Privacy Policy

This Privacy Policy explains how VOILA, a company registered in France under SIREN 913 938 809 (“VOILA”, “we”, “us”), collects, uses, shares and protects personal data in connection with the Hint! mobile application, the companion web application and any related services we operate (collectively, the “Service”).

VOILA is the data controller for the personal data described below. This Policy is drafted to comply with the EU General Data Protection Regulation 2016/679 (“GDPR”), the French Data Protection Act (Loi Informatique et Libertés), the Apple App Privacy framework and the Google Play Data Safety framework. By using the Service you acknowledge having read this Policy. If you do not agree, please do not use the Service.

1. Scope & controller

This Policy applies to all personal data we process in connection with the Service. It does not apply to data processed by third parties under their own responsibility (for example Apple, Google, your device manufacturer, your network operator or any external website you visit from a link in the Service); each of those parties acts as a separate controller and you should review their own privacy policies. Where a third-party provider acts on our behalf to process personal data, it does so as our processor under a written data-processing agreement.

Hint! is offered worldwide. If you live outside the European Economic Area, the GDPR-based protections described here are extended to you on a contractual basis to the extent compatible with your local law.

2. Data we collect

We collect only the data that is necessary to operate the Service, grouped as follows:

2.1 Account & profile data

• An anonymous Firebase user identifier created on first launch.
• If you choose to sign in with Apple or Google: your name (if disclosed), your email address (or the relayed @privaterelay.appleid.com address), and a provider account ID.
• An optional public nickname or alias you choose for leaderboards.
• An optional avatar URL.
• Your preferred language (en, fr or pt) and the app version you are running.

2.2 Game data

• Your daily-card results (score, time taken, hints revealed) and the IDs of cards you have played.
• Engagement counters (e.g. referrals earned, improvement proposals, engagement score).
• Custom cards or hint-replacement proposals you create or submit.
• Notification preferences and the timestamp of your last daily-card redemption.

2.3 Device & technical data

• Push-notification token (Firebase Cloud Messaging token) so that we can deliver the daily-card notification.
• Device type, OS version, app version, language and approximate region derived from your IP address (we do not store your full IP).
• Crash and stability data (stack traces, device model, OS version, app state) collected by Firebase Crashlytics when the app crashes.
• In-app event data (screens visited, buttons pressed, performance metrics such as frame-rate samples) collected by Firebase Analytics with a pseudonymous identifier.

2.4 Subscription & payment data

• Hint+ subscription status and expiry date.
• Apple originalTransactionId or Google Play purchaseToken used to verify and refresh your subscription.
• We never see or store your payment-card information. All payments are handled by Apple App Store or Google Play under their own privacy policies.

2.5 Advertising identifiers (free version only)

• The Identifier for Advertisers (IDFA) on iOS and the Android Advertising ID (AAID) on Android, only when you have given explicit consent through the Apple App Tracking Transparency (ATT) prompt and our in-app consent screen, and only for the purpose described in Section 5.
• If you decline, ads are still shown but they are non-personalised and the identifier is not shared with advertising partners.
• Hint+ subscribers do not see ads and the advertising identifiers are not used for them.

2.6 Communications

• If you contact us by email, we keep your message and contact details for as long as necessary to handle your request and to comply with our legal obligations.

We do not knowingly collect special categories of personal data (Art. 9 GDPR), precise geolocation, contact lists, photos, microphone or camera content, health data, biometric data or political opinions.

3. Purposes & legal bases

We process your personal data on the following legal bases under Article 6 GDPR:

4. Sharing & sub-processors

We do not sell your personal data and we do not share it with third parties for their own independent marketing. We share data only with the following categories of recipients, each bound by appropriate contractual safeguards:

We may also disclose personal data when required to do so by a valid legal request from a competent authority, to enforce our Terms of Service, to protect the rights, property or safety of VOILA, our users or the public, or in the context of a corporate transaction (merger, acquisition or asset sale), in which case the recipient will be bound by terms at least as protective as this Policy.

5. Advertising & analytics

The free version of Hint! displays ads served by Google Mobile Ads (AdMob). On iOS, before any tracking can occur, Apple shows you the App Tracking Transparency (ATT) system prompt; if you tap “Ask App not to Track”, the IDFA is not made available and ads remain non-personalised. On Android within the EEA / UK / Switzerland, we display a Google-certified consent management platform (CMP) screen so that you can grant or refuse personalised advertising before any data is collected. Hint+ subscribers do not see ads and no advertising identifier is processed for them.

