Privacy Policy

1. Data controller

FUYANO, a société par actions simplifiée à associé unique with a share capital of €1
Registered with the Paris Trade and Companies Register under number 108 072 430
Registered office: 173 rue de Courcelles, 75017 Paris, France
Legal representative: Anthony ZHU, president
Email: contact@fuyano.com
Data Protection Officer (DPO): Fuyano has not appointed a DPO, as the designation obligation laid down in Article 37 of the GDPR does not apply. For any question relating to data protection: privacy@fuyano.com.

1 bis. Minimum age (GDPR Art. 8 + COPPA)

You must be at least 13 years old to use Fuyano. If you reside in the European Economic Area (EEA), in the United Kingdom or in Switzerland, you must be at least 16 years old, or the minimum age required by your country to consent to the processing of your personal data. By creating an account, you declare on your honour that you are of the required age.

In accordance with Article 8 of the GDPR and with the Children's Online Privacy Protection Act (COPPA, US), Fuyano does not knowingly process personal data of minors below these thresholds. If we discover that an account has been opened by a minor in breach of this rule, we delete it immediately. To report such a case, contact privacy@fuyano.com.

2. Scope

This policy covers the Fuyano mobile application as well as, where applicable, the fuyano.com website.

3. Data Collected

3.1 Data you provide

• Account: email, public identifier, authentication via email/Google/Apple
• Profile: alias, bio, profile picture, banner, gender (optional — values "Male", "Female", "Other" or "Prefer not to say"; kept on our servers only if you fill it in, for the sole purpose of producing aggregated demographic statistics, on the basis of your consent — see sections 4 and 5), date of birth (optional — verification of the minimum age and aggregated demographic statistics), social links, preferences (language, theme, privacy, notifications)
• User content: posts, messages, photos/videos, documents, audio
• Contact: phone number (optional)
• Sign in with Apple: Apple may transmit to us your Apple user identifier (sub) and, upon your explicit consent at the first sign-in, your first name/surname and email address (real or @privaterelay.appleid.com relay). In accordance with Article 13 of the GDPR, this data is processed for the purpose of authentication and account creation only. You may revoke this access at any time from your iOS Settings → Apple ID → Sign in with Apple → Fuyano → Stop Using Apple ID.
• Device country: when you accept the terms of service, we store on your profile the two-letter country code taken from your device's "Region" setting (for example FR, US). This data comes neither from your IP address nor from GPS, and no location permission is requested from you: it is a setting you choose yourself and it does not reveal where you are. Purpose: monitoring the threshold of 100,000 Californian consumers above which the Californian CCPA/CPRA law would become applicable to Fuyano. Legal basis: legitimate interest (Article 6(1)(f) GDPR) — you may object to it (Article 21, see section 8.5). This data is erased together with your account.

3.2 Data generated by use

• Interactions: likes, follows, views, mentions
• Storage: quota, usage, storage statistics

3.3 Technical data

• Internal identifiers: user uid, technical identifiers necessary for the service
• Technical logs: security events, application errors
• Approximate location: country, region, city inferred from your IP address by Cloudflare at the time of each network request. Pseudonymised data aggregated for server traffic statistics, never linked to your user identity. This last guarantee covers ONLY the data inferred from your IP address: the country taken from your device's "Region" setting is, for its part, attached to your profile (see section 3.1).
• Notification identifiers (APNs / FCM): push notification tokens associated with your account for the delivery of alerts (messages, incoming calls, moderation decisions).

3.4 App permissions

• Camera: capture photos/videos
• Microphone: record voice messages or videos with audio
• Gallery: select or save media

3.6 One-to-one audio/video calls

When you make or receive a call through Fuyano, the following data is processed:

• Call history (CDR): unique call identifier, uid of the other party, type (audio or video), duration in milliseconds, start/end timestamps, TURN relay indicator (relayed boolean). Stored until your account is deleted.
• Ephemeral signaling: SDP offers/answers and ICE candidates pass through our Cloudflare servers in order to establish the peer-to-peer connection. This data is deleted automatically 30 seconds after the end of the call. It is never persisted in a database.
• TURN credentials: single-use relay credentials, valid for the duration of the call, generated on demand. Invalidated as soon as the call ends.

