Privacy Policy · MeetMood

Last updated: October 20, 2026

1. Who We Are

MeetMood is a mobile application and partner portal operated by Yann Joachim Heymug Ewodo (the "controller"). For any question regarding the protection of your personal information, contact us at [email protected], Website: https://meetmood.app

2. Information We Collect

a) User account (if you create one)

Email address, display name and chosen emoji.
Password stored only as a salted hash (bcrypt), never readable by us.
Date of birth (for age-based content filtering).

b) Device and session identifiers

A device identifier (random UUID) is created on first launch and stored locally on your phone. It is sent to the server with each analytics request to associate your interactions with a unique install, without identifying you personally.
A session identifier (random UUID) is also stored locally; it links your activities within a single app install.
These identifiers persist until you uninstall the app or request deletion.

c) Preferences and usage

City, language, budget, interests, maximum distance and preferred time, stored locally and synced with our server.
Mood selections, swipe history (left/right), used to personalise your recommendations.
Saved activities, kept locally and on the server.

d) Location

Your precise position is used to find activities around you. It answers your request and is then dropped: it is never stored as such.
If you have turned on partner offer notifications, an approximate position (rounded to about 1 km) is kept alongside your notification token so we only send you offers near you. You can turn it off at any time in Profile, Notifications; the position then stops being used.

e) Push notification token

Used only to send you the suggestions you opted in to (weather, weekend, inactivity, partner offers).

f) Behavioural analytics data

Event names (e.g. swipe_right, mood_selected, call_clicked) together with language and selected mood are recorded in our own database. This data is used solely to improve the app and provide aggregated statistics to partner businesses. It is not sold or shared with third parties for advertising purposes.

g) Partner portal data (businesses)

Business email, name and details, address, phone number (optional), website URL (optional), venue photo.
Stripe subscription data (customer ID, subscription ID), banking details are processed directly by Stripe and never reach us.

h) Cookies, partner portal only

The partner portal accessible via web browser uses two essential technical cookies, set only when you log into your partner space:

Cookie	Duration	Purpose
`biz_session`	7 days	Maintains your login session on the partner portal. Essential to operation.
`biz_flash`	5 seconds	Shows confirmation or error messages after an action (e.g. "Changes saved"). Clears automatically.

These cookies are essential to the service; no tracking, advertising or third-party analytics cookie is set.

3. What We Do NOT Collect

App users' phone number (except businesses that provide it voluntarily).
Banking or credit card details (handled exclusively by Stripe, Apple or Google).
Address book or contacts.
Precise, continuous location data.

4. How We Use Your Information

Provide personalised activity recommendations based on your mood, budget and location.
Send you the notifications you opted in to.
Improve app performance and fix bugs.
Provide partner businesses with aggregated, anonymous engagement statistics.
Meet legal obligations and respond to your rights requests.

5. Third-Party Services and Transfers Outside Québec

Service	Purpose
Railway (United States)	Hosting of our server and our database. All the information described in section 2 is stored there, in the "US West (United States)" region. Transfer to the United States.
Cloudflare R2 (United States)	Object storage: place images shown in the app (temporary cache) and catalogue datasets. No personal information is stored there.
Resend (United States)	Transactional email delivery: verification code, password reset, partner portal confirmations and notices. Your email address and display name are sent to it at sending time.
Sentry (United States)	Crash monitoring for the mobile app only: no Sentry SDK is installed on our servers. Technical data (OS version, error trace) may be transmitted when a crash occurs, with your consent. Transfer to the United States.
Google (Places, Maps, geocoding) (United States)	Nearby place and activity search, maps, and converting a city name into coordinates. Your search coordinates and, where applicable, the text you type in the Mood Scanner are sent at search time to find relevant results. No account identifier is sent, and no profile is stored with these providers.
Ticketmaster (United States)	Nearby event and show search. Your search coordinates are sent at search time.
OpenWeatherMap	Local weather data. Your approximate coordinates are sent to fetch weather for your area.
Expo / React Native	App framework and push notifications.
RevenueCat	In-app purchase management (premium subscriptions).
Stripe	B2B partner subscription payments.
Anthropic (United States)	Generation of activity suggestions and Secret Date clues. The free text you enter (your Mood Scanner description, a Secret Date personalization detail) is sent to Anthropic to generate the response. This text is not retained by MeetMood after generation. No account identifier or location is sent.

