Privacy Policy

Updated: September 20, 2026

A private exchange

Gribou is published by Alexandre LACOSTE. The app is free, with no in-app purchases, ads or tracking. It lets you exchange drawings, photos and text with friends you choose, so it needs an account and a server.

Data we process

  • Account: email address and password (stored only in hashed form), or your Sign in with Apple identifier; your device language, so we can write to you in English or French.
  • Profile: username, display name and profile photo, visible to your friends and to people who search for your exact username.
  • Creations: images, photos, text and captions you send, their recipients, replies and likes.
  • Connections: friends, requests, invitations, blocked accounts, favorites and notification preferences.
  • Device: notification token and widget access key.
  • Reports: the reason you write when you report a creation or an account.

Purposes

This data is used to provide the service (create your account, deliver your creations to their recipients only, show the widget, send notifications) and to keep people safe (handle reports, limit abuse).

Recipients and processors

Your creations are not analysed before they are sent: they only go to friends whose request you accepted, and they are never passed to a content analysis service. A creation is visible only to you and to the friends you send it to. A recipient can still save or share it, and an exported copy can’t be recalled. An administrator may view a reported creation or account to decide on a moderation action.

  • Supabase: database, file storage and authentication hosting, in the European Union (Ireland).
  • Apple: Sign in with Apple and notification delivery.

Retention

  • Account, profile and creations: as long as the account exists. A deleted creation is removed for all its recipients and its files are erased.
  • Interrupted upload: 24 hours.
  • Invitation link: 7 days.
  • Widget access key: 90 days at most.
  • Technical notification history: 30 days.
  • Reports, including their reason: 90 days.

On your iPhone, Gribou keeps a local copy of your creations and pending sends; it goes away when you sign out or delete your account or the app.

Deleting your account

In the app: Settings > Delete my account. Access to what you sent is removed immediately, then the server erases your files and your account and revokes Sign in with Apple authorization if you used it. Reports already filed are kept without any link to your account until they are erased at 90 days.

Your rights

You can ask to access, correct, erase or port your data, or object to its processing, by writing to lacoste.alexandre.pro@gmail.com. You can also contact the CNIL or the data protection authority in your country.

Publisher and contact

Publisher: Alexandre LACOSTE. If you email us, your address and message are used only to reply and are kept for as long as it takes to handle your request. Any change to these practices will appear in an updated version of this policy and, if significant, will be announced in the app.