Privacy Policy

This is an English translation of the French Privacy Policy, provided for convenience. If the two versions differ, the French version prevails.

What changes in version 1.3: on iPhone, Plumi now also measures its Apple Ads campaigns (section 3.5). The result is linked to your account, and this measurement happens whether or not you accept Apple's tracking request. It has been running since November 6, 2026, with version 1.16.0 of the app. Sections 3.2, 3.3, 5, 6, 7 and 8 have been updated accordingly. Version 1.3 also corrects the account deletion description (sections 6 and 9): deletion is immediate. The previous version mentioned a 30-day grace period that does not exist in the app.

What we want to tell you plainly

Plumi is a companion. For that companion to be there for you, we need to keep a few pieces of information about you. We keep them carefully. We don't sell them. We don't use them to train artificial intelligence. We give them back to you, delete them, or show them to you, whenever you ask.

This document explains exactly what we do, how, and why. It is long because it needs to be. We tried to write it the way we talk.

1. Who we are

Plumi is published by Windfall, a French simplified joint-stock company (SAS), SIREN 879 950 202, with its registered office at ESPACO, 20235 BISINCHI, France. EU VAT number: FR80 879 950 202.

For any question about your data or to exercise your rights: apps.windfall@gmail.com.

Windfall is the data controller within the meaning of Article 4 of the General Data Protection Regulation (GDPR).

2. Who Plumi is for

Plumi is for adults only (18 and over). When you sign up, we ask you to confirm your age. If we learn that a minor is using Plumi, their account is deleted without delay and all their data is erased.

Plumi is an emotional companion. It is not a healthcare professional, not a psychologist, and not an emergency service. Plumi's replies do not replace medical, psychological or psychiatric care.

3. The data we collect

3.1 What you give us

When you create your account:

• Your first name (or the name you choose)
• Your email address (via Sign in with Apple, Google, or a code sent by email)
• Your age range (18 to 24, 25 to 34, 35 to 44, 45 to 54, 55 and over), asked at sign-up: it confirms that you are an adult and tells us, in aggregate, who uses Plumi. Never your date of birth.
• Your usage preferences (how often you get messages, when you can be contacted, the name you give your companion)

When you talk to Plumi:

• The content of your entries (the messages you write, and what you say by voice, once transcribed)
• The replies Plumi gives you
• When you open the app, come back, and leave

When you answer the welcome questions, if you don't skip them:

• How many hours you usually sleep, and how your mind feels at bedtime
• What you would like to have moved forward on in a month, picked from a list or in your own words
• Your bedtime, so Plumi shows up at the right moment

When you do the evening ritual:

• The image you choose for your day, and the times of your rituals
• What you did, what weighed on you, and what you have to do tomorrow
• The reminders you ask for. If you ask for one about an appointment or an event, the notification may name it. It goes through Apple or Google, like any notification.

3.2 What the app records automatically

• A technical identifier for your account (UUID, not linked to your public name)
• Device type (iPhone, model, iOS version)
• Device language, time zone
• Diagnostic data if the app crashes (via Sentry)
• Usage metrics to improve the product (via Amplitude). They are pseudonymous: linked to an account identifier, not to your name. They may include the image chosen for your day, the goal picked from the list, and a bedtime range. We never send the content of your entries, Plumi's replies, or your first name.
• A few measurement events sent to Meta, to know whether our campaigns introducing Plumi reach the right people: install, sign-up, first entry, purchase (amount and currency). Never your words, never your first name, never your email. See section 3.5.
• On iPhone, the result of the Apple Ads measurement: whether or not your install came from one of our campaigns, and which one. It is linked to your account. See section 3.5.

3.3 What you can choose to give us in addition

If you grant the permission:

• Apple's tracking request, on iPhone. If you accept it, your phone's advertising identifier (IDFA) is shared with Meta to link your install to the campaign through which you discovered Plumi. If you decline, Plumi works exactly the same, and Meta measurement goes through Apple's aggregated system (SKAdNetwork), without an identifier. This choice has no effect on the Apple Ads measurement described in section 3.5, which does not use this identifier.

