Privacy Policy

Strat·It Last updated: May 6, 2026 Effective date: March 25, 2026

Pierre Cheneau EI (“we”, “us”, “our”) operates the Strat·It mobile application (the “App”). This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the EU General Data Protection Regulation (GDPR).

This policy describes how we handle your data when you use the App.

1. Data Controller

Pierre Cheneau EI SIRET: ___________________ Address: ___________________ Contact: [email protected]

For any questions about this policy or your personal data, contact us at the address above.

As a small business that does not carry out large-scale processing of sensitive data, we are not required to appoint a Data Protection Officer (DPO) under GDPR Article 37. All privacy-related inquiries are handled directly by the data controller at the email address above.

2. Data We Collect

2.1 Account Data (when you create an account)

• Email address — used for authentication, password recovery, and account communications.
• Display name and handle — chosen by you for community features and team identification.
• Hashed password — stored securely by our authentication provider; we never have access to your plaintext password.
• Role selection — whether you use the App as a coach or a player.

You may use the App without an account (anonymous mode) with limited features. No personal data is collected in anonymous mode.

2.2 Strategy Data

• Strategies, templates, drawings, animations, and configurations you create within the App.
• This data is encrypted with AES-256-GCM both on your device and in the cloud.

2.3 Device Information

• A device identifier derived from your platform’s vendor identifier (e.g., iOS identifierForVendor, Android device ID) combined with a timestamp, used for multi-device synchronization and session management.
• Device name, model, platform, and OS version for device management and crash diagnostics.

2.4 Usage Analytics (opt-in)

With your explicit consent, we use Firebase Analytics to collect anonymized usage data, including:

• Screens viewed and features used.
• App session duration.
• General interaction patterns (e.g., strategy creation, sharing events).

This data is aggregated and anonymous — it cannot identify you personally. You can enable or disable analytics at any time in Settings > Privacy.

2.5 Crash Reports (opt-in)

With your explicit consent, we use Firebase Crashlytics to collect crash diagnostics, including:

• Stack traces and error logs.
• Device model, OS version, and app version.
• Crash timestamps.

Crash reports never contain your strategy data, email, or any user-generated content. You can enable or disable crash reporting at any time in Settings > Privacy.

2.6 Performance Metrics (opt-in)

With your explicit consent, we use Firebase Performance Monitoring to measure app responsiveness, including:

• App start time and screen load times.
• Network request latency.
• Device model, OS version, and app version.

This data is aggregated and anonymous — it cannot identify you personally. You can enable or disable performance monitoring at any time in Settings > Privacy.

2.7 Team Collaboration Data

When you create or join a team:

• Team name — stored encrypted on our servers.
• Member information — your user ID, role within the team (owner, coach, or player), and join date.
• Cryptographic public keys — used for end-to-end encrypted strategy sharing between team members.
• Shared strategies — encrypted with a team key that only team members can decrypt.

2.8 Community Data

When you publish a strategy to the community:

• Author information — your display name and handle (visible to other users).
• Post content — strategy title, description, tags, and tactical context.
• Thumbnail image — a preview of your strategy, stored in cloud storage.
• Engagement data — reactions and view counts.

Community posts are public. Do not include personal information in your post content.

2.9 Biometric Authentication

The App supports Face ID (iOS) and fingerprint/Touch ID authentication for quick unlock. Biometric data is processed entirely by your device’s operating system and never leaves your device. We only receive a success/failure result — we never access, store, or transmit your biometric data.

2.10 Camera Access

The App requests camera access solely for QR code scanning — to scan team invitation codes and strategy sharing codes. No images or video are captured, stored, or transmitted. Camera access can be revoked at any time in your device’s settings.

2.11 Password Breach Checking

When you set a password, we check it against the Have I Been Pwned (HIBP) database using a k-anonymity protocol: only the first 5 characters of the SHA-1 hash of your password are sent to the service. Your password is never transmitted in any form.

3. How We Use Your Data

We do not use your data for advertising, profiling, or automated decision-making.

4. Consent and Privacy Preferences

On first launch, you will be asked to choose your privacy preferences:

• Usage Analytics — anonymous statistics to help us improve the App.
• Crash Reporting — error reports to help us fix issues.
• Performance Monitoring — app responsiveness metrics to help us optimize speed.

All three are disabled by default and only enabled with your explicit consent. You can change these settings at any time in Settings > Privacy. Withdrawing consent takes effect immediately.

5. Data Encryption and Security

We take security seriously:

• At rest: All strategy data is encrypted with AES-256-GCM on your device using keys stored in your platform’s secure storage (iOS Keychain / Android Keystore).
• In transit: All communications use HTTPS/TLS.
• Cloud sharing: Shared strategies use zero-trust encryption. Encryption keys exist only in the share URL fragment and are never sent to our servers. We cannot decrypt your shared content.
• Key derivation: Encryption keys are derived from your password using a memory-hard key derivation function (Argon2id) tuned to current OWASP recommendations. This design allows the same key to be recovered on any of your devices without us ever storing or seeing your password.
• Team encryption: Team strategies are encrypted with a shared team key, distributed between members using modern elliptic-curve public-key cryptography, so that only team members can decrypt them.

6. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms:

• We will notify the relevant supervisory authority (CNIL in France) within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• If the breach poses a high risk to you personally, we will notify you without undue delay via email and/or in-app notification, as required by GDPR Article 34.
• We document all breaches internally, including their nature, effects, and remedial actions taken.

The strong encryption measures described in Section 5 significantly reduce the impact of any breach, as strategy data cannot be decrypted without keys stored solely on your devices.

7. Data Sharing and Third Parties

We never sell your personal data.

We share data only with the following processors, strictly for App operation:

All processors are bound by data processing agreements (DPAs) compliant with GDPR:

• Supabase: Data Processing Addendum available at supabase.com/legal
• Firebase / Google: Google Cloud Data Processing Addendum

Where these processors transfer data to the United States, appropriate safeguards are in place through EU Standard Contractual Clauses (SCCs) as approved by the European Commission. Note that some Firebase services (including authentication) may route data through US-based infrastructure even when configured for European regions.

We have conducted a Transfer Impact Assessment in accordance with the requirements following the Schrems II ruling and are satisfied that the combination of SCCs and the technical encryption measures we employ (AES-256-GCM, zero-trust sharing) provides adequate protection for your data.

Strategy Sharing

When you share a strategy via a cloud link, the encrypted strategy data is stored on our servers. Only someone with the share URL (which contains the decryption key) can access the content. You can revoke any share at any time, and you may set expiration dates or view limits.

8. Data Retention

Anonymization of community posts

When you delete your account, your community posts are anonymized rather than deleted: your author ID, handle, and display name are permanently removed and replaced with “Former Member.” The published strategy content (which you voluntarily made public) is retained to preserve the community knowledge base, but it can no longer be linked back to you in any way. This anonymization satisfies the GDPR right to erasure, as the remaining data no longer constitutes personal data (Recital 26). If you wish to have specific community posts fully deleted before closing your account, you can unpublish them individually from within the App.

9. Automated Decision-Making

The App uses automated rules to enforce subscription tier limits (e.g., maximum number of strategies or team members for free accounts). These rules:

• Are based solely on your subscription tier, not on personal profiling.
• Do not produce legal effects or similarly significant effects on you.
• Can be changed at any time by upgrading or downgrading your subscription.

We do not use AI, profiling, or automated decision-making that would require additional safeguards under GDPR Article 22.

10. Your Rights (GDPR)

You have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate data.
• Erasure (“right to be forgotten”) — Request deletion of your account and all associated data. Contact us at the email below and we will delete your account and all cloud-stored data (strategies, team memberships, shares), anonymize your community posts (see Section 8), and confirm completion within 30 days. Local data on your device can be removed by uninstalling the App or using Settings > Data Management > Reset App.
• Data portability — Export your strategies using the App’s built-in backup feature (Settings > Data Management > Backup). Exports are provided in a structured, machine-readable format.
• Restriction — Request that we limit processing of your data.
• Objection — Object to processing based on legitimate interest.
• Withdraw consent — Disable analytics, crash reporting, and performance monitoring at any time via Settings > Privacy. For other consent withdrawal, contact us.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you believe your rights have been violated, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence. Our lead supervisory authority is the Commission Nationale de l’Informatique et des Libertes (CNIL) in France (cnil.fr).

11. Children and Young Athletes

The App is primarily designed for coaches (adults) to create game strategies and share them with their teams. We recognize that coaches work with youth teams, and players of all ages may interact with the App in the following ways:

Viewing shared strategies (no account required)

Players, including minors, can view strategies shared by their coach via a link or QR code without creating an account. In this case, no personal data is collected from the viewer. The shared content is accessed through a zero-trust encrypted link — we cannot identify who views it.

Account creation (minimum age: 13)

Users must be at least 13 years old to create an account. In countries where the digital age of consent is higher (15 in France, 16 in Germany), account creation by a minor requires consent from a parent or legal guardian, in accordance with GDPR Article 8.

By creating an account for a minor, the parent or legal guardian confirms they have the authority to consent on the minor’s behalf and accepts responsibility for the minor’s use of the App. We encourage coaches who wish to invite young players to a team to direct the invitation through the player’s parent or guardian.

Reporting concerns

We do not knowingly collect personal data from children under 13. If you believe a minor has created an account without appropriate parental consent, contact us at [email protected] and we will promptly delete the account and associated data.

12. Data Storage Location

Your data is processed and stored using the following infrastructure:

Where data is transferred outside the EU, appropriate safeguards are in place through Standard Contractual Clauses (SCCs) and technical measures (encryption). See Section 7 for details.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the “Last updated” date at the top of this page. For significant changes, we will notify you through the App.

We encourage you to review this policy periodically.

14. Contact

For any questions, requests, or concerns about this Privacy Policy or your personal data:

Pierre Cheneau EI Email: [email protected]

This privacy policy applies to Strat·It version 0.9.4 and later.