Know what you’re sharing.
candoany is a public space for art, ideas, and thoughtful connection. You can browse public material without an account. This page describes its account and privacy practices; the Privacy panel inside candoany includes details and controls for individual features.
Website information, policies & help · Terms of Service
Your account and sign-in.
When direct Google or Apple sign-in is available, candoany receives a verified account identifier, email address, and any name you share from that provider. Your provider handles your password; candoany does not receive it. Apple may supply a private relay email address. Google, Apple, and ChatGPT create separate candoany accounts, including when email addresses match. Direct Google and Apple login does not require ChatGPT.
candoany stores the provider identifier and account details to recognize you and associate your records with your account. Direct login uses a Secure, HttpOnly browser session cookie for up to 30 days and a separate cookie remembering your account choice for up to a year. The server stores only a hash of the session token. Temporary sign-in state expires after 10 minutes. Provider tokens received solely for direct Google or Apple login are not retained. Optional YouTube and music connections have separate permissions and token storage, described below. Signing out revokes the current direct session and clears candoany’s hosted sign-in; it does not delete your contributions or private records.
Private messaging and group mentors.
Message attachments are private originals with access checked against current membership and join history, including playback, partial media requests, and downloads. Forwarding or sharing a file makes an independent authorized copy. Studio imports leave originals unchanged. Sharing a private message into a feed opens a draft with Only me selected; you review its destination and audience before publishing. Deleting or leaving the source does not recall copies already received, forwarded, or published.
Organizer stores your private calendar events, to-dos, daily goal definitions and per-day checks, timezone preferences, reminders and source references. Its progress analytics use your retained plans and checks; estimated or planned time is not measured activity. Unfinished item drafts may be saved in this browser’s account-scoped session storage. Importing a feed post or message requires current source access and creates a private planning copy after review. Sharing a plan opens an explicit message or feed draft and creates an independent snapshot; source chat pointers and private analytics are excluded. Organizer has its own controls and paginated account exports. Read the Organizer guide.
Companions stores connection requests, accepted relationships, request and discovery settings, and your own private favorites. Other participants see their relationship with you and your chosen contact display name/code. Your full list and preferences are private by default; name discovery is opt-in. You can separately review and enable public Companions sharing. Its guest-readable page publishes your chosen contact name/code and only accepted connections for which both participants enabled public sharing. The public names, links and counts exclude private connections, pending requests, favorites, sign-in identifiers and email. Turning sharing off withdraws future public reads, but cannot recall copies already made. Blocking uses the messaging block list and removes pending or accepted Companions connections. Unblocking does not restore them. Companions does not grant access to Only me posts, chat history, or private account profile fields. You can remove connections, manage requests and download your current Companions records in Account center. Read the Companions guide.
Global notifications show recent activity relevant to your account across candoany. Category controls, read/unread choices, and quiet mode are private preferences. Notification previews follow source permissions; private chat history and private saves or resonations are not made public through notifications. Read the notification guide.
Private direct and group messages are stored on candoany and accessible only through authorized membership. They are not end-to-end encrypted. New members see messages from when they join; pending invitations do not provide history access. Contact-name discovery is optional, and messaging contact codes do not expose your sign-in identifier or email. Blocking prevents direct messages and new invitations, while existing shared groups keep their membership.
Private Messages calls use Cloudflare RealtimeKit to transport the microphones, cameras and screen shares that participants explicitly enable. Calling uses your chosen Messages display name and an opaque media connection identifier. Only current accepted conversation members can join; direct calls additionally require both people’s acceptance and no block. Calls are excluded from public feeds and cannot broadcast or generate transferable room invitations. Leaving or removal from the conversation revokes access, and call hosts can manage admission and remove participants. candoany does not automatically record these calls. AI text mentors do not receive call audio, video or screen shares. In-app available-call notices reveal a call only to eligible chat members and do not join or start capture automatically. Read the Messages calling guide.
AI mentors receive a bounded recent text context after admission, together with explicit Ask mentor requests. Ordinary admission requires approval from every current human participant. In groups, creators and moderators can explicitly override missing or negative votes with a visible reason. Overrides can permit AI participation despite an individual objection. Membership or management-role changes pause AI for renewed admission. Earlier chat history and unrelated private records are not added to the provider request. Already transmitted context cannot be recalled. Read the private messaging and mentor permissions guide.
Public contributions and personal records.
Original posts have a Public or Only me audience. Public posts and attachments are visible to visitors; Only me and archived posts are accessible only to their owner. Responses follow the post’s current visibility. Chosen public names and explicitly published community records are public. Some aggregate progression and check-in activity is public; the in-app Privacy panel explains those features. Your journal, saved collection, preferences, private practice notes, and private mentor conversations are associated with your account and excluded from public contribution views. Records stay stored so you can return on another device.
You can delete your own posts, responses, journal entries, and private mentor conversations through their controls. Deleting a post removes its attachment and public responses from candoany. Others may already have copied public content. Optional community profiles and sharing controls can be changed in their respective features. Safety reports are private to the review workflow.
AI and external media.
Mentor and generation features identify the configured AI provider and ask for a sharing choice before sending the selected material. The sharing controls explain what context will be sent; signing in alone does not send your journal or private conversations to an AI provider. Public mentor conversations and scheduled public mentor activity use public material under their separate sharing rules.
