Privacy policy
Pompon - Crochet débutant app. Last updated: 20 October 2026.
This policy is a translation of the French privacy policy. If the two versions differ, the French version prevails.
1. Legal information
This privacy policy applies to the mobile application “Pompon - Crochet débutant” (the “App”), published by Lucas Carval, sole trader (French micro-entreprise) trading under the name Kerga Studio, SIREN 891 371 338, whose address is 11 Kergadoret, 29180 Quéménéven, France (the “Publisher”, “we”).
The Publisher acts as the controller of the personal data described below. It has not appointed a data protection officer, as this is not mandatory for its activity.
2. Purpose
This policy informs the person using the App (“you”) about how their personal data is collected, processed and stored, and about their rights, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation, “GDPR”) and the French Data Protection Act (Law No. 78-17 of 6 January 1978, as amended, known as the “Informatique et Libertés” law).
It supplements the terms of use and sale of the App.
3. Categories of data processed
3.1 Account data
On first launch, the App creates an anonymous account, with no email address, name or password. This account is identified by a random technical identifier, which is not shown in the App and which links the subscription to the content of the account. A subscription is linked to a new device through the “Restore purchases” feature, using the Google Play account. The Publisher does not receive the email address associated with that account.
3.2 Answers to the welcome questionnaire
The choices made during the welcome flow, stored as codes: types of items wanted, motivation, stated level, hand used, whether the end-of-trial reminder is turned on, and the screen reached.
3.3 Projects and patterns
Saved, created or imported patterns, the title and status of each project, progress in the pattern (finished rows, number of stitches counted), the related dates and, where applicable, the photograph of the finished piece.
3.4 Photographs and files submitted
- photographs of an item submitted to get a pattern;
- imported patterns (PDF file, photograph, screenshot or text);
- social media posts (TikTok, Instagram, Pinterest) shared to the App: link, video or images, caption and name of the author of the post;
- photographs attached to a message or to a report.
3.5 Exchanges with the chat assistant
The messages sent to the Pompon assistant, its answers, any photographs attached and the context of the question (pattern, part and row in progress).
3.6 Feedback and reports
Comments sent from the App, reports of errors in a pattern or in an answer from the assistant, answers to the end-of-project questionnaire and, where applicable, the reason given when cancelling.
3.7 Subscription data
The status of the subscription (active or not, plan, trial period, expiry date, platform used to subscribe). Payment data is processed only by Google Play and is never passed to the Publisher.
3.8 Audience measurement and diagnostic data
Events of use of the App's features, response times and crash reports, associated with a random identifier specific to the device, separate from the account identifier and renewed every twelve months. This data does not include the text of patterns or messages, photographs or any email address. No screen recording, no personal profiling, no tracking across apps or websites and no geolocation by IP address is carried out.
3.9 Technical operating data
Usage counters for each account (number of patterns generated and messages, cost of artificial intelligence processing) are used to apply the usage limits. A technical log is kept for each generated pattern and each answer from the assistant (duration, cost, version of the instructions, errors). It does not contain the account identifier, the text of messages or photographs.
3.10 Data stored on the device
The App's settings and a local copy of the projects, needed to work offline, are stored on the device and deleted with the App.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating the account, keeping projects, generating patterns, running the chat assistant, managing the subscription | Performance of the contract (Article 6(1)(b) GDPR) |
| Checking the subscription before any artificial intelligence processing, applying usage limits, preventing abuse | The Publisher's legitimate interest in protecting the service and controlling its costs (Article 6(1)(f)) |
| Correcting patterns based on reports; improving the instructions given to the artificial intelligence based on technical logs, photographs and messages | The Publisher's legitimate interest in improving the service (Article 6(1)(f)) |
| Making an anonymized copy of exchanges with the assistant, in order to improve and train an artificial intelligence model specialized in crochet (section 5) | The Publisher's legitimate interest in improving the quality of the service's answers (Article 6(1)(f)), with the option to object in the App |
| Audience measurement and crash detection | The Publisher's legitimate interest in making sure the App works properly (Article 6(1)(f)), under the conditions of the consent exemption for audience measurement set by the CNIL, the French data protection authority (section 12) |
| Keeping accounting records and meeting tax obligations | Legal obligation (Article 6(1)(c)) |
No decision producing legal effects concerning you is taken based solely on automated processing. Artificial intelligence is used only to analyze the photographs and patterns submitted, write patterns and answer questions asked in the App.
