Skip to content
Chaud?

Privacy policy

Version 1.0.0, dated November 6, 2026
Contents14 sections

1. Data controller

Chaud ? is published by Sofiane Msatfa, 28 avenue Audra, 92700 Colombes, France, who is the controller of your data. You can reach him at the address given in section 14.

2. Data we collect

To create your account and let you use the app, we store:

  • Your account: e-mail address, password if you have one (kept as a hash, never in clear text), language, the date you confirmed being 15 or older, the date you accepted the terms and this policy with their version, and your choice to help improve the app (section 6), as well as how you signed up (e-mail, Google or Apple) and, for Google or Apple, the identifier that service gives you and the tokens it hands us at sign-in, which we never use to reach your account there; for Apple, the token that lets us cut the link when you delete your account.
  • Your profile: pseudo, display name, avatar (an illustration chosen in the app or a photo you send), phone number if you give one and its fingerprint, your choices to be found by your pseudo and by your number, and your appearance preferences.
  • Your people: your contact requests (including the ones you decline, so they are not shown to you again), your contacts, the people you block, your groups.
  • Your events: the outings, polls, photo choices and alerts you create or are invited to, your answers, votes and ratings, the date you saw an alert, and the invitation links you generate.
  • Your conversations: your messages, photos, reactions, mentions, and how far you read each conversation.
  • Your devices: the notification tokens of your phones, to send you the notifications you accepted.
  • Your reports: what you report, the reason you chose and your optional comment.
  • The moderation of your account: if a moderator suspends it, the reason they wrote, until reactivation; and whether you are a moderator yourself.
  • Technical data: creation and sign-in dates; the IP address and the kind of device or browser of each session, kept with it; the IP address in the counters that limit attempts; a fingerprint of the e-mail address a code was just sent to, to limit sending; and the information described in section 6.

Someone who answers an invitation without an account gives us only the first name they choose and their answer; their browser keeps a key that lets them change that answer. If they then create an account, their answer is attached to it and the first name and key are forgotten.

We use this data to:

  • Run the service you asked for (legal basis: performance of the contract): keep your account, connect you with your people, show events and conversations, send you the e-mails and notifications about your account and your events.
  • Protect the service and its members (legitimate interest): limit abuse, handle reports, suspend accounts that break the terms.
  • Fix errors (legitimate interest, with as little data as possible, section 6).
  • Understand how the app is used (your consent, given during onboarding and withdrawable at any time in the Profile tab, section 6).
  • Meet our legal obligations, for instance answering a request from an authority.

We never sell your data and we show no advertising.

4. Address book and finding your people

The app can show you which of your phone contacts already use Chaud ?. This search is optional: it only happens if you allow access to your address book, and you can withdraw that permission at any time in your phone settings.

The numbers in your address book never leave your phone. For each number, the app computes a fingerprint: a string derived from the number that cannot be turned back into it. Only these fingerprints are sent to our servers, which compare them with those of members who agreed to be found by their number. They are neither stored nor reused: they are forgotten as soon as the comparison is done. Names, addresses and any other information in your address book are never read.

This technique has a limit we would rather explain: because phone numbers are few, someone computing the fingerprint of every possible number could recover the number behind a fingerprint. This is why the fingerprints of your address book are never kept, and why the number of searches per person and per day is capped. The fingerprint of your own number, however, is kept with your profile as long as your number is on it: it is what other people’s searches are compared with.

You only appear in other people’s searches if you entered your number and turned on "Findable by my number" in your profile. This setting is off by default.

5. What others see of you

Your profile (display name, pseudo, avatar) is visible to any member who finds you: by your pseudo if "Findable by my pseudo" is on (it is by default), by your link or QR code, by your former pseudo during the 30 days it stays reserved for you, by your number if you chose so, and to the people who share an event with you. Your e-mail address and your number are never shown.

Your messages and photos are visible to the people of the event. Moderators read them only when a report targets that message or one of the few neighbouring ones, text only: they do not see photos. We do not read conversations outside of a report.

Invitation links: when the creator of an outing or a poll shares its link, anyone holding it sees, without an account, the event, the display names of the participants and their answers or votes, never their pseudo or avatar.

The photos you send (profile photo, photos of a photo choice, conversation photos) are resized and stripped of their metadata, such as location and camera, before being stored. They are kept in a private space and served through signed links valid for one hour.

6. Analytics and crash reports

To fix errors, the app and our servers send crashes and errors to Sentry, hosted in the European Union. A report contains the error, the screen or request involved, the device model and app version, and your account identifier. It contains neither your messages, nor your photos, nor your contacts.

