Join the beta

Privacy at Farandole

Draft for the beta, October 2026. The app shows the same text: in Settings, tap Read the privacy policy.

Farandole is a game for families and groups: an adult sets tasks, teams play in town, photos land on a private map, and the evening ends with a reveal. This page says what that needs from you, where it goes, and how to make it go away.

Who is responsible

Andreas Mavrocordatos, Luxembourg. Write to contact@farandole.app about anything on this page.

What we hold, and why

Every phone keeps its own copy of an adventure. Our servers pass photos and answers between the phones, and remove the adventure on the schedule under How long.

  • A silent identity for each phone, so its answers and photos reach the right adventure. It carries no name, email or phone number.
  • Your email address, only if you link one, to keep adventures or to work for an organisation. It is used for the sign-in code and, for organisations, so a colleague can add you. Nothing else.
  • What the adults type: the name the kids call you, team names, the players' first names if you add them, the adventure's title and tasks.
  • The game itself: answers, photos, the judging and the scores.
  • That an adult is in charge of each phone: the leader confirms it on Before we start, and the adult with each team ticks a box every time a phone joins. We note when each phone confirmed it, with that adventure.
  • Where a photo was taken. The phone reads its position once, when the photo is taken or picked from your library, to pin it on the group's private map. Never in the background, never live.
  • Whether you have a Farandole pass: where it came from (a store purchase, or given by us), when it started and ends, whether it renews, and a payment problem the store reports. The pass is not on sale yet. During the beta, keeping is free and the only passes are ones we give by hand.
  • Once the pass is on sale, the messages the store sends about it through RevenueCat: their ids and the identity ids they name, the type of message, the product, the store, the dates and, when the store gives one, why a pass was cancelled or ended. Never the price or your country.
  • What you send us. A Report a problem email carries what you write, plus the app version, the phone's system and model, the first 8 characters of this phone's identity and the last sync error. The form on farandole.app/contact carries the topic you pick, your email address, your name if you give it, your message, and the page of our site you came from. Feedback through TestFlight can carry screenshots and crash reports, and you may write in the beta's WhatsApp group.
  • Server logs: our servers note each request with its IP address, and each sign-in, to keep Farandole running and safe.

We use this only to run the adventures you start or join, to keep the ones you ask us to keep, and to fix what goes wrong. The legal basis depends on whose data it is:

  • For the adults who use the app: providing the game you asked for, and the pass if you have one.
  • For the children on a team, and anyone else named or seen in a photo: our legitimate interest, and that of the adult who organised the day, in running the game they asked for. It stays inside the group and is removed from our servers on the schedule below.
  • For a kept adventure, which holds every team's photos and answers: the leader's legitimate interest, and ours, in keeping the day they asked us to keep. We have written down how we weighed this against the players' interests; ask us for it. Any team can have its own photos and answers removed from it (Your rights, below).
  • For messages you send us, the check on the contact form, server logs and the store's messages about a pass: our legitimate interest in keeping Farandole working and safe, answering you, and getting a pass right.

The position also needs your yes in the phone's permission prompt. You can turn location off for Farandole at any time in the phone's settings; photos still work, without a pin on the map. No advertising, no tracking or analytics tools, no profiles, no selling, nothing posted anywhere.

Photos

Photos are taken in the app or picked from your library. Before a photo leaves the phone it is re-encoded, which removes the hidden data cameras add (location, time, device). A photo is seen by the team that took it and by the adult leading the adventure. Other teams see it only if the leader releases it after the reveal. Photos go to your phone's Photos only when you ask, or when you switch on "Also save my photos to Photos as I take them".

Children

Children never have an account and never type an email. Leading an adventure is for adults, and each team's phone should be in an adult's hands: the adult with a team confirms it every time that phone joins. Use first names or nicknames for players; they are optional.

How long

  • An adventure, all of it (its title and tasks, the leader's name, the teams and the players' first names, the answers, photos, judging and scores): removed from our servers 30 days after the last thing that happens in it. That means anything that happens in it, such as it being created, opened or edited, a team joining, an answer or photo, a judgement, the reveal or a release. Looking at it doesn't count. The removal runs during the night after the 30 days, and the app shows the last day.
  • A kept adventure, with every team's photos and answers: stays on our servers while its leader's Farandole pass is active. During the beta, keeping is free for any leader who links an email, and we will tell you at least 30 days before that changes. When the pass ends, or free keeping ends for a leader without a pass, the adventure is removed 30 days later, unless the pass is renewed or bought before then. If the leader stops keeping it, the 30 days start again from then.
  • What a leader deletes (Delete everything now on an adventure, or Settings, Delete my data): removed as soon as the phone reaches our servers, the photo files the same night.
  • This phone's silent identity: removed after 90 days without use, once it leads or plays in no adventure on our servers, belongs to no organisation and holds no pass. An identity with a linked email, and the email, stay until you delete your data. Without a linked email, nobody can reach the identity again once the app is removed.
  • A Farandole pass: the record stays while the pass lasts, and 60 days after it ends. The store's messages about a pass, once it is on sale: 90 days.
  • Removal records: when we remove an adventure, a team or an identity, we keep its id, the date and the reason, never what it held. An adventure's record stays, so that no phone can put a removed adventure back on our servers. A team's or an identity's record goes after 30 days.
  • An organisation: until it asks us to remove it. A member's account and email go when that person deletes their data, and the organisation's contact address goes when the person it belongs to deletes theirs. Its counts of the groups that played stay with it.
  • Messages you send us, by email, through the form on farandole.app or through TestFlight: deleted once the problem is handled, within a year at the latest. Messages in the WhatsApp group stay there until they are deleted in WhatsApp.
  • Server logs, including the record of each sign-in: 7 days.
  • Our backups: the database is backed up daily and each backup is kept 7 days. Photo files are never in our backups. If we ever restore one, everything removed since is removed again before Farandole carries on.

