Privacy Policy

At Adagely, we place the utmost importance on protecting your personal data. This privacy policy informs you, in accordance with the General Data Protection Regulation (GDPR — Regulation EU 2016/679) and the French Data Protection Act (loi Informatique et Libertés), about how we collect, use, and protect your data, and about the service providers that process it on our behalf.

1. Data controller

The data controller for data collected via the website adagely.com and the Adagely application is:

Slifer Solutions has not appointed a Data Protection Officer (DPO) due to its size and the nature of its activities. For any questions regarding your data, please contact us directly at the address above.

2. Data collected

Depending on how you interact with our services, we collect the following data:

2.1 Newsletter registration

• Email address
• Language of the form (English or French)
• Date and time of registration
• GDPR consent (timestamped)

By signing up, you agree to receive from us, by email: a welcome message, then the Adagely newsletter: editorial content about quotes (the story behind a quote, a misattribution) and news about Adagely. You can withdraw this consent at any time with the unsubscribe link included in every email, or by writing to hello@adagely.com.

2.2 Website browsing

• Display preference (light/dark theme), stored locally via localStorage— never transmitted to our servers
• Website audience measurement, without cookies and without storing anything on your device: your browser only sends our server the pages viewed (page address, the name of the site you came from, without the full address of that page, and, if the link you followed contains them, the campaign parameters utm_source,utm_medium and utm_campaign) and a few anonymous events (newsletter sign-up, with the form location, the language and the same origin information; click to Google Play or the app's web version, with its location; steps of the interactive demo). Our server passes this audience measurement on to PostHog (EU instance) without your IP address or email address, with a technical identifier recomputed every day, which cannot recognise you from one day to the next. The website's security events, a separate stream, do include the IP address (see “Website security” below).
• Like any web host, Railway processes your IP address to deliver the pages to you and in its technical logs.
• Website security: every request to the website is recorded in our host's technical logs (30 days; a private archive keeps them for at most 90 days after the date of the request: see 4), with the IP address, the browser used, the address called and the result. We analyse these logs every day to detect attacks and abuse (automated scans, refused or abusive requests: too many requests, invalid request, forbidden access); only IP addresses under watch for hostile behaviour are examined one by one, the rest is only counted. The content of the forms you send (e-mail, message) is not part of these records; the text of a search, however, is part of the address called (see below); in the private archive, on the other hand, only the path and the names of the parameters of the address are kept, never their values. The website also records certain security events itself: a request from an unauthorised origin, a request limit exceeded (forms, search), a form filled in by a robot (honeypot field), an oversized request. Each event includes the IP address, the browser (user agent), the path of the page, the method and the result, never the content of the form, the email address or the text of a search. It is written to our host's logs and sent to PostHog (EU instance), which keeps it for 12 months (see 4).
• Searching the catalogue: the text you type is sent by our server to OpenRouter, which has it classified by TypeSafe's Jev model (an author? a theme? a situation?) to find the matching quotes. It is tied to no identifier and not stored in our database; like any page address, it appears in our host's technical logs. Our audience measurement only counts categories (for example "theme: courage") and the number of results, never the text. Please avoid typing personal information.
• Reporting an error on a quote: the kind of error, your message, the page concerned and, if you give it, your email address are sent to us by email (through Brevo) so we can correct the entry and reply to you. Nothing is stored on the website; the message is kept in our mailbox (hosted by Hostinger) while we handle it, then deleted at the latest one year later.

2.3 Use of the mobile application

The Adagely application is intended for people aged 16 or over. When you create an account and use the application, we process:

