Privacy policy — Wijetto

Who is responsible for your data?

This policy describes the processing of personal data relating to the Wijetto iPhone app and the wijetto.com website.

Data controller: Tom Le Laurain, sole trader
Business address: 25 rue Leroyer, 94300 Vincennes, France
Contact: [email protected]

The data Wijetto uses

Your account and profile: Email address, account ID, sign-in method, display name, optional profile picture and creation and update dates. You sign in with an email code, Apple or Google: Wijetto does not ask for a password. Depending on your chosen method, Apple or Google provides us with an identifier and the authorised profile information, including your email, which Apple may hide.
Your duo and exchanges: Pairing code, your Buddy’s identity, pairing and unpairing dates, sent and received creations, Museum images and metadata (author, recipient, dates and identifiers), sending activity, shared streak, the duo’s time zone and any streak restorations. The time zone defines the duo’s days; it is not GPS location data.
Your photos and stickers: The photos you choose to use and the resulting compositions. Stickers are cut out on your iPhone, without a remote background removal service. Your personal collection is stored locally; Plus lets you back it up in private online storage. A sticker included in a sent wijetto forms part of the image delivered to your Buddy.
Your device and preferences: Technical installation and widget identifiers, notification tokens, language, display preferences and data needed for your session, synchronisation and receiving creations. Technical data such as IP addresses, request dates and errors may appear in service providers’ logs.
Your subscription: Account ID linked to purchases, purchased product, transaction identifiers, store, purchase and expiry dates, trial and renewal status and Plus entitlements. Apple processes payments; Wijetto does not receive your bank card number.
Your support requests: Email address, subject, message content and exchanges needed to respond. The in-app form uses your account’s email address; it sends the message by email without storing its text in the app’s database.

We do not request access to your contacts, GPS location or microphone. We currently include no advertising, audience analytics or marketing tracking.

Why do we process data, and on what basis?

Running your account and duo: Authentication, profile, pairing, sending and receiving wijettos, Museum, streaks, synchronisation and Plus features: performance of the contract for using Wijetto (Article 6(1)(b) GDPR).
Managing your subscription and requests: Verifying purchases, granting Plus access and service-related support: performance of the contract. For general enquiries without a contractual relationship, our legitimate interest in responding to the person contacting us (Article 6(1)(f)).
Enabling optional notifications: Visible notifications about pairing or unpairing, streak or inactivity reminders and duo anniversaries: consent (Article 6(1)(a)), which you can withdraw in iOS settings. Technical communications required to refresh the widget are part of performing the service.
Protecting the service: Preventing abuse, limiting attempts, controlling access and diagnosing incidents: our legitimate interest in ensuring the service’s security and reliability (Article 6(1)(f)).
Meeting our obligations: Keeping legally required documents, responding to authorised authorities and meeting accounting obligations: legal obligation (Article 6(1)(c)). Retaining evidence needed for a dispute is based on our legitimate interest in defending our rights.

Data essential to your account, delivering creations or verifying a purchase is required for those features. Your profile picture, use of photos and permission for notifications are optional. Declining them does not prevent you from using the other available features.

Wijetto does not make decisions producing legal effects on you based solely on automated processing and does not carry out advertising profiling.

Who can access your data?

Your display name, profile picture and shared creations are accessible to your Buddy within the duo. There are no public profiles, directories or user searches. Wijetto does not show your email address to your Buddy.

Content is stored in private spaces with access controls. It is not end-to-end encrypted. The publisher and its service providers may need to access it as necessary for operation, support, security or compliance with a legal obligation. We do not sell your personal data.

Supabase: Authentication, database, private storage of avatars, creations and backed-up stickers, and server functions. Wijetto’s project is located in the London region (United Kingdom). Supabase privacy.
Apple and Google: Account sign-in if you choose one of these providers. Apple also handles App Store distribution, payments and notification delivery on iPhone. These providers also process some data for their own services. Apple privacy and Google privacy.
RevenueCat: Managing and verifying purchases and Plus entitlements using your account ID and technical purchase information. Wijetto does not send your drawings or photos to RevenueCat to manage your subscription. RevenueCat privacy.
Expo: Routing certain notifications: notification token, content and necessary technical information. A notification may include your Buddy’s display name. Expo privacy.
Resend: Sending sign-in codes and forwarding support requests: email address and the relevant message content. Resend privacy.
Cloudflare: Hosting and delivery of wijetto.com through Cloudflare Pages. Cloudflare processes technical request data needed to deliver and secure the website, including IP addresses. Cloudflare privacy.
Hostinger: Hosting of the contact email service. Hostinger processes received emails and the technical data needed for this service. Hostinger privacy.

