Privacy Policy
Last updated: May 2026
Tronche! attaches the utmost importance to the protection of your personal data. This privacy policy describes the data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR / RGPD — EU 2016/679).
1. Data controller
The legal entity in charge of the processing is:
- Karl Cosse — sole trader (micro-enterprise)
- Address: 10 chemin de la Sablière, 33650 Saucats, France
- SIRET: 512 678 822 00044
- Contact: [email protected]
Tronche! plays two distinct GDPR roles depending on the category of data:
- Data controller for: user account, IAP purchases, security logs and technical data (cf. §2).
- Processor within the meaning of article 28 of the GDPR for: the photos collected through the event galleries. The data controller for these photos is the event organiser (the account holder who created the event), in accordance with the Terms of Use §4.
2. Data collected
| Category | Data | Legal basis | Retention period |
|---|---|---|---|
| User account | Email address, hashed password | Performance of the contract | Lifetime of the account + 30 days after deletion |
| Events | First names of the couple, date, event settings | Performance of the contract | Lifetime of the account + deletion on gallery expiry |
| Photos | Image files (EXIF stripped), metadata (date, size) | Performance of the contract | 30 days (Free plan) to 90 days (Premium plan), extendable by cumulative extensions; +30 days of grace after expiry before definitive erasure |
| Guest emails | Email address of photo recipients | Explicit consent (see §3) | 30 days after sending, then automatic deletion |
| Server logs | IP, user-agent, request timestamp | Legitimate interest (security, abuse prevention) | 30 days |
| Technical data (OS, OS version, app version) | OS type, OS version, application version | Legitimate interest (diagnostics, quality of service) | Lifetime of the account |
| Purchases (IAP) | Apple/Google transaction identifier, amount, currency, date | Performance of the contract + legal obligation (accounting) | 10 years (art. L123-22 of the French Commercial Code) |
Technical data
To ensure quality of service and diagnostics, the application transmits on each change:
- The operating system type (iOS or Android);
- The operating system version;
- The version of the Tronche! application.
This information is technical data: it does not contain any direct personal data (no device identifier, no IMEI, no location). It is used to diagnose incidents and adapt features to OS capabilities.
3. Guest emails — consent and use
Guest emails are collected solely to send a specific photo, at the explicit request of the person photographed.
The photobooth participant enters their own email address in the application to receive their photo. This email:
- Is used exclusively to send the requested photo
- Is never used for marketing or commercial purposes
- Is not shared with third parties
- Is automatically deleted 30 days after sending
The email message sent contains a clear statement indicating that the address was used solely for this delivery.
4. Photo processing and EXIF
During upload, the EXIF metadata of photos (which may contain GPS location information, device data, etc.) is automatically removed by our processing. Only the visual data of the photo is retained.
5. Deletion of photos
When you delete a photo, it is immediately hidden from your gallery and from those of the other guests. To allow you to reverse an accidental deletion, the photo is technically retained for 7 days on our servers before its definitive and irreversible erasure. During this period, only the Tronche super-administrator can access the photo, exclusively for technical support reasons in the event of an explicit request on your part.
6. Hosting and transfers
The data is hosted on a Hostinger VPS server located in France (Paris, Île-de-France). All data processing by Tronche! and its processors takes place within the European Union (see §7 for the list of processors).
The Resend email service (resend.com) is used to send photos and transactional emails (verification, notifications). Although Resend Inc. is a company governed by US law, the email processing infrastructure is located in Ireland (eu-west-1 region). A data processing agreement (DPA) compliant with the GDPR governs this processing.
7. Data sharing
We do not sell, rent or transfer your personal data to third parties. Data may be shared with:
- Resend (email sending): recipient email address + email body containing a secure link to the photo (the photo itself is not transmitted to Resend) — processing in Ireland
- Apple App Store (iOS purchases): transaction identifier and amount — Apple Distribution International Ltd, Ireland
- Google Play Store (Android purchases): transaction identifier and amount — Google Ireland Limited
- Competent authorities: in the event of a legal obligation only
8. Gallery visibility
Each event gallery is accessible via a sharing link containing a unique 20-character code. The organiser can configure the visibility of their gallery:
- Public gallery (default): anyone with the link can view and download the photos, without authentication.
- Private gallery: only the organiser (the authenticated account holder) can access the photos via the link. The link does not work for other visitors.
The organiser is responsible for the choice of visibility and for controlling the distribution of the sharing link.
9. Your rights
In accordance with the GDPR, you have the following rights:
- Right of access: obtain a copy of your personal data by contacting us at [email protected] (export in JSON format within 30 days)
- Right of rectification: correct your data via the account settings in the application
- Right to erasure: delete your account from the settings (effective deletion within 30 days)
- Right to portability: receive your data in a structured and commonly used format (JSON)
- Right to object: object to certain processing based on legitimate interest by contacting us
- Right to restriction: request the restriction of a contested processing
- Right to withdraw consent: for processing based on consent (in particular the sending of emails to guests), at any time and without retroactive effect on processing already carried out
10. Exercising your rights
To exercise your rights, contact us at: [email protected]
We will respond within a maximum of 30 days. You also have the right to lodge a complaint with the CNIL (the French data protection authority) (www.cnil.fr).
11. Security
We implement appropriate technical and organisational measures to protect your data:
- Passwords hashed with bcrypt (cost 10)
- Encrypted communications via HTTPS/TLS
- Time-limited JWT tokens (24 hours for access tokens, renewable via refresh token)
- Automatic removal of photo EXIF data
- Data access limited to what is strictly necessary
12. Cookies
The Tronche! web interface (in particular the administrator area) uses only technical cookies strictly necessary for its operation:
- admin_token: short session token (24 hours), HttpOnly, SameSite=Strict
- admin_refresh: session renewal token (90 days), HttpOnly, SameSite=Strict
No tracking, advertising or behavioural analytics cookies (Google Analytics, Plausible, Matomo, etc.) are placed. The native mobile application does not set any cookies.
13. Data breach notification
In the event of a personal data breach presenting a risk to the rights and freedoms of users, Tronche! undertakes to:
- Notify the CNIL within a maximum of 72 hours after becoming aware of it, in accordance with article 33 of the GDPR;
- Inform the affected users as soon as possible when the breach is likely to result in a high risk, in accordance with article 34 of the GDPR.
14. Changes
This policy may be updated. Users will be informed by email of significant changes. The date of the last update is indicated at the top of the page.