privacy policy.

1. Who are we?

Application publisher:

Ammar Osei-Mohamend (trading as Molleva)

Individual entrepreneur (micro-entrepreneur)

SIRET: 99931654000015 — RNE Paris

Registered office: 8 bis rue Abel, 75012 Paris

Contact email: contact@molleva.fr

Email for data protection matters: contact@molleva.fr

Data Protection Contact: Ammar Osei-Mohamend

Contact: contact@molleva.fr

2. Preamble

Molleva is a mobile app for finding daily clarity. It helps people who feel mentally overloaded see things clearly, choose less and move forward without guilt.

The version officially available today is the Android version distributed through Google Play. No iOS version is currently confirmed as available. References to iOS in this policy are conditional and will apply only if such a version is made available.

In this context, Molleva processes personal data. Some of this data is intimate: your notes, your priorities, your energy level for the day. We treat it with the same care as health data, even though Molleva is not a medical or therapeutic app.

This policy explains:

• what data we collect and why,
• how we protect it,
• how long we keep it,
• your rights and how to exercise them.

3. Legal bases for processing

All our processing activities are based on at least one legal basis under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679):

4. Data collected, purposes and retention periods

4.1 Account and authentication data

Data collected:

• Email address (normalised to lowercase, unique account identifier)
• Session identifier (UUID generated on the server)
• Device identifier (random UUID generated by the app — not an advertising identifier or a system hardware identifier)
• Account creation date
• Date of last authentication

What we do not collect: first name, last name, telephone number, postal address, system advertising identifier (Apple IDFA, Google GAID).

Purpose: passwordless OTP authentication, session management, account security.

Legal basis: performance of a contract.

Retention period:

• Guest session on the server: 14 days maximum
• Active sessions: maximum lifetime of 90 days; they can be revoked at any time
• OTP challenges: 5 minutes (automatic expiry)
• Account data: until the account is deleted, then purged within 7 days; backups expire within 30 days

Creating a Molleva account is optional when you start. You can begin as a guest without entering an email address. The guest session is kept on the server for 14 days maximum. To find your days on another device or convert your guest session and keep it for longer, you can create an account later. To create an account, you enter your email address and then verify it using a 6-digit OTP sent to that address.

4.2 Personal content data (data entered in the app)

This data is at the heart of the Molleva experience. It belongs to you.

Purpose: providing the Molleva service as you use it.

Legal basis: performance of a contract.

Retention period: for as long as the account exists. If the account is deleted, data is purged within 7 days and backups expire within 30 days.

The notes you confirm are stored on Molleva’s servers so that they can be backed up, included in your history and synchronised. Text you are still entering remains only in memory on your device until you confirm it. Operational items stored locally (session, preferences, reminders and temporary files) remain on your device. Your email address is not sold or used for targeted advertising.

Searching your history. When you search your history, your query is processed to provide a response and then discarded: it is not stored on the server or on your device.

Duplicate detection. When something you have just captured resembles something already there, Molleva lets you know. The database makes this comparison based on text similarity: no AI model is involved, and nothing is sent to a third party.

4.3 Technical and security data

Data collected:

• IP address — used only for rate limiting (abuse prevention); temporarily stored in rolling 15-minute windows
• User agent and platform — sent automatically by the app; stored in the sessions table for multi-device management and detection of unusual sessions (retention: 30 days / absolute session limit: 90 days)
• IP address at session creation — stored in the sessions table (in addition to rate limiting) for account security; kept for the same period as the relevant session
• Time zone and UTC offset — sent by the app so that your days can be calculated correctly
• Session metadata — hashed tokens (never in plain text), rotation timestamps, revocation reason

Purpose: security, abuse prevention, context-aware time calculations.

Legal basis: legitimate interests (the security of our systems and users).

Retention period: rate limiting: 15-minute windows. Tokens: until revoked or expired (90 days maximum).