• Account data: email address and account identifier. If you sign up with an email address, your password is handled exclusively by our authentication provider (Clerk): we never have access to it. If you sign in with Google or Apple, that provider sends us, via Clerk, your email address and, depending on your settings, your first name, last name and profile picture; your first name is stored in your account. Your email address is also used to send you two service messages, with no advertising: a welcome email when you create your account and a confirmation after it is deleted.
• Preferences and settings: language, theme, reminder time, interests, answers given during onboarding (reactions to quotes, chosen keywords, personal commitment), your artificial intelligence choices and the history of those choices.
• Your content: daily mood, daily journal entries, share messages, accepted challenges, reactions and free-text entries written in journeys, end-of-journey notes, and the journey summaries generated for you.
• Your activity: quotes viewed, liked or shared (with their date), journey progress.
• App audience measurement (PostHog): usage events (screens viewed, actions taken, onboarding choices, language, reminder time, chosen journeys) and device characteristics (model, manufacturer, operating system, app version, language, time zone, screen size). These events are tied to a random identifier that is not linked to your account. Neither your journal text nor your mood is included. If you answer a short optional questionnaire shown in the app (for example at the end of a journey), your answer, including any free text, is stored with this same random identifier.
• Error diagnostics (Sentry): crash and error reports, performance measurements, the screen structure at the time of an error, and masked session replays for about 10% of sessions and for every session in which an error occurs (text, images and illustrations are masked). This data is linked to your account identifier (not to your email address). Errors on our server are also reported, with your account identifier, to our PostHog tool. Errors from the API and website servers are also sent to Sentry, without IP address or request content; only the browser (user agent) and technical headers are passed on.
• Our server's technical logs: for each request, the method, endpoint, result, duration and account identifier. The request content is only recorded when an error occurs, and your mood, journal, free-text entries and email address are then masked. These logs are kept for 30 days at our host. A private archive keeps a reduced version of them for at most 90 days after the date of the request (see 4).
• Security logging: to detect and analyse attacks and abuse, our server records certain events: failed sign-in or authentication, refused access, invalid request, request limit exceeded, invalid signature on a message received from a provider (webhook), actions carried out in our administration interface. Each event includes the IP address, the browser or application (user agent), the address called, the method, the result, a request identifier, your account identifier if you are signed in, and the date and time. These events are written to our host's logs and sent to PostHog (EU instance), separately from the anonymous audience measurement. The following are never recorded: passwords, sign-in tokens, the content of requests (journal, moods, free-text entries) and email addresses. IP addresses classed as "to watch" for hostile behaviour (50 at most per daily report) are checked against the AbuseIPDB reputation database; the country and the hosting provider of an address are determined on our side, without sending anything to a third party. This data is used for no purpose other than the security of the service. Legal basis: legitimate interest (Art. 6.1.f GDPR, recital 49). Retention periods in 4.
• App updates: the application checks Expo's update service, which receives your IP address, platform and app version.
• Push notifications, only if you allow them on your phone (you are asked during onboarding): the application sends our server a notification token(an identifier of your phone used to send notifications, provided by Expo) and the platform (Android or iOS). We also keep your notification settings and a log of the notifications sent (type, token, date and status of the sending). You receive at most two notifications a day: the adage of the day at the time you chose and, in the evening, a reminder if you accepted a challenge. If you stop opening the application, at most two nudges are sent to you (after 3, then 7 days). The text of the adage and of the reminder is written every day by a language model, through OpenRouter, from the quote of the day, its author and its challenges only: no data from your account and no identifier is sent to it. Notifications go out through Expo's sending service, which receives the token and the text of the notification; on Android, Expo has them delivered by Google (Firebase Cloud Messaging).

The application does not access your location, contacts, photos or microphone, and uses no advertising identifier.

2.4 Artificial intelligence processing (OpenAI)

Some features of the application rely on OpenAI's language models (United States). This processing is optional: artificial intelligence stays off until you accept it, at the last step of the app's onboarding (“Accept AI” or “Continue without AI”). Two separate settings, which you can change at any time under Profile → Privacy & Data, determine exactly what is sent:

• AI personalisation (“AI Personalization” setting): every night, to choose your quote for the next day and write the “Why for you” box, we send OpenAI your mood of the day and those of the last 7 days and elements of your activity (ongoing or completed journeys, number of liked quotes and their themes, onboarding keywords). In journeys, your reactions are sent to it to adapt the rest of the journey and, at the end, write your personalised summary. Purpose: to offer you a quote suited to what you are going through, to rule out content that would be inappropriate for how you feel, and to give you a summary that reflects your answers. The “Why for you” explanation never receives your free text.
• Analysis of your writing (setting of the same name): on top of that, an excerpt from your journal (the most recent entry from the last 7 days, limited to 1,000 characters) is sent for the choice of the quote, and thefree text you enter in journeys to adapt the steps and write your summary.

