UsPrivacy Policy
Who we are
Us (“the app”) is published by Workplay (“we”). This policy explains what data the app processes, why, and your rights. Questions: contact@us-app.link.
What we collect
| Data | Why |
|---|---|
| Account: your Apple ID identifier, the name you enter, and your email if you choose to share it through Sign in with Apple. | Create and secure your account. |
| Couple: the link between your account and your partner's, the invitation code, your couple's language. | Show shared items to both partners and no one else. |
| Content you share: links, page text we fetch from those links, screenshots, PDFs, notes, and the information extracted from them (title, price, dates, features). | Build the Decision Cards. Read once to be processed, then encrypted toward your phones: the server keeps no copy. |
| Votes and decisions: your ❤️ 😐 ❌ votes, chosen and eliminated options, and the preferences Us learns from them (for example “you prefer direct flights”). | Show where you agree and improve future suggestions for your couple. Exchanged between your phones in encrypted form; the server cannot read them. |
| Device: a push notification token and your app language. | Notify you when your partner shares or votes. |
| How the app is used: usage events — opening the app, opening the shares pile, a vote, a share created, a match, a question asked — each with its date, your couple and member identifiers, and where the gesture came from. Never the content of what you share: no title, no link, no text, no first name. | Understand what helps and what gets in the way, so we can improve the app. |
| Technical logs: IP address, request timestamps, error traces, kept for up to 30 days. | Keep the service running and secure. |
We do not collect your contacts, your location, or advertising identifiers. There are no ads and no third-party analytics in the app: the usage measurement above is our own, and it stays on our servers — it is never sent to anyone else.
AI processing
Us uses Anthropic (Claude models) and OpenAI as AI service providers to read what you share and build your Decision Cards. They act as our processors, under terms that forbid using your data to train their models. Only what is needed for a given task is sent, never your name, and nothing is sent when you do not share, write or ask anything. These providers are established in the United States, so this processing takes place outside the European Union.
Who can see what
- Shared items are visible to both members of your couple.
- Private items (gift ideas, private notes) are visible only to you.
- Nothing is public, and we never sell or rent personal data.
- Service providers with access to data: our hosting provider (servers located in France, European Union) and our AI service providers for content analysis.
Storage and security
Our servers are in France. Connections are encrypted (TLS), access is restricted to authenticated members of your couple, and sessions use short-lived tokens. Your history itself does not live on our servers: it lives on your phones and in their iCloud backup, and what passes through the server passes encrypted, as the next section explains. Files you share are encrypted before they leave your phone.
End-to-end encryption
Us is built so that your phones hold your data and our servers cannot read it.
- How it works. Each phone holds a key pair, and the two keys of a couple derive a shared key that never leaves the phones. Everything your phones exchange — a share, a vote, a message, an appointment, a file — travels through our server as an encrypted envelope, which the server keeps only until every device of the couple has fetched it, then deletes (thirty days at most if a device never comes).
- What the server stores. Your account and the way you sign in, your public key, which couple you belong to, your devices' push tokens, the envelopes waiting to be fetched, your couple's time zone and the hour of its evening digest. Nothing a couple wrote.
- What the AI sees. A share is sent once, in clear, to be understood: the text of the page, your screenshots and PDFs. The result goes back to your phone and nothing is kept. The same holds for a question to « ✦ Vous » and for the household memory: your phone sends what is needed, and the server keeps none of it. A share sent from the Chrome extension or the Mac app is read by the server for as long as it takes to process it, then encrypted toward your two phones; it is never stored.
- What it means for you. Since the server keeps nothing, it has nothing to give back: your history lives on your phones and in their iCloud backup. A lost phone is recovered from the backup or from your partner's phone. If both phones and both backups are lost, the history is lost with them.
Retention
- What the server holds about you — your account, your public key, your devices, the envelopes waiting to be fetched — is kept for as long as your account exists. Your history is on your phones, not on the server.
- When you delete your account (Profile → Delete my account), your account, private items, device tokens and sessions are deleted immediately. Shared decisions remain visible to your partner, with your name removed, because they belong to the couple.
- If both partners delete their accounts, all couple data is deleted.
- Usage events are deleted automatically after 400 days.
- Backups are rotated within 30 days.
Your rights
Under the GDPR you can access, correct, export or delete your data, and object to or restrict processing. Most of this is available in the app (edit your name and preferences, delete items, delete your account). For anything else, write to contact@us-app.link. You may also lodge a complaint with the CNIL (France) or your local data protection authority.
Children
Us is intended for adults. We do not knowingly collect data from anyone under 16.
Changes
We will post any changes to this policy on this page and update the date above. Significant changes will be announced in the app.