Privacy Policy — Colocation

Version 2.0 — in force on November 12, 2026. This policy explains which personal data the Colocation app (also called “ColocApp”, formerly “Colocataire”) processes, why, with whom, for how long, and how to exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of January 6, 1978 (“Informatique et Libertés”).

1. Controller

Elisée Nelson BANGYA NOUPET, sole trader (trading as “Nelson Apps”), RCS Versailles 934 617 119, 17 avenue de Savoie, 78140 Vélizy-Villacoublay, France. Contact for any question about your data: nelson.apps.dev@gmail.com. No data protection officer has been appointed, as this is not mandatory.

2. Data processed

2.1 Account

• Email address, display name, first and last name, profile photo (optional), account identifier.
• If you sign in with Apple or Google: the identifier, email (possibly hidden by Apple) and name provided by that service. We never receive your Apple or Google password.
• Subscription status, artificial intelligence usage counters, points.

2.2 Household data

• Tasks, shopping lists, menus, recipes and favourites.
• Expenses, splits, balances and settlements recorded between members.
• Payout methods you choose to provide (IBAN, PayPal.me name, Revolut tag, https payment link): optional, visible to and copyable by the members of your flatshare (the IBAN is shown masked and copied in full to pay), never sent to our analytics tool. “I paid” declarations and settlement confirmations.
• Points and ranking.
• Invitation codes and links, public share links (and their expiry date).

This data, together with your display name and profile photo, is visible to the other members of your household. Content shared by link is visible to anyone who holds the link, until it expires.

2.3 Photos

• Profile photo.
• Photo of food leftovers, when you ask for a recipe suggestion from a photo (sent to the artificial intelligence service, see 2.5).
• Photo of a till receipt, when you use “Scan a receipt”: sent to the artificial intelligence service (see 2.5) to extract the shop, date, total, currency, category and line items, then attached to the expense and visible to the members of the flatshare. A receipt may show personal information (last digits of a bank card, name, loyalty card): you may hide it before taking the photo.
• Images sent to support.

The App only accesses the camera or your photo library when you decide to, and with your device’s permission.

2.4 Diet and allergies (health data)

If you enter a diet, allergies or intolerances, this information may reveal data concerning your health within the meaning of Article 9 GDPR. It is optional and only processed with your explicit consent, which you give by entering it and confirming that it may be sent during an artificial intelligence request. You can withdraw this consent at any time by deleting it from the App; withdrawal does not affect processing already carried out. Only enter health information about other people if they have authorised you to do so.

2.5 Artificial intelligence requests

When you use an artificial intelligence feature, and after confirmation in the information window displayed before each request, we send to Google (Gemini, via Vertex AI) only the data needed for the request: the text of your request, the diet and allergies entered, the number of servings, the first names or display names of household members, existing tasks and, where applicable, the photo. Generated results, your reports of generated content and a usage counter are kept. Under Google Cloud’s contractual commitments, this data is not used to train Google’s models.

2.6 Support

If you contact support via the built-in chat (Crisp) or by email: email, display name, profile photo, message content, images and, where applicable, audio calls. If you answer the satisfaction survey: your answers and comments.

2.7 Notifications and emails

Device notification identifiers (push and Live Activities), the associated account identifier, language, and technical tags (subscription tier, marketing consent). Your email address is registered with our sending provider for service emails; marketing emails are only sent with your consent.

2.8 Purchases

History and status of purchases and subscriptions (product, dates, renewal, store country), linked to your account identifier. We receive no bank data: payment is processed by Apple or Google.

2.9 Technical data

• Crash reports and performance measurements (device model and system, App version, technical traces), via Firebase Crashlytics and Firebase Performance.
• Remote configuration settings and security data needed for operation.
• Preferences stored locally on your device.

2.10 Audience measurement (optional)

Only if you accept it in the App: usage events (screens viewed, features used, purchase steps) linked to a pseudonymised identifier, stored in our own analytics tool hosted by Google Cloud in the European Union (Belgium, europe-west1). You can withdraw this consent at any time in the App settings.

2.11 Recipe search

Recipe search terms are sent to TheMealDB, without any account identifier.

We do not collect your location, contacts, phone number or bank data, and use no advertising trackers.

3. Purposes and legal bases

• Providing the App (account, household, tasks, expenses, sharing, synchronisation, service notifications, service emails, support): performance of the contract (Art. 6(1)(b) GDPR).
• Artificial intelligence features: performance of the contract; for diet and allergy data, explicit consent (Art. 9(2)(a)).
• Managing subscriptions and quotas: performance of the contract; keeping proof of transactions: legal obligation (Art. 6(1)(c)).
• Security, prevention of abuse and fraud, stability (crash reports, performance): legitimate interest in providing a reliable and secure service (Art. 6(1)(f)).
• Audience measurement: consent (Art. 6(1)(a)).
• Marketing notifications and emails: consent (Art. 6(1)(a)), which can be withdrawn at any time.
• Satisfaction survey and service improvement: legitimate interest; participation is optional.
• Moderation and responding to authorities: legal obligation and legitimate interest.
• Handling complaints and disputes: legitimate interest in defending our rights.

