1. Identity of the data controller
The controller of your personal data is:
- Company: Equily, a French simplified joint-stock company (SAS)
- SIREN: 100 564 202 (Paris Trade and Companies Register)
- Share capital: €20,000
- Address: 20 rue Delambre, 75014 Paris, France
- Email: contact@equily.co
2. Scope and guiding principles
This policy (the “Policy”) applies to all processing of personal data carried out by Equily in operating its platform (website and mobile app) dedicated to habit tracking and well-being (the “Platform”).
Equily strictly complies with Regulation (EU) 2016/679 (the “GDPR”) and the amended French Data Protection Act No. 78-17 of 6 January 1978 (Loi Informatique et Libertés). Our guiding principles are:
- Data minimisation: we only collect the data strictly necessary for each purpose.
- Transparency: you are informed of each processing operation at the moment it begins.
- Contextual consent: your consent is obtained at the precise moment you add a habit that requires specific data — not globally at sign-up.
- User control: you can change or withdraw your consents, or delete your account, at any time directly from the app.
3. Data collected, purposes and legal bases
We only collect the data strictly necessary for each purpose. The table below summarises all processing carried out by Equily.
| Purpose | Data processed | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Joining the waiting list and receiving launch-related communications | Email address | Consent (Art. 6.1.a) |
| Service communications — messages needed to manage your account, for security, for the operation of the service, or to inform you of significant changes affecting the service | Email address, first name (optional), preferred language |
Performance of contract (Art. 6.1.b) These communications relate strictly to the Equily service and contain no commercial marketing |
| Relationship communications — information about Equily's developments and guidance on using the service, with no promotional purpose | Email address, first name (optional), preferred language |
Legitimate interest (Art. 6.1.f) Equily's interest in maintaining its relationship with its users. You can object to these communications at any time via the link provided in the relevant emails or by contacting us. |
| Newsletter and marketing communications — news, offers or promotional content about Equily | Email address, first name (optional), preferred language |
Consent (Art. 6.1.a) Can be withdrawn at any time via the unsubscribe link in each relevant email or from your profile in the app |
| Local weather adaptation — adjusting habits such as exercise intensity to weather conditions (lighter in extreme heat, severe cold or rain) | Approximate location (coordinates rounded to an area of about 10 km, never precise). Not stored: the location is only used for the time needed to fetch the day's weather, then immediately discarded. |
Consent (Art. 6.1.a) Explicit opt-in, revocable at any time from the permissions in your profile |
| Advertising attribution measurement — assessing the effectiveness of our advertising campaigns run on Meta platforms (Facebook, Instagram) | Device advertising identifier (IDFA on iOS, GAID on Android), technical data sent automatically by Meta's measurement kit (IP address, device model and operating system, app version, installation identifier generated by Meta) and the following steps: app installation and app opens, account creation, completion of the discovery flow (onboarding), first habit completed, returns to the app on days 1, 3 and 7 after account creation, display of the subscription offer, start of purchase, start of a free trial, subscription purchase (plan chosen, amount and currency). On iOS without App Tracking Transparency permission: only an aggregated, anonymous installation signal sent by Apple (SKAdNetwork). No account, health or habit data is sent. |
Consent (Art. 6.1.a GDPR and Art. 82 French Data Protection Act) Requested when you create your account, on a dedicated screen where refusing is as easy as accepting, then, on iOS, via the App Tracking Transparency permission. Before you agree, Meta's measurement kit is not started: nothing is read from or written to your device and nothing is sent. Revocable at any time from Profile > Permissions > Ad measurement. |
| Proof of your consent choices — being able to demonstrate each acceptance, refusal or withdrawal | Consent concerned, choice made (acceptance, refusal or withdrawal), date and time, screen where it was collected, version of the text shown and of this Policy, app version | Legal obligation (Arts. 6.1.c and 7.1) |
| Creating and managing your user account Anonymous mode available with a randomly generated username |
Unique identifier (UUID), email address (optional in anonymous mode), date of birth, gender, main stated goal | Performance of contract (Art. 6.1.b) |