Where your information is hosted: our server and our database are hosted by Railway, in the "US West (United States)" region, that is, outside Québec. Database backups are kept with the same host. We make sure this information receives adequate protection there, as required by Law 25.

Regarding Sentry: if the mobile app crashes, and only if you have agreed to send crash reports, a technical error trace ("stack trace") containing information about your device and app version may be transmitted to Sentry Inc., whose servers are located in the United States. No Sentry SDK is installed on our servers: no server-side data is sent to it. This monitoring tool is configured with sendDefaultPii: false, which excludes the transmission of directly identifying data, and session tokens are stripped from every report before it is sent. For any question about this monitoring, write to us at [email protected].

6. Data Retention

Anonymous analytics data: 12 months, then deleted.
Push tokens: deleted on uninstall or when permissions are revoked.
Account data: kept until account deletion, then erased immediately and irreversibly.
Deletion register: when an account is deleted, we keep one entry attesting that the deletion took place — its date, what triggered it, and its outcome. This entry contains no address, no name, no identifier: only a non-reversible cryptographic fingerprint, which cannot re-identify you or reconstitute the account. We keep it because Law 25 and the GDPR require us to be able to demonstrate that an erasure request was honoured.
Session data and device identifier: kept while the app is installed.

7. Event Submissions

Anyone can submit an event through the public form, without holding an account. We then collect the organizer's email together with the event details they provide (title, description, category, address and position, dates, promoter type and, where applicable, a link to a website or an image). The organizer's email is required; the other information is what they choose to provide.

This email is used to follow up on and moderate the event; and, for an approved event, to contact the organizer again for a future edition. It is never made public: neither the card nor the listing shown in the app displays it, only the moderation queue sees it.

Retention: a rejected submission is deleted after 90 days. For an approved submission, the email is kept 12 months after the event ends or, if no end date is given, 12 months after its start date, then deleted; the event's public listing, however, remains. To access this email, have it corrected or request its erasure, write to us at [email protected]; the rights described in section 8 apply in the same way.

8. Your Rights Under Québec's Law 25

Under the Act to modernize legislative provisions as regards the protection of personal information (Law 25) and the Act respecting the protection of personal information in the private sector, you have the following rights:

Right of access: obtain a copy of the personal information we hold about you.
Right of rectification: have any inaccurate or incomplete information corrected.
Right to withdraw consent: withdraw your consent to the processing of your information, subject to legal obligations.
Right to portability: receive your information in a structured, commonly used technological format.
Right to deletion: request the erasure of your information. To delete your account and all your data, open the app → Preferences → Delete my account. Deletion is immediate and irreversible. It only happens after your explicit confirmation: no deletion can be triggered without that assertion of intent. Afterwards only the register entry described in section 6 remains, which cannot re-identify you.
Right to file a complaint with the Commission d'accès à l'information du Québec (CAI) if you believe your rights were not respected: cai.gouv.qc.ca, Tel.: 1 888 528-7741.

To exercise these rights, write to us at [email protected].

9. Children

MeetMood is not directed at persons under 14. Under Law 25, consent for a person under 14 must be given by the holder of parental authority or by the tutor. We do not knowingly collect information from persons under 14; if we learn that an account was created by such a person without that consent, we delete it.

10. Changes to This Policy

We may update this policy. The "last updated" date at the top reflects any changes. Continued use of the app constitutes acceptance.

11. Contact and Personal Information Protection Officer

Yann Joachim Heymug Ewodo, Personal Information Protection Officer
[email protected], https://meetmood.app