Privacy Policy
Last updated: 27 August 2026
Publisher: X&A Ventures — SAS, 67 boulevard Suchet, 75016 Paris, France —
contact: supportdefix@xa-ventures.com
01Who we are
Défix is a mobile culture-quiz app published by X&A Ventures ("we"). This policy explains which personal data we process, why, and the rights available to you. The data controller is X&A Ventures.
02Data we collect
We collect only what the game needs to work.
| Data | When | Why | Status |
|---|---|---|---|
| Email address | On sign-up / sign-in | To create and secure your account (one-time code sign-in, no password) | Required |
| Display name | Optional, chosen by you | To identify you in leaderboards; by default a neutral name is generated | Optional |
| Approximate location | Only if you enable it, and only while the app is open | To suggest challenges tied to where you are. Never in the background. | Optional |
| Gameplay data | While you play | Scores, levels, badges, streaks, followed themes, game history, question reports — for progression and leaderboards | Required to play |
| Push notification token | If you accept notifications | To send you the daily reminder and league notifications | Optional |
| Diagnostic data | When a crash or technical error occurs | To identify and fix malfunctions (error type, device model, app version). No account identifier is attached to it. | Automatic |
| Feedback messages | If you send us any | To handle your feedback | Optional |
Declining the optional data does not prevent you from using the app; only the related features (appearing in leaderboards under a chosen name, location-based challenges, reminders) will be unavailable.
We do not collect: passwords, contacts, photos, microphone, health data, advertising identifiers.
03What we don't do
- We do not sell your data.
- We use no advertising trackers and no third-party audience measurement tool, and we do not follow your activity across other apps or websites (no "tracking" in the App Store sense). The only third-party SDK in the app is a technical diagnostics tool (Sentry), which reports crashes with no account identifier attached.
- We do not track your location continuously: location is requested occasionally, while the app is open, and only if you allow it. You can refuse or revoke it at any time in your phone settings — the app works fully without it.
04Legal basis (GDPR)
- Performance of the service (art. 6.1.b): email, gameplay data, display name — necessary to provide the game.
- Consent (art. 6.1.a): approximate location and push notifications — enabled only if you consent, revocable at any time.
- Legitimate interest (art. 6.1.f): account security, abuse prevention, service improvement.
05Processors and hosting
We rely on providers that process data on our behalf, under contract:
- Supabase — authentication, database, hosting of account and gameplay data.
- Expo (Expo Application Services) — sending push notifications and delivering app updates.
- Resend — sending the emails that carry your one-time sign-in code.
- Apple / Google — technical delivery of push notifications (APNs / FCM).
- Sentry — collection of crash and technical error reports, with no account identifier attached.
- OpenStreetMap / Nominatim — converting an approximate position into an area name, only when your phone's own location service cannot do it.
Our application data is primarily hosted in Ireland (European Union) via Supabase. Some of our providers or their own sub-processors may process certain data from countries outside the European Economic Area (in particular for the technical delivery of push notifications by Apple and Google); where that is the case, the safeguards required by the GDPR (standard contractual clauses or an equivalent mechanism) are implemented by those providers.
06Retention
We keep each category of data for as long as the purpose it was collected for requires:
| Data | Retention |
|---|---|
| Account (email, display name, gameplay data) | For as long as the account is active, then erased within 30 days of account deletion |
| Approximate location | Not kept beyond the immediate handling of the request; no location history |
| Push notification token | Until notifications are disabled or the account is deleted |
| Feedback messages | 12 months from the date sent |
| Crash reports (diagnostics) | 90 days |
| Technical and security logs | 12 months, for security and abuse detection |
After you delete your account, technical backups that may still contain your data are purged according to our normal backup rotation cycle. Aggregated and anonymised gameplay data, which can no longer identify you, may be kept beyond these periods.
07Your rights
Under the GDPR you have rights of access, rectification, erasure, portability, restriction and objection. To exercise them, write to supportdefix@xa-ventures.com.
- Delete your account: directly in the app, via Profile → Delete my account. Deletion erases your account and the personal data associated with it.
- You can also withdraw location or notification permission at any time in your phone settings.
You may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
08Minors
Défix is neither designed for nor promoted to an audience under 15 — the age from which, under French law, a minor may consent alone to the processing of their data in the context of an information society service. Below that age, signing up requires the joint consent of the minor and the holder of parental authority.
We do not ask for age at sign-up and therefore cannot guarantee that no user under 15 accesses the service. If you are a parent or legal guardian and believe a minor under 15 has created an account without the required consent, contact us at supportdefix@xa-ventures.com so that we can delete the account and the associated data.
09Security
Exchanges with our servers are encrypted (HTTPS/TLS). Access to account data is protected and restricted. As no method is infallible, we cannot guarantee absolute security, but we apply reasonable and up-to-date measures.
10Changes
We may update this policy. In the event of a significant change, we will let you know in the app or by email. The date at the top shows the latest revision.
11Contact
For any question about your data: supportdefix@xa-ventures.com.