Privacy policy

The data controller is SPRINTMOB, a French SASU with share capital of €10,000, registered with the Créteil trade register under number 949 720 544, with its registered office at 21 rue André Bollier, 94100 Saint-Maur-des-Fossés, France.

For anything about your personal data: contact@coinscious.app.

No data protection officer (DPO) has been appointed.

This is a presentation site. It currently has no form, no sign-up, no account, no waiting list and no comments: browsing it sends us nothing you typed.

To know how many people visit the site and which buttons get used, we use Umami, a cookieless audience measurement tool: it stores nothing on your device and does not follow you from site to site. It records the page viewed, the page you came from, your type of device, browser and operating system, your language and your approximate location (country, region). Your IP address is used for that location and to group the pages of one visit, and is not kept afterwards. We only ever see overall statistics, never a person. If your browser sends a Do Not Track signal, nothing is measured. And still no Google Analytics, no ad pixel, no social widget following you around.

Download buttons go through a redirect that tells the store which button was clicked on the page, so we can see which placements lead to installs. The link carries no identifier and sets no cookie. The click is also counted in Umami (button placement and target store), like a page view. On Android, Google Play passes that placement on to the app when it is installed, and Adjust may then tie it to your install (see “In the app: usage analytics, attribution and diagnostics”).

Fonts and images are served from our own domain, so your browser never has to call a third-party service to render the page.

Like any host, the site's host keeps technical connection logs (IP address, timestamp, page requested, browser type) needed to run and secure the service. Render, which hosts the site, keeps these logs for 7 days.

This site sets a single cookie, named NEXT_LOCALE. It remembers the language you picked, French or English, so you get it again next time. It lasts one year.

It is strictly necessary to the service you asked for, which exempts it from consent under the French data protection authority's guidance on cookies and trackers. It still has to be disclosed to you, and this paragraph is that disclosure.

If you switch between the light and dark theme, the site saves that preference in your browser's local storage under the key theme. The value stays on your device and is never sent to us.

No advertising, analytics or social-network cookie is set. You can clear both of these at any time from your browser settings: the site keeps working, it has simply forgotten your preferences.

You sign up with Apple, Google or your email address. We then process your email address, your name if you give it or Apple or Google passes it on, and your Apple or Google account identifier. Sign-in is handled by Clerk.

Your answers to the opening questions: your age, your main goal, your level, your learning goal and how much time you want to spend on it each day. If you take the money personality quiz, its results.

Your progress: lessons and steps taken, answers to exercises, learning sessions, XP, streaks, coins, energy, quests and daily activity.

Your settings: language, time zone and region. For notifications: your device's push token, its type, its model and the app version. For referrals: your code and the link between you and whoever invited you or whom you invited.

This data is stored in our database, hosted by Supabase, which also runs our server functions.

Amplitude measures how the app is used: events such as finishing a lesson, making a purchase or answering the notification prompt, tied to your account identifier, the app version, your platform and a few properties such as your current streak or coin balance. It tells us what works so we can make the app better.

Adjust tells us where an install came from (campaign, ad, link) so we can measure our marketing. On iOS, your advertising identifier (IDFA) is only read if you allow it in Apple's tracking prompt (App Tracking Transparency). On Android, Google's advertising ID may be used: you can reset or delete it in your device settings.

Sentry receives crash and error reports: a technical description of the error, your device model and operating system, the app version, your account identifier, and the last screens you visited and actions you took before the error.

An error report can include a screenshot taken when the problem occurred, and the tool is set up so it can record a replay of the screens around an error. These captures do not mask text or images, so whatever was on screen (your first name, your progress, your answers) may appear in them.

Purchases (the MAX subscription, coin packs) are paid through Apple or Google. We never see your card details. Adapty tells us the status of your subscription and purchases, tied to your account identifier.

If you allow notifications, they are sent through Expo's push notification service, which delivers them via Apple or Google. You can turn them off at any time in your device settings.

Messages sent through the in-app support form land in our team's Slack workspace, along with your account identifier and email address.

Showing the site in the language you picked: SprintMob's legitimate interest in giving you consistent navigation (GDPR article 6(1)(f)), implemented with a strictly necessary cookie.

Running, securing and keeping the site available, through the host's technical logs: legitimate interest (GDPR article 6(1)(f)).

Measuring the site's audience with Umami, without cookies and as overall statistics: SprintMob's legitimate interest in knowing which pages and buttons are useful (GDPR article 6(1)(f)). You can object by turning on your browser's Do Not Track signal.

Replying to a message you send us: steps taken at your request before entering into a contract, or legitimate interest, depending on what you are asking (GDPR article 6(1)(b) or 6(1)(f)).

Providing the app's service (account, lessons, progress, streaks, purchases, referrals, support): performance of the contract formed by our terms of use (GDPR article 6(1)(b)).

Securing the app, diagnosing crashes and improving the product (Sentry, Amplitude): legitimate interest (GDPR article 6(1)(f)). You can object by writing to us.

Measuring where installs come from (Adjust): legitimate interest (GDPR article 6(1)(f)). Reading your advertising identifier on iOS relies on your consent, given in the App Tracking Transparency prompt (GDPR article 6(1)(a)).

Sending you notifications: your consent, given in your device's permission prompt (GDPR article 6(1)(a)).

NEXT_LOCALE cookie: one year, or less if you clear your browser data first.

Theme preference in local storage: kept on your device until you clear it. We have no access to it.

The site's technical logs: 7 days at Render.

Visit statistics (Umami): 25 months at most.

Account and learning data: kept for as long as your account exists. When you delete it from Settings in the app, it is erased from our database and your Clerk account is deleted.

One exception: a referral record is not erased but anonymised (the link to your account is removed), so the referral programme's books still add up.

Data held by our providers (usage analytics, error reports, attribution, purchase status): kept according to each provider's retention settings. Deleting your account does not automatically erase it on their side: write to us to ask for that.

Email exchanges and messages sent to support: kept for 3 years after our last exchange, then deleted.

We do not sell your data, and we pass it to no advertiser, data broker or ad platform.

Our processors, within the meaning of GDPR article 28: Render (site hosting), Umami (site audience measurement), Clerk (sign-in), Supabase (database and server functions), Amplitude (usage analytics), Adjust (install attribution), Sentry (error reports), Adapty (subscription and purchase management), Expo (notification delivery) and Slack (receiving support messages).

Apple and Google also process some data as independent controllers when you use their stores or sign in with them.

Several of these providers are based in the United States or may process data outside the European Union.

Those transfers rely on the safeguards in chapter V of the GDPR: depending on the provider, the EU / US Data Privacy Framework and/or the European Commission's standard contractual clauses.

The GDPR gives you the right to access your data, correct it, erase it, restrict how it is processed, object to that processing, and receive it in a portable format. French law also lets you leave instructions about what happens to it after your death. Where processing relies on your consent, you can withdraw it at any time.

To exercise any of these, write to contact@coinscious.app. We answer within one month, extendable by two more if the request is complex. We may ask for proof of identity where there is reasonable doubt about who is asking.

In the app, you can delete your account yourself from Settings, and withdraw tracking or notification permission in your device settings. Without the app, follow the steps to delete your account.

Browsing this site creates no account and no profile. If you have never written to us and do not use the app, we almost certainly hold nothing about you.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority.

CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. Complaints can also be filed online at cnil.fr.

The Coinscious app is for people aged 15 and over. We do not knowingly collect data about younger children.

If you believe a child under 15 has given us their data, write to contact@coinscious.app and we will delete it.

This policy will change if we add a tool to the site or the app. The date at the top of this page says when it last did.

Anything significant will be flagged on the site or in the app.