I · idiome
Privacy Policy
Last updated: October 12, 2026
Idiome is built around a simple idea: less data, better chosen. This policy describes what we collect, why, and what you can do with it.
1. Legal notice
Publisher: Théo AUGUST
Email: hello@idiome.app
Publication director: Théo AUGUST
Website host: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA
App data host: Supabase, Inc., 970 Toa Payoh North #07-04, Singapore, region: EU
2. Data collected
Website idiome.app
The website sets no cookies and stores no personally identifiable data. Three tools measure aggregate traffic: Vercel Web Analytics and Speed Insights (hashed IPs, Core Web Vitals), and PostHog hosted in the EU (Frankfurt), configured in strict anonymous mode, no cookie or local storage, no user profile created. PostHog records only: one visit event each time the site loads (the page viewed and the page the visitor came from, as reported by the browser), clicks on download buttons, language changes (FR/EN), and clicks on the word-refresh button. The browser's Do Not Track signal is honoured: when it is on, no event is sent. This setup falls under the CNIL exemption from consent for anonymous audience measurement.
Idiome mobile app
The app collects the following data:
- User account (optional): email for authentication. You can use Idiome without creating an account.
- User content: integration sentences you write to validate a word. Stored in your personal history, never published without your consent.
- Technical data: device type, OS version, app version. For debugging and compatibility.
- Push notifications (opt-in): notification token to send you reminders about your word of the week. Disabled at any time in settings.
Idiome does not track advertising, integrates no third-party behavioral audience measurement SDK, does not profile users, and sells no data.
3. Legal bases (GDPR art. 6)
- Contract execution: account creation and management, weekly word delivery
- Consent: push notifications (explicit opt-in)
- Legitimate interest: technical logs for security and service stability
4. Sub-processors
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Web hosting (idiome.app), aggregate analytics | USA / global edge |
| PostHog Inc. | Anonymous audience measurement (visits and interactions) | EU (Frankfurt) |
| Supabase, Inc. | Authentication, database | EU (chosen region) |
| OpenAI, L.L.C. | OpenAI API (editorial selection, definitions) | USA |
| Apple Inc. | iOS distribution, Sign in with Apple | EU / USA |
| Google LLC | Android distribution | EU / USA |
Transfers to the United States are governed by the Standard Contractual Clauses of the European Commission and the EU-US Data Privacy Framework.
5. Retention periods
- Active account: for the duration of your use
- Deleted account: immediate deletion of personal data; backup purge within 30 days
- Technical logs: 30 days
6. Your rights
Under articles 15 to 22 of the GDPR, you have the following rights:
- Access, rectification, erasure
- Portability (data export in JSON format)
- Objection to processing
- Restriction of processing
- Complaint to the CNIL (French data protection authority)
To exercise any of these rights: hello@idiome.app. Response within one month.
7. Minors
The app is rated for all ages (4+ App Store / Everyone Play Store). If you are under 15, use requires consent from a parent or legal guardian (GDPR art. 8, French implementation).
8. Security
Data is encrypted in transit (TLS) and at rest. Authentication is handled by Supabase Auth, which hashes passwords with bcrypt. No password is stored in plaintext.
9. Changes
This policy evolves with the app. Any substantial change is notified by email (if you have an account) and flagged in the app before taking effect.