| Age verification (access restricted to users aged 18 and over) | Date of birth (age calculation only — data already collected for the account) | Performance of contract (Art. 6.1.b) |
| Interface personalisation (time zone, language, time format, country) | Time zone, display language, time format (12h/24h), country of residence | Performance of contract (Art. 6.1.b) |
| Habit tracking and collection of contextual data (step count, diet, skin, allergies, injuries) | Quantitative and qualitative data specific to the activated habit — including health data (see Article 4) |
Explicit consent (Art. 9.2.a) Obtained habit by habit |
| Progress tracking (completions, streaks) | History of daily check-ins, activity data | Performance of contract (Art. 6.1.b) |
| Personalisation and recommendations tailored to your profile (goals, priorities, history) | Main goal, stated well-being priorities (sleep, exercise, nutrition, etc.), completion history, health data within the limits of your consent | Explicit consent (Art. 9.2.a) + Legitimate interest (Art. 6.1.f) |
| Managing premium subscriptions | App Store / Google Play transaction identifier (Equily has no access to banking data) | Performance of contract (Art. 6.1.b) |
| App stability and debugging (Firebase Crashlytics) | Anonymised crash reports: device type, OS version, app version, stack traces, Crashlytics installation identifier (resettable) | Legitimate interest (Art. 6.1.f) No personal health or account data is sent to Crashlytics |
| Internal behavioural analytics — measuring engagement, retention cohorts, analysis of usage journeys | Pseudonymised UUID, timestamped behavioural events (type of in-app action: adding a habit, completion, deletion, frequency of use), sign-up cohort. The specific content of habits is not collected. |
Legitimate interest (Art. 6.1.f) Internal Equily system — no disclosure to third parties. Right to object available from the app settings. |
| Technical support and app improvement | Support messages, anonymised usage metrics, device model and OS version | Legitimate interest (Art. 6.1.f) |
4. Health data and profiling
4.1 Data falling under Article 9 GDPR
Some data you may choose to share with Equily constitutes data concerning health within the meaning of Article 9 GDPR. This includes in particular:
- information about injuries or physical pain;
- dietary data and specific diets;
- food or skin allergies;
- skin type and dermatological information;
- physical activity data imported from Apple Health or Google Fit (with your explicit permission via your operating system's permissions).
In accordance with Article 35 GDPR, Equily carried out a Data Protection Impact Assessment (DPIA) before processing this sensitive data, given the potential risks to your rights and freedoms.
4.2 Profiling and automated decision-making
Equily carries out profiling within the meaning of Article 4(4) GDPR in order to offer you personalised habit and exercise recommendations. This profiling is based on:
- your stated profile: main goal (e.g. healthy ageing), well-being priorities (sleep, exercise, nutrition, etc.), date of birth, gender;
- your activity history: habit completions, streaks, progress;
- your declared health data, within the limits of your consent.
This profiling is carried out solely to improve your experience and does not give rise to any automated decision producing legal effects or similarly significantly affecting you within the meaning of Article 22 GDPR. Recommendations are generated by a combined algorithmic and editorial engine.
You have the right to object to this profiling at any time by deactivating the relevant habits from your personal space or by contacting us at contact@equily.co.
5. Security of personal data
Equily implements technical and organisational security measures appropriate to the sensitivity of the data processed, in accordance with Article 32 GDPR.
5.1 Encryption of health data — two layers
(1) CMEK encryption via Google Cloud KMS HSM — Firestore is encrypted using a key managed through a Google Cloud KMS hardware security module (HSM), configured and controlled by Equily. The key resides on a secure hardware chip and cannot be exported or extracted outside the HSM, including by Google. Only the encryption/decryption operations authorised by the access policy defined by Equily are permitted.
(2) Additional per-user encryption — each account has its own individual encryption key. Your health data is encrypted with your own key before being stored in Firestore, ensuring that no other account can access your data.
5.2 Other security measures
5.3 Backups
Firebase maintains automatic database backups for service continuity purposes. If you delete your account or withdraw your consent, your data is deleted from the active database immediately. It may remain in technical backups for a limited period (generally less than 30 days) before being automatically purged. These backups are only accessible in the event of a serious technical incident and are not used for processing purposes.