3.4 What we don't collect

• No precise location
• No contacts
• No access to your photos
• No stored recording of your voice. If you allow the microphone, your voice passes live through our server to Mistral AI, which transcribes it. We keep the text, not the audio. Without voice input, the microphone is never used.
• No connection to Apple Health or to a watch. What you say about your sleep or your health, you say yourself, and we treat it as sensitive data (section 4).

3.5 Measuring our campaigns

So that Plumi can meet the people it can help, we present it on Facebook and Instagram, and we may also present it in the App Store with Apple Ads. To know whether these campaigns are useful, we measure them. The two measurements don't work the same way.

With Meta. The app includes Meta's measurement tool, and our server confirms sign-ups and purchases to it.

What Meta receives: the fact that an install, a sign-up, a first entry or a purchase took place, the amount and currency of a purchase, a hashed identifier of your account (unreadable as is), and, only if you accepted it on iPhone, your phone's advertising identifier. On Android, the Google advertising ID is used by this tool; you can reset or delete it at any time in your Android settings (Privacy, then Ads).

What Meta never receives: your entries, Plumi's replies, your first name, your email, your companion's name.

With Apple Ads, on iPhone only. During your first openings of the app (three attempts at most, over three days), Plumi asks your iPhone for an attribution token and sends it to Apple, which replies whether your install came from one of our Apple Ads campaigns. This happens for every iPhone install, including on the first opening after updating to version 1.16.0, whether or not you saw a campaign. It doesn't depend on your answer to Apple's tracking request: this flow does not use the advertising identifier (IDFA). It does not exist on Android.

What we keep: the result is saved on your profile, so it is linked to your account. If your install did not come from a campaign, we keep that answer and its date. If it did, we also keep the identifiers of the campaign, ad group, keyword and ad, the conversion type (a download, for example), and Apple's full response, which may add the campaign's country, the ad placement, and the date of the click or impression. The keyword is the one we chose for the ad, such as "sleep". It isn't necessarily what you typed.

Who else receives it: Amplitude receives the answer, the campaign, ad group and keyword identifiers, the conversion type and the attempt number. RevenueCat also receives the token, to link our campaigns to subscriptions.

What Apple, Amplitude and RevenueCat never receive in this measurement: your entries, Plumi's replies, your first name, your email, your companion's name.

If you don't want this link with your account, write to us at apps.windfall@gmail.com: we will erase this result from your profile.

Plumi shows no ads and sells nothing to anyone. These measurements are used only to know where to present Plumi.

4. Sensitive data

Plumi is a space where you can talk about what weighs on you. Some of what you share may be considered sensitive data within the meaning of Article 9 GDPR (in particular anything relating to your mental health or your intimate life).

We know this data deserves stronger protection. Here is what we do in practice:

• Legal basis: your consent, given at sign-up and each time we ask you to grant a permission. You can withdraw it by deleting your account.
• Minimization: Plumi never asks you to say more than you choose to share.
• Confidentiality: access to your entries is strictly isolated. See section 7.
• Crisis detection: Plumi can detect certain serious signals (suicidal ideation, violence, immediate danger) and immediately points you to the right professional resources (in France: 3114, 3919, 15, 17). The log of these detections is hashed and does not contain the text of your messages.

The crisis safety net evaluation set. To check how reliable this detection is, we copied in plain text part of the entries dated August 31 to November 4, 2026: messages flagged as at risk or containing certain words, and twenty randomly drawn messages each day, usually with the five previous exchanges. Your identifier is replaced by a fingerprint. Plumi's founder reviewed part of them to label them, and these messages were analyzed by Mistral AI. From September 25 to October 6, 2026, entries were also sent to OpenAI for this test. This copying stopped on November 5, 2026. Nothing more is added. Messages already copied are erased if you delete your account.

5. Why we process your data

We process your data for the following purposes:

Your entries are never used to train artificial intelligence models. Not by Plumi, and not by our sub-processors (see section 8).

