Privacy policy

1. Data controller

Tom Piguet, sole proprietor, operating under the commercial name Ikigai Studio
55 avenue du Général de Gaulle, 60150 Longueil-Annel, France
SIRET: 904 611 175 00020

GDPR contact: contact.ikigaistudio@gmail.com

2. Data we collect

3. Purposes and legal bases (GDPR art. 6)

4. Recipients and subprocessors

The publisher does not sell, rent, or share your personal data with third parties for commercial purposes. The subprocessors below intervene strictly in the execution of the service:

No data brokers, no advertisers, no resale.

5. Transfers outside the European Union

The main hosting (database, authentication, edge functions) is located in Ireland (EU), no data leaves it as part of the ordinary operation of the App.

Some ancillary subprocessors (RevenueCat, Apple, Google, Vercel, Expo) are established in the United States. These transfers are governed by:

• the European Commission's Standard Contractual Clauses (implementing decision 2021/914 of 4 June 2021);
• the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) when the subprocessor is certified under it.

6. Retention period

7. Your rights

In accordance with articles 15 to 22 of the GDPR and articles 49 and following of the amended French Data Protection Act, you have the following rights:

• Right of access: obtain a copy of all data concerning you;
• Right to rectification: modify inaccurate or incomplete data (directly from the app for most, or by request);
• Right to erasure: delete your account and your data from Profile → Preferences → Account → Delete my account, or by request to contact.ikigaistudio@gmail.com;
• Right to portability: receive your data in a structured and commonly used format (JSON);
• Right to object: object to processing based on legitimate interest, for reasons related to your particular situation;
• Right to restriction: ask for the suspension of contested processing during the investigation of a complaint;
• Right to withdraw your consent at any time, for processing based on it (push notifications in particular), from the app Preferences;
• Right to lodge a complaint with the CNIL (the French data protection authority — www.cnil.fr) if you believe your rights are not being respected;
• Right to define post-mortem directives regarding the fate of your data after your death, in accordance with article 85 of the French Data Protection Act.

To exercise these rights: contact.ikigaistudio@gmail.com

You will receive a response within a maximum of one month from receipt of your request, in accordance with article 12 of the GDPR. This deadline may be extended by two months for complex requests, with prior notice.

8. Security

Technical and organizational measures in place:

• TLS 1.2+ encryption for all client-server communication;
• passwords hashed with bcrypt (Supabase Auth);
• authentication tokens stored in the operating system's secure keychain (expo-secure-store);
• PostgreSQL Row Level Security — each user can only access their own data;
• no direct database access from the client (mandatory passage through secured functions);
• administrator access restricted to the publisher only, traceability of accesses via Supabase.

No system is infallible. In the event of a data breach likely to entail a risk to your rights and freedoms, you will be notified without undue delay, in accordance with article 34 of the GDPR, and the CNIL will be informed within 72 hours (article 33).

9. Minors

The App is open to users at least 13 years old.

We do not knowingly collect personal data concerning children under 13. If you believe a minor under 13 has provided us with personal data, please contact us immediately at contact.ikigaistudio@gmail.com: we will proceed with deletion as soon as possible.

Minor users between 13 and 15 must obtain the prior consent of their legal representatives in accordance with article 8 of the GDPR and article 45 of the French Data Protection Act.

10. Cookies and trackers

11. Modifications

This Privacy policy may be updated to reflect changes to the App or to regulations. The "Last updated" date at the top of the document indicates the current version.

Any substantial modification (new subprocessor, new purpose, new type of data collected) will be the subject of an in-app notification and, where applicable, a consent collection.

12. Contact

For any question relating to your personal data:

contact.ikigaistudio@gmail.com

Data protection officer: none designated. The designation of a DPO is not required given the volume and nature of the processing carried out (article 37 GDPR).