InDevo
InDev'O
← Back to 12 Testers

Privacy Policy – 12 Testers

Version 2.0 – April 7, 2026

Introduction

This Privacy Policy describes how Indevo (hereinafter "the Publisher", "we", "our") collects, uses, stores, and protects the personal data of users of the 12 Testers mobile application (hereinafter "the Application").

This policy complies with the General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679 – and applicable French data protection laws (Loi Informatique et Libertés).

By using 12 Testers, you agree to the practices described in this policy.

1. Data Controller

The data controller is:

Indevo
Auto-entrepreneur (sole proprietorship)
SIRET: 93806683400020
Website: https://indevo.fr
Email: [email protected]

2. Data Collected

We collect the following categories of data:

2.1 Identification Data (via Google Sign-In)

  • Name (Google displayName)
  • Google email address
  • Google profile picture (URL)
  • Google identifier (googleId)

2.2 Profile Data

  • Username chosen by the user
  • Cheese credit balance

2.3 Usage Data

  • Registered applications (name, package, Play Store link)
  • Test campaigns created
  • Tests performed on other applications
  • Cheese transaction history
  • In-app purchases (Google Play Billing)

2.4 Technical Data

  • FCM token (push notifications)
  • Platform (Android)
  • Device identifier

3. Purpose of Processing

Your data is processed for the following purposes:

  • Authentication: secure login via Google Sign-In
  • Service operation: managing test campaigns, Cheese credits, notifications
  • Communication: push notifications related to your activity (tests, expirations, purchases)
  • Advertising: displaying ads via Google AdMob (subject to your consent)
  • Service improvement: anonymized usage statistics

4. Legal Basis

Processing of your data is based on:

  • Contract performance (Article 6.1.b GDPR): necessary to provide the service
  • Consent (Article 6.1.a GDPR): for push notifications and personalized advertising
  • Legitimate interest (Article 6.1.f GDPR): for security and service improvement

5. Data Retention

  • Account data: retained as long as the account is active
  • Transaction data: retained for 3 years after last activity
  • Device tokens: deleted after 30 days of inactivity
  • Session tokens: deleted upon expiration (7 days for refresh token)

Upon account deletion, your personal data is erased within 30 days. Anonymized statistical data may be retained indefinitely.

6. Data Sharing

Your data may be shared with the following third parties:

  • Google (Authentication): Google Sign-In for secure login
  • Google (Firebase Cloud Messaging): push notification delivery
  • Google (Play Billing): in-app purchase processing
  • Google AdMob: ad display (subject to UMP consent)

We never sell your personal data to third parties.

7. International Data Transfers

Your data is primarily hosted on servers located in France / European Union.

Some of our service providers (notably Google) may process data in the United States. These transfers are governed by:

  • The EU-US Data Privacy Framework, under which Google is certified
  • Standard Contractual Clauses (SCCs) adopted by the European Commission
  • Supplementary measures in accordance with EDPB recommendations

You may obtain a copy of the appropriate safeguards by contacting us.

8. Security

We implement appropriate technical and organizational measures to protect your data:

Technical measures

  • HTTPS/TLS encryption for all communications
  • JWT token authentication with rotation and revocation
  • Secure token storage (Expo SecureStore)
  • Rate limiting on sensitive endpoints
  • Password-protected database
  • Environment separation (development, production)

Organizational measures

  • Data access limited on a need-to-know basis
  • Incident response procedures

9. Your Rights

Under the GDPR and the French Data Protection Act (Loi Informatique et Libertés), you have the following rights:

  • Right of access: obtain a copy of your personal data
  • Right to rectification: correct inaccurate data
  • Right to erasure: request deletion of your data
  • Right to portability: receive your data in a structured, machine-readable format
  • Right to object: object to the processing of your data
  • Right to restriction: request limitation of processing
  • Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of prior processing

10. How to Exercise Your Rights

By email

Send your request to: [email protected]

Please include:

  • Your identity (username, account email)
  • The right you wish to exercise
  • Any information that will help us process your request

Response time

We will respond to your request within one month of receipt. This period may be extended by two months for complex requests, in which case we will inform you accordingly.

Complaint to the CNIL

If you believe your rights are not being respected, you may file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL):

CNIL
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07
www.cnil.fr

11. Cookies and Local Storage

12 Testers is a mobile application and does not use cookies in the traditional web sense. However, we use similar technologies on your device:

11.1 Local storage

We use your device's local storage for:

  • SecureStore: securely storing authentication tokens (JWT, refresh token)
  • AsyncStorage: storing your preferences and session state

11.2 Technical identifiers

We use identifiers for:

  • FCM token: push notification delivery via Firebase Cloud Messaging
  • JWT tokens: authentication and session management

11.3 Advertising

The Application displays advertisements via Google AdMob. This service may use advertising identifiers to personalize ads.

You can:

  • Disable ad personalization in your device's settings
  • Reset your advertising identifier

12. Children

12 Testers is intended for users aged 13 years and older. Users under 18 must have parental or guardian consent.

We do not knowingly collect personal data from children under 13. If we discover that a child under 13 has registered, we will promptly delete their account and associated data.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at [email protected].

13. Policy Changes

We may update this Privacy Policy at any time. Significant changes will be communicated to you by:

  • In-app notification
  • Email if necessary

The date of the last update is indicated at the top of this page. Continued use of the Application after changes are posted constitutes your acceptance of the revised policy.

14. Contact

For any questions regarding this privacy policy:

Indevo
Email: [email protected]
Website: https://indevo.fr