External media and search features contact their named services when used. A search query or selected video identifier may be sent to the relevant service. Embedded media and linked sites have their own privacy practices. Device-local preferences and temporary drafts may use browser storage; they are distinct from records saved to your account.
The media hub can play files you explicitly select on your device without uploading them. That local queue lasts for the page session and is released when the page closes or your candoany account changes. Spotify and Apple Music are separate optional connections: after authorization, candoany keeps encrypted service tokens for your current account and uses them for the music features you choose. Disconnecting removes candoany’s retained access; provider account permissions can also be reviewed with the provider. Service SDKs and protected playback contact their respective services. Full playback depends on the provider’s subscription, app approval, and browser requirements.
Location posts and location check-ins store only the place name, selected coordinates, precision, optional address, and normal post details that you publish. Approximate sharing rounds coordinates and omits the address before saving. Your place name remains shared. Public posts can be read without signing in; private posts retain your normal audience controls. Check-ins are self-reported statements, not verified visits or live tracking. Device location is requested only when you choose Use my location, using a single reading.
Choosing Search sends your typed place query to Photon through candoany’s server; candoany does not forward your account identity, device coordinates, or browser cookies. Short-lived shared results are cached by query hash. Opening Explore map loads OpenStreetMap, which receives the displayed coordinates and your browser’s network request under its own privacy practices. Maps do not load automatically when scrolling through a feed.
YouTube search, playback, and optional account access.
How to connect YouTube and choose account permissions.
candoany uses YouTube API Services. Public catalog searches send your search text and selected filters to Google. candoany caches public video metadata and search results to provide discovery and playback links; your private interests are not appended to the Google search request. Embedded YouTube players contact YouTube directly and may serve advertisements and use cookies or similar browser storage under Google’s policies. By using candoany’s YouTube features, you agree to the YouTube Terms of Service. See the Google Privacy Policy for Google’s data practices.
Connecting a YouTube account is optional and separate from signing in to candoany with Google. After you authorize it, candoany can display your channel name and identifier, playlists and their contents, subscriptions, and liked videos. candoany stores encrypted access and refresh tokens, the granted permissions and expiry information, and your channel name and identifier with your candoany account so it can maintain this connection. Library pages are fetched when you request them; candoany does not persist separate copies of your playlists, subscriptions, or liked-video lists on its server. This connection does not provide your Google password, YouTube watch history, purchases, or Premium playback entitlement.
If you separately enable YouTube account controls, candoany can send the actions you choose to YouTube: rate a video, create a private playlist, add or remove playlist items, and subscribe or unsubscribe from a channel. Your connected YouTube library is not automatically published in candoany or sent to AI mentors. Account credentials and library responses are not included in mentor requests. Separate discovery and discussion features may use the public video metadata and candoany context you choose under their sharing controls.
Use Disconnect in the player’s YouTube account panel to clear candoany’s stored YouTube tokens, granted permissions, channel details, and pending connection state. candoany also attempts to revoke the grant with Google. You can independently revoke candoany’s access in your Google Account security settings. Revoking access there prevents further authorized access; use candoany’s Disconnect control to clear its retained connection details as well. Disconnecting does not undo playlist, rating, or subscription changes you already made on YouTube, and does not delete your separate saved discoveries or contributions in candoany.
Google user data is used for the account and player features you authorize. It is not sold, used for advertising, or used to train general-purpose AI models. candoany’s use and transfer of information received from Google APIs must follow the Google API Services User Data Policy, including its Limited Use requirements. A new use beyond the purposes already disclosed requires notice and your consent before it begins.
For questions or complaints about candoany’s Google or YouTube data practices, use the candoany developer contact address Google displays for candoany.com during authorization. The YouTube connection guide explains the available access, revocation, and removal controls.
candoany Market.
Published shops, listings, product photos, and purchase reviews are public. Your signed-in shopping bag, saved goods, and address book belong to your account. Order records and the delivery information needed to fulfill them are available to you and the relevant seller. Removing a saved address does not change an existing order’s delivery record.
Stripe handles hosted checkout, seller onboarding, bank details, and payouts under its own privacy practices. candoany stores the payment references, amounts, and statuses needed to manage orders, returns, and refunds; card numbers and bank account details are entered with Stripe. Digital files remain private to their seller and eligible paid buyers. A guest shopping bag stores public product identifiers and quantities on the device until it is cleared or moved into the signed-in account.
Your choices.
The Account center includes private profile details, default post audiences, response permissions, muted phrases, activity management, in-app notification choices, and paginated downloads of retained records. Public membership and measurement sharing remain separate choices. Archived posts retain their original audience for restoration, and restoring an archived post does not reverse a moderation decision.
For direct Google and Apple accounts, Account center lists active candoany sessions using separate management identifiers and basic browser labels where the actual browser is known. You can revoke an owned session. candoany does not infer an unknown device’s location or expose session tokens. Hosted ChatGPT session, password, and multifactor-authentication controls remain with ChatGPT. In-app notification choices do not register email or push delivery.
Use the same sign-in method to return to the same account. Review sharing choices before publishing or sending material to a provider. The Privacy panel and account settings inside candoany explain feature-specific data, publication, export, deletion, and measurement controls.