Privacy Policy
1. Who we are
Simon BERNARD (Particulier) operates the Yoomu mobile application and the website at https://yoomu.app (collectively, "the Service"). As data controller, we determine how and why your personal data is processed.
Address: , 75013 Paris, France
Privacy contact: [email protected]
2. Data we collect and why
2.1 Account data
When you register: your email address, chosen username, and a hashed password.
We never store or see your plaintext password.
Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
2.2 Profile data
Optionally: a profile picture and a short bio.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can remove this data at any time in your account settings.
2.3 Application data
Books you add to your library, reading progress, book clubs you create or join,
and discussion posts or reviews you write.
Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
2.4 Technical data
IP address, device type and operating system version, app version,
session timestamps, and crash or error reports.
Legal basis: our legitimate interest in operating a secure and stable service (Art. 6(1)(f) GDPR).
2.5 Push notification tokens
If you grant permission for push notifications, we store your device push token
to deliver in-app notifications (e.g. a club member added a book).
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via your device settings.
2.6 Support communications
If you contact our support team, we retain the content of your messages and our replies.
Legal basis: our legitimate interest in resolving your request (Art. 6(1)(f) GDPR).
3. How we use your data
- Provide, maintain, and improve the Yoomu service
- Authenticate your account and keep it secure
- Display your profile and activity to members of your book clubs, as you choose
- Send service notifications (e.g. club updates, reading reminders)
- Show ads within the app (see section 4 — you can opt out)
- Respond to your support requests
- Detect and prevent fraud, abuse, and security incidents
- Comply with legal obligations
4. Who we share your data with
We do not sell your personal data. We share it only as described below.
| Recipient | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting (Cloudflare Pages) and DNS | USA |
| Fly.io, Inc. | API and backend hosting | USA / EU (region-dependent) |
| Apple Inc. | iOS app distribution; push notifications (APNs); app invitations | USA |
| Google LLC | Android app distribution; push notifications (FCM); app invitations (Firebase); in-app advertising (AdMob, opt-in) | USA |
Apple and Google receive only the data necessary for their respective services. Their own privacy policies govern that processing. In-app ads (Google AdMob) are only shown when you have not opted out and are subject to Google's advertising privacy controls at adssettings.google.com.
5. International transfers
The recipients listed above may be based outside the European Economic Area (EEA). We ensure adequate safeguards are in place for every such transfer, including Standard Contractual Clauses (SCCs) approved by the European Commission where required.
6. How long we keep your data
| Data category | Retention period |
|---|---|
| Account and application data | Until you delete your account, then 30 days before permanent deletion |
| Push notification tokens | Until you revoke notification permission or delete your account |
| Technical logs | 90 days |
| Support messages | 3 years from the date of last contact |
After account deletion, we may retain anonymised or aggregated data (which cannot identify you) without time limit for statistical purposes.
7. Your rights under GDPR
If you are based in the EEA, you have the following rights:
- Access — request a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data ("right to be forgotten").
- Restriction — ask us to pause processing in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on our legitimate interest.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority. In France, this is:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
https://www.cnil.fr
8. Children's privacy
Yoomu is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account or provided us with personal data, contact us at [email protected] and we will delete the data promptly.
9. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by in-app notification or email at least 14 days before they take effect. The "last updated" date at the top reflects the version currently in force.
10. Contact
Simon BERNARD
, 75013 Paris, France
[email protected]