Privacy Policy

1. Who is the data controller

The Boki app is published by [company name, legal form, share capital], registered with the RCS (Trade and Companies Register) of [city] under number [SIREN], with its registered office at [full address].

For any question about your data, write to hello@getboki.app. Our data protection officer can be reached at the same address [to be confirmed: whether a DPO is appointed].

2. Data we collect

AccountEmail address, username, encrypted password, or the identifier provided by Apple if you use "Sign in with Apple". Avatar and starting level declared at sign-up.

Photos and metadataThe images you submit to an exercise, their EXIF data (aperture, shutter speed, ISO, focal length, camera model, date) and, if present in the file, GPS coordinates.

ProgressCompleted lessons, XP, streaks, unlocked skills, analysis results for your images, exercise history.

Usage and deviceDevice model, iOS version, app version, installation identifier, crash logs, screens viewed and actions taken in the app.

CommunityPhotos you choose to publish, comments, mentions, and reports you file or that are filed about you.

PurchasesYour subscription status and transaction history as provided by the App Store. We never receive any payment card data.

WaitlistThe email address left on getboki.app to be notified when the app launches, the sign-up date, the site language at sign-up, your browser's language and time zone, the country inferred from your IP address, the location of the form on the page, and the campaign parameters (utm) in the page address. Your IP address is not stored; no cookies are set.

We do not collect your contacts, your real-time location or your health data. Access to the camera and photo library is requested when you need it and can be revoked at any time in iOS settings.

3. Why we process it

Creating and managing your account, authenticating you: Performance of the contract
Analyzing your photos, scoring exercises, calculating XP and skills: Performance of the contract
Publishing your photos to the community and moderating content: Performance of the contract and legitimate interest in maintaining a safe space
Sending streak reminders and learning notifications: Your consent, which you can withdraw in settings
Measuring audience, fixing bugs, improving lessons: Legitimate interest, using aggregated data whenever possible
Managing subscriptions, billing and accounting: Performance of the contract and legal obligation
Responding to your support requests: Performance of the contract
Emailing you when the app launches, in your language and based on its availability in your country, and measuring where sign-ups come from: Your consent, which you can withdraw at any time

We do not use your data for targeted advertising, and we do not sell it.

4. A special case: your photos

Your photos remain yours. An image submitted to an exercise is sent to our servers for analysis, then kept in your progress so you can compare your shots over time.

A photo is visible to other users only if you explicitly publish it to the community. You can remove it at any time; it then disappears from public feeds and is deleted from our servers within 30 days.

[to be confirmed: are your photos used to train analysis models?] If so, this must be subject to separate consent, turned off by default, and described here.

5. How long we keep it

Account, progress and photos: as long as your account is active, then 30 days after it is deleted.
Inactive accounts: deleted after 3 years without signing in, following a warning email.
Technical and crash logs: 13 months maximum.
Support conversations: 3 years after the last contact.
Accounting records related to subscriptions: 10 years, as required by the French Commercial Code.
Reported content and moderation decisions: 1 year after the decision.
Waitlist: until the email announcing the app's launch is sent, then deleted within 3 months, and no later than 3 years after sign-up. [retention period to be confirmed]

6. Who has access to it

Internally, only the people who need it to run the service have access. Externally, we use processors who are bound by contract and use your data only on our behalf:

[to be completed: hosting provider, image storage, image analysis, transactional email, push notifications, analytics, support tool] — with the name, role and hosting country for each.

The country of waitlist sign-ups is determined on our servers using a downloaded geolocation database (IP Geolocation by DB-IP, CC BY 4.0 license): your IP address is not shared with any third party.

We may also disclose data to judicial or administrative authorities when required by law.

7. Transfers outside the European Union

Our data is hosted in the European Union. If one of our providers processes data outside the EU, the transfer is governed by the European Commission's standard contractual clauses or by an adequacy decision. [to be adjusted based on the providers selected]

8. Your rights

You have the right to access, rectify, erase, restrict and object to the processing of your data, the right to data portability, and the right to withdraw your consent at any time.

In the app, Profile → Settings → My data lets you export your photos and progress, and delete your account. For any other request, write to hello@getboki.app: we reply within one month.

To leave the waitlist, write to hello@getboki.app from the address you signed up with: it will be deleted without delay.

If you are not satisfied with our response, you can contact the CNIL (the French data protection authority), 3 place de Fontenoy, 75007 Paris, or file a complaint at cnil.fr.

9. Security

Communications between the app and our servers are encrypted in transit (TLS). Passwords are stored as hashes. Internal access is individual and logged, and backups are encrypted. In the event of a data breach likely to harm you, we notify the CNIL within 72 hours and inform you.

10. Minors

Boki is available to users aged 15 and over. Below that age, signing up requires permission from a person with parental authority. If you find that a child under 15 is using Boki without this permission, write to us and we will delete the account.

11. Cookies and trackers

The app does not use advertising cookies. It stores locally the information needed for your session and your offline progress. On this website, only strictly necessary trackers are set; any non-exempt audience measurement tracker will require your consent. When you choose a language, that choice is remembered in a cookie (boki_langue, 1 year) so the site is shown to you in that language. [to be adjusted if an analytics tool is added to the site]

12. Changes

This policy may change as the service evolves. Any substantial change will be notified to you in the app or by email at least 15 days before it takes effect. The date of the last update appears at the top of this page.