Qui est là ?In short. The app tells the members of a shared place whether you are present or away, never where you are. Your location stays on your phone and is never sent to our servers. Only the members of your space see your first name and status. There are no ads, no data sales and no history, and you can delete your account at any time.
1. Who is responsible
The data controller is Matthieu Gallice, sole trader (micro-entreprise, France), publisher of the “Qui est là ?” app (“Who’s there?”). Full details are in the legal notice.
Contact for any privacy question: contact@orvya-app.fr.
2. Why we process data
One purpose only: letting the members of a shared place (practice, workshop, coworking space, association, shared flat…) see who is on site, updated automatically when they arrive and leave.
The app is not a tool for monitoring work or working hours. Using it to monitor employees is forbidden (see the terms of use).
3. What data
On your phone only
- Device location. Android uses it to detect when you enter or leave the area around the place, including when the app is closed. This check runs on the phone. Only the result (“entered” or “left”) is sent, never your coordinates. Nothing is used if you deny the permission or pause detection.
On our servers
| Data | Source | Who can see it |
|---|---|---|
| Account ID, email address, Google name and profile picture | “Sign in with Google” | Only you. Your email is never shown to other members. |
| Displayed first name | Your Google account, can be changed on request | Members of your space |
| Space joined and role (admin or member) | Your actions in the app | Members of your space |
| Present / away status, time of last change, “paused” state | Automatic detection or manual switch | Members of your space |
| Name, location and radius of the place | Entered by the person who manages the space | Members of that space |
| Time of failed invitation-code attempts | Protection against code guessing | Nobody (automatic check) |
| Technical logs (IP address, date, request type) | Normal operation of our hosting provider | The hosting provider, for security and troubleshooting |
No presence history is kept: each change overwrites the previous status. The app contains no advertising, no analytics and no trackers.
4. Legal basis
This data is needed to provide the service you ask for when you create or join a space (performance of a contract, Article 6(1)(b) GDPR). Location access also requires an Android permission, which you can grant or withdraw at any time in your phone settings. Technical logs rely on our legitimate interest in keeping the service secure (Article 6(1)(f)).
5. Recipients and processors
Your data is never sold, rented or shared for advertising. Only the members of your space see your first name and status. To run the app we use:
- Supabase: database and accounts, hosted in the European Union (Paris region).
- Google: sign-in with a Google account, app distribution through Google Play, and Android location services on your phone (governed by your own Google settings).
- Google Maps: displaying the map of the place when a space is created or its location is changed (only the displayed area is requested from Google, never your location).
- IGN (Géoplateforme, French public service): address suggestions when typing the place’s address. Only the typed text is sent.
- Vercel: hosting of this website (no app data).
6. Transfers outside the EU
The database is hosted in the European Union. Some technical operations by our processors (support, logs, Google sign-in) may involve access from the United States. They are covered by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
7. Retention
- Account, first name and status: as long as the account exists, erased as soon as it is deleted.
- Status: no history, only the latest value exists.
- Space: deleted when the last person leaves it.
- Failed code attempts: 24 hours.
- Technical logs: a few days, according to the hosting provider’s retention period.
8. Security
Each member can only read the data of their own space. No data can be changed directly from the app: every action goes through a server-side function that checks permissions. Connections are encrypted (HTTPS) and invitation codes are protected against repeated guessing.
9. Your rights and choices
In the app, at any time, you can:
- correct your status manually;
- pause detection (you then appear as away);
- leave the space;
- delete your account: Settings → Delete my account (in French: Réglages → Supprimer mon compte). Deletion is immediate and permanent. You can also do it on the web: delete my account.
You also have the rights of access, rectification, erasure, restriction, objection and portability. Write to contact@orvya-app.fr; we reply within one month at most. You can lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of your country.
10. Audience
The app is for adults only (18 and over). It is not directed at children.
11. Changes
If something important changes (for example, a new type of data), this page will be updated before the change applies and the date at the top will change. If the change needs your consent, you will be asked in the app.