Without your consent, neither your moods, nor your activity, nor your writing is sent to OpenAI: you get a quote every day, less personalised, and your journey summary shows your answers as they are. Your email address and your first name are never sent to OpenAI. Under its API terms, OpenAI does not use this data to train its models and may retain it for up to 30 days for abuse monitoring. Your journal stays private: it is never published or shared with other users.

The application's editorial content (quote enrichment, journeys, illustrations, audio narration) is produced beforehand with other artificial intelligence tools, which receiveno data about you.

3. Purposes and legal bases for processing

Withdrawing your consent: in the application, go toProfile → Privacy & Data and turn off “AI Personalization” and/or “Analysis of your writing”. The corresponding data is then no longer sent to OpenAI (see 2.4). Withdrawal does not affect processing carried out beforehand.

Stopping notifications: in the application, go toProfile → Notifications and turn off “Quote of the day”, “Challenge reminder” and “Nudges when I'm away”. You can also withdraw the permission in your phone's settings. No notification is then sent to you anymore. The token is deactivated when you sign out.

The personalisation described above is a form of profiling limited to choosing the content offered to you. We do not engage in any automated decision-making that produces legal effects concerning you or similarly significantly affects you.

4. Data retention period

• Email address (newsletter): retained until you unsubscribe, then erased within 30 days; at the latest, 3 years after your last contact with us (last email opened or message from you).
• Account, preferences and AI choices: for as long as your account is active.
• Quotes received, daily journal and moods, activity (views, likes, shares), journey reactions and summaries: kept for as long as your account exists, so that you can read them again in the app. You can export them or delete your account at any time.
• Server technical logs (IP address, browser, address called, result): 30 days at our host (Railway). A private archive also keeps them for at most 90 days after the date of the request (the two periods run at the same time), then erases them automatically. The archive keeps only the path and the names of the parameters of the address called, never their values (so the text of a search is not in it). Beyond that, only numerical totals, without IP address, are kept for 12 months. For the elements of an incident, a copy is frozen until the incident is closed.
• Security events of the app and the website (2.2 and 2.3: IP address, browser, path of the page): 12 months in PostHog, purged automatically, including after your account is deleted (legitimate interest: the security of the service; a malicious person must not be able to erase their traces by deleting an account). Longer for the elements of an incident, for as long as it is being handled.
• Notification token: for as long as your account exists; it is deactivated when you sign out or when your phone no longer accepts it, and deleted with the account.Log of the notifications sent: 90 days, then erased automatically; it is also deleted with the account.
• Recommendation decision logs: 90 days; they are anonymised if you delete your account.
• Account deletion: your data is erased within 30 days at most. Only your consent history and the recommendation logs are kept, in anonymised form. Technical and security logs are not deleted with the account: they follow their own retention periods (30 days at Railway, at most 90 days in the archive from the request, totals without IP address 12 months, security events 12 months in PostHog). See theDelete your account page.
• At our providers: OpenAI, up to 30 days; technical logs of the website hosting (Railway), including audience events: at most 30 days; analysis and security logs of our network intermediary (Cloudflare), for the traffic that goes through it: about 31 days; error reports (Sentry) and audience measurement, security events included (PostHog): at most 90 days for Sentry, at most 12 months for PostHog; authentication account (Clerk): deleted together with your Adagely account.

5. Data recipients

Your data is never sold or transferred to third parties for commercial or advertising purposes. It is processed only by the service providers necessary for the operation of the service, who act on our behalf and strictly within the scope of their duties.

For the adagely.com website:

• Railway (Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, United States) — website hosting, in data centres located in the European Union (Amsterdam, Netherlands), and the related technical logs.
• Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States) — protection and routing of the website's traffic, when this traffic goes through Cloudflare. Cloudflare is then a network intermediary (proxy and firewall) placed in front of the website: it ends the encryption (TLS) and therefore sees the IP address, the address called, the headers and the content of the exchanges in transit.
• Brevo (formerly Sendinblue — Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) — managing the newsletter's subscriber list and sending its emails (welcome, editorial content). Data processed in the European Union.
• Hostinger (Hostinger International Ltd., Cyprus) — hosting of our mailbox (hello@adagely.com): the messages you send us, error reports on a quote and requests about your rights, for the website and the application alike.