Audio/video media: the encrypted SRTP/DTLS stream travels directly from peer to peer wherever possible. In the event of a TURN relay (when network conditions require it), the packets pass through encrypted — no byte of media is decrypted or stored on the server side.

Disclosure of your IP address to the person you are calling (WebRTC technology): in order to establish the best-performing direct audio connection possible, your device and that of the person you are calling exchange “connection candidates” (ICE protocol, WebRTC standard). Those candidates may reveal to the person you are calling — and to that person alone, never to a third party nor publicly — one or more of your IP addresses: the local address of your home/Wi-Fi network, the global IPv6 address of your device where applicable, or the address of an active VPN interface. We do not configure your browser or application to systematically force traffic through a relay (the technical iceTransportPolicy setting is left at its standard “all routes” value), in order to preserve the best call quality and to limit the load on our relay servers — in accordance with Article 13 GDPR, this information is provided to you before any use of the call feature. This disclosure is inherent to the peer-to-peer operation of WebRTC technology (W3C/IETF standard) and exists, to varying degrees, in every P2P calling application. Since the call feature is reserved for mutual friends (see below), only a person you have explicitly accepted as a contact can receive this information, and only for the duration of the call.

The call feature is reserved for mutual friends (confirmed two-way contacts).

3.5 What we do not collect

• Precise GPS location (the app does not request the system geolocation permission). Moreover, the location metadata embedded in your media (photo EXIF, GPS geolocation of MP4/MOV videos) is stripped on your device before upload.
• Contacts / address book
• Advertising identifiers (Apple IDFA, Google AAID)
• Banking or payment data
• Health or fitness data
• Special categories of data (Article 9 GDPR): racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification purposes, health data, sexual orientation
• Biometric authentication (Face ID / Touch ID): used locally by your device to unlock your stored credentials. Your biometric data never leaves your phone and is never transmitted to Fuyano.

4. Purposes of the Processing

• Operation of the service: authentication, profile, messaging, publishing
• Storage: hosting your content and managing quotas
• Security: prevention of abuse, protection of the account
• Support: assistance and incident resolution
• Aggregated traffic statistics: measurement of visits and detection of abuse, based on pseudonymised data (country/region/city inferred from the IP address, rounded to about 11 km) not linked to your user identity
• Aggregated demographic statistics (age, gender): optional, on the basis of your consent (GDPR Art. 6.1.a). If you fill in your gender and/or your date of birth, this data may be aggregated to produce overall demographic statistics (e.g. breakdown by age bracket or by gender across all users). These statistics are aggregated only, without individual profiling or targeted advertising. You may withdraw your consent at any time by clearing these fields in your settings or by writing to us (see section 8).

We do not display advertising and we do not carry out advertising tracking.

5. Legal Basis (GDPR)

• Performance of the contract (Art. 6.1.b): provision of the features of the app
• Legal obligation (Art. 6.1.c): verification of the minimum age (GDPR Art. 8, COPPA), traceability of moderation actions (DSA Art. 17), retention of GDPR audit logs
• Consent (Art. 6.1.a): optional data (e.g. profile picture, bio, phone number, date of birth, gender) and aggregated demographic statistics (age, gender). You may withdraw your consent at any time, without affecting the lawfulness of the processing carried out beforehand.
• Legitimate interest (Art. 6.1.f): security and prevention of abuse, aggregated traffic statistics (visits, detection of network anomalies, admin traffic map — pseudonymised data that cannot be re-identified)

6. Retention Period

In accordance with Article 5(1)(e) of the GDPR (storage limitation), we retain your data for the following periods:

• Active account: retained as long as you have not requested deletion. You can delete your account at any time from the application (Profile → Settings → Account → Delete account) or by email to contact@fuyano.com.
• Deleted content (soft delete): 7 days before permanent deletion. Allows a short window for accidental recovery.
• Technical logs (Cloudflare): 30 days, for security purposes (anti-DDoS, anti-abuse).
• Aggregated traffic statistics (Cloudflare): 90 days, pseudonymised data (country/region/city, never linked to your identity).
• Authentication and database logs (Supabase): 7 days.
• Account deletion audit log: 180 days, then automatic purge. Traceability obligation (GDPR Art. 30).
• Content reports (DSA Art. 16): all public reports, whether processed or not, are purged automatically 12 months after their receipt.
• Dormant notification tokens (90 days without use): automatic monthly purge.
• Cookies / web local storage: the duration of the browser session, plus 1 year for the GDPR consent preference.

