1. Who are we?
Data controller:
Debtouch, EURL with share capital of €2.00
Registered with the Paris Trade and Companies Registry: 984 152 363 R.C.S. Paris
7 rue de Toul — 75012 Paris, France
Contact: antoine.debtouch@gmail.com
Join Me Now is a mobile app that lets you create and join events happening within the next 24 hours, to make it easier to meet up in person with friends, family and colleagues.
This privacy policy is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and French data protection law.
2. Data collected and legal bases
We collect only the data strictly necessary for the service to function (data minimisation principle, Art. 5 GDPR).
2.1 Account data
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Identification, service communications | Contract performance (Art. 6.1.b) |
| Username | Display within the app | Contract performance (Art. 6.1.b) |
| Password (hashed) | Authentication | Contract performance (Art. 6.1.b) |
| Phone number | Contact synchronisation, identification | Consent (Art. 6.1.a) |
| Profile picture | Display within the app | Consent (Art. 6.1.a) |
2.2 Service operation data
| Data | Purpose | Legal basis |
|---|---|---|
| Event content (title, location, time) | Service provision | Contract performance (Art. 6.1.b) |
| Ephemeral chat messages | Communication between participants | Contract performance (Art. 6.1.b) |
| Event participation status | Invitation management | Contract performance (Art. 6.1.b) |
| Push notification token | Sending notifications | Consent (Art. 6.1.a) |
2.3 Technical data
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, connection logs | Security, debugging | Legitimate interest (Art. 6.1.f) |
| Device identifier, app version | Compatibility, push notifications | Legitimate interest (Art. 6.1.f) |
2.4 Contacts
| Data | Purpose | Legal basis |
|---|---|---|
| Phone numbers from your contacts | Identify which of your contacts already use the application | Consent (Art. 6.1.a) |
With your explicit permission, the app reads the phone numbers from your device's contact book to compare them against our user base. These numbers are never stored in our database or kept in our logs: they are used only for a one-off comparison at the moment of synchronisation, then immediately discarded server-side. Your contacts' names and email addresses never leave your device: only phone numbers are transmitted, solely for this comparison.
The first time you sync your contacts, people in your contact book who already use the app may receive a notification informing them of your sign-up. They can turn this type of notification off at any time in the app's settings.
3. Retention periods
Your data is not retained beyond what is strictly necessary.
| Category | Retention period |
|---|---|
| Account data (active user) | Duration of the contractual relationship |
| Account data after deletion | Permanently deleted within 30 days of the request, unless a legal obligation requires otherwise |
| Chat messages | Physically deleted (permanent database erasure) at the end of the event |
| Created events | Anonymised at the end of the event: title, location, address, and participant list are removed; only aggregated, non-identifying statistics are retained |
| Contact book phone numbers | Not retained — processed transiently in memory during synchronisation, never logged or stored in the database |
| Connection logs | 12 months (legal obligation) |
| Password reset tokens | 1 hour from generation |
| Billing data (where applicable) | 10 years (accounting obligation) |
Once an event has ended, no personal data about it is retained: exchanged messages are physically deleted from the database, and the event itself is anonymised (its title, location, address, and participant list are removed). Only aggregated, non-identifying statistics (category, duration, number of participants) are kept to help us improve the service.
4. Recipients of data
We do not sell or export your data to anyone. It is processed solely by the following technical providers, acting as data processors, strictly on our instructions and for the sole purposes described below:
- Scaleway: sovereign hosting of the application and the website (servers, database);
- Brevo: transactional email and SMS delivery (verification codes, password resets);
- Google (Maps/Places API): address and GPS point search only, when creating or editing an event's location;
- Expo: sending push notifications.
Your data may also be disclosed to judicial or administrative authorities, upon legal request, in compliance with applicable law.
Brevo and Scaleway are French companies hosting their data within the European Union. Google and Expo, US companies, are subject to the safeguards required under Chapter V of the GDPR for any data transfer outside the EU (standard contractual clauses, EU-US Data Privacy Framework).
5. Your rights
Under Articles 15 to 22 of the GDPR, you have the following rights:
- Right of access (Art. 15): obtain a copy of your personal data.
- Right of rectification (Art. 16): correct inaccurate or incomplete data.
- Right to erasure (Art. 17): request deletion of your data ("right to be forgotten").
- Right to restriction of processing (Art. 18): suspend processing in certain cases.
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
- Right to object (Art. 21): object to processing based on legitimate interest.
- Right to withdraw consent (Art. 7): withdraw your consent at any time.
- Right to lodge a complaint (Art. 77): lodge a complaint with a supervisory authority.
To exercise your rights: contact us at antoine.debtouch@gmail.com, describing your request. We will respond within one month (Art. 12 GDPR), extendable by two additional months for complex requests.
6. Protection of minors' privacy
Join Me Now is restricted to persons aged 15 or over (threshold set by French data protection law).
Below the age of 15, registration requires the joint consent of the minor and their legal representative. If we become aware that we have collected data from a child under 15 without such consent, we will delete it immediately.
7. Push notifications
Push notifications are sent only if you have granted the relevant permission on your device. You can revoke this permission at any time in your device settings or directly within the app.
8. Data security
We implement appropriate technical and organisational measures to protect your data:
- passwords hashed using an adaptive algorithm resistant to brute-force attacks;
- encrypted transport (HTTPS/TLS);
- short-lived access tokens with automatic rotation;
- data access restricted to authorised personnel.
9. Cookies and trackers
The Join Me Now mobile app does not use cookies in the traditional sense. Technical device identifiers may be used for push notifications, in accordance with applicable guidelines on mobile applications.
The Join Me Now website may store your cookie consent choice locally to avoid asking for your preferences on every visit. This storage is strictly necessary for the consent banner to function.
Audience measurement trackers are activated only if you explicitly accept them via the banner or the cookie preferences panel. You can change your choices at any time via the "Cookie preferences" link in the website footer.
10. Changes to this Privacy Policy
Any material change to this policy will be notified to you in the app before it takes effect. The date of the last update appears at the top of this document.
Continued use of the app after notification constitutes acceptance of the changes.
11. Contact
For any question about the protection of your personal data:
Debtouch — Data controller
7 rue de Toul — 75012 Paris, France
antoine.debtouch@gmail.com
If you are not satisfied with our response, you may lodge a complaint with your national data protection authority (in France: www.cnil.fr).