Last updated: July 27, 2026
This policy explains what personal data is collected when you use the Wakatoo application and the wakatoo.com website, why we collect it, and what your rights are. It is written in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
This is an English translation provided for convenience. In the event of any discrepancy between this translation and the French version (« Politique de confidentialité »), the French version shall prevail.
1. Who is responsible for your data?
The data controller is:
Gauthier Aubé — Sole proprietor (entrepreneur individuel)
21410 Mâlain, France
SIREN (French business registration number): 799 206 172
E-mail: contact@wakatoo.com
2. What data do we collect?
Data you provide to us
- Account: e-mail address, username, password (stored encrypted, never in plain text). If you sign in with Google, Apple or Facebook, we receive from those services your name, your e-mail address and, where applicable, your profile picture;
- Profile: avatar, city and country, photos and descriptions of your instruments, and anything else you choose to add;
- Content: rhythms you create, shares, messages sent through private messaging, feedback sent through the feedback form;
- Correspondence with us: e-mails or messages sent to support.
Data generated by your use of the service
- Progress: completed quests, unlocked cards, experience points, rhythms played;
- Purchases: transaction identifiers provided by Apple/Google and RevenueCat (subscribed tier, start and end dates, free trial status). We never have access to your banking details, which are processed exclusively by Apple or Google;
- Usage data: usage events kept as anonymous as possible (screens viewed, features used), measured through Mixpanel on servers located in the European Union;
- Technical data: device model, operating system, crash reports (Firebase Crashlytics), push notification token;
- Approximate location (« Around you »): from the city entered in your profile, we compute on our servers the geographic coordinates of the centre of that city — never your exact position or your address. They are used solely to estimate the distance between you and other members.
What stays on your device
- Your address book: if you use the « Invite friends » feature, your contacts are read locally on your phone, only to display the list and prepare an invitation SMS. They are never sent to our servers.
- Your practice audio recordings: they are recorded and analysed locally on your device. A recording is only uploaded to our servers if you explicitly choose to share the corresponding rhythm.
- Your GPS position: the « Locate me » button uses your phone’s GPS locally only, to pre-fill your city name. Your position is never stored and never sent to Wakatoo’s servers; only a reverse-geocoding request (coordinates → city name) is sent to the Nominatim service (OpenStreetMap).
3. Why, and on what legal basis?
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, saving your progress, providing the app’s features | Performance of the contract (the Terms) |
| Managing your subscriptions and purchases | Performance of the contract |
| Operating the community (visible profile, messaging, shares) | Performance of the contract |
| Connecting you with members near you (« Around you ») | Legitimate interest — can be turned off at any time in the app: Profile → Settings → Privacy → « Appear in “Around you” » |
| Sending push notifications and practice reminders | Consent (system permission, can be disabled at any time) |
| Accessing your contacts to invite friends | Consent (system permission, never uploaded) |
| Measuring how the app is used in order to improve it | Legitimate interest — can be turned off at any time in the app: Profile → Settings → Privacy → « Share anonymous usage statistics » |
| Fixing bugs and crashes | Legitimate interest |
| Meeting our legal obligations (invoicing, accounting) | Legal obligation |
4. Who has access to your data?
Your data is never sold and is never used for third-party targeted advertising. It is processed by the following technical service providers, each limited to its own task:
| Service | Company | Location | Role |
|---|---|---|---|
| Website and WordPress backend hosting | Infomaniak Network SA | Switzerland (recognised as adequate by the EU) | Accounts, progress, course content |
| Firebase (database, storage, authentication, notifications) | Google Ireland Ltd | Ireland / EU, safeguarded transfers | Community, messaging, shares, sign-in |
| Firebase Crashlytics | Google Ireland Ltd | Ireland / EU, safeguarded transfers | Crash reports |
| Mixpanel | Mixpanel Inc. | European Union servers | Usage statistics |
| RevenueCat | RevenueCat Inc. | United States, safeguarded transfers | Technical subscription management |
| Apple App Store / Google Play | Apple Inc. / Google LLC | Depending on your account | Payment processing |
| Nominatim | OpenStreetMap Foundation | United Kingdom (recognised as adequate by the EU) | Geocoding: converting your city name into coordinates, and vice versa |
Some members of the community also see the information you make public: username, avatar, instrument collection, shared content. You can adjust your profile’s visibility in the application (Profile → Settings → Privacy).
In « Around you », other members only see your public profile and an approximate distance, rounded to the kilometre — never your position or your address. You appear in this feature by default; you can stop appearing in it at any time (Profile → Settings → Privacy → « Appear in “Around you” »).
5. Does your data leave the European Union?
Our data is hosted primarily in Switzerland (covered by a European Commission adequacy decision) and in the European Union. Where a service provider may transfer data to the United States (Google, RevenueCat), those transfers are safeguarded by the EU–US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses. The Nominatim geocoding service is operated by the OpenStreetMap Foundation in the United Kingdom, a country also covered by a European Commission adequacy decision.
6. How long do we keep your data?
- Account and progress: for as long as your account is active. After account deletion (possible at any time in the app: Profile → Settings), your data — including your city and the associated city-centre coordinates — is erased from our active systems without undue delay, and at the latest within 90 days, including technical backups;
- Private messages: deleted along with your account; messages you sent to other members may remain visible in their conversation;
- Crash reports and usage statistics: limited retention periods applied by Crashlytics and Mixpanel (5 years at most);
- Billing data: 10 years (legal accounting obligation).
7. Your rights
Under the GDPR, you have the following rights over your data:
- Access: obtain a copy of the data we hold about you;
- Rectification: correct inaccurate data (most of it can be edited directly in the app);
- Erasure: delete your account and your data (directly in the app or on request);
- Portability: receive your data in a machine-readable format;
- Objection: object to processing based on our legitimate interest — for usage statistics as well as for « Around you », a switch is available directly in the app (Profile → Settings → Privacy);
- Restriction: request the temporary freezing of a processing operation;
- Post-mortem directives: define what happens to your data after your death (French law).
To exercise these rights, write to contact@wakatoo.com. We reply within one month. Proof of identity may be requested in case of reasonable doubt about your identity.
If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority (CNIL): www.cnil.fr — CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
8. Security
We apply appropriate technical and organisational measures: encrypted communications (HTTPS/TLS), secure credential storage on your device, encrypted passwords, strict access rules on our databases, least-privilege principle with our service providers. As no system is infallible, we will notify you as required by law in the event of a data breach likely to affect you.
9. Minors
Wakatoo is reserved for people aged 15 and over (the digital age of consent in France). We do not knowingly collect data from minors under 15; any account identified as such will be deleted. If you are a parent and believe your child is using Wakatoo, please contact us.
10. Notifications
Push notifications (community activity, practice reminders) require your system permission and can be fine-tuned in the application (Profile → Settings → Notifications) or in your phone’s settings.
11. Cookies
The Wakatoo application does not use cookies. The wakatoo.com website may use cookies that are strictly necessary for its operation; any non-essential cookie (audience measurement, third-party content) will be subject to your consent through the banner provided for that purpose.
12. Changes to this policy
This policy may evolve along with the service or with regulations. The date of the latest update is shown at the top of the page; in the event of a substantial change, you will be informed in the application or by e-mail.
13. Contact
For any question about your personal data:
contact@wakatoo.com
Gauthier Aubé, 21410 Mâlain, France