artificial intelligence system.