Compliant with CNIL recommendations and Articles 82 et seq. of the French Data Protection Act (Loi Informatique et Libertés), as well as the ePrivacy Directive (2002/58/EC).
1. Scope: what this policy covers
This policy covers the Molleva mobile app, which is intended for the general public. The version officially available today is the Android version distributed through Google Play. No iOS version is currently confirmed as available; references to iOS in this policy are conditional and will apply only if such a version is made available. It is the only service that uses persistent identifiers.
| Service | Trackers |
|---|---|
| Molleva mobile app (Android available; no iOS version confirmed) | Identifiers described in Article 3 |
Website molleva.fr | No cookies, pixels or audience measurement trackers. The website also remembers two functional preferences, described in section 1.1 below: closing the download banner and your language choice. They respond to your actions on the site and are not used to track your browsing. |
| Internal administration tool | One session token, strictly necessary for administrator authentication. No audience measurement. Not accessible to the public. |
1.1 What the molleva.fr website keeps in your browser
Article 82 of the French Data Protection Act does not apply only to cookies: it covers any information stored on your device. Browser local storage is included. For accuracy, here is everything the website writes there.
| Information | Storage type | Contents | Where | Duration |
|---|---|---|---|---|
molleva-sticky-dismissed | Session storage | The value 1, indicating that you closed the download banner | All pages | Cleared when the tab is closed |
molleva-language | Local storage | fr or en, after a manual choice | All pages | Until you change language or clear the site data |
That is all. Two functional preferences: banner dismissal for the session, and language until you choose another language or clear the site data.
These preferences are not used for audience measurement, profiling or advertising. Language storage contains only fr or en after a manual choice. When you switch languages, this value also appears in the URL of the requested page. On the home page, if no choice has been saved, the site reads your browser language. This functional personalisation provides the service you requested.
To clear it: close the tab for the banner; for language, choose the other version or clear site data for molleva.fr in your browser settings.
History. Until 13 August 2026, the /beta-android page also kept your first name and email address in local storage while you applied to join the closed beta. The Android version is now officially available, so the form has been removed and these two pieces of information are no longer written. If they are still in your browser, clearing site data for molleva.fr will remove them.
Key point: A native mobile app — Android today, then iOS once that version is available — does not use browser cookies in the usual technical sense. Trackers in a mobile app take other forms: persistent local identifiers, third-party SDKs, system advertising identifiers (Apple IDFA / Google GAID), etc.
This policy explains exactly which identifiers Molleva uses, and why.
2. What Molleva does NOT use
Molleva has made deliberate choices to limit trackers as much as possible:
| Tracker | Used? | Comment |
|---|---|---|
| Browser cookies | No | Native mobile app |
| Third-party analytics SDKs (Firebase, Amplitude, Mixpanel, Segment, PostHog, Braze) | No | 100% first-party analytics |
| Third-party crash-reporting SDKs (Sentry, Crashlytics, Bugsnag) | No | Not integrated |
| Session replay (Hotjar, FullStory, LogRocket) | No | Prohibited by internal policy |
| Apple advertising identifier (IDFA) | No | Neither collected nor requested |
| Google advertising identifier (GAID) | No | Neither collected nor requested |
| Hardware identifier (IMEI, serial number) | No | Not collected |
| Marketing attribution tracking SDKs (AppsFlyer, Adjust, Branch) | No | Not integrated |
| Social network SDKs (Meta SDK, Twitter SDK) | No | Not integrated |
| Remote push notifications | No | Local reminders only (on-device) |
| Remarketing pixels | No | No tracking WebView |
3. Identifiers and trackers used by Molleva
3.1 Device identifier (Device ID)
| Field | Value |
|---|---|
| Nature | Random UUID generated by Molleva on first launch |
| Storage | Native Secure Storage (Android Keystore today; iOS Keychain once the iOS version is made available) |
