Privacy Policy

Data controller

The data controller for your personal data is:
UITGuard — French single-member limited liability company (SARL à associé unique)
Registered office: 12 chemin de Longuemare, 78270 Cravent, France
Versailles Trade and Companies Register (RCS) 979 263 225 — SIRET: 979 263 225 00018
Represented by its managing director: Tardy Christophe
Data protection contact email: contact@monecrin.com

You may also lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority: 3 place de Fontenoy, 75007 Paris — www.cnil.fr

Data collected

In the course of operating the Mon Écrin service, we collect the following data:

Identification data: name, email address
Connection data: IP address, browser type, pages viewed, date and time of access
Device data: device identifier, model, storage capacity
Media file metadata: file name, size, type, capture date, checksum (the files themselves are stored on the storage destination you have chosen)
Cookies: strictly necessary session cookies

Metadata and geolocation

When you back up photos, the EXIF metadata embedded in the files (technical information, capture date, and where applicable geolocation data) is preserved with the original file. This metadata is encrypted at rest (AES-256-GCM) in the same way as your files. No extraction, analysis, or exploitation of this metadata is carried out by us.

Use of data and legal bases

Your data is used for the purposes described below, each based on a legal basis in accordance with Article 6 of the GDPR:

Legal bases for personal data processing
Data	Purpose	Legal basis (Art. 6 GDPR)
Identification (name, email)	Account and subscription management	Performance of contract — Art. 6.1.b
Content of your files (photos, videos, documents)	Backup, storage and retrieval of your files	Performance of contract — Art. 6.1.b
Connection data (IP, browser)	Security, abuse prevention	Legitimate interest — Art. 6.1.f
Device data and file metadata	Synchronisation and service operation	Performance of contract — Art. 6.1.b
Payment data (via Stripe)	Subscription management and billing	Performance of contract — Art. 6.1.b
Technical session cookies	Authentication and operation	Performance of contract — Art. 6.1.b
App diagnostics (if you accept them)	Service improvement, error resolution	Legitimate interest — Art. 6.1.f (opt-out available)
Backup status of each device (reduced report, sent on every cycle)	Show the status of your backups, detect a device that has stopped backing up and let you know	Performance of the contract — Art. 6.1.b
Website audience measurement (pseudonymised daily fingerprint, no cookie)	Aggregated visit statistics for the public pages of the website	Legitimate interest — Art. 6.1.f (objection possible from your browser)

App diagnostics

The mobile app may collect diagnostic data (sync reports, performance metrics, error reports) to improve service reliability and resolve errors. These reports are linked to your account and your device, so that we can analyse the errors that concern you and assist you.

You can disable this collection at any time from the mobile app settings, under "Privacy" → "Diagnostics and reports". This setting does not stop the reduced backup-status report described below, which the service needs.

Backup status of your devices

On every backup cycle, the Android app always sends, even if you have declined diagnostics, a report reduced to the backup status: the device's technical identifier, its model, its system version and the app version; the type of cycle, what triggered it and its result; file counters (total, left to send and their size, being sent, backed up, freed from the device, in error, excluded, refused); the number of photos taken with the camera in the last 15 days that the app cannot see, for example because their folder is not backed up (a single number, with no name, path or content, so that we can tell you about photos that may not be protected); where relevant, the technical reason why the backup did not take place (for example an expired session or a backup not yet set up) or why its scope is reduced (access to videos or documents refused). This report contains no file name, path or content, and no free text. It is used to show the status of your backups on the website and in the apps, and to spot a device that has stopped backing up so that we can let you know.

Website audience measurement

To understand how the public pages of the website are visited (home, help, blog, legal pages…), each page displayed sends a measurement request without cookies: no cookie is set or read, and nothing is stored on your device. The audience measurement never records your IP address or browser type. They are only used to compute, by cryptographic hashing under a secret key drawn at random every day, two pseudonymised values, kept in temporary memory and never in our database: a pseudonymised identifier of your address and a visitor fingerprint. The address identifier is used for a page-view counter erased after one hour at most; together with the fingerprint, it is also used to count the same visitor only once per day, and both are then erased at the latest one hour after the end of the day. The daily key is destroyed after 48 hours at most: while it exists, these values are pseudonymised data; afterwards, they can no longer be reversed. Technical copies of this temporary memory may persist a few more minutes. Only aggregated statistics are stored in the database: number of visitors and page views per day, per page and per origin (search engine, social network, referring website, direct link, campaign). They cannot identify you and are never used for profiling. Declared bots are not counted, and the customer area is not concerned. As for any request, your IP address also appears in the technical security logs described above (connection data), with their own retention period.

