Privacy Policy — Kroket

Last updated: May 2, 2026

1. Who We Are

Kroket is a mobile application published by Jason CHUMMUN, a sole entrepreneur based in Bagnolet, France, operating under the Kroket brand. Kroket allows users to scan pet food products and evaluate their nutritional quality.

For any questions regarding this policy, please contact us at: jason@helixion.eu

2. Data We Collect and Why

Kroket is built on a privacy-by-design principle. No user account is required, and no email address or real name is ever requested.

2.1 Data Collected Automatically

Data	Purpose	Legal Basis
`device_id` (anonymous device identifier)	Associate your data with your device without personally identifying you	Legitimate interest (service operation)

The device_id is a technical identifier generated locally on your device. It cannot be used to identify you as a natural person.

2.2 Data Entered by the User

Data	Purpose	Legal Basis
Pet profiles (name, species, breed, age, weight, medical conditions, allergies)	Personalise nutritional analysis	Consent (voluntary input)
Scan history (products scanned, scores)	Allow users to review their history	Consent (service usage)
Shopping lists	Purchase planning feature	Consent (service usage)

2.3 Data Submitted Through Contributions

Data	Purpose	Legal Basis
Packaging photos uploaded voluntarily	Enriching the product database via OCR (Mistral AI)	Explicit consent

Photo uploads are strictly voluntary and require an explicit user action.

2.4 What We Do Not Collect

Kroket does not collect:
- Full name, email address, or phone number
- Location data (GPS)
- Behavioural browsing or advertising data
- Biometric data
- Payment information

3. Third-Party Processing

Mistral AI (OCR)

When you upload a packaging photo, the image is sent to Mistral AI for text extraction (OCR). Mistral AI acts as a data processor. The data transmitted is limited to the image provided and contains no information that could personally identify you. For more information: https://mistral.ai/privacy

Resend (transactional email delivery)

When you use magic link sign in, your email address and the magic link URL are transmitted to Resend to deliver the message. Resend acts as a data processor and only receives the data strictly necessary to send the email. For more information: https://resend.com/legal/privacy-policy

Server logs (nginx)

Our web server (nginx) records technical access logs for every HTTP request received by the API. Each log entry contains:

the client IP address,
the request timestamp,
the HTTP method and the URL called (including query string parameters such as device_id),
the HTTP response status code,
the user agent string.

These logs are considered pseudonymous data (combination of IP and device_id) and are retained for 14 days, after which they are automatically deleted by log rotation (logrotate). The purpose is service security, incident diagnostics, and abuse detection. Legal basis: legitimate interest of the publisher in ensuring the security and availability of the service.

We do not sell, rent, or transfer any data to third parties for commercial purposes.

4. Hosting and Data Transfers

All data is stored on a VPS server located in France (Europe). No data transfer outside the European Economic Area (EEA) takes place, except for requests sent to Mistral AI in connection with the OCR feature.

5. Data Retention

Data	Retention Period
Pet profiles	Until deleted by the user
Scan history	Until deleted by the user
Shopping lists	Until deleted by the user
Uploaded photos	Duration required for OCR processing, then deleted
`device_id`	Until account deletion
Server logs (nginx)	14 days, then automatically deleted
Database backups	30 days, then automatically deleted

In the absence of any activity for 24 months, data associated with a device may be automatically deleted.

Account deletion takes immediate effect on production servers. Any residual data present in automated backups is purged at the latest 30 days after deletion, when the affected backups expire.

6. Your Rights

Under the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — you have the following rights:

Right of access: obtain a copy of the data associated with your device_id
Right to rectification: correct inaccurate data directly in the app
Right to erasure: delete all your data (see section 7)
Right to data portability: receive your data in a structured, machine-readable format
Right to object: object to certain processing activities
Right to restriction: request that processing of your data be restricted

To exercise these rights, contact us at jason@helixion.eu. We will respond within 30 days.

7. Deleting Your Data

You can delete all your data at any time, directly from the app:

Open the Kroket app
Go to the Profile tab
Tap Delete my account
Confirm the deletion

This action is irreversible and triggers the cascading deletion of all your pet profiles, scan history, shopping lists, and votes. Deletion takes effect immediately on our servers.

8. Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration, including:

Encrypted communications (HTTPS/TLS)
Restricted and authenticated server access
Separation of development and production environments
Regular backups

9. Minors

Kroket is intended for users aged 13 and over. We do not knowingly collect data from children under the age of 13. If you believe a child under 13 has used our service, please contact us so we can delete the relevant data.

10. Changes to This Policy

We may update this privacy policy. In the event of a material change, we will notify you via an in-app notification. The date of the last update is shown at the top of this document.

11. Contact

Jason CHUMMUN — Kroket
Bagnolet, France
Email: jason@helixion.eu

If your concern is not resolved, you have the right to lodge a complaint with your local data protection authority (e.g. ICO — ico.org.uk for the UK, CNIL — cnil.fr for France).