6. International data transfers
Your data is primarily hosted within the European Union. The table below lists all of Equily's technical service providers:
| Provider | Role | Established in | Storage | Safeguard (Art. 46 GDPR) |
|---|---|---|---|---|
| OVH SAS | Website hosting (landing page / front-end) | France — EU | France — EU | No transfer outside the EU — OVH DPA |
| Google LLC Firebase, Cloud KMS, Crashlytics |
Application hosting, authentication, database, HSM key management (CMEK), crash reports (Crashlytics — without Analytics) | United States | EU — europe-west | European Commission SCCs + Google Firebase DPA. CMEK keys reside in an HSM configured by Equily — the key cannot be exported outside the module. DPA → |
| Meta Platforms Ireland Ltd Meta Platforms, Inc. (United States) |
Advertising campaign attribution measurement. Equily and Meta are joint controllers (Art. 26 GDPR) for the collection and transmission of data by Meta's measurement kit, under the “Controller Addendum” to Meta's Business Tools Terms; Meta is solely responsible for any subsequent processing it carries out. | Ireland — EU (transfer to the United States) |
United States | EU–US Data Privacy Framework + European Commission SCCs. Only the advertising identifier, the measurement kit's technical data and the steps listed in Article 3 are sent, and only after your consent. Meta Privacy Policy → |
| Brevo SAS formerly Sendinblue |
Delivery of service and relationship communications, management of the newsletter and contact lists | France — EU | EU | French company, data hosted in the EU — no transfer outside the EU. Brevo DPA → |
| OpenWeather Ltd | Provision of local weather data (One Call API) | United Kingdom | United Kingdom | European Commission adequacy decision (United Kingdom). Only an approximate location (an area of about 10 km) is sent, never stored by Equily. Privacy policy → |
7. Retention periods
Your data is kept only for as long as strictly necessary for the purposes for which it was collected:
| Data category | Retention period |
|---|---|
| Account data (UUID, email, date of birth, gender, goal, priorities) | For as long as the account is active. After 3 years of inactivity or upon a deletion request: erasure or full anonymisation in the active database. |
| Interface preferences (language, time zone, time format, country) | For as long as the account is active. Deleted with the account. |
| Health and habit data | Deleted immediately from the active database when the consent specific to the relevant habit is withdrawn, or when the account is deleted. See Article 5.3 regarding technical backups. |
| Service and relationship communications via Brevo | For as long as the account is active and as long as these communications are necessary for the purpose concerned. If you object to relationship communications, your address is removed from the corresponding mailing list and may be kept in a suppression list limited to the information needed to ensure your choice is respected over time. |
| Newsletter and waiting list | 3 years from collection or last engagement, unless consent is withdrawn earlier. If you unsubscribe, your address is removed from the relevant mailing list and may be kept in a suppression list limited to the information needed to ensure your choice is respected over time. |
| Advertising measurement data (advertising identifier, journey steps listed in Article 3) | Equily keeps no history of these events: only a local marker on your device prevents the same step from being sent twice. Once received, this data is subject to Meta's own retention periods, as set out in its privacy policy. |
| Proof of your consent choices | For as long as the account is active, in order to be able to demonstrate your choices. Deleted with the account. |
| Location for weather adaptation | Not stored. The approximate location is only used for the time needed to fetch the weather, then discarded. Equily does not store it either on your device or on its servers. |
| Behavioural analytics data | Rolling 24 months from each event collected, then automatic deletion. Anonymised aggregated data derived from these analyses may be kept indefinitely. |
| Crashlytics reports | 90 days (Firebase Crashlytics default retention period). |
| Support data and technical logs | 13 months maximum. |
| Firebase technical backups | 30 days maximum — not used for processing purposes (see Article 5.3). |
| Anonymised data for statistical purposes | Kept indefinitely (not subject to the GDPR, direct identification impossible). |
8. Recipients of data
Your personal data is never sold or transferred to third parties for commercial purposes. It may only be shared with:
- Equily SAS (data controller), for the operations described in this Policy, including the internal behavioural analytics system operating on pseudonymised data (encrypted UUID).
- Google LLC (Firebase, Cloud KMS HSM, Crashlytics), technical processor bound by a GDPR-compliant DPA. Health data is protected by CMEK HSM encryption and per-user encryption.
- Meta Platforms Ireland Ltd (and Meta Platforms, Inc. in the United States), joint controller with Equily for collection and transmission, for attribution measurement of our advertising campaigns, receiving only the device advertising identifier, the measurement kit's technical data and the steps listed in Article 3, and only after your consent. No account, health or habit data is sent.
