Privacy Policy

Effective date: September 20, 2026

Common is a dating app for adults who want to meet people who share their Catholic faith. This policy explains how we collect, use, share, and retain personal information when you use Common and contact our support team.

Common is operated by Somos Common S.A.S. de C.V., located at Calle Jorge Bravo 1525, Colonia Paseos del Sol, C.P. 45079, Zapopan, Jalisco, México ("Common," "we," "us," or "our"). This operator is responsible for the personal information described in this policy.

Privacy contact: [email protected]
Telephone: +52 33 11064347

1. Information we collect

Account and sign-in information

When you sign in with Apple or Google, we receive information used to authenticate you, including your provider identifier, authentication credentials, email address, and, when provided by the sign-in service, your name. If you use Apple's Hide My Email feature, we receive the relay email address supplied by Apple. We do not receive your Apple or Google password.

We create a Common account identifier and maintain session information so you can remain signed in and use your account across app sessions.

Profile information

We collect the information you enter when creating or editing your profile, including:

• Your name, date of birth, sex, and profile photos.
• Your country and state or region of residence, country of birth, and languages.
• Your Catholic movement or religious affiliation, biography, and favorite saint quotation.
• Your education level, preferences about having children and pets, and information you provide about exercise, alcohol consumption, and smoking.

We also maintain profile-verification status, account creation and activity information, and premium status. We use your date of birth to determine your age and eligibility to use Common.

Your profile's residence information comes from your selections. The current app does not request access to your device's precise GPS location.

Sensitive information

Your religious affiliation and other information you provide in your profile or communications may reveal religious beliefs or other information that receives special protection under applicable law. We use religious profile information to provide Common's profile, discovery, and connection features, including displaying it to other members. Where required by applicable law, this processing requires your explicit consent. Sharing is limited to the circumstances described in Section 3. You may withdraw consent as explained in Section 6.

Interactions and communications

We collect your discovery preferences, likes, saved profiles, mutual matches ("Commons"), blocked-user information, and related activity. When you use chat, we process your messages, the photos and videos you send, and associated information such as participants, timestamps, and delivery or read status.

If you contact us for support, profile verification, or to report a concern, we collect your contact details and the information and attachments you send. Reports from other members may also contain information about you.

Purchases and subscriptions

Apple processes payments for purchases made through the App Store. We and our subscription-management provider receive information needed to verify purchases, restore access, and manage subscriptions, including transaction identifiers, purchased products, subscription status, and account identifiers. We also share your account email address with our subscription-management provider. We do not receive your full payment-card details from Apple.

Usage, device, and diagnostic information

The app and its service providers collect technical information such as device and operating-system details, app version, IP address, identifiers, timestamps, network-request information, errors, crashes, and performance measurements.

We use third-party analytics services to understand how people use Common. This includes app launches, screens viewed, taps, onboarding, profile changes, likes, saved profiles, matches, and subscription activity. These records can be linked to your account identifier, email address, and premium status. Certain interaction events also include the identifier or name of the member you interacted with. This analytics information is not necessarily anonymous.

We use third-party diagnostic services to investigate errors and performance issues. Diagnostic information can be associated with your email address and account identifier. These services also capture session replays for a sample of app sessions and sessions in which errors occur. These replays represent in-app screens and interactions to help us understand what happened around a problem; they are not camera recordings. Diagnostic records may also include navigation, network, and error context.

Information stored on your device

Common stores session credentials, cached profile and chat information, preferences, and service identifiers on your device to keep you signed in and support app functionality. Removing the app does not itself delete information already stored on our servers or by our service providers.

2. How we use information and our legal bases

The table below explains how we use the information described in Section 1 and the legal bases for processing under the GDPR, including for users in Spain. In other countries, processing is subject to the consent requirements and other grounds recognized by the applicable local law; the GDPR bases are not universal exceptions to those requirements. Where we rely on legitimate interests, we consider your rights and interests and whether they override ours. Processing sensitive information also requires an applicable condition under the rules protecting that information; providing the service does not, by itself, satisfy that requirement.

You may withdraw consent or exercise applicable rights to object to processing as explained in Section 6. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Necessary and secondary purposes in Mexico: Account administration, profile and chat features, purchases, requested support, service security, and legal compliance are purposes needed for our relationship with you. Usage analysis to evaluate preferences and develop future features is a secondary purpose. You may decline that secondary use by emailing [email protected], without losing access to the core service. Processing sensitive information remains subject to the applicable consent requirements.

3. How information is shared

With other members

Other members can see the profile information presented in Common, including your name, age, photos, residence information, religious affiliation, biography, and other displayed profile details. Your likes and mutual matches can be visible through the relevant app features. Messages and attachments are shared with the participants in the conversation.

Other members may save or copy information you share, including by taking screenshots. Deleting information from Common cannot remove copies another person has independently saved.