You can object by enabling the "Global Privacy Control" or "Do Not Track" signal in your browser: no measurement request is then sent.

Signing in with a Google or Apple account

You can create your account or sign in with a Google or Apple account.

With Google, we receive your Google account identifier, your email address, your name and the address of your profile picture, updated at each sign-in. Your picture is displayed from Google's servers: when it appears on a page of the site, your browser requests it from Google.
With Apple, we receive an identifier specific to Mon Écrin and your email address — where applicable a masked address created by Apple, which forwards our messages to you — and, at the very first sign-in only, your name.

We have no access to your Google or Apple password, nor to your other data held by them, and we send them neither your files nor the content of your Écrin.

To display the “Sign in with Apple” button, the site's sign-in and registration pages load a script provided by Apple (appleid.cdn-apple.com, appleid.apple.com); when you choose “Continue with Google”, your browser is redirected to Google, with no Google script on our pages. Google and Apple then act as independent data controllers, under their own privacy policies.

If you withdraw Mon Écrin's access to your Apple account, your Mon Écrin account and your files are kept; you can get back into it through “Forgot password”, using the email address of the account.

Organising your memories by place ("Your trips")

If you enable it, the "Your trips" feature automatically groups your photos by place, so you can relive your memories destination by destination. This feature is entirely optional: it relies on your explicit consent (legal basis: Article 6.1.a of the GDPR) and is disabled by default. It uses only the geolocation coordinates that may be present in your photos. To protect your privacy, no geographic location is readable on our servers: places are indexed in an encrypted, anonymised form (a cryptographic fingerprint unique to your account), so we can never know where your photos were taken. Your data remains hosted exclusively in France, and your home address is never recorded: on the contrary, it is automatically excluded from the grouping.

You can disable this feature at any time. Disabling it has no effect on your photos and triggers the automatic deletion of the location data that had been built to organise your trips.

Your trips and the associated location data are kept for as long as the feature remains enabled, then erased from our active systems when you disable it. For security reasons, an encrypted copy may remain in our backups for up to 30 days, before being permanently erased when those backups are rotated.

Face recognition in your photos ("People")

The "People" feature automatically groups the faces detected in your photos so you can find your memories by person. This processing relies on biometric data (the facial fingerprint) and therefore falls under a special category of data (Article 9 of the GDPR): it only runs if you have given your explicit, dedicated consent (legal basis: Article 9.2.a of the GDPR), separate from any other consent, and is disabled by default. All of the computation — face detection, fingerprint calculation, grouping by person — runs exclusively on your device: neither your photos, nor the detected faces, nor the computed fingerprints are ever transmitted to our servers or to any third party. Each device is an independent silo: your fingerprints are never compared with those of another user or with an external database. No civil identity is automatically attached to a detected person; only you may, if you wish, give it a purely local first name. This feature is never used to authenticate or unlock anything.

You can withdraw your consent as easily as you gave it, at any time, from the mobile app's settings. Withdrawing it triggers the immediate and complete deletion of the biometric fingerprints and person groupings stored on your device; the same applies if you uninstall the app.

Biometric fingerprints and person groupings are kept only on your device, for as long as the feature remains enabled. They are automatically deleted when you withdraw your consent, when you uninstall the app, and — specifically — when the corresponding source photo is itself deleted. This data never passes through our servers and is therefore never retained by us.

Cookies and similar technologies

Mon Écrin uses only technical cookies necessary for the operation of the service (session management, authentication). No advertising, tracking, or behavioural analysis cookies are used.

You can configure your browser to reject cookies, but this may affect the operation of the service.

