Nous Deux

Privacy policy

Last updated: 15 November 2026

Publisher and contact

Nous Deux is a free, ad-free app for couples: a shared calendar, period tracking, location sharing if you turn it on, lists and little notes. For any question about this policy or your data, contact us through the project repository: github.com/Eragon67360/nous-deux.

Data we collect

We only process the data the app needs to work and to share things with your partner.

  • Account and authentication: sign-in identifier (sign in with Google or with Apple) and the email address Google or Apple provides, if any. For the few accounts we create ourselves (app store review, testing): an email address and a password, stored only as a hash.
  • Profile: display name, gender, app language, profile picture (avatar), link to your partner when you form a couple.
  • Shared calendar: titles, descriptions, dates and times of the events you or your partner create, and the countdown option if you turn it on for an event. Visible only within the couple.
  • Period tracking: if you choose to track your cycle: the start and end dates of your periods, how you feel each day if you note it (symptoms, mood) and your notes. This is health data. Your partner sees your dates and how you feel for as long as you share them: two switches in the Period tab, on by default, that you can turn off at any time. Your notes are never shared: nobody but you can read them.
  • Location (optional): if you enable location sharing, your real-time position (latitude, longitude) is used for display on the map. No location history is stored, and when you turn sharing off, your last position is erased.
  • Shared lists: list names, items, who added them and whether they are ticked. Visible only within the couple.
  • Little notes: the last little note each of you sent (its type and time), so your partner can see it. No history is kept.
  • Days together: the date your relationship started, which either of you can change.
  • Notifications: notification token (FCM) to send you the reminders you turn on (for example the reminder the evening before your partner's period), your partner's little notes, and word that their period started when they share their cycle.
  • Crash reports: when the app crashes or hits an unexpected error: what went wrong and where in the app's code, the app version, the phone's model and state (system version, memory, storage, battery, network), its language and time zone, and whether the app had just come back from the background. A report is built to say nothing about you: no account, name, phone number, email, IP address or location, and no screenshot. The app cleans its error texts of email addresses, phone numbers, identifiers and coordinates before sending them, and our server filters out IP addresses, email addresses and device identifiers again before storing anything.
  • Technical data: requested permissions (calendar, notifications, location, camera to scan your partner's QR code) and information needed for the app to work on your device.

Purposes of processing

The data is used to: provide and secure the service (sign-in, storage, sync); let you share within the couple (calendar, period tracking, lists, little notes, days-together counter, location if turned on); send the notifications you accepted; show the map (through OpenFreeMap) when location sharing is on; find and fix crashes and errors (crash reports).

Legal basis

Processing of data related to your account, your profile, the calendar, lists and little notes is necessary for the performance of the contract (use of the app). Cycle data is health data: we only process it with your explicit consent (Article 9(2)(a) GDPR), which you give by choosing to track your cycle in the app. We record when you gave it, and clear that record when you withdraw it. You can withdraw it at any time in Settings › Period: you stop tracking and can delete all your cycle data. Location sharing and push notifications are optional and also based on your consent; you can turn them off at any time in the app or device settings. Crash reports rely on our legitimate interest in keeping the app working (Article 6(1)(f) GDPR); they are limited to the technical details listed above, and you can object by contacting us.

Hosting and processors

Data is hosted and processed by the following services, in line with their privacy policies and applicable rules (including GDPR where relevant):

  • Hetzner (Germany): our own servers in Germany, running Supabase (open-source software): sign-in, database and profile photos, backed up every day over an encrypted connection to Hetzner storage in Finland. They also run GlitchTip (open-source software), which receives crash reports. This website is hosted there too, with no ads. It counts its visits with Umami, open-source software running on these servers: pages viewed, the site you came from, browser, system, device type, screen size, language, approximate country, region and city (worked out from your IP address, which isn't kept), with no cookies. The site's only cookie remembers your language. The data stays in the EU.
  • Firebase (Google): sending push notifications (FCM).
  • OpenFreeMap (Hyperknot Software, Hungary): map tiles, from OpenStreetMap, shown when location sharing is on. To draw the map, your phone asks its servers for the areas on screen: no account, no cookies, and its logs don't keep your IP address, except error logs, deleted after 7 days. The service may go through the Cloudflare network.
  • Google and Apple: sign-in (Sign in with Google / Sign in with Apple); data processed by these services is governed by their own policies.

Retention

Data is kept while your account is active. For location and little notes, only the latest value is kept, and your location is erased as soon as you stop sharing it. If one of you leaves the couple, the couple's shared data (calendar, period dates and daily check-ins, location, lists, little notes and start date) is deleted for both of you; your cycle notes, which are yours alone, stay until you delete them. When you stop tracking your cycle, you can delete all your cycle data at once. When you delete your account (Settings › Account), your account, profile, photo and cycle notes are erased at once, and you leave the couple: its shared data is deleted for both of you. Backups are kept for 14 days: once an account is deleted or one of you leaves the couple, the erased data also disappears from the backups within 14 days. Crash reports are deleted after 30 days and are not backed up.

Your rights

Under the GDPR and applicable data protection law, you have the following rights:

  • Right of access to your personal data
  • Right to rectification of inaccurate or incomplete data
  • Right to erasure (subject to legal obligations)
  • Right to restriction of processing
  • Right to object to certain processing
  • Right to data portability
  • Right to withdraw your consent at any time, without affecting what was done before

To request deletion of your account and data, see the dedicated page: Account deletion.

To exercise your other rights, contact us via the GitHub link at the start of this document. You may also lodge a complaint with the CNIL (www.cnil.fr) or the supervisory authority in your country of residence.

Policy changes

We may change this policy. The version in force is the one published on this page, with its last-updated date shown at the top.

Effective date

This privacy policy took effect on 15 November 2026.