Privacy policy

Last updated: 12 November 2026

This is a translation. The French version is the one that legally applies.

Bocal is an app for keeping, together, the links you send each other. This page explains what data Bocal uses, why, for how long, and what your rights are. It follows the General Data Protection Regulation (GDPR) and the Belgian law of 30 July 2018 on data protection.

In short: no account, no e-mail, no ads, no trackers, no cookies. Bocal only keeps what it needs for your jars to work.

Who is responsible for your data?

Guillaume Vanden Herrewegen, in Belgium, who develops and publishes Bocal.

Contact for any question about your data: contact@g-vandenherrewegen.be

What data?

• Your first name (or a nickname): you choose it on first launch. The members of your jars see it.
• A technical identifier: a random number created by the app on first launch, with no link to your identity. It is used to recognise you without an account or password. The app also creates a random backup password that you never have to type: it lets you get your account back on your next phone.
• Your recovery code, if you create one (Settings): the server only keeps a fingerprint of it, computed with a secret key. The code cannot be worked out from it, even with the database.
• Your jars: their name, colour, emoji, members and who their admin is.
• The links you add: the link's address, its tags, the date, and who added it. To show a preview, the phone of the person who adds the link reads the title, the image address and the site name from its page, then saves them with the link. The server then copies this public image into a private space, visible only to the jar's members.
• The invite codes of your jars, and the wrong codes tried, with the IP address they came from (kept for one day at most, to block anyone trying to guess codes).
• Your purchases, once purchases are offered in the app (not yet), and only if you buy something: the product bought, the purchase token and order number given by Google Play, and the date. Bocal never receives your name, your e-mail address or your payment method: Google Play takes the payment.
• Your reports and blocks: if you report a link or a person, the reason, the jar, a copy of the reported link and first name, and your identifier (against abuse; the reported person never knows who reported them). If you block someone, the list of people you have blocked (they don't know).
• Notifications, only if you allow them on your phone: a notification token (a technical address given by Google or Apple to reach this phone), the app's language, your phone's time zone offset (for the evening summary at your time), the app's version number (to announce an update), and your notification settings (what notifies you, the summary time, the jars you muted). To avoid duplicates, the server also briefly records each notification sent (who caused it, the jar, the link).
• Technical data: like any online service, the server receives your phone's IP address with each exchange. It is used to run the service and protect it against abuse, and it is deleted from the server logs after a few days.

Bocal never asks for your last name, e-mail, phone number, location, contacts or photos.

Why, and on what basis?

• Running Bocal (creating jars, inviting, adding and showing links, getting your account back on another phone): this is the service you ask for by using the app (GDPR, article 6.1.b, performance of a contract).
• Handling your purchases (checking with Google Play that a purchase is real, linking it to your account, finding it again on a new phone, removing it if it is refunded or cancelled): this is the purchase contract (article 6.1.b). Keeping a record of purchases for the accounts: legal obligation (article 6.1.c).
• Protecting the service (limits against abuse, blocking after too many wrong codes, technical logs) and backing it up (to restore it after a failure): legitimate interest in keeping Bocal safe and available for everyone (article 6.1.f).
• Handling reports (removing illegal or abusive content, excluding a person): legitimate interest in keeping jars safe for everyone (article 6.1.f).

Your data is never sold, used for advertising, or used to build a profile of you.

Who sees your data?