Firebase Analytics events are collected with a pseudonymous Firebase Installation ID. We use it to understand which features are used and to detect performance regressions. You can opt out of analytics from the in-app settings; on EEA / UK devices analytics events are gated behind your consent choice. We do not enable Google Signals.

6. International transfers

Some of our sub-processors are headquartered in the United States or operate global infrastructure. Where we transfer personal data outside the European Economic Area, we rely on one or more of the following safeguards:

• The EU-US Data Privacy Framework (DPF), where the recipient is self-certified (e.g. Google LLC, Apple Inc.).
• The European Commission’s Standard Contractual Clauses (SCCs) completed by the supplementary measures recommended by the European Data Protection Board.
• Your explicit consent for occasional, non-systematic transfers.

You can request a copy of the relevant transfer mechanism by contacting us at the address in Section 15.

7. Retention

8. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”);
• Restrict or object to certain processing;
• Receive your data in a structured, machine-readable format (portability);
• Withdraw your consent at any time, without affecting the lawfulness of prior processing;
• Define directives regarding the fate of your data after your death, in accordance with French Law n° 2016-1321.

Most of these rights can be exercised directly from the in-app Settings (account deletion, analytics opt-out, notification opt-out). For any other request, contact us at guillaume@bellut.com. We answer within one month (extendable by two months for complex requests, as permitted by Art. 12(3) GDPR). If you believe our processing infringes your rights, you may lodge a complaint with the French supervisory authority, the Commission Nationale de l’Informatique et des Libertés (CNIL) at cnil.fr/fr/plaintes, or with the supervisory authority of your EU member state of residence.

9. Children

Hint! is not directed at children under 13 (or the higher minimum digital-consent age set by your country, e.g. 15 in France under Art. 7-1 of the French Data Protection Act). We do not knowingly collect personal data from children below that age. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us and we will delete the data and the associated account without undue delay. We do not run behavioural advertising or build profiles of users we believe to be minors.

10. Security

We implement and maintain technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, in accordance with Art. 32 GDPR. These measures include encryption in transit (HTTPS / TLS 1.2+), encryption at rest by Firebase, hardened Firestore security rules, least-privilege IAM, two-factor authentication on administrator accounts, dependency scanning and code review.

However, no method of transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security and accept no liability for any unauthorised access or use that occurs despite the implementation of reasonable security measures, except where such liability cannot be excluded under applicable law. Should a personal data breach affect your data, we will notify the CNIL within 72 hours where required and will inform you directly when the breach is likely to result in a high risk to your rights and freedoms.

11. Cookies & similar technologies

The Hint! mobile application does not use HTTP cookies. It does store small amounts of data locally on your device (Firebase Installation ID, secure-storage entries for your session, cached game state). The Hint! web application uses strictly necessary browser storage (localStorage / IndexedDB) to keep you signed in and to cache the daily card. No advertising or marketing cookies are set on the web application. If we add any optional cookies in the future, we will display a CMP banner so you can accept or refuse them before they are set.

12. Automated decisions & AI

Hint! does not take any decision producing legal or similarly significant effects about you on a purely automated basis (Art. 22 GDPR). The hints displayed in cards are generated by large-language models (Google Gemini, OpenAI GPT, Anthropic Claude) using only the public text of the relevant Wikipedia article; no personal data about you is sent to those models. AI-generated content may contain inaccuracies; it is provided for entertainment only and we accept no liability for any reliance placed upon it.

13. Third-party services & links

The Service may include links to third-party websites or services (for example a Wikipedia article, an App Store / Google Play page, a TikTok video, a partner’s site). Those services are governed by their own privacy policies and we do not control and are not responsible for their practices. We encourage you to read their policies before providing them with your personal data. Where we authenticate you using Sign in with Apple or Google, the identity provider acts as an independent controller for the data it collects on its own login page; only the limited information described in Section 2 is shared with us.

14. Changes

We may update this Privacy Policy from time to time, for example to reflect changes in the Service, in our sub-processors or in applicable law. When we do, we will revise the “Last updated” date at the top of this page and, when changes are material, provide additional notice within the app or by email to subscribed users where reasonable. Your continued use of the Service after the new Policy takes effect constitutes your acknowledgement of the updated Policy.

15. Contact & complaints

For any privacy-related question, request or complaint, please contact us at:

• Data controller: VOILA — SIREN 913 938 809, France
• Email: guillaume@bellut.com (please use the subject “Privacy — Hint!”)
• Terms of Service: tulleb.com/app/hint/terms_of_service.html
• Supervisory authority: Commission Nationale de l’Informatique et des Libertés (CNIL) — cnil.fr