Privacy Policy
Last updated: 8 November 2026
Who is responsible
Victor Morel, sole trader trading as Sesam, SIRET 992 008 607 00010, 25 rue du Landy, 93400 Saint-Ouen-sur-Seine, France. Contact: privacy@sesamlabs.fr
What we process, why, on what basis, for how long
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Sign-in identifier (Apple, Google or e-mail), e-mail address if given | Create and secure the account | Contract | As long as the account |
| Profile: age band (under 16 or 16 and over), level, language, time zone, optional first name | Adapt the lessons and reminders; choose how ads are served (section Ads) | Contract; for the age band, also the legal duties that protect minors | As long as the account |
| Learning data: answers, results, progress, XP, streak | Run the service (lessons, reviews, progress) | Contract | As long as the account; after the account is deleted, kept under an internal identifier that no longer points to anyone (address, sign-in identities and profile erased), to improve the content |
| Without an account: a pseudonymous device identifier, the profile and the learning data above | Use the App before creating an account, and keep the progress if an account is created later | Contract | 90 days without use, then deleted; erasable at any time (Settings › Account › Erase this device's data) |
| Device for reminders: notification token, platform, app version, language, last use; history of reminders sent | Send streak reminders, if you allowed them | Contract | Until sign-out or account deletion; reminder history 90 days |
| E-mail sign-in codes (address, IP address) | Send the code and limit abuse | Legitimate interest | 24 hours |
| Spark Premium subscription: store transaction identifiers, period dates, status (active, grace, cancelled, expired), auto-renewal on or off | Give access to what you pay for, show your subscription, accounting duties | Contract, legal obligation | 10 years (accounting records) |
| Error reports | Fix the content | Legitimate interest | 3 years |
| Usage statistics (learning and navigation events, app version, country) | Understand how the App is used and improve it | Consent, asked in the App after the first lesson, withdrawable in one tap (Settings › Privacy › Usage statistics) | 12 months |
| Crash and error reports | Fix bugs | Legitimate interest | The provider's retention period (90 days); no direct identifier |
| Ads, free version only (see Ads) | Fund the free version | 16 and over: consent where the law requires it (European Economic Area, United Kingdom, some US states), legitimate interest otherwise; under 16: legitimate interest, with limited, non-personalised ads only | Google's retention periods |
Usage statistics are sent only if you agree, when the App asks after your first lesson; without an answer or if you refuse, nothing is sent. If you are below the age at which you can consent alone in your country (15 in France, 13 to 16 elsewhere in the European Union), ask a parent before you accept. Statistics are tied to a pseudonymous identifier, are never used for ads and never tracked across apps; you can withdraw at any time in Settings › Privacy › Usage statistics, which the device and our servers respect. Crash reports are always sent, with no direct identifier. No data is sold. Learning data are not used to train artificial-intelligence models; AI is only used to write the learning content, with no user data.
Ads
The free version shows ads from Google AdMob at the end of a session (never during an exercise, never in the Tools, never in your first two sessions, at most three a day). With Spark Premium, the ad software is never started and nothing is sent to Google.
For everyone: ads are non-personalised (they are not based on your interests or your activity elsewhere) and limited to content suitable for all ages (rating G). We do not ask for permission to track you across apps (no tracking prompt on iPhone) and we do not use your device's advertising identifier to personalise ads: on iPhone it is not read, and on Android the App does not ask for the permission to access it. To show an ad and count it, Google's software processes information about your device and the App (model, operating system, app version, language), an approximate location derived from your IP address, and your interactions with the ad (shown, tapped). Google acts under its own privacy policy: https://policies.google.com/privacy
If you are 16 or over: where the law requires it, the App first shows Google's consent form (User Messaging Platform) for the storage and access that even non-personalised ads need. If you refuse, you still see limited ads, which store nothing on your device for advertising. You can change your choice in Settings › About › Ad privacy choices, when that row is shown.
If you are under 16, or until you have answered the age question: every ad request is tagged as directed to children and as from a user under the age of consent. Nobody asks you to consent to ads; Google then serves only limited, non-personalised ads under its rules for children.
The age question (under 16 or 16 and over) is the only age information we collect. It never limits what you can learn. You can change it in Profile (towards "under 16" at once, the other way once a day).
Minors
The App is for people aged 13 and over. Under the age of majority, a parent or legal guardian agrees to its use. We do not knowingly collect data from children under 13; if you think a child under 13 uses the App, write to privacy@sesamlabs.fr and we will delete the account.
No profiling. Your learning data adapt your lessons and reviews, and nothing else: they are never used for advertising, never sold, never combined with data from other services to build a profile of you, and no decision with legal or similarly significant effect is made from them. Ads are never personalised, whatever your age.
Who receives data (processors)
| Provider | Role | Location |
|---|---|---|
| Scaleway SAS | Hosting of the app and the database | France (Paris region) |
| Resend, Inc. | Sending sign-in codes by e-mail | United States — Data Privacy Framework (European Commission adequacy decision of 10 July 2023) |
| Apple, Google | Sign-in (if chosen), payment for purchases | Their own policies apply |
| Apple (Apple Push Notification service), Google (Firebase Cloud Messaging) | Delivering reminders to your device | Their own policies apply |
| RevenueCat, Inc. | Checking purchases, subscriptions and access rights; your record there is deleted with your account | United States — European Commission standard contractual clauses |
| Google Ireland Limited (AdMob, User Messaging Platform) | Ads in the free version and the ad consent form | European Union and United States — Data Privacy Framework |
| PostHog Inc. (EU cloud) | Usage statistics, with no session replay and no IP address kept | European Union |
| Functional Software Inc. (Sentry, EU data residency) | Crash and error reports | European Union |
Your rights
Access, correction, erasure, restriction, objection, portability, and withdrawal of consent at any time. Access and portability are available directly in the App (Settings › Account › Export my data, a JSON file of everything we hold about you). So is erasure (Settings › Account › Delete my account): it deletes your profile, your sign-in identities, your devices, your sign-in codes, your statistics events and your RevenueCat record; the stores' purchase records stay with Apple and Google, and deleting your account does not cancel a subscription (cancel it in your store account); crash reports hold no direct identifier and expire at the end of the provider's retention period. For any other request: privacy@sesamlabs.fr. We answer within one month. A parent can exercise these rights for a minor.
You can complain to the French data protection authority, the CNIL (www.cnil.fr), or to the authority of the country where you live.
Security
Encrypted connections (HTTPS), sign-in tokens kept in the device's secure keychain, access to data limited to the Publisher, hosting in the European Union.
Changes
This policy may change; the current version is in the App and at sparkchem.sesamlabs.fr/privacy. The French version, at sparkchem.sesamlabs.fr/confidentialite, has the same content.