| Transmission | Sent to our servers with each authenticated request |
| What it is not | Not an advertising identifier, not a system hardware identifier |
| Purpose | Link the session to the device, prevent session theft, account security |
| Duration | Until the app is uninstalled or the account is deleted |
| Legal basis | Performance of a contract / Legitimate interests (security) |
| Consent required | No — strictly necessary tracker |
3.2 Anonymous analytics identifier
| Field | Value |
|---|---|
| Nature | Random UUID generated on first launch, separate from your account |
| Storage | Your device’s native Secure Storage |
| Transmission | Sent to our servers with analytics events |
| Purpose | Analyse app usage in aggregate (onboarding, feature adoption) without directly linking it to your identity |
| What it is not | This identifier is never matched with your email or user_id on the server for analytics |
| Duration | Until the app is uninstalled or the account is deleted |
| Legal basis | Legitimate interests |
| Consent required | No — audience measurement exemption, see Article 5.2 |
| Objection | Yes, at any time, from Profile → Privacy (see Article 6.2) |
3.3 Analytics session identifier
| Field | Value |
|---|---|
| Nature | Random UUID generated each time the app is opened |
| Purpose | Group events from the same session to analyse user journeys |
| Duration | Ephemeral — not persisted between app openings |
| Legal basis | Legitimate interests |
3.4 Session tokens (access token and refresh token)
| Field | Value |
|---|---|
| Nature | Opaque cryptographic tokens generated on the server |
| Storage | Native Secure Storage (WHEN_UNLOCKED_THIS_DEVICE_ONLY) |
| Transmission | Sent to our servers for authenticated requests |
| Purpose | Keep you signed in between sessions |
| Duration | Access token: 15 minutes. Refresh token: 30 days. Absolute session limit: 90 days |
| Legal basis | Performance of a contract |
| Consent required | No — strictly necessary for authentication |
3.5 RevenueCat identifier (Premium subscribers)
| Field | Value |
|---|---|
| Nature | Pseudonymous identifier generated by RevenueCat |
| Purpose | Subscription management (activation, renewal, cancellation) |
| Transmission | Shared with RevenueCat Inc. (processor) |
| Duration | For as long as the account exists |
| Legal basis | Performance of a contract |
| Consent required | No — necessary to manage the subscription you purchased |
4. Data stored locally without being sent to the server
This data stays in your device’s Secure Storage. It is not sent to our servers.
| Data | Technical key | Purpose | Duration |
|---|---|---|---|
| Preferences (theme, check-in time) | molleva.preferences.v1 | Personalised interface | Until deletion or reset |
| Local reminders (scheduled time, notification identifier) | molleva.reminders.v1 | Reminders and anchors you set up | Until deletion or disabling |
| Return reminders | — | Only if you turn on “Return reminder” in Profile: two local notifications, three and seven days after your last app opening. Each new opening resets the schedule. No remote push token or note content is sent. Legal basis: consent. Turn the option off in Profile or disable notifications in your phone’s settings. | Until the next app opening or until the option / notifications are disabled |
| Subscription status cache | molleva_subscription_cache | Avoid a network request every time the app opens | Until invalidated |
| Premium discovery cues | molleva.premium-discovery.v1 | Show cues for a newly opened feature only once | Until the account is deleted |
| Audience measurement opt-out | molleva.analytics-opt-out.v1 | Remember your choice not to participate in usage statistics | Until you change this choice |
| Pending action queue and report for problem reporting | molleva.crash-actions.v1, molleva.crash-pending.v1 | Reconstruct the context of an incident you choose to report to us. Nothing is sent unless you explicitly submit it. | Until submission or abandonment |
| Compromised device detection (root / jailbreak) | — | Local check at launch to warn you if your device’s secure storage can no longer be considered reliable. The result is not sent to anyone. | Not persisted |
Sharing a recap image. When you choose to share a recap, the image is composed on your device, written to a temporary file, then handed to the system share sheet. Molleva does not send it to any server and does not know who you send it to. The temporary file is automatically cleared.
