Privacy Policy
The short version: we collect what running MERCI! requires, keep it in Paris, and sell nothing. Here's the long version anyway.
1. What we collect
To run the Service we process: your email address and display name; your password in hashed form, or the Google or Apple account you choose to sign in with; the files you store and their metadata (names, sizes, types, folder structure, and the capture date and location recorded in photos and videos); the share links you create; and activity and connection logs (sign-ins, sign-outs, uploads, deletions, shares and account changes) with the IP address, approximate country, device, operating system and app version. Files are transferred over HTTPS and stored on our infrastructure in Paris. They are not encrypted on your device: the service operator can read them in order to operate the Service, for example to generate previews. We process no payment data, since paid plans are not on sale.
2. What we never collect
No ad profiles. No selling data. No AI training on your files. No third-party trackers in our apps.
We do not build advertising profiles, sell or rent personal data, scan your files for marketing purposes, or use your Content for unrelated purposes.
3. How we use data
We use personal data to operate and secure the Service (legal basis: contract), to prevent abuse and fraud and to keep the activity and connection logs that let you and us investigate what happened on an account (legitimate interest and the legal obligations of hosting providers), to send service emails such as sign-in links and codes, address verification and sign-in alerts (contract), to answer contact-form messages (legitimate interest), and to maintain the release waitlist when you submit your address (consent; removal is available on request). The waitlist does not currently run an email distribution.
4. Sharing & processors
Scaleway (Paris region, France), running self-hosted Appwrite, is our hosting processor: it runs account authentication, the database, file storage and this website, and delivers the account emails (sign-in links and codes, address verification, password recovery, sign-in alerts). Appwrite stores your password in hashed form and keeps the sign-in session records you can review and revoke in Settings → Security (IP address, browser, operating system, approximate country). If you sign in with Google or Apple, that provider confirms your identity and shares your name and email address with us under its own privacy policy. No payment provider is involved, since paid plans are not on sale. Email privacy@merci.0x12.eu to request the current processor categories and processing locations. We disclose data to authorities when legally required.
5. Retention
Account data is kept while the account is active. Items moved to the trash remain available for 30 days; emptying the trash permanently deletes them. Deleting your account from Settings → Profile, after confirming a one-time code, immediately and irreversibly erases your files, folders, share links and profile; copies of deleted files kept in our storage provider’s version history expire within 14 days. Activity and connection logs, including IP addresses, are kept for 12 months from each event, including after the account is deleted, and the record of the legal documents you accepted is kept as evidence of that acceptance. Contact-form messages and waitlist addresses are deleted after 12 months. Limited records may be retained where the law requires it.
6. Your rights
You can correct your profile name and email, review your activity history and delete your account from Settings. For access, portability, restriction, objection or another privacy request, email privacy@merci.0x12.eu. EU/EEA residents have the full set of GDPR rights, detailed on our GDPR page, including the right to complain to your supervisory authority (ours is the French CNIL).
7. Children
MERCI! isn't directed at children under 15 in France, or under 13 elsewhere (or the higher age local law sets in your country). A parent or guardian must provide any consent required by local law and supervise the account. If we learn we hold data of a child below the threshold without consent, we delete it.
8. Contact & DPO
Data controller: EURL ZENATI (operating the Service under the trade name “MERCI!”), a French single-member limited liability company registered with the Paris Trade & Companies Register under no. 981 830 227, registered office: 60 rue François 1er, 75008 Paris, France. The Data Protection Officer is reachable at dpo@merci.0x12.eu, and privacy requests can be sent to privacy@merci.0x12.eu.