Privacy policy

This is an English translation provided for convenience. The French version of this policy is the authoritative one.

This policy explains what data the Depression app and its website process, why, on what basis, with whom and for how long, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi n° 78-17 of 6 January 1978). Because the app deals with mental health, we have designed it so that your most personal information does not leave your phone, and below we describe, without leaving anything out, what does leave it.

1. Data controller

BAUGEY MATHEO, sole trader (entrepreneur individuel) trading as DEVOLIM
248 rue de Bègles, 33800 Bordeaux, France
SIREN: 948 000 757
Email: contact.depression@devolim.fr

The publisher has not appointed a data protection officer: any question or request relating to your data is handled directly by the publisher, at the address above.

2. Our principles

• No account to create: you are not asked for a name, an email address, a phone number or a password.
• What you write and log stays encrypted on your phone.
• No advertising, no ad tracking, no advertising identifier, no geolocation.
• No data sold, rented, exchanged or transferred, to anyone.
• Artificial intelligence is only used with your explicit consent; your messages are never stored on our servers or used to train an AI.
• Usage statistics are off by default and never contain your moods, your scores, your texts, your treatments or your contacts.
• We collect as little as possible, and the data kept on our servers is kept for a limited time, except the technical identifier, which contains nothing about you.

3. What stays on your phone

The following information is stored only on your phone, in an encrypted vault (AES-256-GCM encryption, with the key kept in the system's secure keychain):

• your first name or nickname, if you give one, and your answer to the question “Where are you at right now?” (« Où en es-tu en ce moment ? »);
• your moods, emotions, sleep, energy and related notes;
• your answers and scores on the PHQ-9 questionnaire;
• your gratitude journal, the thoughts you examine, your grey days kit (kit des jours gris);
• your progress, your activities and your answers in the programme and the exercises;
• your safety plan, your trusted contacts (name and number) and your text message template;
• your treatments, their times and the doses you have taken;
• your conversations with Kolo, kept for 30 days after the last message of each conversation, then removed automatically;
• the version and date of your acceptance of the health disclaimer and of the terms, and the date of your consent to Kolo.

A few settings with no personal content are kept outside the vault, in the app's preferences (appearance, sounds, language, mood reminder time, whether the lock is on or not, your choice regarding statistics). The lock code is never stored in plain text: only a hash (PBKDF2) is kept in the keychain.

We have no access to this information and cannot recover it. It is deleted when you tap “Erase everything” in Settings, Privacy (Réglages, Confidentialité), or when you uninstall the app.

Backups. On Android, cloud backup and transfer to another phone are disabled for the app. On iPhone, the encrypted vault files may be included in iCloud or computer backups; they remain unreadable without their key, which only carries over in an encrypted backup or a direct transfer to a new iPhone.

Export. You can export your data (a readable file in JSON format) or share your questionnaire results as a PDF, for example with your doctor: you choose the recipient, through your phone's share menu. The file is not encrypted: keep it somewhere safe. Once shared, it is outside our control; the temporary files created by the app are then deleted from the phone. You can also share your safety plan as text.

Notifications. Reminders are local notifications, scheduled on the phone itself, with no sending server. By default, a treatment reminder only shows “It's time for your reminder” (« C'est l'heure de ton rappel »); the name of the treatment only appears on the lock screen if you turn this option on.

4. What leaves your phone

4.1 From the first launch

So that the app works and stays secure, three technical exchanges take place from the first launch, even before you use Kolo, and they contain no information about your health:

• Anonymous identifier: the app creates a random technical identifier (Firebase Authentication anonymous sign-in). It contains neither your name, nor your email address, nor your number; we call it “anonymous” for this reason, but under the GDPR it is pseudonymous data, since it is specific to your installation. It is used to apply Kolo's usage limits, to link your subscription and to erase your data on our servers when you ask us to.
• Service protection: every request to our servers carries a Firebase App Check attestation (Apple App Attest and DeviceCheck, Google Play Integrity) proving that it comes from the genuine app. This attestation contains no content and is not kept by us.
• Subscription status: the app asks RevenueCat, using your anonymous identifier, whether a subscription is active.

