Privacy Policy

1. Who we are

Thingz is operated by Grégoire Sempe, an individual acting as an independent publisher based in France. The service is accessible at thingzapp.com and app.thingzapp.com.

For any question about this policy or your personal data, contact us at privacy@thingzapp.com.

2. What we collect

We collect only the data that is strictly necessary to provide the service.

Account data — when you sign up, we collect your email address and your name. Nothing else is required.

Usage data — we may collect basic technical data such as your IP address, browser type, and the pages you visit, for the purpose of maintaining security and diagnosing errors. This data is not linked to your identity and is not used for tracking or analytics.

We do not collect payment data. If and when paid plans are introduced, payments will be processed by a third-party provider (such as Stripe) and we will never see or store your card details.

We do not use third-party analytics tools such as Google Analytics.

3. How we use your data

We use your email address and name exclusively for:

• Creating and managing your Thingz account
• Sending you notifications related to your account activity (hacktons, reminders, status updates)
• Sending you transactional emails such as password resets or account confirmations
• Contacting you about service updates, if you have opted in to communications

We do not use your data for advertising, profiling, or any purpose unrelated to providing the service.

4. Legal basis for processing (GDPR)

We are subject to the General Data Protection Regulation (GDPR) as a service operated from France within the European Union.

The legal basis for processing your personal data is:

• Contract performance — processing your email and name is necessary to provide the service you signed up for (Article 6(1)(b) GDPR)
• Legitimate interest — basic technical data processed for security and error diagnosis (Article 6(1)(f) GDPR)
• Consent — for any optional marketing communications, which you can withdraw at any time

5. Who we share your data with

We do not sell your personal data. We do not share it with third parties for advertising or marketing purposes.

We use a limited number of trusted sub-processors to operate the service:

• Supabase — database and authentication infrastructure, hosted in the European Union
• Railway — application hosting
• Sentry — error tracking (no personal data intentionally sent)

If the service is integrated with a third-party tool you have authorised (such as Slack or Microsoft Teams), data shared through that integration is governed by the terms of that third party.

6. How long we keep your data

We keep your account data for as long as your account is active. If your account is closed or deactivated, we delete your personal data within 30 days, unless we are required by law to retain it longer.

If an account is deactivated due to inactivity, you will be notified in advance and given the opportunity to reactivate before deletion occurs.

7. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the data we hold about you
• Right of rectification — you can ask us to correct inaccurate data
• Right of erasure — you can ask us to delete your data
• Right to restriction — you can ask us to limit how we use your data
• Right to portability — you can ask us to provide your data in a portable format
• Right to object — you can object to processing based on legitimate interest
• Right to withdraw consent — if processing is based on consent, you can withdraw it at any time

To exercise any of these rights, contact us at privacy@thingzapp.com. We will respond within 30 days.

You also have the right to lodge a complaint with the French data protection authority, the CNIL.

8. Cookies

Thingz uses only strictly necessary cookies required for the service to function — specifically, session cookies used for authentication. These cookies are essential and cannot be disabled without breaking the service.

We do not use advertising cookies, tracking cookies, or third-party analytics cookies.

9. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS), database access controls, and row-level security on all data.

No method of transmission over the internet is completely secure. If you believe your data has been compromised, contact us immediately at privacy@thingzapp.com.

10. Children

Thingz is a business tool intended for adults. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has created an account, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. When we do, we will update the date at the top of this page and, if the changes are significant, notify you by email.

Your continued use of Thingz after a change constitutes acceptance of the updated policy.

12. Contact

For any question about this policy, your data, or a request to exercise your rights:

• Email: privacy@thingzapp.com
• General contact: hello@thingzapp.com