Technical logs (server logs)

Data collected:

• HTTP request logs: endpoint, response code, timestamp
• No email addresses and no user content in logs (automatic redaction)
• The IP address may appear in infrastructure logs

Purpose: security, incident detection, debugging.

Legal basis: legitimate interests (the security of our systems).

Retention period: 14 to 30 days, with automatic rotation.

4.4 AI features and content processing

When you use AI assistance, your data is processed as follows.

Provider: Mistral AI.

The seven AI features concerned and what is sent:

Redaction when importing pasted text. Web addresses and email addresses are removed from the text on the server, before any call to the AI system. An item containing only that information is discarded.

Marking generated content. In accordance with Article 50(2) of the AI Act, the origin of content produced by a model is recorded with your data: for each captured item, whether it was typed, dictated, photographed or pasted; for each subtask created by breaking down a priority, whether it was suggested by a model, which model, and whether you edited it before confirming it; and for each text produced through clarification, that it came from AI-assisted rephrasing. If you rewrite a clarified text yourself, this marker is removed. These markers appear in your data export.

What we store: only technical metadata about AI usage (feature used, model, token counts, estimated cost, status, latency). We do not store AI prompts or responses. This metadata is kept for as long as the account exists and purged with it. It is not included in the export file, but remains covered by your right of access on request.

Legal basis: performance of a contract (the feature is activated at your request).

Transparency of AI systems (Art. 50, Regulation (EU) 2024/1689 — AI Act)

In accordance with Article 50 of Regulation (EU) 2024/1689 on artificial intelligence, as amended by Regulation (EU) 2026/1744 known as the “Digital Omnibus”, Ammar Osei-Mohamend informs you that the processing described in this section involves interaction with an artificial intelligence system provided by Mistral AI.

This information is provided in the App, before the first text is sent to an AI feature. It is also reflected in the Terms of Use and in the AI Information Notice.

The AI systems used by Molleva are classified as limited risk within the meaning of the AI Act. No automated processing that produces legal or significant effects is carried out in relation to you (Art. 22 GDPR).

4.5 Internal first-party analytics

Molleva uses an entirely internal, first-party analytics system — we do not integrate any third-party analytics SDKs (no PostHog, Amplitude, Mixpanel, Segment, Firebase Analytics, etc.).

Data collected:

• Anonymous identifier (random UUID, separate from your account identifier, stored in your device’s Secure Storage)
• Session identifier (random UUID, renewed for each session)
• Event name (e.g. “feature used”, “onboarding completed”)
• Platform (Android currently; iOS when the iOS version becomes available)
• App version
• Timestamp

What we do not collect in analytics: your email address, your actual account identifier, your IP address, the content of your notes, your energy levels, or your personal intentions.

No session replay. No screen recording is ever made.

Purpose: product improvement (features adopted, onboarding journeys, errors encountered).

Legal basis: legitimate interests.

Your right to object. You can turn off this collection at any time from Profile → Privacy → “Help improve Molleva”. The change takes effect immediately. The same screen displays your analytics identifier: since events do not contain an account identifier, this is the only way to ask us to delete them.

Paywall display test. The Premium screen has two variants that differ only in the order in which the two plans are displayed. Prices do not vary from one user to another. The variant shown to you is recorded with the analytics events under the same anonymous identifier.

Retention period: Individual analytics events are kept for 13 rolling months from the date of collection, in accordance with the CNIL recommendation (Deliberation No. 2020-091 of 17 September 2020). After 13 months, events are aggregated into anonymous statistics (counts by period, event and platform, with no individual identifiers) and the raw rows are then deleted. Aggregated statistics, which are no longer personal data, are kept indefinitely to analyse how the service changes over time.

Collection is enabled by default and can be disabled at any time from Profile → Privacy. Molleva considers that this configuration may qualify for the exemption from consent applicable to certain audience measurement tools. This is Molleva’s assessment and does not constitute certification or approval by the CNIL.

