Version française · Deutsche Version · Versione italiana · Versión en español · Versão em português
PRAWND privacy policy
This is a translation. The French version is the reference and prevails in case of any difference.
Version of November 7, 2026 (translation of Ocean comments; country and time zone set on the phone).
PRAWND is a game among friends: one photo challenge a day, in a private squad of 2 to 8 people. Once a week, a shared challenge is offered to all players aged 15 and over: the Ocean. This page explains, simply, what data we keep, why, for how long, and how to delete it.
Who is responsible
Humaro Studio (humaro.fr), a non-professional publisher. Contact: contact@prawnd.app.
What we keep, and why
| Data | Why |
|---|---|
| The identifier provided by Apple or Google, or your e-mail if you sign in with a code | Signing you in. Never shown in the game; only the team sees it, in its admin tool, for support and deletion requests. We only e-mail you to send your sign-in code, once to welcome you when your account is created, and, at most once, to let you know if PRAWND can't send you notifications (without them, you miss the daily challenge). Never any advertising. |
| Your username, your avatar (an emoji and a color) | So your squad recognizes you. |
| Your year of birth (not the full date) | Checking the minimum age required by the app stores. |
| Your photos, reactions, comments, votes | The game itself. Visible only to your squad. When a player shares their squad's invitation link, the page shows, for the last round that ended, the username, avatar and aura of the members who posted, along with their blurred photos. It is visible to anyone who has the link. |
| Your Ocean photos, if you choose to play it | The Ocean challenge. Visible to all players aged 15 and over, with your username and avatar (not your squad). |
| The date you accepted the Ocean | Proving you were told that these photos are seen by everyone, with your username. |
| Your phone's notification token | Sending you the challenge of the day. |
| The times of your answers | The timer, late answers, the streak. |
| The time of your last visit, and the hours when you use the app (kept 90 days) | Knowing how many players are active and when (the details are only seen by the team). |
| The screens you open in the app and a few actions (opening the app, sharing an invite code, opening a notification), with an identifier drawn at random at install (kept 90 days) | Understanding where new players get stuck and improving the game. Stays with us: no outside analytics tool, never your photos, your messages, your location or your contacts, and we don't measure how much time you spend in the app. |
| What you write in "Give feedback", with the app version and your phone model | Reading your ideas and fixing bugs. Seen only by the team, erased with your account. |
| The country and time zone set on your phone, your phone model, its system and the app version (latest value only) | Knowing where players come from and which phones to fix bugs on. Seen only by the team, erased with your account. It's a phone setting: no GPS, no location. |
| When the app or the server crashes: a technical report (the type of error, the screen, the app version, your phone model and version), without your username, e-mail, photos or IP address (kept 90 days at most) | Finding and fixing crashes. Sent to Sentry, our error tracking tool, which keeps these reports in Europe. |
On the prawnd.app website, if you leave your e-mail to be told about the launch: your address and the sign-up date, nothing else. An e-mail first asks you to confirm your sign-up; without confirmation, we never write again and the address is erased 30 days later. It is only used to write to you about the app's launch and major new features, never for anything else, and is neither sold nor shared. Every e-mail contains a link to unsubscribe; you can also write to contact@prawnd.app. The address is erased at your request, 30 days after you unsubscribe, or at the latest 3 years after you signed up.
Cookies and audience measurement on the site. Only if you click "Accept" in the cookie banner, the site uses Google Analytics 4 to measure its traffic as statistics: pages viewed, the site or campaign you came from, type of device, and a few clicks (installing the app from the App Store, TestFlight, Google Play or the Android file, joining the testers group, signing up for the newsletter). _ga cookies kept for 13 months at most, statistics kept for 14 months. Recipient: Google Ireland Limited; data may be transferred to Google LLC in the United States, under the EU-US Data Privacy Framework (European Commission adequacy decision of July 10, 2023). No advertising, Google Signals turned off. The addresses sent to Google never contain an invitation code or a personal link, and invitation pages are never measured. Declining is as easy as accepting; your choice is kept for 6 months, and you can change your mind at any time with the "Cookies" link at the bottom of the pages. Legal basis: your consent.
Cookie-free visit statistics. The site also measures its traffic with Umami, a tool we host ourselves in France. Umami sets no cookie and assigns no identifier: it only keeps totals (pages viewed, country, type of device, the site you came from), without being able to recognize anyone. On the home page, the Android pages and the help pages, it also notes how the page is read, still without knowing by whom: time spent on the page, how far down it was scrolled, sections shown and clicks to install the app. Never in the app or on a personal page, and never what you type. The IP address is only used to work out the country and is not kept. Nothing goes to a third party, which is why it doesn't ask for your consent. It is never loaded on invitation pages. Legal basis: our legitimate interest in knowing whether the site is seen.
Visit alerts. Without any cookie or identifier, our server tells the publisher (via Telegram) when a real person looks at the site, and when they click to install the app: type of device, network operator, approximate city (worked out from the IP address on our server, with the DB-IP database, without any outside service), the site you came from and the page viewed. The IP address is neither kept nor passed on. If you decline cookies, your browser no longer reports your visits or clicks to us. Legal basis: our legitimate interest in knowing whether the site is seen; you can object by writing to contact@prawnd.app.
