1.Who we are
Youoki is a private messaging app designed for families. The data controller for your personal data is the publisher of the Service: Samir MRABET, sole proprietor (business name FIBERMS) (see the legal notice).
This policy explains, in plain language, what data we process, why, and what your rights are.
2.Our principle: minimum data
We collect only what is necessary for the Service to function. You can use Youoki with just a username, without providing an email address or phone number.
3.Data we collect
Account data
- Username (required) and display name
- Email address and phone number (optional — useful for password recovery)
- Password, stored only in encrypted form (hashed with Argon2) — never in plain text
- Year of birth for a child account only, entered by the parent when the accounts are linked — we never ask for your age when you sign up
- Birthday (day and month), if you choose to provide it for reminders
- Profile picture, if you add one
Content you exchange
- Messages, photos, videos, voice messages, documents
- Reactions, favorite messages, drafts
Relationship data
- Your contacts, friends, and groups within Youoki
- Your referral code and associated invitations
Location data
- Only if you voluntarily enable location sharing in a conversation. Disabled by default.
Technical data
- IP address, device type and operating system
- Active sessions (device, date, connection)
- Technical logs and error reports
Usage data
- Badges obtained, balance and history of Points
- Activity statistics (number of messages, active days, etc.)
- Games played, scores, rankings, tournaments and Points stakes
Everyday apps
- Notes, lists, calendar events, albums and memories, polls, shared expenses and money pots, recipes, birthdays
- This content is stored on our servers and protected by transport encryption; it is not end-to-end encrypted
Parental controls (linked accounts)
- The child's live location and location history
- Safe zones and entry or exit events
- Battery level and connection status of the device
- Activity log within Youoki (last connection, usage time, services opened) — never the content
- Restrictions set by the parent, and SOS alerts
Assistance features (only at your request)
- When you tap "Translate", "Transcribe" on a voice message, or when you play Petit Bac, the text of the message (or the audio of the voice message) is decrypted on your device and then transmitted unencrypted to our servers and to our artificial intelligence provider in order to produce the translation, the transcription or the refereeing decision.
- The audio is never retained. The text of a transcription is saved with the message so that it does not have to be computed again.
Link previews
- When a message contains a link, our server may visit it in order to display a preview (title, image). The server then sees the address of the link, not the message.
Phone contacts (Android, optional)
- If you allow it, Youoki adds "Youoki call" actions to the entries in your address book and matches your Youoki friends to your contacts by phone number.
- This processing takes place solely on your device: your address book is never transmitted to our servers.
Notifications
- Notification tokens (Firebase on Android, APNs and PushKit on iPhone, Web Push in the browser), deleted when you log out or delete your account
Security and anti-abuse
- Log of friend requests, failed login attempts
- Anti-bot token (Cloudflare Turnstile) at sign-up
- IP address and approximate location of sessions
4.Why we use it
- Provide the Service (account, messages, calls, groups, everyday apps, games, Points) — legal basis: performance of the contract.
- Location sharing (between friends or within parental controls), access to contacts, camera, microphone and photos — legal basis: your consent, which you give through your device permissions and the app settings, and which you can withdraw at any time.
- Assistance features (translation, transcription, game refereeing) — performance of the contract, triggered only by your explicit action.
- Security and anti-abuse (protection against password stuffing, against bots, prevention of Points fraud) — legal basis: legitimate interest. Accounts that reach certain limits are flagged for human review; no sanction is automated.
- Allow you to recover your access (email, SMS, validation by trusted contacts) — performance of the contract.
- Communicate with you about how the Service works (notifications, support) — performance of the contract.
- Improve reliability (error reports, monitoring) — legitimate interest.
- Retain certain identification and connection data — legal obligation (French LCEN law and decree no. 2021-1362).
We do not use your data for advertising purposes and we do no advertising profiling.
5.End-to-end encryption
Encryption uses the X25519 (key exchange) and AES-256-GCM (encryption) standards. A backup of your keys, itself encrypted with your password, allows you to recover your history on a new device — we cannot decrypt it.
In a group, each message is encrypted with a unique key, wrapped for every member. If a member does not yet have an encryption key (application too old), the message is sent with transport encryption only so that nobody is left out; a padlock indicates the status of each conversation.
The following remain readable by our servers: routing metadata (who exchanges with whom, and when), the @ mentions of a member, the captions of media sent in a group, and the content you voluntarily submit to the assistance features.
One-to-one calls use DTLS-SRTP. Calls with three or more participants go through our own relay server, which we host ourselves and which routes the streams without recording them.