To understand how the app is used, and only if you ticked "Help improve the app", we count actions such as "sign-up completed", "event created" or "message sent", with their type and your account identifier, never with their content, at PostHog, hosted in the European Union. You can change your mind whenever you want in the Profile tab. Nothing is measured during development.

7. Recipients and processors

Your data is processed by our servers and by the following providers, each for one specific task and under a data processing agreement:

  • Hosting of the server and database: Hetzner Online GmbH, in Germany.
  • Photo storage: Cloudflare R2.
  • E-mail delivery (confirmation codes, notices about your account): Resend.
  • Notifications: Expo’s notification service, then Apple and Google to deliver them to your phone.
  • Crash tracking: Sentry (section 6).
  • Analytics: PostHog, hosted in the European Union (section 6).
  • Sign in with Google or Apple, if you choose it: Google or Apple know that you sign in to Chaud ? and give us your e-mail address and name; the profile picture Google offers is not stored. When you delete your account, we erase what Google or Apple handed us and ask Apple to revoke the access; Google keeps Chaud ? in the list of applications connected to your account until you remove it there, in the security settings of your Google account.

Other members and people invited by link see what you publish according to the rules of section 5.

8. Retention periods

  • Your account and its content: as long as your account exists. Deleting it erases everything immediately (section 11). During a suspension, your profile and your content stay in place and visible in your events.
  • Sessions, with the IP address and device used to sign in: 60 days without use, then you are signed out; you can sign out of every device at any time.
  • Sign-up never confirmed: 7 days, then erased with its e-mail address.
  • Codes sent by e-mail: 1 hour, kept hashed. The fingerprint of the address a code was sent to stays, to limit sending.
  • Former pseudo: reserved for 30 days after a change so you can take it back, then released; three former pseudos at most.
  • Anti-abuse counters (contact requests and photos per hour, messages per minute, events, searches and reports per 24 hours): 24 hours at most.
  • Photo sent but never used in an event or a message: 24 hours.
  • Address book fingerprints: never kept. The fingerprint of your number: as long as your number is on your profile.
  • Answer of a guest without an account: as long as the event exists; the creator can remove it.
  • Reports: as long as the reporter’s account and the reported person’s account exist; a handled report is erased 90 days after it was handled (the moderation log keeps what was done).
  • Moderation log: each moderator’s action is kept without time limit, with the moderator’s name and what was moderated as it read (name and pseudo, text of the message, title of the event), even after the accounts concerned are deleted.
  • Crash reports (Sentry): 90 days at most.
  • Analytics (PostHog): 1 year at most.

9. Transfers outside the European Union

Our servers, crash tracking and analytics are located in the European Union. Some providers (Cloudflare, Resend, Expo, Sentry, Apple, Google) are American companies and may process data outside the Union: these transfers rely on the European Commission’s standard contractual clauses or on the EU–US Data Privacy Framework, depending on the provider.

10. Your rights

At any time you can access your data, correct it, erase it, object to processing based on our legitimate interest, ask for its restriction, withdraw your consent to analytics in the Profile tab, and withdraw a permission (camera, photos, address book, notifications) in your phone settings.

In the app, you edit your profile, your number and your visibility yourself, and you delete your account. For anything else, write to the address in section 14 from the e-mail address of your account, or giving your pseudo and how you sign in if your address is an Apple relay address. You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

Exporting your data to a file is not yet offered in the app: ask us by e-mail.

11. Deleting your account

From the app: "Profile" tab, then "Delete my account", and confirm. Deletion is immediate and final: your profile, contacts, groups, answers, votes, ratings, reactions, photos, messages and the events you created, with their conversation and all their photos, are erased. Other people’s messages stay in their events. Only the moderation log keeps, where applicable, what a moderator moderated (section 8).

If you can no longer open the app, write to the address in section 14 from the e-mail address of your account, or giving your pseudo and how you sign in.

12. Security

Exchanges between the app and our servers are encrypted (HTTPS). Passwords are hashed. The e-mail address is confirmed by a code, or by Google or Apple when you sign in with them; sign-in attempts and e-mail sending are rate-limited, and sessions can be revoked. Every access rule is checked by the server: nobody can read an event they were not invited to or did not receive the invitation link of. Accounts that break the terms can be suspended.

13. Changes to this policy

This policy carries a version number and a date. When it changes, the app asks you to accept it again before going on; the current version is always published on this site.

14. Contact

For any question about your data: contact@chaud-app.com.