• The members of your jars see your first name, the links you add and the content of the jars. Anyone who has a jar's code sees its list of members and can join it: only share your codes with people you trust.
• Supabase (Supabase Inc.) hosts Bocal's database, on servers located in the European Union. Supabase acts as a processor, under a data processing agreement that complies with the GDPR. For support and maintenance, Supabase may access the data from other countries, with the safeguards provided by the GDPR (standard contractual clauses of the European Commission).
• Google (Google Ireland Ltd), on Android only: the identifier and the backup password are kept by your phone's Google Play services (Block Store), which give them back to Bocal on your next Android phone. They only go into your online Google backup if it is end-to-end encrypted (screen locked with a PIN, pattern or password): Google then cannot read them.
• Google (Google Ireland Ltd) also sends, through Gmail, the e-mail that tells Bocal about a report, with the content of the report. Google acts as a processor.
• Apple (Apple Distribution International Ltd), on iPhone only: the identifier and the backup password are kept in your iCloud Keychain, which gives them back to Bocal on your next iPhone with the same Apple Account. iCloud Keychain is end-to-end encrypted: Apple cannot read them. If it is turned off, they stay on your iPhone only.
• Google (Google Ireland Ltd, Firebase Cloud Messaging), only if you allow notifications: Bocal's server hands it each notification (its text, for example “Léa joined the jar Restos”, and your phone's token) so that it delivers it. On iPhone, Google passes it to Apple's notification service (APNs), which delivers it to your iPhone. Google acts as a processor and does not use these notifications for advertising.
• Google Play (Google Ireland Ltd), only if you buy something, once that is possible: Google Play takes the payment, under its own terms and privacy policy, as a separate controller. Bocal's server asks Google Play to check each purchase, and every night to find out which purchases were refunded or cancelled.
• GitHub (GitHub Inc.) hosts the web page that opens when you tap an invite link. GitHub receives the IP address of whoever opens the page. GitHub also keeps the database backups: every night, an automatic GitHub service (GitHub Actions) makes a copy, encrypts it straight away with a key whose secret part only Bocal's publisher holds, then stores it for 30 days. GitHub cannot read these copies. GitHub is certified under the EU–US Data Privacy Framework.
• The linked sites: for the preview, only the phone of the person who adds a link opens its page (or the preview interface of YouTube or TikTok). The site then receives that phone's IP address, just as when you open the link yourself. The preview image is downloaded by Bocal's server: the other members never contact that site unless they open the link.

For how long?

• Your data stays as long as you use Bocal.
• When you leave a jar, your place in it is deleted. The links you added to it stay for the other members.
• A jar with no members left is deleted immediately, with its links.
• The copy of a link's preview image is erased when the link is deleted.
• Delete my data (in the app: your initial at the top of the home screen) immediately erases your first name, your identifier and your places in the jars. The links you added to shared jars stay there, without your name.
• An identifier with no jar for 30 days (for example if you uninstalled the app) is erased automatically.
• Wrong codes tried, and the IP address that goes with them, are erased after one day.
• Your recovery code's fingerprint is replaced when you create a new one, and erased with your identifier.
• A report is kept for one year, then erased. A block stays until you unblock the person, and disappears with your account.
• The notification token is erased when you delete your data, when Google or Apple says it is no longer valid (app uninstalled, notifications refused), or when it is not among your 10 most recent phones. The record of notifications sent is erased after 7 days.
• Backups are kept for 30 days: erased data also disappears from the backups at most 30 days later.
• A purchase stays recorded for as long as it is valid. After “Delete my data”, it is detached from you (no first name or identifier any more): it stays, with the product, the token and the order number, so that “Restore purchases” can find it and for the accounts. A refunded or cancelled purchase is erased.

Cookies and storage on your phone

Bocal uses no cookies, no audience measurement tool, no advertising tracker.

The app only keeps on your phone what it needs to work: your session (so it doesn't ask for your first name every time you open it) and your settings (sounds, vibrations, language). This is strictly necessary for the service you ask for: no consent is required for it (ePrivacy Directive, article 5.3, and Belgian law of 13 June 2005, article 129). Uninstalling the app erases everything, except, on Android, the account backup for your next phone: “Delete my data” erases it too.

The invite web page sets no cookies and uses no trackers.

Your rights

At any time, you can:

• access your data and receive a copy in a common format (right of access and to data portability);
• correct your first name (in the app, or by writing to us);
• erase your data (“Delete my data” in the app, or by writing to us);
• object to processing or ask for it to be restricted.

Write to contact@g-vandenherrewegen.be giving your first name in Bocal and the name of one of your jars, so we can find you without an account. We reply within one month.

If you think your rights are not respected, you can file a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit): rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, contact@apd-gba.be.

Minimum age

Bocal is meant for people aged 13 and over (the age set in Belgium to consent alone to an online service). Below that age, ask a parent for permission.

Security

Exchanges between the app and the server are encrypted (HTTPS), and the database only accepts encrypted connections. Each person can only read and change the jars they are a member of: this is checked by the database itself, not only by the app. Limits prevent abuse (number of jars, links, codes tried per account and per IP address). The recovery code is never stored in clear, and backups are encrypted.

Changes

If this policy changes, the new version will be published in the app and on privacy.html, with its date.