Privacy Policy

Last updated: July 9, 2026

Fabled SL (“we”, “us”, or “our”) operates the Fabled app and the website fabled.co (together, “Fabled”).

We respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and Spanish data protection law. This policy explains what we collect, why, and the rights you have.

1. Who we are

Data controller: Fabled SL, a company incorporated in Spain.
Contact: hello@fabled.co

2. Information we collect

We collect the following categories of data, most of which you provide directly:

Account information — your email address, a password (stored securely and never in plain text), your username, and any profile details you choose to add, such as a display name, bio, and avatar photo.
Content you create — the photos and images you upload (to your objects, collections, profile, community posts, marketplace listings, and chats) and the text you post, including objects, collections, posts, comments, and marketplace listings.
Messages — the content of direct messages you exchange with other members, and any messages you send us for support.
Technical data — if you enable notifications, a push notification token used to deliver them, plus the basic authentication data required to keep you signed in and operate the app.
Usage and device data — analytics about how you use the app (for example which screens you view and which features you use), together with your device type, operating system, and app version. Our analytics do not capture the content of your posts, messages, or searches.

We do not collect your location or contacts, we do not process any payment or financial information, and we do not use advertising identifiers.

3. How we use your information

To create and operate your account and provide the Fabled service.
To display your collection and enable communities, the marketplace, and messaging between members.
To send notifications (push and email) that you have opted into.
To keep Fabled secure, prevent abuse, and enforce our Terms of Service.
To understand how Fabled is used so we can improve it, using privacy-friendly product analytics that do not capture the content of your posts or messages.
To respond to your questions and provide support.
If you use the optional object-identification feature, the photo you submit is processed by a third-party AI provider to identify the item and research its value.

4. Legal bases for processing

Performance of a contract (Art. 6(1)(b) GDPR) — to provide the service you sign up for.
Consent (Art. 6(1)(a) GDPR) — for push notifications and any marketing emails. You can withdraw consent at any time.
Legitimate interests (Art. 6(1)(f) GDPR) — to keep the platform secure and to improve it.

5. Sharing your information

We do not sell your personal data. Your public profile and public content (for example your username, bio, avatar, public objects, posts, listings, and comments) are visible to other members, and where public, to visitors.

We use trusted service providers who process data on our behalf, only as needed to provide their service:

Supabase — database, authentication, and file/image storage.
Expo, Apple Push Notification service (APNs), and Firebase Cloud Messaging (FCM) — to deliver push notifications.
Resend — to send account and notification emails.
Google — to power the optional object-identification and value-research feature from photos you submit.
PostHog (EU region) — product analytics to understand how the app is used and to improve it.

6. International data transfers

Some of our providers are located outside the EU/EEA (for example, in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

7. Data retention

We keep your personal data for as long as your account is active. If you delete your account, we delete your personal data and content, except where we are required to retain limited information to comply with a legal obligation or to resolve disputes.

8. Your rights (GDPR)

You have the right to:

Access, rectify, or erase your data
Restrict or object to processing
Withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal)
Data portability
Lodge a complaint with the Spanish Data Protection Authority (AEPD): https://www.aepd.es

To exercise any of these rights, email us at hello@fabled.co.

9. Deleting your account

You can delete your account at any time from within the app (Settings → Delete account) or at fabled.co/settings/delete-account. This permanently removes your account and associated data.

10. Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit and access controls. No method of transmission or storage is completely secure, but we work to protect your information against unauthorised access, alteration, or loss.

11. Children

Fabled is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18.

12. Changes to this Privacy Policy

We may update this policy from time to time. The “Last updated” date at the top will be changed accordingly. We recommend you review it periodically.