Privacy policy

This page describes what RevealChat does with your data. It is written to be read, not to be worked around.

In short

• The cleanup happens on your phone. Reading the export file, splitting it, merging identities, computing the counters: all of that runs locally, with no network.
• Nothing is sent until you start an analysis. You are the one who triggers it, including for the 3 free insights.
• When you do start one, only what is strictly needed leaves. Excerpts and counters, not your contact list, not your media, not your address book.
• Your messages are not stored at all on our servers. They pass through for the length of one analysis, they are never written down.

Data controller

Brian Biendou EI, Sonnerie 10, 8 rue de la Mayenne, 31100 Toulouse, France. SIRET 919 153 189 00015. For any question about your data: contact@revealchat.fr.

No data protection officer has been appointed: the activity does not fall into the cases where that appointment is mandatory. Requests are handled directly by the publisher, at the address above.

Data processed

On your device, never sent

The WhatsApp export file you select, the messages it contains, the sender names, the dates and the times. The app reads these to build a usable corpus.

Sent when you start an analysis

Excerpts of the conversation and statistics computed locally are sent to our servers, then to the provider of the artificial intelligence model that writes the insights. The selection is made to keep the volume sent down to what the writing needs.

Technical data

A session identifier, generated on first launch, unrelated to your phone and to your number. The first name you enter, the language you choose, the status of your purchases, and our servers’ error logs.

The app embeds no analytics and no crash reporting tool: no Firebase, no Sentry, no equivalent. Nothing counts your sessions, nothing traces your screens. The day such a tool were added, it would appear here and in the store listing before being switched on.

Analytics on this site

The pages of this site are counted by Vercel Web Analytics, our host’s measurement tool. It records the page viewed, the page you came from, the country, the device type and the browser. It sets no cookie, creates no identifier that would follow you from one visit to the next, and cannot recognise you on another site. The data is aggregated: we see totals, not visitors. This only concerns the site: the mobile app is not covered by this paragraph.

Legal bases

• Performance of the contract for the analysis you ask for and the delivery of its results.
• Legitimate interest for the security of the service and the prevention of abuse.
• Consent for any optional processing, revocable at any time.

Recipients

• Supabase, Inc. for hosting the database and the server functions. Our project is hosted in Ireland (eu-west-1 region).
• Mistral AI and OpenAI for writing the insights from what is sent. The app spreads its calls between the two: the same analysis may be written by one, by the other, or by both.
• Vercel Inc. for hosting this site and its analytics.
• Apple and Google for distributing the app and handling in-app purchases.

What the model provider does with the excerpts

Mistral AI and OpenAI keep what they receive for a rolling thirty days, to detect abuse of their service, then delete it.

Neither of them uses it to train their models. At OpenAI that is the default for everything going through a programming interface. At Mistral AI training is planned by default but can be refused from the customer account: the objection is exercised on every account we use.

Transfers outside the European Union

The database, the server functions and therefore all of your analyses stay in Ireland, inside the Union. Mistral AI is a French company. On that path, none of your data leaves the Union.

OpenAI, Vercel, Apple and Google are United States companies. Transfers to these providers rely on the standard contractual clauses adopted by the European Commission, included in the processing agreements we entered into with each of them.

Retention periods

• The export file and the messages in it: never kept by us. They stay on your phone, and you erase them by uninstalling the app.
• The excerpts sent for an analysis: not kept either. They pass through our servers for the length of the call, without being written there. Only the model provider keeps them for thirty days, as stated above.
• Analysis results, your first name, your language and your purchases: for as long as your account exists. There is no automatic expiry, and you delete the whole lot at any time from the app.
• Sales records: ten years from the close of the accounting year concerned, as article L. 123-22 of the French commercial code requires. They are kept in an anonymous form: amount, date and pack purchased, with no link to a person.
• Technical logs: one day, the retention period of our hosting plan, then automatic deletion.
• Backups: there are none. Our hosting plan includes no restorable backup. Deleted data is gone immediately and for good, there is no copy lingering for a few more days.

A conversation involves another person

A WhatsApp export contains the other person’s messages as much as yours. By importing a conversation, you state that you took part in it. RevealChat publishes no result, never contacts the people mentioned, and does not cross-reference conversations between users. Sharing a result is always something you trigger yourself.

Your rights

You have a right of access, correction, erasure, restriction, objection and portability. Deletion is requested from the app or through the Delete your data page.

For any request: contact@revealchat.fr. If we disagree, you may lodge a complaint with the CNIL, the French data protection authority, cnil.fr, or with the supervisory authority of your own country of residence.

Minors

RevealChat is for people aged 16 and over. That is the highest threshold the GDPR lets member states set: choosing it avoids having to collect parental consent in one country and not in another. It is declared identically in the App Store and Google Play listings.

We do not ask for proof of age, and we do not run a verification that would require collecting an identity document: that would mean gathering more data in order to protect less. If we are told an account belongs to someone younger, it is deleted, along with the analyses attached to it.