Crash reports (section 4.6) are also active from the first launch.

4.2 Messages to Kolo, only with your consent

Kolo only works after you have given your explicit consent, on a dedicated screen that explains what follows. When you write to Kolo, the app sends, in encrypted form, to our server function (Google Cloud Functions, europe-west1 region, in Belgium):

• your message;
• the latest messages of the current conversation, so that the reply makes sense;
• the app language and the country code set on your phone (to choose the right helpline numbers);
• your anonymous identifier and the App Check attestation.

The server first looks for signs of crisis, checks your usage limits and your subscription, then passes the following to OpenAI, which writes the reply: your message, the conversation context, the language, a “France or another country” indication (not your country code) and a pseudonymous identifier, obtained by hashing your anonymous identifier, which OpenAI uses to detect abuse. The message and the reply are also checked by OpenAI's moderation service, to filter out dangerous content. If a sign of crisis is detected, the server replies itself with a fixed message giving helpline numbers, without calling the model.

• We do not store any messages: neither in our database nor in our technical logs.
• OpenAI processes this data on our behalf, with data residency in Europe. It is not used to train its models; it may be kept for up to 30 days for abuse detection, then deleted.
• You can withdraw your consent at any time, in Kolo under My conversations (Mes conversations), or in Settings, Privacy. Without your consent, nothing is sent to Kolo; the app's other features remain available.
• When writing to Kolo, do not include your name, your address or any information that could identify you or someone close to you.

4.3 Counters and subscription status on our servers

On our servers (Google Cloud Firestore database, in Europe), no text is stored. The following are linked to your anonymous identifier:

• the counters of messages sent to Kolo (per day and per minute), which apply the usage limits;
• when one of your messages has mentioned a crisis, the end time of a two-hour period during which your messages are not counted against the daily limit, so that you are not deprived of replies at that moment (technical protections against abuse still apply). This information reveals that a message mentioned distress: we treat it as health data, within the scope of your consent to Kolo. It is erased as soon as you send your first message after this period ends, and at the latest along with the rest of the counters;
• your subscription status (active or not, end date), stored so that it does not have to be requested from RevenueCat with every message, and checked again regularly.

The server's technical logs record the type of event (reply sent, crisis reply, error), without your identifier or the content of messages. As with any online service, Google Cloud's request logs also record the IP address and device type behind each call.

4.4 Suggestions, bugs and reports

If you write to us from the app (suggestion or bug), we receive: the text you write, a rating from 1 to 5 if you give one, the category, the app version, the phone's system (iPhone or Android), the language and your anonymous identifier. If you report a reply from Kolo (long press on the reply), we receive the reported reply, the tool suggested, if any, and the reason you chose, never your own messages; the reported reply may, however, repeat what you had confided, and we then treat it as health data. The report window tells you this and asks for your consent before sending (“Accept and send”, « Accepter et envoyer »). These submissions contain neither your name nor your email address: we cannot reply to them. Do not include any information about your health in them.

4.5 Usage statistics, only if you agree

Using an app dedicated to depression can in itself be sensitive information. That is why statistics are off by default, including on the very first launch, and are only turned on if you agree (the “Usage statistics without content” switch, « Statistiques d'usage sans contenu », offered with the health disclaimer and in Settings, Privacy).

If you turn them on, Google Analytics for Firebase receives, together with a pseudonymous instance identifier: the screens displayed (designated by a generic name); the features used, without their content (for example: a mood logged, a questionnaire started or completed, an exercise started, a programme session completed, a purchase started); whether or not a subscription is active; and the information that Google Analytics collects automatically (phone model and system, language, approximate country, sessions, first open). The following are never sent: your mood level, your answers or scores, your texts, the names of your treatments or of your contacts, the content of your messages. Even with your consent, nothing is sent about help, support lines, a crisis, your trusted contacts, your safety plan or your medication: these screens and actions are excluded from statistics, as are the crisis exercises. Advertising is always denied in the Google Analytics consent settings, and the advertising identifier is not collected. Turning statistics off stops the collection and erases the instance identifier.

