Privacy policy
What Acto knows about you, why, where it is kept, and how to have all of it erased.
Last updated: 2026-07-28
1. In short
Acto sells nothing, tracks nobody and embeds no advertising beacon. The database is hosted in France. You can erase everything from inside the app, in three taps.
The data controller is Arnaud CHIKHANI, 37 rue Saint-Ambroise, 75011 Paris, France. For any question about your data: contact@acto.re.
2. The data Acto processes
Your account. Your email address, your display name, your profile picture if you add one, and your password, which we never see in clear text. If you sign in with Google or Apple, we only receive the associated email address.
What you create. Your scenes and imported texts, your video takes, clips, photos, comments and audio recordings.
Your network. The actors you add as contacts, your pending requests, the people you have blocked, and your reports.
Acto never accesses your phone’s address book. Your network is built inside the app only.
Your notifications. A technical token provided by your phone, if you accept notifications. It says nothing about you.
Usage measurement. Pseudonymised events: screens opened, features used, errors encountered. Never the content of your scenes, never your messages. This measurement can be switched off in Settings.
Import diagnostics. When an import fails, we keep technical information about the attempt so we can fix the problem. Neither the document’s content nor its file name.
3. What Acto does not do
- no selling or renting of your data;
- no advertising, therefore no advertising profiling;
- no third-party tracker, no external analytics SDK, no pixel;
- no tracking across apps or websites, so nothing to allow on iOS;
- no AI model trained on your content;
- no human reading of your videos or recordings, except a report under moderation.
4. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Performance of the contract |
| Providing the app’s features (texts, takes, clips, podcast) | Performance of the contract |
| Network between actors: contacts, likes, comments | Performance of the contract |
| Moderation, safety, fighting abuse | Legitimate interest and legal obligation |
| Push notifications | Your consent, withdrawable in your phone settings |
| Pseudonymised usage measurement | Legitimate interest, with opt-out in Settings |
| AI features (difficult import, analysis) | Your explicit consent, revocable |
| Service emails (confirmation, password) | Performance of the contract |
5. Where your data is kept
| Provider | What it processes | Where |
|---|---|---|
| Supabase | Account, texts, network, usage measurement | European Union (Paris) |
| Cloudflare R2 | Videos, photos, audio recordings | Distributed, possibly outside the EU |
| Google (Gemini) | The text you submit to the AI features | United States |
| Resend | Your email address, for service messages | United States |
| Expo | The notification delivery token | United States |
| Vercel | The acto.re website | United States |
These providers act as processors, on instruction, and have no right to use your data for their own purposes.
6. Transfers outside Europe
Some providers in the table above are established in the United States, or may store data there. Those transfers rely on the European Commission’s standard contractual clauses, backed by each provider’s own safeguards.
If this matters to you, you can keep your content off the network: nothing obliges you to publish a clip or a photo.
7. For how long
- Your account and content: as long as your account exists. Everything is erased when you delete it.
- Usage measurement: 13 months, then automatic purge.
- Import diagnostics: 30 days.
- Reports: for as long as it takes to handle them, then as long as needed as evidence in case of repeat offence or legal follow-up.
- Service emails: a few days at our sending provider.
8. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to set instructions on what happens to your data after your death.
The fastest route is the app itself: you edit your profile and address in Settings, you switch usage measurement off in one gesture, and you delete your whole account without asking anyone. For anything else, write to contact@acto.re, we answer within one month.
If our answer does not satisfy you, you can refer the matter to the French data protection authority, cnil.fr.
9. Security
Exchanges between the app and our servers are encrypted in transit. Passwords are hashed. Access to your content is controlled row by row at database level, and media are only served through signed, time-limited links.
No system is perfect. In the event of a data breach posing a risk to you, we will tell you and notify the CNIL within the timeframes set by the GDPR.
10. Minors
Acto is not aimed at children. You must be at least 15 to create an account.
If you notice an account belonging to someone younger, write to us at contact@acto.re: we will close it.
11. Cookies
The app uses no cookies. The acto.re website sets a single one, `acto-lang`, which remembers the language you chose. It serves no advertising purpose and requires no consent.
12. Changes
This policy may change. The last updated date appears at the top of this page, and any substantial change will be flagged to you inside the app or by email.