Privacy policy

Last updated: May 15, 2026

This policy describes the personal data processed by PartyMaker, the purposes of that processing, and the rights you have under the General Data Protection Regulation (GDPR) and the French "Informatique et Libertés" act.

Data controller

Antonin De Almeida. To exercise your rights or ask any question: contact.partymaker@antonin.ovh.

Data collected

• Federated identifier: the opaque identifier returned by Apple or Google (the "subject"). The email address linked to the account is not retained.
• Username: freely chosen at sign-up. Visible to other members of your groups.
• Availability: the dates you mark as "in" or "out", per group.
• Notification preferences and reminder time.
• Push token (APNs or FCM) for your phone, used to deliver notifications.
• Session tokens (refresh tokens) so you can sign in again without re-entering credentials on every launch.
• IP address: logged transiently by the server for security reasons.

Purposes and legal bases

• Service delivery (coordinating evenings between friends) — performance of the contract (GDPR article 6.1.b).
• Push notifications — consent (article 6.1.a), revocable at any time from Settings → Notifications and at the system level.
• Service security (rate limiting, access logging) — legitimate interest (article 6.1.f).

Recipients

Data is not shared with any third party for commercial purposes. To deliver push notifications, the server communicates with:

• Apple Push Notification service (APNs) — Apple Inc., USA. Apple acts as a processor; notification content transits through its servers.
• Firebase Cloud Messaging (FCM) — Google LLC, USA. Same arrangement.

The application server is hosted by OVH (France).

Transfers outside the European Union

Push notifications transit through Apple and Google services located in the United States. Those transfers are governed by Standard Contractual Clauses and the EU-US Data Privacy Framework.

Retention

• Account and username: as long as your account exists.
• Past availability: automatically purged after each day has passed.
• Push token: as long as the app is installed and signed in.
• Session tokens: 90 days, or until revoked.
• Account deletion: immediate erasure of all data concerning you.

Your rights

• Access and portability: you can download all of your data from the app (Settings → Download my data).
• Erasure: you can delete your account from Settings → Delete my account. Deletion is immediate.
• Rectification: you can change your username and preferences directly in the app.
• Objection / restriction: you can disable notifications from Settings.
• Complaint: you may lodge a complaint with the CNIL (cnil.fr) — France's data-protection authority — at any time.

Security

The database connection is encrypted (TLS). Access tokens are stored on your phone in the iOS Keychain or Android SharedPreferences. The server applies rate limiting and restricts admin interfaces to the local network.

Changes

This policy may evolve. The last update date appears at the top of this page.