Sub-processors and data recipients

We never sell your personal data. In accordance with Article 28 of the GDPR, we use the following sub-processors to provide the service:

List of sub-processors and data recipients
Sub-processor	Purpose	Location
OVHcloud (Object Storage S3)	Hosting of encrypted files	France: primary storage in Gravelines, backup copy in a second data center in Strasbourg
OVHcloud (servers and database)	Hosting of the service's servers and database	France: Roubaix, Strasbourg and Gravelines
Stripe Payments Europe Ltd.	Credit card payment processing (web channel)	European Union (Ireland) — card data not transmitted to UITGuard
Google Play Billing (Google Ireland Ltd.)	Payment and subscription processing for Android app users	European Union (Ireland), with possible transfers outside the EU governed by the European Commission's standard contractual clauses
Google Ireland Ltd. (Google Workspace, Gmail API)	Sending service emails (verification, notifications, invoices, security alerts)	European Union (Ireland), with possible transfers outside the EU governed by the European Commission's standard contractual clauses
OVHcloud (SMS)	Sending one-time verification codes by SMS (phone number and code)	France

For fraud prevention and compliance with their own regulatory obligations, Stripe and Google act as independent controllers.

Your data may also be disclosed to competent administrative or judicial authorities upon legal request, under the conditions provided by law.

These sub-processors process your data under their own data processing terms.

Data transfers outside the European Union

Your personal files (photos, videos, documents) and their metadata are stored exclusively in France, on OVHcloud infrastructure. No transfer of this data takes place outside the European Union.

Certain technical data (transaction identifiers, in-app payment validation via Google Play Billing) may transit through Google infrastructure located outside the EU. These transfers are governed by the standard contractual clauses approved by the European Commission (Decision (EU) 2021/914 of 4 June 2021), ensuring a level of protection equivalent to that required by the GDPR.

Android mobile app — permissions and data

The Android app requests certain Android permissions necessary for automatic backup. Each permission is requested with a contextual explanation and can be denied. Denying certain permissions prevents the service from functioning.

Access to photos and videos (READ_MEDIA_IMAGES, READ_MEDIA_VIDEO): required to read the files to be backed up. No file is sent without your initial consent via the onboarding screen.
Access to files (documents) (MANAGE_EXTERNAL_STORAGE on Android ≤ 12, Storage Access Framework on Android 13+): required for backing up the Documents and Downloads folders when you enable it.
Notifications (POST_NOTIFICATIONS): to display backup progress and alert in case of errors. Optional.
Background service (FOREGROUND_SERVICE, WAKE_LOCK, REQUEST_IGNORE_BATTERY_OPTIMIZATIONS): to allow backup to run even with the screen off.

The app contains no advertising SDK and no trackers, and does not use Google Analytics or any equivalent. Its outgoing network traffic goes to our servers and storage hosted in France, and to Google only for signing in with a Google account and for payment via Google Play.

Family accounts and member sharing

Family plans allow the account administrator to invite up to 10 members to share the subscribed storage space. In this context:

Each member has their own account, their own files, and their own history: a member's photos are never visible to other members, except through a shared album explicitly created.
The family account administrator has knowledge of the identity (first name, last name, email) of invited members and their aggregate storage usage (in GB), but has no access to the content of their files.
The "protected" role (minors or dependents) allows the administrator to manage the subscription without access to the protected person's personal content.
When a member leaves the family group, their data remains in their own individual account. No copy is retained by the administrator.

Minors

The service is not intended for minors under 15 years of age. In accordance with Article 8 of the GDPR and Article 45 of the French Data Protection Act (loi Informatique et Libertés), the consent of a minor under 15 must be given jointly by the minor and by the holder of parental authority.

Within family plans, the account administrator (holder of parental authority) may invite a minor via the "protected" role, which constitutes parental consent within the meaning of Article 8 of the GDPR for the creation and management of the minor's account.

If you find that a minor under 15 has an account without the required joint consent, please contact us at contact@monecrin.com so that we can delete the account without delay.