- OpenWeather Ltd, processor for the provision of weather data, receiving only an approximate location (never stored by Equily) when you enable weather adaptation.
- OVH SAS, processor for website hosting, with no access to application data.
- Brevo SAS, processor for the delivery of service communications, relationship communications and newsletters. Brevo may receive your email address and, where applicable, your first name and preferred language. Newsletters and marketing communications are only sent to people who have given their consent where required.
- Apple Inc. / Google LLC, for the technical management of subscriptions through their stores (transaction identifiers only — Equily has no access to any payment data).
- Competent authorities, where applicable, when required by law.
9. Your rights
In accordance with Articles 15 to 22 GDPR, you have the following rights over your personal data. Most of them can be exercised directly from the app settings.
To exercise a right you cannot exercise directly from the app, contact us at contact@equily.co. We undertake to respond within one month (Art. 12 GDPR), which may be extended by two months where requests are complex.
10. Advertising attribution measurement and no tracking cookies
Our website uses no tracking, advertising profiling or behavioural analytics cookies for advertising purposes. Our app uses no advertising tracker other than the measurement described below, which is subject to your consent, and serves no targeted advertising.
For the purpose of measuring the effectiveness of our advertising campaigns run on Meta platforms (Facebook, Instagram), Equily sends Meta your device's advertising identifier (IDFA on iOS, GAID on Android) and the following steps: app installation and app opens, account creation, completion of the discovery flow (onboarding), first habit completed, returns to the app on days 1, 3 and 7 after account creation, display of the subscription offer, start of purchase, start of a free trial, subscription purchase (plan chosen, amount and currency). This processing is based exclusively on your consent:
- it is requested when you create your account, on a dedicated screen where refusing is as easy as accepting;
- until you have accepted, Meta's measurement kit is not started: nothing is read from or written to your device for Meta, and nothing is sent to it;
- on Android, your agreement in Equily is sufficient; on iOS, the advertising identifier and steps are only sent if you also allow tracking via Apple's App Tracking Transparency (ATT) mechanism;
- on iOS, if you accept in Equily but refuse ATT, only the installation is reported, once, through Apple's SKAdNetwork mechanism: Apple sends Meta an aggregated, delayed signal without any identifier;
- your choice (acceptance, refusal or withdrawal) is recorded with its date and the version of the text shown, so that it can be demonstrated;
- this consent can be withdrawn at any time from Profile > Permissions > Ad measurement: collection stops immediately;
- no account, health or habit data is ever sent to Meta.
If you refuse this tracking, the app remains fully functional. Details of this processing are set out in Article 3, transfer arrangements in Article 6, and retention periods in Article 7.
Minimal technical data strictly necessary for the app to function (Firebase authentication tokens stored via Flutter Secure Storage, session preferences) may be stored locally on your device. This data is not sent to third parties for tracking purposes. Firebase Crashlytics is used without Google Analytics.
11. Minors
The Equily Platform is restricted to people aged 18 and over. The date of birth collected at sign-up is used to verify this access requirement. It is not used for any other purpose without your explicit consent.
We do not knowingly collect personal data from people under 18. If you become aware that a minor has created an account on our Platform, please let us know at contact@equily.co so that we can delete the data concerned immediately.
12. Changes to the Policy and contact
This Policy was first published in February 2026. It was updated in May 2026 to include: the newsletter via Brevo, user profile data (date of birth, gender, goal, priorities, interface preferences), premium subscription management, Firebase Crashlytics, the double encryption architecture for health data (CMEK HSM + per-user encryption), and the mention of technical backups. A subsequent update introduced the weather adaptation feature based on an approximate, non-stored location (processor OpenWeather Ltd). The July 2026 update introduced advertising attribution measurement via Meta, based on consent and limited to the advertising identifier and to installation and day-3 retention events. The August 2026 update clarified the use of Brevo for delivering service and relationship communications to Equily users, while keeping consent as the legal basis for newsletters and marketing communications where required. The October 2026 update details advertising measurement via Meta: the full list of steps sent (including the free trial and the subscription with its amount), the measurement kit's technical data, the aggregated SKAdNetwork installation signal on iOS, the kit starting only after your agreement, joint controllership with Meta, and retention of proof of your consent choices.
For any question about this Policy:
- Email: contact@equily.co
- Post: Equily SAS — 20 rue Delambre, 75014 Paris, France