Once an account has been deleted, the account's own data is irreversibly erased from the production servers within 30 days, and from the periodic backups within 7 days. When an account is deleted, messages its holder had personally sent you remain visible in your conversation, but their author permanently ceases to be identifiable: their name, handle, photo and profile are erased and replaced with the label "Deleted user". Files you sent are deleted from our servers; your contacts see the label "Media unavailable" in their place.

7. Hosting and processors

In accordance with Article 13.1.e of the GDPR, here is the list of our technical processors (within the meaning of Article 28 of the GDPR) which process your data on our behalf:

• Supabase (European Union — AWS eu-west-3 Paris): authentication, PostgreSQL database, Edge Functions. No transfer outside the EU.
• Backblaze B2 (United States): storage of files (images, videos, documents, audio), encrypted at rest (server-side AES-256 encryption).
• Cloudflare (global network, EU edge given priority): network distribution (CDN) of your media, hosting of the real-time messaging service (EU), storage of the large files of your personal Drive (R2 objects, encrypted at rest with AES-256), aggregated traffic statistics.
• Expo (EAS Build) (United States): build, signing and technical distribution service for mobile builds; does not process production user personal data.
• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM, Google): technical delivery of push notifications only, payloads encrypted in transit.
• Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA: provider of the Sign in with Apple service. DPA via the Apple Developer Program License Agreement (Standard Contractual Clauses included, in accordance with Article 28 of the GDPR).
• Resend (United States): sending of the ban notification email (information about the moderation decision, DSA Art. 17), receives your email address and the ground. No persistent retention at the provider.
• Stripe (Stripe Payments Europe Ltd, Ireland — EU; some processing by Stripe Inc., United States, under the Standard Contractual Clauses): collection of “Offer a tea” donations on a payment page hosted by Stripe. Stripe receives your email address, your payment details (never passed on to Fuyano) and, if you fill them in, your username and an optional message. Fuyano stores no banking data; only the email address, the username and the message are viewable by the team.

We neither sell nor rent your data. It is shared only with these processors in order to provide the service.

7.1 Transfers outside the European Union

In accordance with Article 13.1.f of the GDPR, we inform you that some of our processors process your data outside the European Union. These transfers are governed by the appropriate safeguards provided for in Articles 44 to 49 of the GDPR:

• Supabase (EU — AWS eu-west-3 Paris): no transfer outside the EU.
• Backblaze B2 (United States): transfer governed by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision 2021/914 of 4 June 2021), signed in the Backblaze DPA.
• Cloudflare (United States and global network): transfer governed by the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Cloudflare self-certification) and the Standard Contractual Clauses. Covers CDN distribution, R2 storage of the large files of your personal Drive and the TURN relay (EU) for one-to-one calls; the relayed media packets are SRTP/DTLS encrypted and are not decrypted on the server side.
• Expo (EAS Build) (United States): transfer limited to the mobile build and signing pipeline, governed by the contractual safeguards applicable to the provider.
• Apple APNs (global network): transfer governed by the Apple Developer Program Licence Agreement terms and the EU-US Data Privacy Framework.
• Google FCM (global network): transfer governed by the Google Cloud Data Processing Addendum terms and the EU-US Data Privacy Framework.
• Resend (United States): transfer governed by the Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

The applicable DPA contracts and safeguards (GDPR Art. 28, Standard Contractual Clauses, Data Privacy Framework certifications) are kept internally and available upon written request to support@fuyano.com.

8. Your Rights (GDPR)

8.1 Right of access

You can request a copy of all the data we hold about you.

8.2 Right to rectification

You can request the correction of your information if it is inaccurate.

8.3 Right to erasure ("right to be forgotten")

You can request the complete deletion of your data at any time.