6. How long we keep your data

• Account and entries: as long as your account exists. The raw text of your entries stays about 7 days in their working space, then they are archived with their summary.
• After account deletion: your account and your data are erased immediately, with no grace period and no way back. We ask Amplitude and RevenueCat to erase it at the same time, and they process it on their side.
• Crisis detection logs (hashed, no content): 6 months, then automatic deletion.
• Crisis safety net evaluation set: until it is deleted or until your account is deleted. Its retention period is still to be set; we will state it here.
• Technical logs (Sentry, Amplitude): 90 days maximum.
• Campaign measurement events (Meta): Windfall does not keep them; on Meta's side, they are governed by the Meta Business Tools Terms.
• Apple Ads measurement: the result stays on your profile as long as your account exists and goes with it. At Amplitude, it follows the technical log retention above. When you delete your account, we ask Amplitude to erase it and RevenueCat to delete your record. On Apple's side, it is governed by the Apple Ads terms.
• Billing data (if you ever pay for a paid service): 10 years, a legal tax obligation.
• Contact data (emails you send us): 3 years after the last exchange.

7. Who has access to your data

Entries are stored encrypted at rest (AES-256) in our database hosted in France (Paris). Access is controlled by row-level security rules (Row Level Security). Technically, each entry can only be accessed from your authenticated identifier.

Exceptional human access to your entries can only happen in three cases:

1. You asked for it, for example by joining a voluntary review circle with your explicit consent, or by reporting a bug to be fixed.
2. Legal obligation (court order): in that case, we inform you unless the law forbids it.
3. The crisis safety net evaluation set, partly reviewed by Plumi's founder to label these messages (see section 4). This copying has been stopped since November 5, 2026.

Usage metrics (Amplitude) are filtered in the app so they never transmit the content of your entries, your first name or your email. The same rule applies to measurement events sent to Meta: no content, no first name, no email, a hashed account identifier. And to the Apple Ads measurement: no content, no first name, no email, with a result linked to your account (section 3.5).

8. The sub-processors we use

To run Plumi, we rely on a few technical partners. Each is bound by a Data Processing Agreement and by our privacy policy.

Transfers outside the European Union

Some of our sub-processors are located in the United States. These transfers rely on the European Commission's adequacy decision of July 10, 2023 (EU-US Data Privacy Framework), supplemented by the European Commission's Standard Contractual Clauses (SCCs). We have documented a transfer impact assessment (TIA) for each. You can ask us for a copy of this documentation.

Your email is never sent to Anthropic or Mistral AI in the content of prompts, and we use a pseudonymized identifier. Your first name, however, may appear there, so that Plumi can call you by your name. Your entries contain whatever you write in them.

9. Your rights

The GDPR gives you several rights over your data. For each of them, you can contact us at apps.windfall@gmail.com or directly from the app settings.

• Right of access: know what data we hold about you, and receive it. Response time: 1 month maximum (8 days for health data).
• Right to rectification: correct what is inaccurate.
• Right to erasure ("right to be forgotten"): delete your account and all your data. A button is available in the app settings. Erasure is immediate. The steps, including without access to the app, are described on the page Delete your account and your data (in French).
• Right to restriction: ask us to suspend processing in certain cases.
• Right to data portability: get your data back in a readable format (JSON).
• Right to object: object to certain processing based on legitimate interest.
• Right to withdraw your consent at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint with the CNIL (French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or via www.cnil.fr. You may also contact the data protection authority of the country where you live.

10. Security

We implement technical and organizational measures to protect your data:

• Encryption at rest (AES-256) of the database
• Encryption in transit (TLS 1.3) for all communications
• Strong authentication (Sign in with Apple/Google or a code sent by email)
• Strict isolation per user identifier (Row Level Security)
• Logging of administrative access
• Separate development and production environments
• Robust password policy for Windfall access
• Ongoing security training

In the event of a data breach likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours and inform you directly if the risk is high.

11. Cookies and trackers

The Plumi app does not use cookies within the meaning of the ePrivacy Directive. It uses technical identifiers that are strictly necessary for authentication and synchronization, exempt from prior consent under Article 82 of the French Data Protection Act (loi Informatique et Libertés).

Our website uses audience measurement tools (Google Analytics, PostHog) and the Meta pixel, only if you accept them in the consent banner shown on your first visit. Without your consent, only strictly necessary technical cookies are set.

12. Changes to this policy

We may need to change this policy (changes to the product, the law, or our partners). In the event of a substantial change, we will notify you by email and/or by an in-app notification, at least 30 days before it takes effect. You will then be able to withdraw your consent or close your account.

13. To finish

If you have a question, a doubt, a concern: write to us at apps.windfall@gmail.com. We read. We reply.