Privacy
Privacy policy
This policy describes how Romain Mathieu (“we”, “the data controller”), publisher of Red Flag Radar (redflagradar.fr), processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018.
Privacy contact: contact@redflagradar.fr. Full identity: see the legal notice.
1. Principles
At your request, Red Flag Radar reads a screenshot of a conversation; it also offers a relationship self-assessment (quiz). The content of a conversation is sensitive by default. Product design:
- no account: the app works with random identifiers, without name, e-mail or phone number;
- your quiz answers and the history of your results stay on your device;
- a screenshot is only sent when you start an analysis; it is processed in memory and then deleted, the image is not stored on our servers;
- no advertising identifier, no ads, no third-party advertising tracker. Usage statistics never contain the content of your conversations and can be turned off in the app.
2. Data controller
Romain Mathieu, natural person, CBE 1036.553.777, VAT BE1036553777, Rue du Marais 80, 6150 Anderlues, Belgium.
No data protection officer (DPO) has been appointed at this stage (not mandatory for this structure). The GDPR contact point is contact@redflagradar.fr.
3. Data processed
3.1 Data we do not collect
- Name, e-mail, phone number (no account creation)
- Advertising identifiers, targeted advertising, third-party advertising trackers
- Location, contacts, photos other than the screenshot you choose
- The content of conversations or results in usage statistics
3.2 Quiz and history (on-device)
Your quiz answers, their scores and the history of your analyses (score, verdict, signals, chosen context) are stored only on your device. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). They are deleted when you uninstall the app or clear its data.
3.3 Screenshot analysis (Supabase, OpenAI)
When you start an analysis, the following is sent over HTTPS to our server (Supabase, hosted in the European Union, Ireland): the image, the app language, the relationship context you chose (crush, partner, ex, situationship) and the “doubts” you ticked. The server forwards them to OpenAI (artificial intelligence API) to produce the result: score, verdict, detected signals, advice. The image is not stored on our servers: it is processed in memory and then deleted; the result is returned to your device.
Under its API terms, OpenAI does not use this data to train its models and may retain it for up to 30 days for abuse monitoring. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) — you request the analysis.
A screenshot may contain third-party data (the person you are talking to). Only submit conversations you took part in and hide what is not needed (numbers, addresses, photos). Do not upload intimate or sexual content, health information or professional secrets.
3.4 Installation identifier (usage limit)
A random identifier, generated at installation and not linked to your identity, is sent with each analysis to limit analyses to 15 per day and prevent abuse. On the server it is kept for 24 hours and then deleted automatically. Basis: legitimate interest (Art. 6(1)(f) GDPR). We also keep a global counter of the total number of analyses, with no personal data, shown in the app.
3.5 Usage statistics (PostHog)
To understand how the app is used and improve it, including by comparing different presentations of the offers (A/B tests), the app sends usage events to PostHog (instance hosted in the European Union). Examples: app opened, screenshot chosen, analysis completed (score and number of signals), offer screen shown, purchase started or completed (product, price, currency), result shared.
These events are linked to a random pseudonymous identifier, with the device type, system and app version, language and the offer variant shown. They never contain the image, the text of conversations, the explanations of the result, the details of your doubts or whether a dangerous situation was detected. The RevenueCat identifier is linked to this PostHog identifier so that purchases can be matched with the statistics.
Basis: legitimate interest (Art. 6(1)(f) GDPR) — measuring and improving the service. You can object at any time: Account → Usage statistics in the app; no further events are then sent. Policy: PostHog.
3.6 Subscriptions and payments
Purchases are processed by Apple (App Store) or Google (Google Play), through RevenueCat, which manages access to the offers. We never receive your payment details (card, etc.). RevenueCat processes an anonymous customer identifier, the purchase history (product, price, dates, subscription status, refunds) and the store country. A single report purchase is remembered on your device.
Basis: performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)). Policies: Apple, Google, RevenueCat.
3.7 Support contact
If you write to us (contact@redflagradar.fr): identity, e-mail, message content, attachments you choose to send. Basis: legitimate interest (support) and/or pre-contractual measures (Art. 6(1)(b)/(f)).
3.8 Technical hosting data for the website
The website host (Hostinger International Limited) may process technical logs (IP address, date, URL, user-agent) for security and proper operation. Basis: legitimate interest (Art. 6(1)(f)). Policy: Hostinger. The website does not set audience measurement cookies.
4. Purposes
- Providing the screenshot analysis, the quiz and the history
- Preventing abuse (15 analyses per day)
- Managing purchases and subscriptions
- Measuring and improving the service, including A/B tests
- Providing support and handling GDPR requests
- Complying with legal obligations (accounting, tax)
- Securing the infrastructure
5. Recipients
Supabase (analysis server, usage limit), OpenAI (analysis, when you start it), PostHog (usage statistics), RevenueCat (purchase management), Apple and Google (stores, payment), Hostinger (website hosting), e-mail provider for support, authorities where legally required. No sale of personal data, no sharing for advertising purposes.
6. Transfers outside the EEA
The Supabase and PostHog servers we use are located in the European Union. OpenAI, RevenueCat, Apple, Google, and the parent companies of Supabase and PostHog may process data in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses. Details on request at contact@redflagradar.fr.
7. Retention periods
- Quiz, history and single report purchases: on the device, until deletion or uninstallation
- Screenshots: not stored on our servers (processed in memory); at OpenAI, at most 30 days
- Installation identifier (usage limit): 24 hours
- Usage statistics (PostHog): at most 13 months
- Purchase history (RevenueCat): for the duration of the commercial relationship, then legal accounting periods
- Support e-mails: up to 3 years after the last useful contact
- Accounting data: legal periods (7 years in Belgium)
- Website hosting logs: in principle up to 90 days
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection, portability (where applicable), and the right to withdraw consent. To exercise them: contact@redflagradar.fr. As the app has no account, please give us, if possible, the identifier shown in your store receipt so that we can find your data. We reply within 30 days.
Objecting to statistics: Account → Usage statistics in the app. On-device data: uninstall the app or clear its data. Complaints: Belgian Data Protection Authority (APD/GBA) — dataprotectionauthority.be, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be; or the authority of your country of residence.
9. Security
Appropriate measures: HTTPS/TLS, data minimisation, no stored images, automatic deletion of usage-limit identifiers, restricted server access and separate technical keys. No system is infallible: protect your device (passcode, biometrics) and do not upload unnecessary information (passwords, bank codes, health data).
10. Minimum age and minors
The App is reserved for people aged 16 and over. 16–17-year-olds may use it for their own conversations; purchases are subject to the store’s parental controls (Family Sharing, Google Play parental controls). Submitting sexual content involving a minor, or conversations between people under 16, is prohibited. If you are a parent and believe a child under 16 has used the App, contact us to have their data deleted.
If an analysis detects threats, control or violence, the app shows helplines for free (3919, 119, 17, 114, 112). These numbers are dialled by your phone: we have no knowledge of these calls.
11. Changes
This policy may be updated. The date at the top of the page is authoritative. In case of a material change, notice may be displayed on the site and/or in the application.
12. Contact
contact@redflagradar.fr — Romain Mathieu, Rue du Marais 80, 6150 Anderlues, Belgium.