6.Who your data is shared with
We do not sell or rent your data. We use a limited number of technical service providers (processors), strictly to operate the Service:
- Contabo GmbH (Munich, Germany) — server hosting, storage of media and backups, call relay server
- Cloudflare, Inc. (United States) — domain name, website protection, anti-bot verification (Turnstile) at sign-up, distribution of installation files
- Google LLC — Firebase Cloud Messaging (United States) — Android and browser push notifications
- Apple Inc. — APNs and PushKit (United States) — push notifications and call signalling on iPhone
- Twilio Inc. (United States) — recovery and verification SMS
- Resend, Inc. (United States) — transactional emails
- Functional Software, Inc. (Sentry) — error reports, on its European infrastructure (Frankfurt)
- OpenAI, L.L.C. (United States) — transcription of voice messages, only at your request
- Anthropic, PBC (United States) — translation of messages and refereeing of the Petit Bac game, only at your request
The relay server for group calls (LiveKit) is software that we host ourselves on our servers: it is not a third-party provider.
These providers only have access to the data necessary for their task and are bound by confidentiality. We may also be required to disclose data upon a lawful request from a competent authority.
7.Transfers outside the European Union
Your data is hosted and backed up within the European Union. Push notifications, SMS, emails, anti-bot verification and the assistance features do, however, involve US-based providers.
These transfers rely on the "EU-US Data Privacy Framework" adequacy decision where the provider is certified under it, and on the European Commission's standard contractual clauses in every case. You can obtain a copy of these safeguards on simple request.
8.Data retention period
- Account and content: for as long as your account is active.
- Account deletion: your profile is pseudonymised and your personal data erased immediately. The messages you have sent remain with their recipients (article 17.3.b of the GDPR).
- Identification data and connection logs: kept in a restricted-access area for the sole purpose of responding to judicial requests, for the periods imposed by decree no. 2021-1362 (1 year for connection data, 5 years after the account is closed for identity data).
- Live location (sharing between friends): in memory only, erased when sharing stops or when you log out.
- A child's location history, zone events and activity log: 30 days on a rolling basis, and deleted immediately if the parental link is removed.
- Sessions and connection tokens: until revoked, and at most 30 days without use.
- Notification tokens: until you log out or delete your account.
- History of Points, stakes and referrals: for the lifetime of the account (necessary for the balance of the economy and for fraud prevention).
- Technical server logs: 12 months maximum.
- Error reports: 90 days.
- Backups: database 7 days locally and 30 days off site; media synchronised daily, deleted files purged within 30 days.
- Reports: 12 months after closure (5 years where a sanction is applied).
9.Your rights
In accordance with the General Data Protection Regulation (GDPR), you have the following rights:
- Access: know what data we hold about you
- Rectification: correct inaccurate data
- Erasure: delete your account and your data
- Portability: export your data
- Objection and restriction: object to certain processing
- Withdrawal of consent: at any time, by turning off the permission concerned (location, contacts, camera, microphone)
- Post-mortem directives: decide what happens to your data after your death (article 85 of the French Data Protection Act, loi Informatique et Libertés)
- Automated decision-making: not to be subject to a fully automated decision — we take none
You can exercise most of these rights directly in the application: Account → Privacy lets you export your data or delete your account (your password is requested, and the operation is irreversible). On Youoki Web, it is under Settings → Security. For any other request, write to us at [email protected].
We reply within one month (extendable by two months for complex requests) and may ask you to confirm your identity, for example from your logged-in account. The data controller is Samir MRABET, publisher of Youoki.
If you believe your rights are not being respected, you can file a complaint with the French National Commission for Data Protection (CNIL) — cnil.fr.
10.Children and Youoki
Youoki accepts users from the age of 13, with a parent's authorisation up to and including the age of 15. Below that age, a child may only use Youoki under the responsibility of a parent who links their account to their own. In France, processing the data of a minor under 15 requires the consent of a holder of parental authority.
Linked accounts benefit from the parental controls described in the Terms (location, safe zones, device status, activity log, restrictions, SOS): the parent never sees the content of their child's messages, calls, notes or memories. This data is retained for 30 days and deleted as soon as the link is removed.
If you are a parent and notice that a child has created an account without your consent, contact us at [email protected]: we will proceed to delete the account and associated data.
11.Cookies and trackers
The website and application use no advertising cookies or marketing trackers. Only data strictly necessary for operation is used (authentication, session maintenance, language and appearance preferences). No consent banner is therefore required.
Two exceptions to be aware of: at sign-up, the Cloudflare Turnstile anti-bot module may set a technical security cookie; and the pages of this website load the Inter typeface from Google Fonts, which transmits your IP address to Google when the page is displayed. We plan to host this typeface on our own servers in order to remove that transfer.
12.Security
We implement technical measures to protect your data: end-to-end encryption of private and group conversations, hashed passwords, encrypted connections (HTTPS/WSS), protection against intrusion attempts, and regular backups. Since no system is foolproof, we encourage you to choose a strong password and keep it secret.
13.Changes
This policy may be updated to reflect changes in the Service or regulations. The date of last update appears at the top of the page. In case of significant change, we will inform you via the application.
14.Contact us
For any questions regarding your personal data, write to us at [email protected].