Data may also be disclosed to the competent authorities where required by law. For more information about the recipients of your data, email [email protected].

Where is your data processed?

The Supabase database and app storage are configured in London. As of the date of this policy, the United Kingdom benefits from a European Commission adequacy decision allowing these transfers.

Some providers and their subprocessors operate in other countries, including the United States. Depending on the recipient, transfers must be covered by an applicable adequacy decision or appropriate safeguards, including the European Commission’s standard contractual clauses, together with any necessary measures.

You can request information about processing locations and a copy of the applicable safeguards at [email protected].

How long is data kept?

Account, profile and Museum: Until account deletion or an applicable erasure request. Creations published in the Museum do not expire automatically. No automatic deletion for simple inactivity is currently planned.
Stickers backed up with Plus: Until they or the account are deleted. Ending a Plus subscription does not, by itself, delete a collection already backed up.
Abandoned uploads: Files uploaded for a send that was never published are eligible for cleanup after 24 hours. This cleanup does not affect published creations.
Support: Two years after the request is closed, unless longer retention is necessary for a dispute or legal obligation. This period applies to exchanges retained in the support mailbox.
Purchases and supporting records: Information needed for Plus access is retained to manage the subscription and related requests. Accounting documents we are legally required to retain are kept for ten years. Transaction data retained by Apple is also subject to its own obligations.
Technical logs and backups: These follow the retention cycles of the relevant services and are not used as a permanent history of your creations. Retention periods vary by provider and service configuration; you can contact us to find out which apply to your request. In a dispute or incident, only the necessary data may be isolated for the time needed to handle it or for the applicable limitation period.

Local data (drafts, preferences, stickers and Museum copies) may remain on your iPhone. Signing out does not necessarily delete these files. Uninstalling removes the app’s local data on that device, subject to backups managed by the operating system.

Deleting your account and creations

You can request deletion of your account from Profile → Delete my account, or by emailing [email protected]. We may verify that the request comes from the account holder.

Deletion in the app deletes the Supabase account, profile, avatar, duo, backed-up stickers and online archives of wijettos sent or received by that account. This may also remove those online archives for your former Buddy.

It does not remotely delete copies already downloaded, exported or saved by your Buddy, screenshots or personal device backups. Any residual technical backups follow their renewal cycle.

Support records and purchase data held by providers are not all automatically erased by the in-app action. For a broader erasure request, contact us: we will also address remaining data and requests to our processors, subject to applicable retention obligations.

Deleting your account or the app does not cancel your Apple subscription. You must also cancel it in your Apple account settings.

Permissions and storage on your iPhone

The camera is used to take a photo for a creation, a sticker or your profile. The photo library lets you choose images to import. Wijetto does not automatically upload your entire photo library.

Visible notifications are optional. You can change permissions in iPhone Settings → Apps → Wijetto or in notification settings. Turning them off may prevent the relevant reminders and alerts. Some notifications may be visible on the lock screen: you can hide their previews in iOS.

The app stores information needed to operate on your device: session, preferences, drafts, sticker collection and local copies of creations. This storage is not used for advertising tracking.

In its current version, the website includes no advertising or audience measurement cookies and has no data collection form. The website’s fonts and visual resources are served locally. Visiting the website nevertheless generates technical requests to the hosting provider.

The website saves your language choice in your browser’s local storage for future visits. This preference stays on your device and is not used for advertising tracking.

If you are under 18

Wijetto is intended for people aged 13 and over. If you are a minor, your legal representative’s permission is required to use the service and take out a subscription.

In France, where processing relies on consent, children under 15 must consent jointly with a holder of parental responsibility. In other countries, applicable local thresholds and rules must be followed. The minimum age of 13 does not replace these requirements.

If you are a parent or legal representative and want to exercise your child’s rights or report use of the service by a child under 13, email [email protected].

Your rights and how to exercise them

Depending on your situation and the GDPR’s conditions, you have rights of access, rectification, erasure, restriction and portability of your data. You can object to processing based on our legitimate interests on grounds relating to your particular situation. You can also withdraw your consent at any time, without affecting processing already carried out.

To exercise your rights, email [email protected] with the address associated with your account and your request. We only ask for additional proof of identity if there is reasonable doubt about your identity, and in a proportionate manner.

We normally respond within one month. If the complexity or number of requests requires an extension, this period may be extended by two months; we will inform you within the first month and explain why.

You may also set instructions concerning your data after your death under French law, and lodge a complaint with the CNIL or the data protection authority in your country of residence.

Changes to this policy

This policy may change if the service, its providers or applicable rules change. The update date appears at the top of the page. If a substantial change affects your data, we will inform you through an appropriate channel, including in the app or by email. If new processing requires your consent, we will request it before it begins.

Any questions? [email protected].