Privacy Policy
Last updated: 11 September 2026
Sod is built to run on as little data as possible. This page says exactly which data, why, and for how long.
1. Controller
[TO BE COMPLETED: legal name], contact: nathanesebban18@gmail.com.
2. Data collected
| Data | Why | Legal basis |
|---|---|---|
| E-mail address | Create the account, reset the password, send service e-mails | Performance of the contract |
| First name or nickname | Address you inside the app and in simulations | Performance of the contract |
| Password | Authentication. Stored only as an Argon2id hash, never in clear text | Performance of the contract |
| Age range, education, employment status, industry, role, interests, confidence level | Pick simulations that are plausible for you. All of these answers are optional | Consent |
| Simulation results: decisions, durations, hints used, score, streaks | Measure progress and adapt the path | Performance of the contract |
| Language, timezone, display and notification preferences | Make the app work correctly | Performance of the contract |
| Push notification token | Send the daily reminder, only if you enable it | Consent |
| Technical logs (truncated IP address, date, route called) | Security, abuse prevention, diagnosis | Legitimate interest |
What Sod does not collect: no contacts, no photos, no location, no content from your real mailbox, no advertising identifier. Simulations never ask for a real password, card number, IBAN or code: those fields are pre-filled with fictional data, and anything typed stays on the device.
3. No advertising trackers
Sod contains no ad network, no behavioural analytics SDK and no third-party tracker. No data is sold, rented or shared for commercial purposes.
4. Recipients
Data is processed by the publisher and by the providers strictly necessary to run the service:
- IONOS SE (Germany): server and database hosting;
- Expo / Google / Apple: push notification delivery, only if you enable it, and only the device token;
- e-mail provider: service e-mails (address verification, password reset).
Hosting involves no transfer outside the European Union. Push delivery may involve Apple or Google servers, covered by standard contractual clauses.
5. Retention
- Account and profile: as long as the account exists;
- Simulation results: as long as the account exists (they are your progress);
- Technical logs: 12 months;
- After account deletion: erased within 30 days, unless a legal obligation requires otherwise.
6. Your rights
You have the right to access, rectify, erase, restrict, object and port your data.
Two of those are available directly in the app, without writing to anyone: Settings → Export my data and Settings → Delete my account. For the others, write to nathanesebban18@gmail.com.
You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).
7. Security
Passwords are hashed with Argon2id. Traffic is encrypted over HTTPS. Authentication tokens are stored in the device's secure store (Keychain / Keystore), never in clear text. Database access is restricted to the application server.
8. Minors
The app is available from the age of 13, with parental consent under 15. No data is knowingly collected from younger children.
9. Changes
Any substantial change to this policy is announced in the app before it takes effect.