4.6 Premium subscription data

Molleva currently offers a Premium subscription managed through the Google Play Store for the available Android version. Apple App Store management would apply only if an iOS version is made available; RevenueCat handles subscription management technically.

Data held by Molleva:

• Subscription status (free / premium / grace period / expired)
• Subscription plan (monthly / annual)
• Expiry date
• Identifier sent to RevenueCat: this is your Molleva account identifier, not a separate identifier — it allows RevenueCat to link a purchase to the right account
• Subscription event log (webhooks: subscription, renewal, cancellation, refund)

We do not collect your payment data. Card numbers, IBANs and financial data are handled exclusively by the store used (Google currently, then Apple if the iOS version is made available) and RevenueCat.

Transfer to RevenueCat: RevenueCat Inc. (USA) processes data relating to your subscription as a processor, covered by the standard contractual clauses. Policy: revenuecat.com/privacy.

Legal basis: performance of a contract.

Retention period: for as long as the account exists + 10 years for billing data (legal accounting obligation).

4.7 Data stored locally on your device

The following data is stored on your phone in native Secure Storage (Android Keystore today; iOS Keychain once the iOS version is made available), encrypted by the operating system and accessible only while the device is unlocked:

Return reminders. This option is off by default. If you turn it on in Profile, the app schedules two local reminders, three and seven days after your last app opening. Each new opening resets the schedule. You can turn the option off in Profile or disable notifications in your phone’s settings. These reminders do not pass through our servers.

Sharing a recap image. When you share a recap, the image is composed on your device, written to a temporary file, then handed to the system share sheet. It does not go through any server, and we do not know who you send it to.

Compromised device detection. When the app launches, it checks locally whether the device is “rooted” or “jailbroken” so it can warn you if its secure storage can no longer be considered reliable. The result of this check is not sent to anyone.

Temporary files (JSON export, OCR, sharing) may be created on your device and are automatically deleted.

4.8 Bug and crash reports

Data collected:

• Problem description (entered by you — manual report via Profile → Report a problem)
• The last three actions performed in the app (opt-in — crash report only; you explicitly tick the “Attach my recent actions” box)
• Report type (manual or automatic)
• Technical error message (if applicable, for crashes)
• Timestamp

What we do not collect in reports: the content of your notes, your priorities, your energy levels, or your personal intentions.

Purpose: improving the stability and quality of the service, resolving malfunctions.

Legal basis:

• Manual report: performance of a contract (Art. 6(1)(b) GDPR) — you choose to use the reporting feature
• Crash report with recent actions: consent (Art. 6(1)(a) GDPR) — you explicitly tick the box to send the actions

Retention period: 12 months from resolution of the report, then deletion.

Recipients: internal team (admin back office — restricted access).

4.9 Support and account recovery

If you contact us to recover an account, the following information is recorded in a support request and sent by email to our team:

• Contact email address (entered by you)
• Previous account email address
• Approximate creation date (entered by you)
• Device used (described by you — not collected automatically)
• Approximate date of last sign-in
• Optional note

This information is kept in our database for no more than 30 days so that we can handle your request, then automatically deleted. Any copies that may remain in support email inboxes are subject to the retention policy of our provider and support team.

Legal basis: performance of a contract / legitimate interests (customer service).

Ordinary support tickets (message, details and optional attachment) are kept while they are being handled. If you attach an image to a support ticket, it is sent to our support team with the ticket; this is separate from OCR import, which is processed on the device. After resolution, tickets and their attachments are deleted no later than 12 months afterwards; open tickets are not purged while they remain necessary to handle the request.

5. Mobile permissions requested

Permissions not requested: GPS location, contacts, address book, health data, Bluetooth, NFC, broad external storage access.

6. Transfers outside the European Union

The mechanism is not the same for every provider. A processor established in the Union (Mistral AI, Brevo) does not give rise to an international transfer at its level: the GDPR applies to it directly. For processors established outside the Union (Railway Corporation, RevenueCat), the transfer is governed by the European Commission standard contractual clauses.

