Privacy & Cookies

Data controller

The data controller is Marie Bianchi, sole trader (SIRET: [To be completed]). Privacy contact: support@chronotwin.app.

1. Zero readable user data on our servers

ChronoTwin is built around a local-first principle. Your Twin (profile, observations, trips, shift patterns, Apple Health status) is end-to-end encrypted before it leaves your device. Our servers only keep an opaque identifier and an encrypted blob (AES-GCM 256-bit) that they cannot decrypt.

2. Encryption key and pairing

The decryption key is derived from a secret phrase only you hold (PBKDF2-SHA256, 310,000 iterations). It never travels through our servers. To pair a new device, you use an ephemeral pairing code generated locally.

Three routes let you recover your Twin on a new device: your secret phrase, a pairing code (QR or copy-paste, valid for 3 minutes) from a device that is already unlocked, or an encrypted backup file you export yourself from Settings.

The backup file (.ctwin) stays encrypted with your secret phrase. You store it wherever you want (iCloud Drive, Google Drive, a password manager, a disk): neither Apple, nor Google, nor we can read it. No automatic backup is made on your behalf.

If you lose your secret phrase and no device remains unlocked, the Twin stored in the cloud and your backup files become permanently unreadable: we have no way to restore them. Local data on devices that are still unlocked remains intact, and you can always start over with a new secret phrase.

3. Identity and authentication

You may use Sign in with Apple or Google. We only receive an opaque identifier; your real name and email address are not stored on our servers (unless you choose to share your email with Sign in with Apple, in which case it remains tied to your authentication account and is not used for marketing).

4. Apple Health

On iOS, ChronoTwin only reads sleep data (sleepAnalysis) through HealthKit, with your explicit permission. The app never writes to Health. This data stays on the device or is encrypted before any sync.

5. Telemetry and diagnostics

We collect anonymised error reports to improve the app. Reports are sanitised on the device before being sent: no precise location, no personal identifier, no authentication token, no health data. You can disable this in Settings.

6. Payments

On the web, payments are handled by Stripe. On iOS, in-app purchases are handled by Apple; we only keep a subscription flag after Apple validates the receipt. We do not store or process your payment information.

7. Cookies and local storage

ChronoTwin uses no third-party cookies, no advertising cookies and no tracking pixels. The app relies on your device's local storage (localStorage) to keep: your encrypted Twin, your display and language preferences, your consent choices (telemetry, cookie banner) and an anonymous, regenerable installation identifier. This data only leaves your device in encrypted form (Twin) or anonymised form (error reports, if enabled).

8. Retention and your rights (GDPR)

The encrypted Twin is kept until you delete your account or rotate your secret phrase; anonymised telemetry logs are kept for at most 12 months. You have the rights of access, rectification, erasure, portability and objection. As your personal data is end-to-end encrypted, erasure consists of the permanent deletion of the encrypted blob, which becomes unreadable. To exercise your rights: support@chronotwin.app. You may also lodge a complaint with the CNIL.

9. Contact

For any privacy question, please reach out via the Support page.