Data security

We implement technical and organisational measures to protect your data:

Encrypted communications (HTTPS)
File integrity verification (SHA-256 checksum)
Strict access controls
Passwords stored securely (hashing)

Data retention periods

Account data (identification, preferences): for as long as your subscription runs. When the subscription ends, your account is deactivated and then deleted within the time limits set out below for your files. No commercial solicitation is sent to you without your prior consent (Art. L34-5 of the French Postal and Electronic Communications Code).
Files (photos, videos, documents) and metadata: as long as the account is active. If you cancel your subscription, a ZIP archive of your files is made available to you for 2 months (for a cancellation at your initiative, after at least 3 months of paid subscription); your account is then deactivated and permanently purged 30 days later. If you delete your account, no export is sent: download your files before making your request. Your account is deactivated as soon as the request is processed, then permanently purged, backup copies included, within 30 days. Files on your phone are not affected by these server purges.
Trash (deleted files): 1 year (365 days by default, configurable by the service administrator), after which files are permanently purged and unrecoverable. A warning email is sent 30 days before the purge.
Connection data (IP, user-agent, access logs): 3 months maximum.
ZIP download links (GDPR export): 72 hours, then automatic deletion of the link and the temporary ZIP file.
Billing data (invoices, transactions): 10 years from the date of invoice issuance, as required by French accounting and tax law (Art. L123-22 of the Commercial Code). Data is anonymised upon account deletion (the user's name is replaced by an internal identifier).
Consents (agreements, withdrawals, accepted version): for the duration of service use, then 5 years after cessation, for evidentiary purposes in case of a claim.
Diagnostics and sync reports: 90 days, linked to your account.
Website audience measurement: pseudonymised address identifier and visitor fingerprint erased at the latest one hour after the end of the day (the page-view counter per address, after one hour at most); computation key destroyed within 48 hours, after which these values can no longer be reversed. All of this is kept in temporary memory, never in the database (technical copies of a few minutes at most). The aggregated statistics, which contain neither IP address nor fingerprint, are kept to follow how visits evolve.
Data breach notifications: 5 years from the date of notification, for evidentiary purposes.

Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

Right of access (Art. 15): obtain confirmation that your data is being processed and receive a copy. Accessible directly from your dashboard and the mobile app, under "Privacy".
Right to rectification (Art. 16): correct inaccurate or incomplete data (editable from your profile).
Right to erasure / right to be forgotten (Art. 17): request the deletion of your account and all your data via the "Delete my account" button in settings. No export is sent: download your files before making your request (ZIP export from your dashboard). Your account is deactivated as soon as the request is processed, then permanently purged, backup copies included, within 30 days; this purge is irreversible (files on your phone are not affected).
Right to restriction (Art. 18): restrict the processing of your data (suspend automatic backup, disable diagnostics).
Right to data portability (Art. 20): receive your data in a structured, commonly used, and machine-readable format. The complete ZIP export (photos, videos, documents) is available from your dashboard, once per month.
Right to object (Art. 21): object to the processing of your data based on legitimate interest (app diagnostics).
Right to withdraw consent (Art. 7): for processing based on consent, you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to issue post-mortem directives: in accordance with Article 85 of the French Data Protection Act, you may communicate your directives regarding the retention, deletion, and disclosure of your data after your death.

How to exercise your rights?

Directly from the mobile app or your dashboard ("Profile" and "Privacy" sections), for most rights;
By email to contact@monecrin.com;
By post to: UITGuard, 12 chemin de Longuemare, 78270 Cravent, France.

We undertake to respond to your request within one month of receipt, in accordance with Article 12 of the GDPR. This period may be extended by two months if the request is complex or numerous, in which case we will inform you.

Proof of identity may be requested in case of reasonable doubt about your identity (Article 12.6 of the GDPR).

Complaint to the CNIL — if you believe your rights are not being respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority: 3 place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07 — www.cnil.fr/fr/plaintes.

Automated decision-making and profiling

In accordance with Article 22 of the GDPR, we inform you that no decision producing legal effects concerning you or significantly affecting you is made on a solely automated basis using your data.

No commercial, behavioural, or advertising profiling is carried out. The generation of thumbnails from your files is an automated technical process strictly necessary for displaying the gallery: it does not constitute profiling or automated decision-making within the meaning of Article 22.

Data breach notification

In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach likely to result in a risk to your rights and freedoms, we undertake to:

Notify the CNIL within 72 hours of becoming aware of the breach;
Inform you without undue delay if the breach is likely to result in a high risk to your rights and freedoms.

The notification will include the nature of the breach, the likely consequences, the measures taken or proposed to address it, and recommendations to mitigate any potential adverse effects.

Contact us

For any question regarding this privacy policy:
Email: contact@monecrin.com
Address: 12 chemin de Longuemare, 78270 Cravent, France