Privacy Policy
Last updated: 27 April 2026
This policy explains how we collect, use and protect your personal data when you use the Amuseemus App, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act as amended. A French version of this policy is available at https://amuseemus.com/privacy-policy and prevails for users residing in France in case of discrepancy.
1. Data controller
The Amuseemus mobile application (the "App") is published by Amuseemus, SAS (Société par Actions Simplifiée), registered at 32 Allée de la Robertsau, 67000 Strasbourg, France (SIRET: 100 328 616 00014). General contact: [email protected] — Data Protection Officer (DPO): [email protected].
2. Scope
This policy applies to the Amuseemus mobile application available on Google Play and the App Store, as well as its web version where applicable. It does not cover third-party sites or services that the App may link to (for example, a partner museum's website), which have their own policies.
3.1 Data you provide when signing up
| Data | Required | Purpose |
|---|---|---|
| Email address | Yes | Identification, sign-in, service communications |
| Password | Yes | Authentication (stored hashed on the server) |
| Name (or pseudonym) | Yes | Profile display, personalisation |
| Profile description | Optional | Profile personalisation |
3.2 Data generated by your use of the App
| Data | Source | Purpose |
|---|---|---|
| Quest progress (status, start and end dates) | Automatic | Saving your journey, gamification |
| Answers to quest steps, scores, emoji reactions | Automatic | Evaluating answers, calculating points |
| Achievements unlocked | Automatic | Gamification |
| Search queries | Automatic | Returning search results |
| Questions asked to the Smart Chat (AI assistant) | Automatic | Providing contextual answers |
| User identifier (UUID) | Automatic | Internal referencing |
3.3 Location data (optional)
The App may access your device's precise location (GPS) or approximate location (network) only after your explicit authorisation (Android/iOS system dialog).
When location is active, your coordinates (latitude, longitude) are sent to our backend with API requests in order to show you nearby museums and quests, and to validate your presence at locations relevant to certain quest steps.
These coordinates are not stored persistently; they are refreshed for each request. You can revoke this authorisation at any time in your device's system settings. The App remains functional without location, although certain features will be limited.
3.4 Technical data
We do not use advertising identifiers (AAID, IDFA) and do not collect your contacts, photos, microphone or calendar. The App contains no advertising and no third-party tracking cookies.
| Data | Source | Purpose |
|---|---|---|
| IP address | HTTP request headers | Security, logging, abuse prevention |
| Device language | Accept-Language header | Localising the interface and content |
| Device integrity token (Firebase App Check) | Google Play Integrity (Android) / App Attest (iOS) / reCAPTCHA Enterprise (web) | Protecting our API against bots and abuse |
3.5 Special categories of data
We do not knowingly collect "sensitive" data within the meaning of Article 9 of the GDPR (ethnic origin, opinions, health, sexual orientation, etc.). If you provide such information in free-text fields (name, description), it is processed in the same way as ordinary identification data; we recommend that you do not disclose it.
4. Purposes and legal bases of processing
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Account creation and authentication | Performance of a contract (Art. 6(1)(b)) |
| Saving your quest progress | Performance of a contract (Art. 6(1)(b)) |
| Showing nearby museums and quests (location) | Consent (Art. 6(1)(a)) — given via the system dialog |
| Providing the Smart Chat (AI assistant) | Performance of a contract (Art. 6(1)(b)) |
| App and API security (App Check, IP logging) | Legitimate interest (Art. 6(1)(f)) — protecting our systems against abuse |
| Responding to your support requests | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal obligations (accounting retention, legal requests) | Legal obligation (Art. 6(1)(c)) |
5. Recipients and processors
Your data may be transmitted to the following recipients, acting as processors within the meaning of Article 28 of the GDPR. We do not sell your data and do not share it for advertising purposes.
| Recipient | Role | Data concerned | Location |
|---|---|---|---|
| Our backend api.amuseemus.com | Application hosting, database | All data above | European Union |
| Google Cloud Platform / Firebase App Check | Device integrity validation | Integrity token (no direct personal data) | EU (Ireland) and United States |
| Google Maps Platform | Map rendering | Geographic coordinates for map display | United States |
| Google Play / Apple App Store | App distribution | Technical identifiers related to installation, install statistics | United States |
5.1 Transfers outside the European Union
Some of our processors (notably Google) may process data in the United States. These transfers are governed by:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adherence to the EU–US Data Privacy Framework (DPF) where the processor is certified
6. Retention period
After these periods, your data is deleted or irreversibly anonymised.
| Data | Retention |
|---|---|
| User account (email, name, hashed password) | As long as your account is active, and up to 12 months after your last sign-in |
| Quest progress, scores, achievements | As long as your account is active |
| Location data sent with requests | Not retained persistently beyond the processing of the request (anonymised technical logs within 30 days) |
| Technical logs (IP, sign-in dates) | 12 months maximum |
| Data required for compliance with legal obligations | As required by applicable law |
7. Your rights
In accordance with the GDPR (Articles 15 to 22), you have the following rights:
- Right of access to your personal data
- Right to rectification of inaccurate or incomplete data
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability in a structured, machine-readable format
- Right to object to processing based on legitimate interest
- Right to withdraw consent at any time where processing is based on it (e.g. location)
- Right to give directives concerning the retention, deletion and communication of your data after your death (French Data Protection Act)
How to exercise your rights
Send your request to [email protected], indicating your user identifier or the email address associated with your account. We will reply within a maximum of one month (extendable by two months for complex requests, in accordance with Art. 12(3) GDPR).
Account deletion
You may request the complete deletion of your account and the associated data:
- From the "Profile" screen of the App (feature to be enabled in a future version)
- By writing to [email protected]
8. Security
We implement appropriate technical and organisational measures to protect your data:
- Encryption in transit: all communications between the App and our backend are protected by HTTPS/TLS (REST) and WSS (WebSocket)
- Password hashing on the server (high-cost algorithms: bcrypt/argon2)
- Firebase App Check: protection against automated API abuse
- Access control: only authorised members of our team access the data, on a need-to-know basis
- Regular encrypted backups
9. Minors
The App is not directed at children under the age of 13. If you are under 16 (the age of digital consent in France), you must obtain authorisation from your legal representative before creating an account. The age of digital consent may differ in other EU countries; the local minimum age applies.
If we learn that an account has been created by a minor without valid authorisation, we will delete it.
10. Cookies and similar technologies
The mobile App does not use cookies within the meaning of the ePrivacy directive. It uses minimal local storage (shared_preferences) to:
- Store your authentication token (so you do not have to sign in at every launch)
- Remember your system permission preferences (e.g. the state of the location permission request)
11. Changes to this policy
We may update this policy to reflect legal, technical or functional changes. The version in force is always the one available at https://app.amuseemus.com/privacy and in the App's "About" menu. In case of substantial changes, we will inform you via in-app notification or by email.
12. Contact
For any questions concerning this policy or the processing of your data:
- Email: [email protected]
- Postal address: Amuseemus SAS, 32 Allée de la Robertsau, 67000 Strasbourg, France