waitedPrivacy Policy
This is a translation provided for convenience. In case of discrepancy, the French version prevails.
Version 1 — draft to be reviewed by a lawyer before publication. Passages in square brackets are to be completed.
1. Data controller
[NAME OF THE COMPANY OR PUBLISHER], [ADDRESS], reachable at [CONTACT EMAIL] (data protection officer: [IF APPOINTED]).
2. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Username, password (stored hashed), recovery code (stored hashed) | Create your account and recover it | Performance of the contract |
| Age confirmation (16 or over) and date of acceptance of the terms | Comply with the minimum age | Legal obligation |
| Public encryption key | Allow encrypted photos to be sent to you | Performance of the contract |
| List of follows, blocks | Friends, conversations, protection | Performance of the contract |
| Text messages | Display your conversations | Performance of the contract |
| Encrypted photos and their settings (waiting time, protections, challenges) | Deliver the photos | Performance of the contract |
| Credits, purchase history (store transaction reference) | Manage credits, accounting | Contract, legal obligation |
| Notification token | Send notifications | Performance of the contract |
| Reports and, for a reported photo, the transmitted photo | Moderation, safety | Legitimate interest, legal obligation |
Photo encryption. Your photos are encrypted on your phone. Our servers only store an encrypted version that they cannot read. The only exception: when a recipient reports a photo, they send it to us decrypted for moderation.
Text messages. Text messages are not end-to-end encrypted: they are encrypted in transit and stored on our servers.
We do not sell your data and we do not use targeted advertising.
3. Recipients
- Hosting: [HOSTING PROVIDER, COUNTRY].
- Payments: Apple (App Store) and Google (Google Play), under their own policies. We do not receive your bank details.
- Notifications: Expo's notification service, then Apple and Google, which receive the text of the notification.
- Authorities, where required by law (in particular for content involving a minor).
4. Retention periods
- Photos: automatically deleted 7 days after they are sent by default — the sender chooses 24 hours, 7 days or 30 days for each conversation; if the wait is longer, the photo stays until one day after the wait ends (31 days at most). Earlier if the sender deletes it or if either party deletes their account. A "view once" photo can only be opened once: the recipient's key is erased from our servers as soon as it is opened. Backup copies follow within one hour for photos and within 3 days for the database.
- Account and text messages: as long as your account exists.
- Account deletion: immediate erasure. Purchase records are kept without any link to your identity for the legal period (10 years for accounting purposes).
- Reports: [PERIOD, e.g. 1 year] after they have been processed, unless proceedings are ongoing.
5. Your rights
You can access your data, rectify it, erase it (account deletion in the app), restrict its processing, object to it and request its portability, by writing to [CONTACT EMAIL]. You can also lodge a complaint with the CNIL (www.cnil.fr).
6. Minors
waited is restricted to persons aged 16 or over. If you believe an account belongs to a younger person, report it or write to us.
7. Security
Hashed passwords and recovery codes (scrypt), end-to-end encrypted photos, private key kept only on your phone, encrypted connections (HTTPS).