8.4 Right to data portability

You can receive your data in a structured format (JSON/CSV). Your exports include the messages you received; if their author has deleted their account, they are no longer identified in it.

8.5 Right to object

You can object to the processing of your data.

8.6 How to exercise your rights

Send an email to privacy@fuyano.com with the subject "RGPD - [Your request]".
We will reply within 30 days at the latest.

8.7 Right to lodge a complaint

You can lodge a complaint with the CNIL (France):
www.cnil.fr

9. Notifications

We use local notifications for certain alerts (e.g. storage). No advertising notifications.

10. Website and Cookies (if applicable)

The site may use technical cookies (theme preference) and anonymised statistics, without advertising tracking.

9 bis. Your rights — California residents (CCPA / CPRA)

If you reside in the State of California (United States), the California Consumer Privacy Act (CCPA, 2018) and its amendment the California Privacy Rights Act (CPRA, in force since 1 January 2023) grant you the following rights concerning your personal information. These rights are in addition to the GDPR rights described in section 8 above.

9 bis.1 Right to Know

You can request to know the categories of personal information that we collect about you, the sources of that information, the purposes of the collection, the categories of third parties with which we share your information, and the specific information that we hold. See also our section 3 (Data collected) and 7 (Hosting and processors) above.

9 bis.2 Right to Delete

You can request the deletion of the personal information about you that we have collected and retained. You can exercise this right directly from the application (Profile → Settings → Account → Delete account) or by email to contact@fuyano.com.

9 bis.3 Right to Correct

You can request the correction of inaccurate personal information that we hold about you. See section 8.2 above.

9 bis.4 Right to Opt-Out of Sale or Sharing

Fuyano does not sell and does not share your personal information with third parties for cross-context behavioral advertising purposes. No explicit consent is therefore required for advertising sale or sharing, since no sale or sharing of that nature takes place.

Sharing with our technical processors (Supabase, Backblaze B2, Cloudflare, APNs/FCM) listed in section 7 does not constitute a "sale" or a "sharing" within the meaning of the CCPA/CPRA — these are transfers to "service providers" bound by a data processing agreement (DPA) that strictly restricts their use of your data.

9 bis.5 Right to Limit Use of Sensitive Personal Information

Fuyano does not process sensitive personal information within the meaning of the CPRA (racial or ethnic origin, religion, sexual orientation, health data, genetic or biometric data, precise geolocation, contents of private communications not intended for Fuyano). The messages that you send through the messaging feature are processed solely in order to route them to their recipients (necessary contractual purpose). See section 3.5 above.

9 bis.6 Right to Non-Discrimination

We will not discriminate against you for having exercised any of your CCPA/CPRA rights. This includes: no denial of service, no different price, no degraded quality of service, no penalty, no threat of retaliation. Exercising your rights is free of charge and unconditional.

9 bis.7 How to exercise your CCPA/CPRA rights

Send an email to privacy@fuyano.com with the subject "CCPA - [Your request]" (or "Right to Know", "Right to Delete", etc.). We will reply within 45 days at the latest (extendable by a further 45 days if justified by the complexity, in accordance with CCPA §1798.130(a)(2)).

You may designate an authorized agent to exercise your rights on your behalf, subject to a verifiable power of attorney and verification of your identity.

In the event of an unresolved complaint, you may contact the California Attorney General (oag.ca.gov/privacy/ccpa).

10 bis. Reporting illegal content (DSA Article 16)

In accordance with Article 16 of Regulation (EU) 2022/2065 (Digital Services Act), any person or entity may notify us of the presence on Fuyano of information that they consider to be illegal content (hate, harassment, child sexual abuse material, infringement of rights, serious disinformation, etc.).

Use our public reporting form to submit your substantiated notification. Each report receives an acknowledgement of receipt and is the subject of a reasoned decision communicated to the notifying party and, where applicable, to the user whose content is concerned.

11. Changes to this Policy

We reserve the right to modify this privacy policy at any time.
Changes will be published on this page with a new update date.

12. Contact

For any question concerning this policy or your personal data:
Email: contact@fuyano.com

Language: In the event of a translation of this privacy policy, only the French version is authoritative.