The short version: we collect as little as possible, encrypt file contents before upload, and sell nothing. Here's the long version anyway.
To run the Service we process: your email and display name; billing details (handled by our payment processors - we never see full card numbers); device and app metadata needed for sync (device name, OS, app version); and technical logs (IP address, timestamps) for security and debugging. File metadata (names, sizes, folder structure) is processed to provide the file library and name search. File contents are encrypted on your device before upload; encrypted bytes are transferred over HTTPS and remain encrypted in storage.
We do not build advertising profiles, sell or rent personal data, scan your files for marketing purposes, or use your Content for unrelated purposes.
We use personal data to operate and secure the Service (legal basis: contract), to prevent abuse and fraud (legitimate interest), to send service emails like security alerts and billing receipts (contract), and to maintain the release waitlist when you submit your address (consent; removal is available on request). The waitlist does not currently run an email distribution.
Scaleway (Paris region, France), running self-hosted Appwrite is our hosting processor: it runs account authentication, the database, encrypted file storage and this website. Appwrite stores your password in hashed form, keeps the sign-in session records you can review and revoke in Settings → Security (IP address, browser, operating system, approximate country) and sends the account emails (address verification, password recovery). Other service providers process payments and deliver transactional email. Email privacy@merci.0x12.eu to request the current processor categories and processing locations. We disclose data to authorities when legally required.
Account data is kept while the account is active. Items moved to the trash remain available for the retention period shown in the app; emptying the trash permanently deletes them. Settings → Profile lets you request account deletion, which starts an irreversible deletion process. Limited records may be retained where the law requires it.
You can correct your profile name and email and request account deletion from Settings. For access, portability, restriction, objection or another privacy request, email privacy@merci.0x12.eu. EU/EEA residents have the full set of GDPR rights, detailed on our GDPR page, including the right to complain to your supervisory authority (ours is the French CNIL).
Merci! isn't directed at children under 15 in France, or under 13 elsewhere (or the higher age local law sets in your country). A parent or guardian must provide any consent required by local law and supervise the account. If we learn we hold data of a child below the threshold without consent, we delete it.
Data controller: EURL ZENATI (operating the Service under the trade name “Merci!”), a French single-member limited liability company registered with the Paris Trade & Companies Register under no. 981 830 227, registered office: 60 rue François 1er, 75008 Paris, France. The Data Protection Officer is reachable at dpo@merci.0x12.eu, and privacy requests can be sent to privacy@merci.0x12.eu.
Cloud storage for real life. Every photo, doc and memory - warm, safe and everywhere you are.