Details about Railway hosting: as of the verification on 28 August 2026, the production PostgreSQL database is documented as hosted in Railway’s US East region. Railway Corporation is established in the United States, so the processing agreement and applicable standard contractual clauses must be checked and kept up to date in accordance with Articles 28 and 46 of the GDPR.

Details about Mistral AI: the company is French and therefore directly subject to the GDPR. This does not prejudge where its own subprocessors are located; Mistral AI publishes them at trust.mistral.ai/subprocessors.

7. Processors and recipients

Your data is not sold or shared for commercial purposes.

Recipients:

1. Our internal team — only authorised people have access according to their specific responsibilities
2. Molleva’s technical administration (back office). To be transparent, here is what this tool actually lets its users see: the list of accounts with their email addresses, a search by email address, an individual account record, the text of submitted problem reports, and subscription events linked to an email address. It does not provide access to the content of your notes. Access relies on a shared API key held by the publisher.
3. Our technical subprocessors (listed above, solely for the services they provide)
4. The competent judicial or administrative authorities (on lawful request)

Your data is not sold or shared for commercial or advertising purposes, either with third parties or within our group.

8. Security

Technical and organisational measures in place:

• Encryption in transit: HTTPS is mandatory; no unencrypted connections are used in production
• Encryption at rest: server-side hashed tokens (HMAC with a secret key), mobile data in native Secure Storage (WHEN_UNLOCKED_THIS_DEVICE_ONLY)
• Short token lifetimes: access token 15 min, refresh token 30 days, absolute session limit 90 days
• Rate limiting: all authentication routes are protected by rate limits (by IP address and email address)
• Secure OTP: 6-digit code, expires in 5 minutes, maximum of 3 attempts, minimum response delay to prevent timing attacks
• Token reuse detection: reusing a refresh token that has already been rotated causes all sessions to be revoked. A brief tolerance window, 60 seconds by default, follows each rotation: it absorbs replays caused by a network interruption or two simultaneous requests, which are not attacks. After that time, revocation is immediate
• Log redaction: email addresses, tokens and user content are masked in all system logs
• Ownership checks: every resource is checked on the server; the user_id comes from the token, never from the client
• No session replay

9. Your rights

Under the GDPR (Articles 15 to 22) and the French Data Protection Act (Loi Informatique et Libertés):

Response time: 1 month (extendable to 3 months for complex requests, with prior notice).

Complaint to the CNIL: www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Legal guarantee of conformity

Independently of your rights over your personal data, since Molleva is a digital service, you benefit from the legal guarantee of conformity under Articles L224-25-12 and following of the French Consumer Code. Its terms are set out in Article 12 of the Terms and Conditions of Sale.

10. Access and deletion features in the app

Exporting your data (Portability)

From Profile → Export my data, you can download a JSON file containing: account information, profile, notes/captures, daily priorities, check-ins, small wins, daily anchors, support intentions, recurring habits.

Deleting your account (Right to erasure)

From Profile → Delete my account:

• All your data is deleted from the server within 7 days
• All sessions are revoked immediately
• All local data is erased (tokens, preferences, reminders, temporary files, scheduled notifications)
• Backups expire within 30 days
• Recent authentication is required for this action (security)

11. Minors

Molleva is not intended for anyone under 15 (the minimum age required under French law for digital consent — Article 45 of Law No. 78-17 of 6 January 1978, as amended). Under the age of 15, consent is given jointly by the minor and the holder of parental authority. If we learn that a minor under 15 has created an account without valid parental consent, we will delete that account.

12. Changes

We will notify you of any substantial change in the app before it takes effect. The current version is always available in the app (Profile → Legal notices).

13. Contact

Email: contact@molleva.fr

Mail: Ammar Osei-Mohamend — Data Protection Service — 8 bis rue Abel, 75012 Paris