Privacy policy

In short

Gavroche, the app, collects no data: your vault is encrypted and stays on your devices. The website gavroche.labroca.app, on the other hand, handles the strict minimum: the messages you send us through the contact form, and, only with your consent, visit statistics. This page details everything, in line with the GDPR.

Data controller

Any data collected through this site is processed by La Broca, a French sole proprietorship registered under SIRET 952 483 089 00027, reachable at hello@labroca.app. The publisher's full legal identity appears in the legal notice, accessible from the footer.

The Gavroche app: no collection

The app does not collect, transmit, or sell any personal data. There's no account to create, no Gavroche server, and no tracker.

• Your vault is encrypted (AES-GCM) and stored only on your devices.
• No analytics tool, no advertising, no third-party SDK inside the app.
• iCloud sync, optional and off by default, goes through your own Apple account and is end-to-end encrypted: we never have access to your data.
• Autofill runs entirely on the device.

The website: contact form

When you write to us through the form, we receive your name, email address, and message, solely to reply to you (legal basis: steps taken at your request, GDPR art. 6.1.b, and legitimate interest in replying, art. 6.1.f). These messages reach us by email and are kept for a maximum of 12 months after the last exchange, then deleted.

The website: audience measurement and cookies

The site uses audience measurement (Google Analytics) to understand how it's used. No measurement cookie is set without your consent: a banner lets you accept or decline, just as easily either way, and change your mind at any time (legal basis: consent, GDPR art. 6.1.a). Declining doesn't affect browsing in any way. Statistics are aggregated and only used to improve the site; they're kept for a maximum of 14 months.

The Chrome/Opera extension: no collection either

The autofill extension works exactly like the app: it doesn't collect, transmit, or sell any data. It communicates only locally, on your device, with the Gavroche app installed on your Mac, never with a server.

• The extension reads the displayed page only to spot login fields (username/password) and offer to fill them, this content is never sent anywhere.
• The all-sites access permission (host_permissions) is used only to detect a login form on any site you visit; it is not used to observe or record your browsing.
• Communication with the Mac app (nativeMessaging) stays strictly local to your device (stdio channel), never over the network.
• No analytics tool, no advertising, no third-party SDK in the extension.

Recipients and processors

No data is sold or shared for advertising purposes. Our providers only act on instruction:

• Vercel Inc. (United States): site hosting.
• Resend: delivery of contact form emails.
• Google Ireland Ltd: audience measurement, only if you consent.
• Apple: app distribution and payment via the App Store, we never receive any personal or banking information about you.

Transfers outside the European Union

Some providers (Vercel, Google) are based in the United States. These transfers are governed by the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.

Your rights

Under the GDPR and French data protection law, you have the following rights over your data:

• Right of access, rectification, and erasure.
• Right to restrict processing and right to object.
• Right to data portability.
• Right to withdraw your consent at any time (audience measurement).

Exercising your rights

Write to us at hello@labroca.app: we reply within a month. You can also file a complaint with the CNIL (cnil.fr), the French data protection authority. For the app's data, everything is already in your hands: it only ever exists on your devices, deleting it is entirely up to you.

Children

The app is suitable for all audiences and collects no data, including regarding minors.

Changes

This policy may be updated, notably when new services are activated (audience measurement). The last-updated date above reflects the version in force.

Contact

A question about this policy? hello@labroca.app