With service providers

We share personal information with third-party providers that perform services for us or on our behalf. Depending on their role, these providers process information for:

• Hosting and storage: Operating our backend, databases, authentication infrastructure, and media storage, including account and profile information, photos, and operational records.
• Chat and communications: Providing chat accounts and conversations, including member names, profile photos, messages, media, and conversation information.
• Subscription management: Verifying purchases, restoring access, and managing premium subscriptions using account identifiers, email addresses, and purchase and subscription information.
• Analytics: Understanding usage and evaluating features using the account-linked activity information described above.
• Diagnostics and technical support: Investigating errors and performance issues using diagnostic records and session replays, which may be linked to your account as described above.
• Sign-in and payment services: Authenticating your account and processing purchases. Sign-in services and app stores also process information under their own privacy policies.

We require service providers processing personal information on our behalf to protect it consistently with this policy and applicable requirements, and to use it only for the services they provide to us.

Legal and business disclosures

We may disclose information when necessary to comply with applicable law or valid legal process, protect people's rights or safety, investigate fraud or abuse, or establish or defend legal claims. If Common undergoes a merger, acquisition, or transfer of its business, personal information may be transferred as part of that transaction, subject to applicable privacy obligations.

Sale and advertising

We do not sell your personal information or share it for targeted advertising, including advertising that tracks you across other companies' apps or websites. Our use of analytics and diagnostic providers is for operating and improving Common as described in this policy.

4. Device permissions

Common may request permission to access:

• Photos: To select profile photos and share images or videos in chat, or save media you choose to download.
• Camera: To capture photos or videos you choose to share.
• Microphone: To record audio when recording videos in chat.

You can manage these permissions in your device's Settings. Declining a permission may prevent the feature that needs it from working. Revoking a permission stops future access through that permission; it does not delete information you previously uploaded. Contact us or use the relevant deletion controls to request removal of that information.

5. Retention and account deletion

We keep personal information only for as long as reasonably necessary for the purposes described in this policy. In determining retention, we consider the type and sensitivity of the information, the purpose for which it is used, whether your account is active, and applicable legal requirements.

To delete your account in the app, open Mi Perfil (My Profile), select Eliminar cuenta (Delete account), and confirm. You can also contact [email protected] for assistance or to request deletion of personal information.

Account deletion removes your core profile and starts cleanup of associated information, including profile photos, likes, and chat account and conversation data. Photo cleanup runs separately and normally completes within a few minutes after account deletion. Account deletion is permanent, and your Common chats cannot be recovered through the app.

Common does not keep a separate archive of deleted accounts. Some information may remain with our service providers after account deletion, including analytics and diagnostic records used to understand usage and troubleshoot problems, subscription and transaction records used to administer purchases, and backup copies. Retention of these records depends on the relevant service's retention schedules and deletion processes, the purposes described above, and any applicable legal requirements.

You can contact [email protected] for information about retention or to request deletion of personal information, including information held by providers on our behalf.

Deleting your account or uninstalling Common does not cancel an App Store subscription. Manage or cancel your subscription through your Apple account's subscription settings or Apple's subscription-management page.

6. Your choices and privacy rights

You can edit supported profile fields and photos in the app and manage camera, microphone, and photo permissions in device Settings. You can also manage Common's sign-in connection through your Apple or Google account settings. Disconnecting a sign-in provider does not by itself delete your Common account.

Depending on the law that applies to you, you may have rights to access or obtain a copy of your personal information, correct it, request deletion, object to or restrict certain processing, receive portable data, and withdraw consent where processing relies on consent. Withdrawal does not affect processing that was lawful before you withdrew it. If withdrawn information is necessary for a feature, we may no longer be able to provide that feature.

To exercise a right or withdraw consent, email [email protected] and describe your request. We may need to verify that the request concerns your account before acting. We handle requests without charge where required, respond within the period required by applicable law, and explain any applicable limitation or exception. Rights, conditions, and deadlines differ by country. You may also have the right to complain to your local data-protection authority.

Users in Mexico

This policy is Common's comprehensive privacy notice (aviso de privacidad integral). You may exercise rights of access, rectification, cancellation, and opposition (ARCO), revoke consent, or request limits on use or disclosure by emailing [email protected], our privacy contact.

Include your name, a reply address, the right requested, and information identifying the relevant records. For corrections, explain the changes and provide supporting information. We will explain the identity-verification requirements; a representative must also establish their authority. We reply electronically and can provide electronic copies.

For ARCO requests, we communicate our decision within 20 business days of receipt and, when granted, act within 15 further business days. Each period may be extended once for an equal period when legally justified; we will explain an extension or refusal. Exercising these rights is free, subject to legally permitted copying or delivery charges. Cancellation can involve restricted storage before final erasure where legally required.