On your phones

  • Each phone keeps its own copy of every adventure it played, until you delete it there. It stays on the phone after our servers remove the adventure.
  • Your phone's own backup (iCloud, or Google's backup on Android) and moving to a new phone can carry Farandole's adventures and photos. The sign-in never travels with them: on the new phone, sign in with the email you linked and your adventures connect again.
  • The backup file (Settings, Back up all my adventures) holds every adventure you led or played on that phone, photos included (not an organisation's working copies). On a leader's phone that means every team's photos and answers, including photos not released to the other teams. It is your own copy: we never see it, and where you save it is up to you.
  • The carnet you download holds one adventure, and is yours to keep.
  • Delete my data clears this phone. It cannot reach a phone backup, a backup file or a carnet you saved elsewhere; delete those yourself.

Where it is kept

On Supabase's servers in Frankfurt, Germany, in the European Union, under a data processing agreement. Some of the services Farandole uses are run by companies in the United States. Where one of them can reach personal data, the transfer is covered by the EU's standard contractual clauses or the EU-US Data Privacy Framework:

  • Supabase runs our servers; the data itself stays in Frankfurt.
  • Resend emails the sign-in codes, from its EU region in Ireland.
  • Cloudflare serves farandole.app. Through Cloudflare Email Routing it passes email sent to contact@farandole.app, and each message from the form on farandole.app/contact, on to the mailbox where we read them, at Google (Gmail). farandole.app itself stores nothing from the form and keeps no log of it.
  • Cloudflare Turnstile checks that a person is writing, on the contact form only. For that it processes your IP address, your browser's User-Agent, the fingerprint of the browser's secure (TLS) connection, and which site asked; our site also sends Cloudflare your IP address with the result to confirm it. Cloudflare does this for us, and, as a controller itself, uses the same signals to improve how Turnstile tells people from bots; it says they are not used to identify, profile or target anyone. Turnstile runs in its own frame from Cloudflare and may store a little data there for the check; farandole.app sets no cookie. Cloudflare's Turnstile Privacy Addendum (cloudflare.com/turnstile-privacy-policy) has the details.
  • RevenueCat, once the Farandole pass is on sale in the app: it handles the store purchases for us. It will hold the identity Farandole gives your phone, your pass purchases and the country of your store account. Nothing goes to RevenueCat today.
  • Apple and Google, once the pass is on sale: they take the payment in the App Store or Google Play, under their own terms and as controllers themselves.
  • Apple runs TestFlight, which carries the iPhone beta and its feedback and crash reports; Expo builds the app and hosts the Android download; WhatsApp carries the beta's group. These three under their own terms.

Later the app will come through the App Store and Google Play, under their own terms.

Your rights

Under the GDPR you can see, correct, take with you, or delete what we hold about you, ask us to limit how it is used while a question is sorted out, and object to how it is used.

  • See and take with you: the carnet holds one adventure, and the backup file every adventure you led or played on this phone, photos included.
  • Delete: Settings, Delete my data removes this phone's identity, every adventure you lead and their photos from our servers, your pass record, and an organisation's contact address if it is yours, then clears the phone. It needs Wi-Fi or signal, and on a phone linked to an email, the sign-in with that email; without them, nothing is deleted and the app says so. Photo files go the same night; our backups age out within 7 days. An adventure you only joined stays with its leader until our servers remove it.
  • A pass bought in a store keeps renewing until you cancel it there, even after Delete my data; the app shows Manage the pass. When you delete your data, we also ask RevenueCat to delete its record of you.
  • Your team in a kept adventure: write to contact@farandole.app and we remove your team's photos and answers from it, within a month.
  • Anything else: write to contact@farandole.app. We answer within a month.

You can also complain to Luxembourg's data protection authority, the CNPD (Commission nationale pour la protection des données, cnpd.public.lu), or to the authority where you live.

Organisations

Tourist offices and organisers who publish adventures appear under their own name. For an organisation we hold its name, kind, town and country, its website if it adds one, and the account and email address of each person in it. The email of the person who set it up is also kept as the organisation's contact address, so we can reach it, for example to check it before its card says Official; the organisation's members can see it. The name, kind, town and website go with the adventure to every phone that opens its code. A colleague is added by the email address they linked in the app, which we look up for that. Organisations never see the games played, the teams or any photo: only how many groups started and finished each adventure, and how many started each version. We keep these counts by month.

Changes

If this page changes in a way that matters, we will say so in the app and on farandole.app before the change applies.