Privacy Policy

1. Data Controller

The controller responsible for your personal data is NOSAL WEB SALES, SASU with its registered office at 18 chemin de la Guinguette, 57100 Thionville, France (RCS Thionville 979 446 846). For any question about this policy or your personal data, contact us at contact@recontrol.io.

2. The Data We Collect

We collect only what we need to run ReControl. Depending on how you use the app, this includes:

• Account & authentication data: your email address and the identifier provided by your sign-in provider (Apple or Google), as well as your language and time zone.
• Date of birth: the birth date you declare during onboarding, used to check your eligibility and to compare your progress with your age group.
• Activity & gameplay data: your exercise sessions (repetitions, duration, exercise type), coins, XP, level, streaks, personal records, quests, and the number of apps you block — together with estimated "time saved".
• Onboarding answers: information you provide during onboarding (your first name, your goals, declared screen time, distracting apps, how you discovered ReControl). Before you create an account, these answers are stored against an anonymous identifier generated on your device.
• Subscription data: your subscription status and an identifier created by our subscription provider.
• Technical data: your device type and operating system, the app version, and your IP address (used to secure the service and prevent abuse).

3. Camera and Exercise Detection

Detecting your exercises is the core of ReControl, and we designed it to protect your privacy. Before the camera is used, we ask for your explicit consent, which you can withdraw at any time in your device settings.

• On-device only: the camera feed is analysed entirely on your device. It is never recorded, stored, or transmitted to us or to any third party.
• No face or biometric data: body and pose landmarks are processed in real time and immediately discarded. We do not retain images or landmarks, we do not perform facial recognition, and we do not create biometric identifiers.
• Only a count leaves the device: once an exercise is verified, only the resulting number of repetitions is synced to your account.

4. App Blocking and Screen Time

To block distracting apps, ReControl uses Apple's Screen Time / Family Controls on iOS and equivalent mechanisms on Android. The list of apps you choose to block stays on your device and is never sent to our servers — we store only the number of blocked apps. Screen Time data is used solely to provide the blocking and progress features; it is never sold or used for advertising.

5. How We Use Your Data

We use your data for the following purposes, each with a legal basis under the GDPR:

• To provide the service — create and manage your account and run the exercise, gamification and app-blocking features (legal basis: performance of our contract with you).
• To manage subscriptions — process and track your purchases through the app stores (performance of contract; legal obligation for accounting).
• To keep ReControl safe and fair — detect cheating and abuse and apply rate limits (our legitimate interest in a secure service).
• To improve the app — understand how onboarding performs and which features are used (our legitimate interest in improving ReControl).
• For advertising measurement — measure the performance of our advertising, as described in section 6 (your consent and/or our legitimate interest, depending on your settings and region).
• To comply with the law — meet legal obligations and respond to valid requests from authorities.

6. Advertising and Measurement

We use Meta (Facebook) tools to measure how well our advertising campaigns perform, so we can reach people who may be interested in ReControl. To do this, the app shares a limited set of events with Meta — such as account creation, viewing the subscription screen, and completing a purchase (the purchase event is sent through our subscription provider).

Where these events are linked to you, this is done using your email address hashed on your device (it is turned into an irreversible code before it leaves your phone) and an anonymous installation identifier. We do not show the App Tracking Transparency prompt and do not collect your device advertising identifier (IDFA). This feature currently applies on iOS. You can object to this processing at any time by contacting us, and you can also limit ad tracking in your device settings.

7. Who We Share Your Data With

We never sell your personal data. We share it only with trusted service providers that help us operate ReControl — for example cloud hosting and database storage, authentication and app distribution through the app stores, payment and subscription management, transactional email, security and abuse prevention, and advertising measurement (see section 6). They act solely as processors on our instructions, under data-processing agreements, and receive only the data they need for their task.

We may also disclose your data where required by law or to protect our rights, and, in the event of a merger or acquisition, your data may be transferred to the entity that takes over our business.

8. International Data Transfers

Your account and activity data are hosted within the European Union. Some of our service providers may process certain data (such as technical or advertising data) outside the European Economic Area, in particular in the United States. Where that happens, we rely on appropriate safeguards — primarily the European Commission's Standard Contractual Clauses — to keep your data protected.

9. How Long We Keep Your Data

We keep your personal data only as long as necessary:

• Account and activity data: for as long as your account is active.
• Anonymous onboarding sessions that never lead to an account: automatically deleted after 90 days.
• Sign-in links: kept only for a short period, then automatically deleted.
• After account deletion: your data is removed from our active databases within 30 days, and from routine backups within 90 days.

10. Your Rights

Under the GDPR, you have the right to access your data, correct it, erase it, restrict or object to its processing, and to data portability. Where processing is based on your consent, you may withdraw that consent at any time without affecting processing carried out beforehand.

To exercise your rights, contact us at contact@recontrol.io. You also have the right to lodge a complaint with your data-protection authority — in France, the Commission Nationale de l'Informatique et des Libertés (CNIL, www.cnil.fr).

11. Security

We take appropriate technical and organisational measures to protect your data, including encryption in transit, restricted access, hashing of sensitive tokens (sign-in links are stored only as a hash), and on-device processing of the camera feed. No system is perfectly secure, but we work to protect your information against unauthorised access, loss or misuse.

12. Children's Privacy

ReControl is not directed to children under 16. We do not knowingly collect personal data from anyone under 16, and we ask for your date of birth to help enforce this. If you believe a child under 16 has provided us with personal data, please contact us and we will delete it.

13. Our Website and Cookies

Our website (recontrol.io) does not use advertising or third-party tracking cookies. It only stores a small preference in your browser to remember your chosen language.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will indicate the date of the last update at the top of this page and, where the changes are material, provide reasonable notice. Your continued use of ReControl after the changes take effect constitutes acceptance of the updated policy.

15. Contact

For any question about this Privacy Policy or your personal data, contact NOSAL WEB SALES at contact@recontrol.io.