Privacy policy

Data we collect

We collect only what the app needs to work:

• Your email address and password (encrypted), to create your account. Browsing the map and feed requires no account.
• Your display name and, if you provide it, your town. This information is public.
• The GPS location of the report you publish. It is requested only when you report, never in the background, and is used to place the problem on the map.
• The photos you attach to a report, after automatic masking (see below).
• The text of your reports and comments.
• Your confirmations, badges and contribution counters.

What we do not collect

Kartié does not track your location in the background, does not access your contacts, shows no advertising and sells no data. No advertising tracker is embedded in the app.

How photos are processed

Before publication, faces in your photo are detected on your own phone, then irreversibly pixelated by our server. Licence plates and documents are NOT masked automatically: when the analysis spots one, the app warns you and you mask it yourself, with a finger, before publishing. You check the result in every case.

Only the masked version is stored on our servers. The original photo is never stored: it passes through memory for the duration of the analysis and then disappears. Photo file metadata, including the precise location recorded by your phone, is removed during this processing.

Automatic moderation and the use of OpenAI

To protect privacy and prevent Kartié from becoming a place for denouncing people, every post (text and image) is analysed automatically before going live. This analysis is performed by OpenAI, L.L.C., a provider established in the United States, acting as a processor.

Only the content of your post (the text and image) and the declared category are sent to OpenAI. Your identity, email address and exact location are not. This transfer outside the European Union is covered by the European Commission Standard Contractual Clauses.

This analysis is explained inside the app and requires your explicit consent before your first post. Without that consent you may browse Kartié freely but not publish.

Moderation decisions (verdict and reason) are kept for twelve months for traceability and to handle appeals.

The providers we use

Kartié relies on a small number of providers, all named here:

• Supabase (Supabase, Inc.) — database hosting, account management and photo storage. Data is hosted in the European Union (Paris region).
• OpenAI (OpenAI, L.L.C., United States) — automatic analysis of text and images for moderation, as described above.
• Apple (Apple Inc.) — app distribution through the App Store and push notification delivery.
• Vercel (Vercel Inc.) — hosting of this website.

Retention

Your reports, comments and masked photos are kept while your account exists and while they remain useful to the community. Moderation logs are kept for twelve months. If you delete your account, all your data is erased immediately and permanently.

Your rights

Under the General Data Protection Regulation you have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability.

You can delete your account directly in the app: Profile, then Settings, then "Delete my account". Deletion is immediate and permanent. For any other request, write to gonthierlucas3@gmail.com. You may also lodge a complaint with the French data protection authority (CNIL).

Image rights and third-party data

If you believe you appear in a photo published on Kartié, or that a post identifies you, write to gonthierlucas3@gmail.com. The content is removed without delay while we verify, and within 24 hours at the latest.

Minors

Kartié is not intended for children. Creating an account is reserved for people aged 13 or over.

Changes to this policy

Any substantial change to this policy will be announced in the app before it takes effect.