4.6 Crash reports

When the app crashes or encounters an error, Firebase Crashlytics receives a technical report: the error trace, the phone model, the system and app version, whether or not a subscription is active, and an installation identifier specific to Crashlytics. These reports are not linked to any other identifier and, by design, do not contain your texts, moods, scores, treatments or contacts.

4.7 Purchases

Payments are collected by Apple (App Store) or Google (Google Play): we see neither your identity nor your bank details. RevenueCat, our subscription management provider, receives your anonymous identifier and, when you make or restore a purchase, the transaction information sent by the store (product, dates, store country and currency, receipt), in order to unlock and verify your Premium access.

4.8 Messages to support

If you email us, we use your address and your message only to reply to you. When emailing us, only include the health information that is strictly necessary for your request.

4.9 Calls, text messages and links

When you call a helpline or a trusted contact from the app, the call or text message is prepared and then made by your phone itself, at your initiative. The app does not pass these numbers on to us and does not alert anyone. Links to external websites (helplines, public services, findahelpline.com, this website) open in your browser, under the responsibility of those websites.

5. Health data

Your moods, your answers to the questionnaire, your treatments and what you confide in the app are health data, protected by Article 9 GDPR. Our choice is not to receive them: they stay encrypted on your phone, under your sole control. The exceptions are limited and described above:

• the messages you choose to send to Kolo, and any resulting crisis period, processed on the basis of your explicit consent (Article 9(2)(a) GDPR), which can be withdrawn at any time, without the messages being stored on our servers;
• reports of Kolo's replies, sent with your explicit consent collected in the report window, and suggestions if you nevertheless include health information in them.

Statistics, crash reports and message counters do not contain the content of what you do in the app. Our architecture is designed not to host health data: our servers do not keep any, apart from the crisis period indicator and the reports described above, which are erased when their retention period ends.

6. Purposes and legal bases

7. Recipients and processors

Your data is only accessible to the publisher and to the providers below, which act on its behalf as processors (Article 28 GDPR), with the exception of Apple and Google for sales, which act under their own responsibility.

Each of these providers is contractually bound to ensure the confidentiality and security of the data. No data is sold, rented or transferred to third parties. We would only disclose data to an authority in response to a request with a legal basis.

8. Transfers outside the European Union

Our server functions and our database are located in the European Union, and Kolo's replies are processed by OpenAI with data residency in Europe. Some data may nevertheless be processed outside the European Union, in particular in the United States, by our providers or their affiliates: RevenueCat, OpenAI for operations its affiliates carry out outside European data residency, Google for its global services (anonymous sign-in, App Check, Crashlytics, Analytics), and Cloudflare for delivering the website. These transfers are covered by the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures.

9. Retention periods

Automatic erasures on our servers are carried out by Google when the scheduled period expires, usually within the following days.

10. What we do not do

• No advertising, either in the app or on the website.
• No ad tracking: the advertising identifier is not collected, and the app does not ask for Apple's tracking permission (App Tracking Transparency), which it does not need.
• No geolocation: only the time zone and the region set on your phone are used, to animate the app's sky and to choose the helpline numbers for your country.
• No access to your address book: a trusted contact is chosen with the system picker, which only passes the chosen name and number to the app.
• No access to the camera, the microphone or your photos, nor to Apple Health or Health Connect data.
• No selling, renting or exchanging of data, no data brokers.
• No training of artificial intelligence with your messages.
• No profiling, and no sharing with an employer, an insurer or a bank.

11. Automated processing and artificial intelligence

Kolo is an artificial intelligence: its replies are generated automatically. The app and the server also automatically detect certain words of distress, in order to display helpline numbers and prevent a person in crisis from being left without a reply by the daily limit. This processing does not make any decision producing legal effects concerning you or significantly affecting you within the meaning of Article 22 GDPR: it does not alert anyone and does not pass on your situation to anyone.

12. Phone permissions

• Notifications: only requested when you schedule a reminder (mood, programme, treatments).
• Face ID or fingerprint: for the lock, if you turn it on. Recognition is performed by the system; the app receives neither your face nor your fingerprint.
• Exact alarms and restart (Android): so that treatment reminders arrive on time and are rescheduled after a restart.
• Internet: for Kolo, messages to the team, purchases, crash reports and, if you accept them, statistics.