5. Reuse of exchanges with the assistant
The Publisher makes an anonymized copy of exchanges with the chat assistant, intended to improve and train an artificial intelligence model specialized in crochet. This copy meets the following conditions:
- Content. The copy includes the text of the questions and answers, the context of the question (pattern, part, row) and the month of the exchange. It does not include any photograph or the storage location of a photograph. It only records that a photograph was attached.
- Anonymization. The copy contains no account, conversation or message identifier. Email addresses, phone numbers and links are removed automatically from the text before copying.
- When the copy is made. The copy is made every night for exchanges older than twenty-four hours, and also immediately before an account is deleted, whether the deletion is requested in the App or results from the automatic deletion provided for in section 8.
- Retention. The copy is kept after the account is deleted. Since it is not linked to any account, it can no longer be found or deleted on request.
- Right to object. The “Help Pompon answer better” setting, found in Me, then Settings, is on by default. Turning it off stops all copying from that moment. Exchanges that take place while it is off are never copied, even if it is turned back on later. Copies already made are kept.
- Use. The copy is not sold, published or used for advertising. If a provider were to take part in training this model, it would receive only the anonymized copy and would be named in this policy before any transfer.
6. Recipients of the data
Your data is processed by the Publisher. It is not sold, rented or used for advertising. It is shared, only as far as needed for their tasks, with the following providers, who act as processors or technical recipients:
| Provider | Task | Data concerned |
|---|---|---|
| Supabase Pte. Ltd. | Database hosting, management of anonymous accounts, file storage | All the data described in section 3 (except data stored on the device), and the anonymized copy described in section 5. Hosted at Amazon Web Services, Paris region (eu-west-3). |
| Anthropic, PBC (Claude models) | Analysis of photographs and imported patterns, writing patterns, answers from the chat assistant | Photographs, pages of imported patterns, text of shared posts, messages sent to the assistant with their photograph and context. No account identifier or email address is sent. Calls go through Anthropic's API offering, whose terms exclude training on this data and limit its retention. |
| fal.ai | Cutting out the photographed item, extracting images from a video | Photograph of the item or video of a shared post, with no identifier. |
| ScrapeCreators (Web Scraping Guy LLC, Austin, Texas, United States) | Retrieving the video, images and caption of a post shared to the App | Link to the post, with no account identifier. |
| Apify Technologies s.r.o. (Prague, Czech Republic; processing in the European Union and the United States) | Retrieving the video or images of a shared post, if the previous provider fails | Link to the post and, for image extraction, the address of the video, with no account identifier. |
| RevenueCat, Inc. | Tracking the subscription status and passing that status to the Publisher's servers | Anonymous account identifier, purchases and subscription status, platform used. |
| Google Ireland Limited (Google Play) | Distribution of the App, sale of the subscription, payment collection, cancellation and refunds | Payment data and Google Play account data, processed by Google under its own terms. The Publisher has no access to them. |
| PostHog, Inc. | Audience measurement and crash reports | Events described in section 3.8, associated with the random device identifier. Hosted in the European Union. |
| 650 Industries, Inc. (Expo) | Tools used to build the App | No personal data of the person using the App. The App's reminders are scheduled locally on the device. |
Your data may also be disclosed to any competent administrative or judicial authority, where the law requires it.
7. Transfers outside the European Union
Some providers are based in the United States or may process data there: Anthropic, fal.ai, ScrapeCreators, Apify, RevenueCat, PostHog and Supabase, including where the main hosting is located in the European Union. These transfers are covered by the adequacy decision for the EU-U.S. Data Privacy Framework, where the provider is certified under it, or otherwise by the standard contractual clauses adopted by the European Commission, included in the provider's data processing agreement.