For the mobile application:

• Clerk (Clerk, Inc., United States) — authentication and account management: email address, password, first name, last name and picture provided by Google or Apple, sign-in sessions (IP address, device type).
• Brevo (Sendinblue SAS, France) — sending the account’s service emails (welcome, deletion confirmation): email address and language. Data processed in the European Union.
• Railway (Railway Corporation, United States) — hosting of our server and database, which hold all the application data described in 2.3. Hosting region: European Union (Amsterdam, Netherlands). Railway also stores the private archive of the technical logs of the website and the application, in a storage space operated by Tigris Data, Inc. (United States) and located in Amsterdam (Netherlands).
• Cloudflare (Cloudflare, Inc., United States) — same role in front of the web application and the administration interface, when their traffic goes through Cloudflare: a proxy and firewall that end the encryption (TLS) and see the IP address, the address called, the headers and the content of the exchanges in transit, including the data described in 2.3.
• OpenAI (OpenAI, United States) — language models, only with your consent: moods, activity and, if you turn it on, a journal excerpt for the daily quote; reactions and, if you turn it on, free-text entries for journeys (details in 2.4).
• PostHog (PostHog Inc., instance hosted in the European Union) — anonymous app and website audience measurement; reporting of our server's errors; cost and duration of language-model calls, without their content; security events (2.2 and 2.3), kept for 12 months, which are a stream separate from the anonymous audience measurement: they include the IP address and, if you are signed in, your account identifier.
• OpenRouter (OpenRouter, Inc., United States) — classification of the searches typed on the website by TypeSafe's Jev model, without any identifier (see 2.2); writing of the notification text from the quote of the day, its author and its challenges, without any data from your account or identifier (see 2.3).
• Sentry (Functional Software, Inc., United States; data hosted in the European Union, in Frankfurt) — error and crash diagnostics, masked session replays, linked to your account identifier; for errors from the API and website servers: without IP address or request content, with only the browser (user agent) and technical headers.
• Expo (650 Industries, Inc., United States) — delivery of app updates; sending of push notifications (notification token and text of the notification).
• Google (Firebase Cloud Messaging) — delivery of push notifications to Android phones, on behalf of Expo: notification token and text of the notification.
• GitHub (GitHub, Inc., a Microsoft subsidiary, United States) — security alerts and incident drafts, which may include the IP address of a hostile source; processing of the daily export of the technical logs (they pass through its servers for the time of the export, without being kept there).
• Anthropic (Anthropic Ireland, Limited, Dublin, Ireland; claude.ai service), a separate controller — daily security report, which shows the IP addresses under watch for hostile behaviour; Anthropic processes them under its own privacy policy.
• AbuseIPDB (AbuseIPDB LLC, Pennsylvania, United States) — IP address reputation database: it receives only the IP addresses classed as "to watch" for hostile behaviour, 50 at most per daily report, with no other data.

If you choose to sign in with Google or Apple, these companies process your sign-in as separate controllers, under their own privacy policies.

The application offers no in-app purchases at this time. Should subscriptions be offered in the future, their management may be entrusted to RevenueCat; this policy will be updated accordingly.

6. Data transfers outside the European Union

Several of our providers are based in the United States, and some of your data may be processed there: this is notably the case for OpenAI,Clerk, Sentry (data hosted in the European Union, in Frankfurt; a US company),Railway (a US company, although our servers are in the European Union),Expo, Google (delivery of notifications),OpenRouter, GitHub, Cloudflare, Tigris Data, Inc.(storage of the archive, on behalf of Railway), AbuseIPDB and, for some operations, PostHog. Anthropic Ireland, Limited is established in the European Union; its own transfers to its US parent company are governed by its privacy policy.

These transfers are covered by appropriate safeguards within the meaning of Articles 45 and 46 GDPR: the Standard Contractual Clauses adopted by the European Commission and/or, where the provider has joined it, the EU–US Data Privacy Framework. You can obtain a copy of these safeguards by writing to us athello@adagely.com.