You can withdraw these permissions at any time in your phone's settings.

13. Security

• Your content is encrypted on the phone (AES-256-GCM, using the system's encryption functions), and the key is kept in the system's secure keychain.
• Optional lock by code or biometrics, with increasing waiting times after several failed attempts; the app's content is hidden in the app switcher.
• All exchanges with our servers are encrypted (HTTPS).
• Our servers only accept requests from the genuine app (App Check); the database is closed to any reading or writing from the app; secret keys stay on the server; Kolo's replies are signed, so that a modified phone cannot make it say anything other than what it said; usage limits protect the service.
• Data kept on our servers is erased automatically when the scheduled period expires.
• Access to administration tools is restricted to the publisher.

The lock protects access to the app; it does not replace your phone's unlock code. No system is invulnerable: protect your phone and keep its system up to date.

14. Your choices and your rights

At any time, in the app, you have:

• a switch to accept or refuse usage statistics (Settings, Privacy);
• the option to withdraw your consent to Kolo (in Kolo, My conversations, or in Settings, Privacy);
• the option to erase your conversations with Kolo;
• an export of your data (Settings, Privacy);
• the “Erase everything” function (Settings, Privacy). It deletes your content from the phone and, if your phone is connected to the internet, your counters, any crisis period, your subscription status and your suggestions and reports on our servers; it also erases the statistics identifier. The following remain, without any content: the anonymous identifier itself, the subscription information held by RevenueCat and by Apple or Google, the technical counter of erasure requests, as well as the logs, reports and statistics already transmitted and whatever OpenAI may keep, which are erased when their retention period ends (section 9). Without a connection, erasure on our servers is retried automatically each time you open the app, until it succeeds. The anonymous identifier is deliberately kept: it is what allows your subscription to remain active.

Under Articles 15 to 22 GDPR, you have the right to access, rectify, erase, restrict, object to and port your data, the right to withdraw your consent at any time without affecting processing already carried out, as well as the right to give instructions concerning your data after your death (Article 85 of the French Data Protection Act). These rights can be exercised by email at contact.depression@devolim.fr. We reply within one month, extendable by two further months for complex requests.

As we do not know your identity, we cannot use your name or email address to find the data linked to your anonymous identifier: the in-app tools above are the safest and quickest way to exercise your rights. We will never ask you for health information to handle a request. You can object to crash reports by writing to us; as they are not linked to any information about you, we cannot find the ones that concern you, and uninstalling the app is currently the certain way to stop them being sent. Purchase information can also be managed with Apple or Google.

15. Data about people close to you

The trusted contacts you save (name and number) stay on your phone and are never sent to us. Make sure these people agree to be listed there and to be contacted by you. Avoid mentioning identifiable third parties in your messages to Kolo and in what you send to the team.

16. Website

This website sets no cookies and uses no audience measurement tool. Fonts are hosted with the website: your browser does not contact any font, advertising or measurement service. The website is hosted by OVH and may be delivered through the Cloudflare network, which protects it against attacks and speeds up its display; these providers process, for these purposes only, the technical data of your visit (IP address, pages requested, date) for a limited time.

17. Minimum age

The app is reserved for people aged 16 and over, who state this before accepting the terms. It is not intended for children and we do not knowingly collect data about them. If you are a parent or guardian and believe that a child under 16 is using it, write to us; the “Erase everything” function also deletes their data from the phone and from our servers.

18. Security incident

In the event of a personal data breach, we notify the CNIL (Commission nationale de l'informatique et des libertés), the French data protection authority, under the conditions of Article 33 GDPR and, where the breach is likely to result in a high risk to your rights and freedoms, we inform you in the app or on this website, in accordance with Article 34.

19. Complaint to the CNIL

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr.

20. Changes

This policy may be amended to reflect legal or technical developments. The last update date appears at the top of this page; substantial changes are notified within the app and, if they affect your consent, you will be asked for it again. In the event of any discrepancy between the French version and a translation, the French version prevails.