8. Retention periods
| Data | Retention period |
|---|---|
| Account, answers to the welcome questionnaire, projects, photographs, imported files, shared posts, assistant messages | For as long as the account exists. After the subscription ends, this data is kept for two years, so that it can be restored if a new subscription is taken out, then deleted automatically. |
| Account that has never been linked to a subscription | Deleted automatically, with its content, after twelve months without activity. |
| Reasons for cancellation, numerical answers to end-of-project questionnaires, reports | Kept without an identifier after the account is deleted. The free text of feedback is deleted with the account. |
| Anonymized copy of exchanges with the assistant (section 5) | Kept for as long as it is useful for improving and training the model, including after the account is deleted. |
| Technical logs of patterns and of the assistant (with no account identifier) | Kept for as long as they are useful for measuring the cost and quality of the service. |
| Audience measurement data | Thirteen months at most. The device's measurement identifier is renewed every twelve months. |
| Billing data | Processed by Google. The sales statements sent to the Publisher are kept for ten years, in line with French accounting obligations. |
9. Account deletion
You can delete your account at any time from the App, in Me, then Settings, then “Delete my account”. Deletion is immediate and permanent. It covers projects, saved, created or imported patterns, photographs and files submitted, shared posts and their media, assistant messages, the free text of feedback, answers to the welcome questionnaire, subscription status, usage counters and the account itself. The matching customer record at RevenueCat is also deleted.
The following are kept, with no link to the account: numerical answers to questionnaires, reasons for cancellation, reports, technical logs and the anonymized copy described in section 5, unless the “Help Pompon answer better” setting was turned off before deletion.
Deleting the account or uninstalling the App does not end the subscription, which is cancelled from Google Play.
If you cannot access the App, the procedure for deletion by email is described on the page pompon.lavenian.com/en/suppression.
10. Your rights
Under the applicable rules, you have the following rights over your data:
- the right of access and the right to obtain a copy;
- the right to rectification;
- the right to erasure;
- the right to restriction of processing;
- the right to portability of the data you provided;
- the right to object to processing based on the Publisher's legitimate interest;
- the right to set instructions on what happens to your data after your death (a right provided by French law).
The right to object to audience measurement and to the copy described in section 5 is exercised directly in the App, in Me, then Settings, using the “Usage analytics” and “Help Pompon answer better” settings.
Since the data in the anonymized copy described in section 5 is not linked to any account, it cannot be the subject of a request for access, rectification or erasure.
If, after contacting us, you believe that your rights are not being respected, you can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French data protection authority, online at www.cnil.fr/fr/plaintes or by post at: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
11. Exercising your rights and contact
Any request about your data can be sent by email to [email protected] or by post to Lucas Carval, Kerga Studio, 11 Kergadoret, 29180 Quéménéven, France. You will receive a reply within one month of receipt of the request. This period may be extended under the conditions set out in the GDPR.
Since the account is anonymous, identification relies on the purchase: the request must state the subscription date and, if possible, the order number on the Google Play receipt. If there is reasonable doubt about the identity of the person making the request, the Publisher may ask for any information that shows the account belongs to them.
12. Trackers and audience measurement
The App uses no advertising trackers. Audience measurement, provided by PostHog, is set up to meet the conditions of the consent exemption defined by the CNIL: purpose limited to measuring use and detecting crashes; no profiling, no cross-referencing with other processing and no tracking across apps; no storage of the IP address; lifetime of the identifier and of the data limited to thirteen months. It can be turned off at any time in Me, then Settings, using the “Usage analytics” setting.
13. Minors
The App is not intended for people under fifteen. The Publisher does not knowingly collect data about them. If it appears that such data has been submitted, it can be deleted on simple request to the address given in section 11.
14. Security
The Publisher implements technical and organizational measures suited to the nature of the data processed: encryption of exchanges with the servers, separation of each account's data at database and file storage level, and secret keys kept only on the servers. In the event of a data breach likely to result in a risk to your rights, the Publisher makes the notifications required by the rules to the CNIL and, where applicable, to the people concerned.
15. Changes to this policy
This policy may be changed, in particular to take account of changes to the App or to the rules. Any substantial change is brought to your attention in the App before it comes into force. The applicable version is the one published on this page, whose update date is shown at the top.