5. CNIL analysis and legal basis
5.1 Strictly necessary trackers — no consent required
Under the CNIL guidelines (Deliberation No. 2020-091 of 17 September 2020), trackers essential to the operation of the service do not require prior consent.
For Molleva, this category includes:
- Session tokens — authentication is impossible without them
- Device ID — account security (preventing session theft and detecting token reuse) depends directly on it
- RevenueCat identifier — necessary for the subscription purchased by the user
5.2 First-party analytics — audience measurement exemption
The CNIL provides for an exemption from consent for first-party audience measurement trackers when:
- the purpose is strictly limited to internal audience measurement to improve the service
- the data is not combined with other processing activities or shared with third parties
- the data collected is not used to build an individual profile
- users are informed and have a way to object
We consider that Molleva meets these conditions, and treat the anonymous analytics identifier as exempt from prior consent. A way to object is available (see Article 6.2).
This is our conclusion, not the CNIL’s. Since 4 July 2025, the evaluation programme for audience measurement solutions has been replaced by a self-assessment carried out by the publisher. Molleva is therefore neither “certified” nor “approved” by the CNIL — no publisher can be any more. We document our analysis and stand by it.
This scope is what makes the exemption tenable: events contain neither the content of your notes, nor your energy levels, nor any data that would describe you rather than count a use.
6. Control and objection
6.1 Local notifications (reminders)
You control notification permissions in your system settings:
- Android (version currently available): Settings → Apps → Molleva → Notifications
- iOS (once the iOS version is available): Settings → Notifications → Molleva
Disabling notifications does not affect how Molleva works.
6.2 Usage statistics (objection)
At any time in the app:
Profile → Privacy → Help improve Molleva
Just turn off the switch. The change takes effect immediately: no further events are collected or sent, and any waiting to be sent are discarded. You can turn participation back on whenever you like.
We cannot process this objection by email. Usage statistics events do not contain an account identifier, so we would be unable to tell which ones are yours. The switch in the app is the only reliable way, and it is also the quickest.
6.3 Deleting statistics already collected
Usage statistics events are not linked to any account identifier. They therefore cannot be returned to you individually or deleted based on your account alone.
If you would like them deleted, you can send us the analytics identifier displayed in Profile → Privacy at contact@molleva.fr.
In any event, these events are aggregated into anonymous statistics after 13 months, and the raw rows are then destroyed.
Do this before deleting your account. Deleting your account erases the analytics identifier from your device. Without it, no one — you or us — can find the relevant events. If you want them deleted, note down the identifier first.
6.4 Deleting local identifiers
Deleting your account (Profile → Delete my account) erases all local identifiers from your device, including the Device ID, analytics identifier and keys listed in Article 4.
Uninstalling the app deletes the data in your device’s Secure Storage.
7. Molleva’s commitments on trackers
Molleva undertakes to:
- Never use an advertising identifier (IDFA, GAID)
- Never sell data to advertisers or data brokers
- Never use in-app behavioural advertising targeting
- Never integrate session replay or screen recording
- Inform users before integrating any new tracker
8. Changes
If new trackers are introduced (e.g. a crash-reporting SDK or third-party analytics), this policy will be updated and you will be informed in the app before they are activated.
9. Regulatory references
- Law No. 78-17 of 6 January 1978, as amended (French Data Protection Act, Loi Informatique et Libertés)
- Regulation (EU) 2016/679 (GDPR)
- Directive 2002/58/EC (ePrivacy), transposed into French law
- CNIL Deliberation No. 2020-091 of 17 September 2020 (cookie guidelines)
- CNIL Recommendation of 1 October 2020 (methods for obtaining consent)
10. Contact and complaints
For any questions about trackers: contact@molleva.fr
To exercise your GDPR rights: see our Privacy Policy.
Complaint to the CNIL:
www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07