Privacy policy

This page describes what RevealChat does with your data. It is written to be read, not to be worked around.

In short

• The cleanup happens on your phone. Reading the export file, splitting it, merging identities, computing the counters: all of that runs locally, with no network.
• Nothing from your conversation is sent until you start an analysis. You are the one who triggers it, including for the 3 free insights.
• When you do start one, only what is strictly needed leaves. Excerpts and counters, not your contact list, not your media, not your address book.
• Your messages are not stored at all on our servers. They pass through for the length of one analysis, they are never written down.

Data controller

Brian Biendou EI, Sonnerie 10, 8 rue de la Mayenne, 31100 Toulouse, France. SIRET 919 153 189 00015. For any question about your data: contact@revealchat.fr.

No data protection officer has been appointed: the activity does not fall into the cases where that appointment is mandatory. Requests are handled directly by the publisher, at the address above.

Data processed

On your device, never sent

The WhatsApp export file you select, the messages it contains, the sender names, the dates and the times. The app reads these to build a usable corpus.

Sent when you start an analysis

Excerpts of the conversation and statistics computed locally are sent to our servers, then to the provider of the artificial intelligence model that writes the insights. The selection is made to keep the volume sent down to what the writing needs.

Technical data

A session identifier, generated on first launch, unrelated to your phone and to your number. The first name you enter, the language you choose, the status of your purchases, and our servers’ error logs.

The app embeds a crash reporting tool, Sentry, and no analytics: nothing counts your sessions, nothing traces your screens. When the app hits an error, a report goes to Sentry: the technical trace (code files and line numbers), the device model, the operating system version and the app version. Before it leaves, every text in the report is scrubbed on your phone: any line shaped like a conversation message, any e-mail address and any phone number are replaced with markers, and console logs are never attached to the report. Your IP address is not stored with it.

Analytics on this site

The pages of this site are counted by Vercel Web Analytics, our host’s measurement tool. It records the page viewed, the page you came from, the country, the device type and the browser. It sets no cookie, creates no identifier that would follow you from one visit to the next, and cannot recognise you on another site. The data is aggregated: we see totals, not visitors. This only concerns the site: the mobile app is not covered by this paragraph.

Legal bases

• Performance of the contract for the analysis you ask for and the delivery of its results.
• Legitimate interest for the security of the service and the prevention of abuse.
• Consent for any optional processing, revocable at any time.

Recipients

• Supabase, Inc. for hosting the database and the server functions. Our project is hosted in Ireland (eu-west-1 region).
• Mistral AI and OpenAI for writing the insights from what is sent. The app spreads its calls between the two: the same analysis may be written by one, by the other, or by both.
• Vercel Inc. for hosting this site and its analytics.
• Functional Software, Inc. (Sentry) for collecting the app’s crash reports, hosted on its European Union infrastructure.
• Brevo (a French company) for sending our e-mails: password resets, and messages telling you about a change to the service. Your address and first name are stored there for that purpose only.
• Apple and Google for distributing the app and handling in-app purchases.

What the model provider does with the excerpts

Mistral AI and OpenAI keep what they receive for a rolling thirty days, to detect abuse of their service, then delete it.

Neither of them uses it to train their models. At OpenAI that is the default for everything going through a programming interface. At Mistral AI training is planned by default but can be refused from the customer account: the objection is exercised on every account we use.

Transfers outside the European Union

The database, the server functions and therefore all of your analyses stay in Ireland, inside the Union. Mistral AI and Brevo are French companies. On that path, none of your data leaves the Union.

OpenAI, Vercel, Apple, Google and Sentry are United States companies. Transfers to these providers rely on the standard contractual clauses adopted by the European Commission, included in the processing agreements we entered into with each of them. Crash reports, for their part, stay inside the Union: our Sentry organisation is created on its European region.

Retention periods

• The export file and the messages in it: never kept by us. They stay on your phone: the app keeps the conversation in its private folder, excluded from Android’s automatic backups, so you can analyze another period without exporting everything again. You erase them from the Profile screen, or by uninstalling the app.
• The excerpts sent for an analysis: not kept either. They pass through our servers for the length of the call, without being written there. Only the model provider keeps them for thirty days, as stated above.
• Analysis results, your first name, your language and your purchases: for as long as your account exists. There is no automatic expiry, and you delete the whole lot at any time from the app.
• Sales records: ten years from the close of the accounting year concerned, as article L. 123-22 of the French commercial code requires. They are kept in an anonymous form: amount, date and pack purchased, with no link to a person.
• Technical logs: one day, the retention period of our hosting plan, then automatic deletion.
• Crash reports: ninety days at Sentry, its platform’s standard retention, then automatic deletion.
• Backups: there are none. Our hosting plan includes no restorable backup. Deleted data is gone immediately and for good, there is no copy lingering for a few more days.

A conversation involves another person

A WhatsApp export contains the other person’s messages as much as yours. By importing a conversation, you state that you took part in it. RevealChat publishes no result, never contacts the people mentioned, and does not cross-reference conversations between users. Sharing a result is always something you trigger yourself.

Your rights

You have a right of access, correction, erasure, restriction, objection and portability. Deletion is requested from the app or through the Delete your data page.

For any request: contact@revealchat.fr. If we disagree, you may lodge a complaint with the CNIL, the French data protection authority, cnil.fr, or with the supervisory authority of your own country of residence.

Minors

RevealChat is for people aged 16 and over. That is the highest threshold the GDPR lets member states set: choosing it avoids having to collect parental consent in one country and not in another. It is declared identically in the App Store and Google Play listings.

We do not ask for proof of age, and we do not run a verification that would require collecting an identity document: that would mean gathering more data in order to protect less. If we are told an account belongs to someone younger, it is deleted, along with the analyses attached to it.