Consent withdrawal and requests to limit use follow the same contact procedure. Withdrawal does not invalidate earlier lawful processing or prevent processing required by law. You may seek protection of your rights from the Secretaría Anticorrupción y Buen Gobierno.

Users in Brazil

Under Brazil's LGPD, you may request confirmation of processing, access, correction, portability as provided by applicable rules, and anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed information. You may request deletion of information processed with consent, subject to lawful retention exceptions; information about the public and private entities with which we share information; and information about the possibility and consequences of refusing consent.

You may withdraw consent, object to processing based on a consent exception when it violates the LGPD, and request review of decisions made solely by automated processing that affect your interests, including information about the criteria and procedures used, subject to legal protections for trade secrets.

For confirmation and access, we provide a simplified response immediately or a complete statement within 15 days, as applicable. Contact [email protected] to exercise your rights. If your request remains unresolved, you may petition the ANPD.

Other Latin American rights

The following provisions apply where the relevant country's law governs your information. They supplement the rights and request procedure above and do not limit protections available in other countries.

• Argentina: You may request access, correction, updating, deletion, and confidential treatment where applicable. Access requests are answered within 10 calendar days; correction, updating, and deletion requests within five working days. The Agencia de Acceso a la Información Pública (AAIP) receives complaints concerning violations of personal-data rights.
• Colombia: You may know, update, and correct your information, request proof of authorization and information about its use, and request revocation of authorization or deletion where applicable. Queries are answered within 10 working days and claims within 15 working days, with legally permitted extensions explained to you. You may complain to the Superintendencia de Industria y Comercio (SIC) after first completing the applicable query or claim procedure with us.
• Costa Rica: You may request access, correction, or deletion, free of charge, with requests resolved within five working days. You may seek protection from the Agencia de Protección de Datos de los Habitantes (PRODHAB).
• Ecuador: You may request access, correction or updating, deletion, objection, portability, suspension of processing, and protection concerning qualifying automated decisions, and withdraw consent. You may seek protection from the Superintendencia de Protección de Datos Personales (SPDP).
• El Salvador: You may exercise rights of access, rectification, cancellation, opposition, portability, forgetting, and restriction where applicable, and seek protection from the Agencia de Ciberseguridad del Estado (ACE).
• Peru: You may request information, access, correction, updating, inclusion, cancellation, and objection under applicable conditions. You may seek protection from the Autoridad Nacional de Protección de Datos Personales (ANPD) of Peru.
• Uruguay: You may request access, correction, updating, inclusion, and deletion, and challenge qualifying automated decisions. Access and correction or deletion requests are generally handled within five working days. You may complain to the Unidad Reguladora y de Control de Datos Personales (URCDP).
• Panama: You may exercise access, rectification, cancellation, opposition, and portability rights and complain to the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI).
• Chile: You may request information about your data, its source, recipients, and purposes, and correction, deletion, or blocking where applicable. You may seek protection through the competent courts.

Users in Spain

For our services offered to people in Spain, the EU General Data Protection Regulation (GDPR) applies. You have rights of access, correction, erasure, restriction, objection, and data portability, subject to the conditions established by that regulation. You may also withdraw consent where processing relies on it.

We respond to GDPR rights requests without undue delay and normally within one month of receiving them. If complexity or the number of requests requires an extension, we may take up to two additional months and will explain the extension within the first month. Requests are generally free; legally permitted exceptions apply to manifestly unfounded or excessive requests.

You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) or another competent supervisory authority. You do not need to contact us first to exercise that right.

7. International transfers

Common and its providers may process information outside the country where you live, where data-protection laws may differ.

Common's operator is located in Mexico. Our backend and data are hosted in the United States. When you use Common from Spain or Latin America, your information is transferred to and stored in the United States as part of providing the service. Our other service providers may process information in countries where they operate.

For transfers from the European Economic Area, our service-provider agreements include European Commission-approved Standard Contractual Clauses, which require recipients to protect personal information, and reliance on the EU–US Data Privacy Framework where the recipient is certified and the transfer is covered. The applicable mechanism depends on the provider and transfer. You can contact [email protected] for more information or a copy of the applicable safeguards.

8. Security

We use technical and organizational measures intended to protect personal information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage can guarantee complete security. If you believe your account or information has been compromised, contact us at [email protected].

9. Adults only

Common is intended for people 18 years of age or older. People under 18 must not create an account or use the service. If you believe a person under 18 has provided personal information to Common, contact us so we can investigate and take appropriate action, including removing the account and associated information.

10. Changes and contact

We may update this policy when our practices or legal obligations change. We will publish the updated version with a new effective date and provide additional notice or request consent where required by applicable law.

For privacy questions or requests, contact:

Somos Common S.A.S. de C.V.
Calle Jorge Bravo 1525, Colonia Paseos del Sol, C.P. 45079, Zapopan, Jalisco, México
[email protected]
Telephone: +52 33 11064347