Where an install comes from. When you tap a prawnd.app/go link (in a bio, a video, a QR code) or the "install" button of an invitation, our server records the link's source (for example "tiktok"), the invitation code if there is one, the type of phone and a fingerprint of your IP address: a code computed from the address, which cannot be turned back into it. The address itself is never kept in plain form. When the app first opens, this fingerprint is only used to know where the install came from and to open the invitation you had received; on Android, Google Play also passes the source to the app. A click is used only once and is deleted after 7 days at most. The source (not the fingerprint) is then stored with your account, to count sign-ups by source, and deleted with it. Nothing is shared with third parties or sold. Basis: our legitimate interest in knowing which links bring players; you can object by writing to contact@prawnd.app.
Ambassadors program (ages 15 and up). If you apply on prawnd.app/en/ambassador, we keep your username (to find your account), your school, city, country and what you wrote, with the age you declared in the app. No phone number, no full name. If you're under 18, we also keep one of your parents' email address and the date they confirmed, as a record of their consent: it's only used to send them one confirmation email, never marketing. Only the PRAWND team sees applications, and we reply in the app. The application is deleted with your account, or on request at contact@prawnd.app. Basis: your request, and a parent's consent for minors.
"A question?" button. On the home page and the Android pages, this button opens WhatsApp in a new tab, with a message already started. Nothing is loaded from WhatsApp before you click. If you write to us, your number, profile name and messages are processed by WhatsApp (Meta group), with a possible transfer outside the European Union; we only use them to reply to you. The click counts like the others in the audience measurement and visit alerts above. Legal basis: your request.
No geolocation, no contacts, no access to your photo library (the camera only opens during a challenge). No advertising, no data sold or shared for commercial purposes.
Who sees what
In your squad. Your photos and comments are only visible to the members of your squad, and only after they have answered the challenge of the day themselves (or at the end of the day). These photos never leave your squad. One single exception, for safety: when someone reports a photo or a comment, the team can see that day's challenge in that squad (photos and comments) to understand the situation. Every such viewing is logged. The team also looks at usage statistics by nickname (who answered, on time or late, how many comments and reactions), never seeing a photo or the text of a comment, and has no other access to squads. When a player shares their squad's invitation link, the page shows, for the last round that ended, the username, avatar and aura of the members who posted, along with their blurred photos. It is visible to anyone who has the link.
On the Ocean (from age 15, only if you choose to). The Ocean is the only place in PRAWND where a photo is seen by people you don't know: all players aged 15 and over who played that challenge (or everyone, once the day is over). Before your first photo, the app tells you clearly and asks for your consent; on the camera screen, you are reminded every time.
- Your username and avatar are shown on your photo, without your squad. Your avatar is a drawn shrimp, never a photo of you. Pick a username that doesn't give away your real name. The app asks for your consent again before your first photo with your username.
- Back camera only, and challenges about objects or things, never about people.
- Every photo is checked by the team before it appears. It is rejected if a face, personal information (name, address, school, license plate) or anything inappropriate can be seen. A rejected photo is erased right away.
- You can delete your photo at any time, report a photo, and hide someone: you won't see their photos anymore, and they are not told.
- Comments under an Ocean photo are open to all those players, published immediately and without prior review, with your username and avatar. Before your first comment, the app asks for your consent (the date is kept); without it, you can read but not write. You can delete your own, report other people's, and delete those under your photo; they are erased if you delete your account.
- Ocean photos are erased 30 days after the challenge.
- Under-15s don't see the Ocean and cannot take part in it.
How long
Squad photos are kept for 12 months and then erased automatically. Ocean photos, 30 days. You can delete an answer at any time from the app. If you delete your account, your photos (squads and Ocean) are erased right away; your username is replaced with "compte supprimé" ("deleted account") in your squad's past games.
A deleted photo or account disappears right away from the app and from storage. Encrypted copies, unreadable without our key, may still remain in the backups (see "Where the data is"): they are erased no later than 44 days afterwards.
Where the data is
In Europe: database and photos with Supabase (Frankfurt, Germany), game server with OVH (France). Notifications go through Expo's service and through Apple or Google to be delivered. E-mail sign-in codes, the welcome e-mail and the one-time e-mail about turned-off notifications are sent by Resend. Crash reports are kept by Sentry, in Europe (Germany). The "Translate" button under an Ocean comment sends the text of that comment, already visible to all Ocean players, to DeepL (Cologne, Germany) to translate it: never your username or any other data. DeepL may keep these texts to improve its service. To follow the test, the team receives internal alerts (for example "new account: username") that never contain an e-mail, an age or a photo.
Backups. Every night, the database (without sessions or sign-in tokens) and every photo are backed up, encrypted with a key that only the team holds. These backups are kept for 14 days on our server with OVH (France): a deleted photo stays there for 14 days, encrypted, and then disappears. Also every night, an encrypted copy of these backups is made on a team server, in France: what the OVH server has erased stays there for 30 more days, and is then erased too.
Age
You must be at least 13 years old. For under-15s in France, a parent's consent is required (French law no. 2023-566): by creating your account, you confirm you have it. A parent can ask for their child's account to be deleted at contact@prawnd.app.
Report, block, delete
In the app: report a photo, a comment, a challenge suggested by a member, or a person; block someone; hide someone on the Ocean; delete your answer; leave a squad; delete your account (Account → Delete my account). Reports are reviewed within 24 hours. A challenge suggested by a member of your squad is removed as soon as it is reported.
Your rights
You can ask to access, correct or delete your data by writing to contact@prawnd.app. If you are not satisfied with the answer, you can contact the CNIL, the French data protection authority (www.cnil.fr). You can also delete your account without the app, from this page: we send you a confirmation link by e-mail.