StidyPrivacy policy
This policy explains what personal data the Stidy app (the "App") collects, why, and what your rights are. It complies with the EU General Data Protection Regulation (GDPR).
1. Data controller
Ophelie Baribaud (full details in the terms). Contact: ophelie@stidy.app.
2. Data we collect
| Data | Why |
|---|---|
| Account: anonymous technical identifier and, if you choose, email, Apple or Google identifier, display name, public friend ID | Create and secure your account, let you recover your data and be added by friends |
| App content: habits, check-ins, streaks, to-dos, mood, settings | Run the App and compute your streaks and statistics |
| Journal: notes and optional photos | Let you keep a journal. Notes are encrypted (AES-256-GCM) before being stored |
| Social: friends, groups, reactions, reports | Social features and moderation. Friends only see your total streak count, never the details of your habits or your journal |
| Notifications: push notification token, history of notifications sent | Send you reminders and friend alerts, and respect sending limits |
| Subscription: subscription status (via RevenueCat, Apple or Google). We never receive your card number | Enable Plus features where applicable |
We do not collect your location, your contacts or any advertising identifier, and we do not show ads.
3. Legal bases
- Performance of a contract: providing the App and its features.
- Consent: push notifications and photos, which you can withdraw at any time in your phone settings.
- Legitimate interest: security, abuse prevention and moderation.
- Legal obligation: retaining billing records.
4. Recipients and processors
We do not sell or rent your data. It is processed by the following providers, only to run the App:
- Amazon Web Services (server, database and photo storage hosting), Europe (Paris) region.
- Google Firebase (authentication and push notifications).
- RevenueCat (subscription management), as well as Apple and Google (payments via app stores).
Some of these providers may process data outside the European Union, notably in the United States. Such transfers are covered by appropriate safeguards (European Commission standard contractual clauses or an adequacy decision).
5. Retention
Your data is kept as long as your account exists. When your account is deleted, it is erased, except for items we are legally required to keep (for example billing data, held by Apple, Google or RevenueCat). Technical backups are purged within a reasonable time.
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent. To exercise them, write to ophelie@stidy.app; we reply within one month. You may also lodge a complaint with your local data protection authority (in France, the CNIL).
7. Security
Traffic to our servers is encrypted (HTTPS), journal notes are encrypted at rest, and access to data is restricted. No system is infallible; we will notify you of any data breach as required by law.
8. Children
The App is intended for people aged 15 and over. Below that age, the consent of a parent or legal guardian is required. If you believe a child has given us data without that consent, contact us so we can delete it.
9. Changes
We may update this policy. For significant changes, we will let you know in the App. The last-updated date appears at the top of this page.