Privacy Policy

Last updated: July 25, 2026 · Version francaise

Togezer (the "Application") is published by CharlyAndCo, represented by Guillaume Charly, headquartered in France.

This privacy policy describes how we collect, use, store and protect your personal data in compliance with the General Data Protection Regulation (GDPR).

1. Data collected

Registration data: email address, phone number (if SMS signup), display name, profile photo. If you use Apple Sign-In or Google Sign-In, we only receive the authorized identifier and email.

Usage data: events created, participations, messages, pulses, favorites, saved locations, flatshare expenses, kitty contributions, shared photos.

Location data: GPS position (only when explicitly enabled for Pulses, location sharing or place search). No background geolocation without your consent.

Payment data: kitty payments are processed by Stripe Connect. Togezer does not store any credit card numbers. Stripe is PCI DSS compliant.

Voice data: voice planning uses on-device transcription (Apple Speech / Web Speech API). The transcribed text is sent to our server for analysis by Claude Haiku (Anthropic). No audio recordings are stored.

2. Purpose of processing

Your data is used exclusively to:

— Provide the Application's features (plans, events, messaging, kitties, flatshare, favorites, map).
— Personalize your experience (AI suggestions, place recommendations).
— Send notifications (push, email, SMS) related to your plans and activities.
— Improve the Application (anonymized usage statistics).
— Comply with our legal obligations.

3. Legal basis

Processing is based on: contract performance (use of the Application), your consent (geolocation, notifications), legitimate interest (service improvement), and legal obligations (GDPR, tax retention).

4. Hosting and security

Data is hosted on Google Firebase (project findme-31457), region europe-west1 (Belgium, European Union). Communications are encrypted via HTTPS/TLS. Authentication uses Firebase Auth with JWT tokens.

The backend is hosted on Vercel (Europe region). Cloud Functions run in europe-west1.

5. Third-party processors

— Google Firebase (hosting, database, authentication, storage, push notifications) — EU.
— Vercel (backend and website hosting) — EU/US with standard contractual clauses.
— Stripe (kitty payments) — PCI DSS compliant, standard contractual clauses.
— Anthropic (Claude Haiku AI for voice planning and suggestions) — anonymized data.
— Brevo (transactional emails) — hosted in EU.
— Nuitee/LiteAPI (hotel search) — anonymized requests, no personal data transmitted.

6. Data retention

Your data is retained as long as your account is active. Upon account deletion, all personal data is erased within 30 days. Billing data is retained for 10 years in compliance with French tax obligations.

7. Your rights

Under the GDPR, you have the following rights:

— Access: obtain a copy of your personal data.
— Rectification: correct inaccurate data.
— Erasure: delete your account and all data (available in Settings → Delete my account).
— Portability: export your data in a structured format (available in Settings → Export my data).
— Objection: object to processing on legitimate grounds.
— Restriction: request processing restriction.

To exercise these rights, contact us at guillaume@charlyandco.fr. Response within 30 days maximum.

8. Cookies and trackers

The mobile Application does not use cookies. The togezer.co website does not use any advertising cookies or third-party trackers. No data is sold to third parties. No advertising is displayed in the Application.

9. Children

The Application is not intended for children under 16. If we learn that a user is under 16, their account will be deleted.

10. Changes

This policy may be updated. In case of substantial changes, you will be notified via the Application. The last update date is indicated at the top of this page.

11. Contact and complaints

For any questions: guillaume@charlyandco.fr

For unresolved disputes, you may file a complaint with the CNIL (French Data Protection Authority): www.cnil.fr.