Cloudflare is certified under the Data Privacy Framework, with the Standard Contractual Clauses as a fallback. Tigris Data, Inc. stores the archive in Amsterdam on behalf of Railway; its data-processing contract includes the Standard Contractual Clauses. AbuseIPDB is not certified under the Data Privacy Framework: it receives only IP addresses classed as "to watch" for hostile behaviour, 50 at most per daily report, never an account, content or any other data.

7. Cookies and trackers

The adagely.com website uses only:

• localStorage — key theme: stores your display preference (light or dark mode). This is not a cookie in the strict sense — this data remains on your device and is never transmitted to our servers. No consent is required for this purely functional storage.
• Internal audience measurement: counting of anonymous events,without cookies and without storing anything on your device (see 2.2).
• cf_clearance cookie (Cloudflare): set only if the website goes through Cloudflare and Cloudflare asks you for an anti-bot check, to remember that you passed it. It is strictly necessary to protect the service: no consent is required.

We use no third-party cookies, no tracking pixels, and no advertising trackers, unless you start a YouTube video yourself (see below). In the application, PostHog and Sentry store a random identifier of their own on your device; no advertising identifier is used and no data is shared for targeted advertising.

The website's fonts are hosted by Adagely: displaying a page contacts no third-party service (no Google Fonts or other).

YouTube videos

The video pages of the website (adagely.com/fr/videos, in French) first show a plain preview image, hosted by Adagely: until you click the play button, the YouTube player is not loaded and no data is sent to YouTube or Google.

The YouTube player, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), is loaded only when you click, in privacy-enhanced mode (youtube-nocookie.com). From that click on, Google may store cookies or trackers on your device and process your IP address and playback data, as a separate controller, under its own privacy policy:policies.google.com/privacy. This data may be transferred to the United States. Clicking the play button amounts to consenting to this loading; if you prefer to avoid it, the full text of each video is on its page.

8. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights over your personal data:

• Right of access (Art. 15 GDPR) — obtain a copy of the data we hold about you
• Right to rectification (Art. 16 GDPR) — correct inaccurate or incomplete data
• Right to erasure (Art. 17 GDPR) — request deletion of your data (“right to be forgotten”); deleting the account erases the account data, but technical and security logs follow their own retention periods (30 days at Railway, at most 90 days in the archive from the request, totals without IP address 12 months, security events 12 months in PostHog), for the security of the service (legitimate interest, see 4)
• Right to restriction (Art. 18 GDPR) — request temporary suspension of processing
• Right to data portability (Art. 20 GDPR) — receive your data in a structured, machine-readable format
• Right to object (Art. 21 GDPR) — object to processing based on our legitimate interest
• Right to withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal
• Right to give instructions on what happens to your data after your death (French Data Protection Act)

Directly in the application, without writing to us, fromProfile:

• export your data (access and portability): Privacy & Data → Export as JSON or Download Archive;
• withdraw your consent to AI personalisation: the “AI Personalization” and “Analysis of your writing” switches;
• delete your account: Delete my account. The details, including how to make a request without the app, are on theDelete your account page.

To exercise any of these rights in another way, send your request to:hello@adagely.com. We will respond within a maximum of one month. Proof of identity may be requested if there is reasonable doubt about your identity.

You also have the right to lodge a complaint with the competent supervisory authority:

9. Data security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or disclosure:

• Data transmission encrypted via HTTPS (TLS), enforced by the application
• Data access restricted to authorised personnel only
• Protection of the website, the web application and the administration interface by a firewall placed upstream (Cloudflare), which filters known abusive requests, for the traffic that goes through Cloudflare
• Logging of security events (failed sign-ins, refused access, abnormal requests, administration actions) and daily monitoring to detect attacks and abuse
• Masking of text and images in session replays and of personal content in error logs
• Hosting with established providers (Railway for the website, the server and the database)

In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible, in accordance with Article 34 of the GDPR.

10. Changes to this policy

We reserve the right to modify this privacy policy at any time, in particular to comply with any legal, regulatory, or technical developments. The date of the last update is indicated at the top of this page. In the event of a substantial change, we will inform you in the application or by email.

11. Applicable law and jurisdiction

This policy is governed by French law and European Union law. In the event of a dispute not resolved amicably, the French courts shall have jurisdiction, subject to the protective rules you enjoy as a consumer.