Privacy

No cookies

This site sets no cookies and writes nothing to your browser's storage, neither for measurement nor for advertising. The analytics described below work without cookies and without storing anything on your device. There is therefore no banner to accept.

Analytics

This site counts its visits, so that we know whether it is read and how people reach it. No third-party tool, no advertising tracker, no cookie: the measurement is done by our own server, hosted in France, and feeds no one else. No font is loaded from a third-party domain, and the platform logos are hosted here: no request is made to a third party while you browse.

What is recorded on each visit: the page viewed, the site you came from — its domain name only, never the full address, which could contain your search terms —, your browser's language, a screen class (mobile, tablet, desktop), your time zone and the time spent on the page.

To tell two visitors apart without following you, the server computes a fingerprint from your IP address and your browser, mixed with a secret only we hold. Your IP address is never stored and cannot be recovered from that fingerprint. The fingerprint is, however, stable over time: it lets us know that a visitor has come back. It is therefore pseudonymised data, not anonymous. It is used only for counting, is cross-referenced with no other source, and never leaves our server.

A visit is kept for thirteen months — the period the French data protection authority applies to analytics — then deleted automatically. We locate visitors roughly, by country and city, at their first visit, and keep no precise position.

As with any web server, the host keeps technical connection logs for security and for the proper running of the service. Those logs are the host's responsibility and are neither used nor consulted for analysis by TheUnnamedCompany.

Beta and waiting list

This site carries a single form: the one that lets you join the beta and be told when the app is released. We collect your email address, and nothing else — no name, no phone number, no organisation. It is used only to send you the beta invitation, then the release message. It is never sold, and never used for a newsletter. Legal basis: your consent, given by submitting the form. Retention: for the duration of the beta and until the release message is sent, and at most 2 years, or immediately on request.

To keep automated submissions out, the form measures how long elapsed before sending and includes an invisible trap field. Neither is kept beyond handling the request.

There is no other form on this site. If you write to us by email, the information you send — name, contact details, the context of your request — is used only to answer it. Legal basis: our legitimate interest in replying to an enquiry (article 6.1.f GDPR). Retention: 3 years from our last exchange.

The TooMee app

Here is what the app sends to our server. Its library never reaches us: it lives on the device and in the user's own private iCloud database.

• Usage measurement: the app reports that an item was filed, its type, the entry point used, whether the analysis succeeded and which feature was used — never what the item contains: no title, no address, no note, no tag. These events are tied to an identifier drawn at random on first launch, hashed by our server, which names no one and disappears with the installation. Purpose: knowing what is actually used. Legal basis: legitimate interest.
• The ToomCard and sponsorship, if the user opens their card: a randomly drawn card identifier kept in their iCloud keychain, the nickname they choose to display, and — if they scan someone's card — the fact that this person sponsored them. It is the only data we keep that links two people together. None of the library is part of it. Legal basis: performance of the requested service. Retention: as long as the card exists; deletion on request at contact@toomee.app.

If the user picks a remote analysis engine, the content of the item they file goes to the provider of that engine, which they configured themselves, and not to us. With Apple Intelligence, the analysis stays entirely on the device.

This data is received and stored on our own server (Fly.io, Paris region). It is never sold, never passed to a third party, and never used for advertising profiling. The app's Settings › Privacy screen describes it item by item, in the user's own language.

Processors and hosting

• OVH SAS — hosting for the pages of this site, 2 rue Kellermann, 59100 Roubaix, France (Lille Métropole trade register 424 761 419 00045).
• Fly.io (Fly.io, Inc.) — receives and stores the waiting-list addresses, the app's usage measurement and the sponsorship links, Paris region (France).
• Resend — delivery of transactional emails related to the beta and the waiting list.
• Apple — synchronisation of the library through the user's own private iCloud database, to which we have no access.

No other processor is involved in the running of this site or of the app.

Your rights

You have the right to access, correct, erase, restrict, object to and port your data. Write to contact@toomee.app: we answer within 30 days. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).