Privacy policy
This policy explains what data the rim. app ("the app") processes, why, who it is shared with and what your rights are. It applies to the iOS and Android mobile app. The French version prevails in case of discrepancy.
1. Data controller
Rim Battal, sole trader (France) — SIRET 103 388 278 00014 — 36 rue du Mont Thabor, 75001 Paris, France.
Contact for any question about your data: contact@rimbattal.store.
2. Data we process
| Data | Why | Legal basis |
|---|---|---|
| Email address and password (the password is stored in irreversibly hashed form by our host) | Create and secure your account, let you sign in and reset your password | Performance of the contract |
| First name (optional) | Personalise the app | Performance of the contract |
| Your journal content | Save and sync your writing. It is encrypted on your device before upload (see section 4) and stays confidential: no one reads it. | Performance of the contract |
| Chosen language | Show the app and our messages in your language | Performance of the contract |
| Event registrations (event, number of seats) and confirmation email | Manage your attendance at workshops and gatherings | Performance of the contract |
| Subscription status (active, expired, complimentary), purchase store, expiry dates, RevenueCat customer ID | Give subscribers access to the app | Performance of the contract |
| List of people offered complimentary access: email address, note, duration, activation date | Automatically unlock the complimentary access (for example for the project's supporters) once the matching account is confirmed | Legitimate interest (providing the promised access); the address is removed on request |
| Technical data (IP address, device type, app version, connection logs) | Security, abuse prevention, delivering app updates | Legitimate interest |
Kept only on your device: your theme, your reminder preferences (morning and evening reminders are local notifications), your drafts and your journal encryption key in clear form. Our servers only receive encrypted copies: one encrypted with your password, the other with a recovery key (see section 4).
The app contains no advertising, no analytics and no trackers. Your data is never sold or used for advertising.
3. Payments
Subscriptions are sold and billed by Apple (App Store) or Google (Google Play). We never receive your payment details. Through RevenueCat, Apple or Google only send us your subscription status (offer, dates, renewal).
4. Journal encryption
Each entry is encrypted on your device (AES-256-GCM) before being sent to our servers. The encryption key is generated on your device and then itself encrypted with a key derived from your password (PBKDF2-SHA256). This encrypted copy of the key lets you get your writing back on a new device by signing in.
Backup copy: so that you don't lose your journal if you forget your password, a second copy of the key is kept, encrypted with a separate server key (AES-256-GCM) stored apart from the database with restricted access. This copy is only decrypted for you, at your request, when you reset your password in the app; every recovery is logged. It is never used to read your journal. It is deleted with your account.
If you reset your password, your entries therefore remain readable. Still choose a strong password (at least 8 characters): the security of your journal also depends on that of your account and your mailbox.
5. Recipients and processors
Your data is only accessible to Rim Battal (to run events and subscriptions) and to the following technical providers, acting on our instructions:
| Provider | Role | Location |
|---|---|---|
| Supabase Inc. | Database hosting, authentication, server functions | European Union (Frankfurt, Germany) |
| RevenueCat Inc. | Subscription management | United States |
| Expo (650 Industries Inc.) | Building and delivering app updates | United States |
| Resend Inc. | Sending emails (event confirmations, password reset) | United States |
| Apple Inc. / Google LLC | App distribution, subscription payments | United States / EU |
| Cloudflare Inc. | Hosting these information pages | Worldwide |
Transfers outside the European Union rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
6. Retention
- Account, journal, registrations and subscription status: as long as your account exists. They are deleted as soon as you delete your account.
- Technical logs: a few days at our providers, for security.
- Purchase history: kept by Apple, Google and RevenueCat under their own legal obligations.
7. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. You can delete your account and all your data directly in the app (how) or write to contact@rimbattal.store. We reply within one month.
You may also lodge a complaint with the French data protection authority, CNIL (www.cnil.fr), or your local authority.
8. Minimum age
The app is intended for people aged 15 or over.
9. Changes
We may update this policy. If the change is significant, we will let you know in the app.