No decision producing legal effects or significantly affecting you is taken solely on the basis of automated processing. We do not sell or rent your data.

4. Recipients and processors

Your data is accessible to the Publisher and, within the limits of their tasks, to the following providers, bound by confidentiality and security commitments:

• Google Ireland Ltd / Google LLC (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Remote Config, Crashlytics, Performance, Hosting; Vertex AI Gemini; Google Cloud for audience measurement) — European Union and United States.
• OneSignal, Inc. (push notifications, Live Activities, emails) — United States.
• RevenueCat, Inc. (subscription management) — United States.
• Crisp IM SAS (support chat) — France / European Union.
• TheMealDB (recipe search, without identifier) — United Kingdom.
• Apple and Google, as stores and sign-in providers, which process payments and sign-in identifiers under their own policies, as separate controllers.

The other members of your household and holders of a share link see the data described in section 2.2. We may disclose data to authorities where required by law.

5. Transfers outside the European Union

Some providers (Google LLC, OneSignal, RevenueCat) are established in the United States or may access data there; some technical processing of the App (server functions related to tasks and profiles) runs in the United States, and the Gemini service is called through a Google global endpoint. These transfers are covered by the EU-U.S. Data Privacy Framework adequacy decision where the recipient is certified and, otherwise, by the European Commission’s standard contractual clauses. The United Kingdom benefits from an adequacy decision. You can obtain a copy of the safeguards by writing to us.

6. Retention periods

• Account and profile: as long as the account is active; deleted immediately when the account is deleted (section 7). An account inactive for 3 years may be deleted after an email warning.
• Content posted in a shared household: remains visible to the other members after you leave or delete your account, as long as the household exists; a household of which you were the only member is deleted with your account.
• Share links: until they expire; the corresponding technical records are purged no later than 12 months afterwards.
• Diet and allergy data: until you delete it or delete the account.
• AI requests and results, reports: until the account is deleted; usage counters are reset periodically.
• Support (Crisp, email): 3 years after the last exchange; deleted within 30 days on request.
• Satisfaction survey: 3 years at most.
• Pseudonymised audience measurement: 25 months at most.
• Crash reports: 90 days.
• Notification identifiers: until you unsubscribe, delete the account or the token expires.
• Proof of purchase and transactions: for the legal retention period of accounting records (10 years).
• Information needed to handle a dispute or to prove your consents: 5 years after the end of the relationship (ordinary limitation period).
• Technical backups: erased by rotation within 35 days at most.

7. Account deletion

You can delete your account from the App (My Profile → Danger zone → Delete my account) or via the “Account deletion” page of the website. Deletion erases your profile, photo, counters, reports, households of which you were the only member, and your profiles at OneSignal and RevenueCat. Content posted in a shared household is kept for the other members (section 6). Data held by Crisp and by our analytics tool is deleted within 30 days on simple request to nelson.apps.dev@gmail.com. Deleting your account does not cancel your subscription with Apple or Google.

8. Your rights

You have the rights of access, rectification, erasure, restriction, objection (in particular to any processing based on legitimate interest and, without giving reasons, to direct marketing), portability (receiving your data in a structured format, on request by email), withdrawal of your consent at any time, and the right to set instructions regarding your data after your death (Article 85 of the French Data Protection Act).

To exercise these rights, write to nelson.apps.dev@gmail.com from the address linked to your account. We reply within one month, which may be extended by two months for complex requests. We may ask you to prove your identity if there is reasonable doubt.

You may lodge a complaint with the French data protection authority (Commission nationale de l’informatique et des libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the supervisory authority of your country of residence.

9. Minors

The App is not intended for people under 15, who are not allowed to create an account. If we learn that such an account has been created, we delete it. A parent can report it to us at the address above.

10. Security

We implement appropriate technical and organisational measures: encryption of communications (HTTPS/TLS), access rules limiting each user to the data of their households, reinforced authentication for account deletion, secure local storage of secrets, restricted access to administration consoles. As no system is completely secure, we cannot guarantee absolute security; in the event of a data breach presenting a risk to your rights, we will notify the CNIL and, where necessary, the people concerned, under the conditions laid down by the GDPR.

11. Trackers and software development kits

The App includes no advertising kit or cross-app advertising tracking and does not request tracking permission (ATT) on iOS. The kits used (Firebase, OneSignal, RevenueCat, Crisp) are needed to run the service; audience measurement and marketing communications are only enabled with your consent. The website sets no audience measurement or advertising cookies.

12. Changes

We may update this policy to reflect changes to the App or the law. The date and version appear at the top of the document. Any significant change is notified to you in the App or by email before it takes effect and, if it requires your consent, we will ask for it again.

13. Contact

Elisée Nelson BANGYA NOUPET (Nelson Apps), 17 avenue de Savoie, 78140 Vélizy-Villacoublay, France — nelson.apps.dev@gmail.com