Privacy Policy
28 October 2026 · v2026-10-28
This policy explains what data the Monsieur François app collects, why, and what rights you have as a result. Most of the app works fully on your device — below we explain exactly what, if anything, ever reaches our servers or other companies.
Who is responsible for your data
The controller of your personal data — the one who decides why and how it is processed — is Joanna Wargalla, ul. Zawiszy 4 lok. 1, 01-167 Warszawa, Poland. In this policy, "we" means the controller. For questions about your data or to exercise your rights, write to privacy@monsieurfrancois.app.
What data we collect
When you create an account, you provide your name, email address, password, age and gender (gender is used only so the app can address you with the correct grammatical forms). Your password is never stored in plain text — we only store a one-way cryptographic hash (PBKDF2-SHA256) with a unique salt. You can also create an account or sign in with Google or Apple: Google or Apple then gives us the identifier of your account with them, your email address (with Apple this may be a forwarding address if you choose to hide yours) and — if you allow it — your name; we never receive your Google or Apple password or access to any other data in those accounts, and an account created this way does not need a password in the app. For learners aged 13 to 16 (inclusive) we also store when they confirmed at registration that a parent or guardian agrees. While you are signed in, the app syncs your learning progress with our server so it is available on each of your devices: completed lessons, exercise results, the review state of your flashcards, the words in your own word list (with their example sentences), your study days (used to count your streak, with an identifier of the device they were recorded on), the days covered by a streak freeze or a streak repair, the rewards you have already collected (so that none is paid twice), your Louis d’or and XP history, your level and selected settings (such as your learning goal, daily XP goal, reminder time and sound, and when you last repaired your streak). Your Louis d’or balance is kept by our server. Our server also stores the sittings and results of L’Examen de François; for each purchase, the store, the product, the transaction number, the purchase data returned by the store (the receipt), its status and expiry date and whether a free trial is running; and data on your use of the AI features: how many messages you sent to the AI Assistant each day (not their content), the identifier, start and end time and length of each François Live call, and the cost of your AI use each month. To protect accounts against password guessing, we record failed sign-in attempts for an email address: the address, the number of attempts and any temporary lock. Your device's IP address reaches our servers with every request; we use it briefly to limit the number of requests and do not store it in our database. If you allow notifications, we also store your device's notification token, its time zone and whether study reminders are switched on (details below). Your profile photo itself never leaves your device. When you share your streak or your week's summary, the app makes the image on your device: it shows only the number of days or XP and the Monsieur François logo, never your name, nickname or photo. It leaves your phone only through the app you choose to share it with, and it is never sent to us. We also record which versions of the Terms of Service and this Privacy Policy you accepted and when, and — for each purchase — the statement you ticked in the purchase summary right before it, in the wording shown, with the time. If you add lessons from your study plan to your phone's calendar, the app saves the events in the calendar on your device; they are not sent to us. Providing your name, email address, password, age and gender is voluntary, but without them an account cannot be created, and the app is used with an account; everything else is collected only when you use the feature concerned.
Why we process this data
We use account and progress data to provide the service: authentication, syncing your learning across devices, running and grading L’Examen de François, handling purchases and the Premium and Premium Plus subscriptions, providing the AI features and enforcing their limits, sending the emails and notifications described in this policy and — if you join them — the friends leaderboard, leagues, Défi and referrals. We also use some data to keep the service secure and working: to block password guessing and abuse, to correct Louis d’or entries that break the rules, and to find and fix crashes. We never use your account and progress data to select ads, and we never sell your data.
Legal basis for processing
We process data to perform our contract with you (GDPR Art. 6(1)(b)): the account, syncing, L’Examen de François, purchases and subscriptions, the AI features including François Live and François’s notes after a call, your word list, leagues, Défi, referrals, service emails such as codes, and the notifications you switch on in the app — including the notification token and, while reminders are on, your time zone and whether you have studied that day, needed for the evening streak reminder. We rely on your consent (Art. 6(1)(a)) for personalised ads, for crash reports sent to Sentry if you switch them on in Settings, and for the friends leaderboard — joining it is your consent and leaving it withdraws it; for learners under 16, a parent or guardian gives that consent (Art. 8 GDPR), and a learner aged 16 joins on their own consent but, as an additional safeguard, also only once a parent or guardian consents; you can withdraw consent at any time, which does not affect processing that took place before. We rely on our legitimate interests (Art. 6(1)(f)) for the security of the service (limiting requests by IP address, recording failed sign-ins, preventing abuse of Louis d’or and referrals), for showing non-personalised ads that fund the free version, for keeping purchase records needed to handle refunds and disputes, and for keeping the record of the documents you accepted and of the statements made before a purchase, to be able to show what was agreed, and for keeping a parent's or guardian's email address and the history of their consent, to be able to show that consent was given; you can object to this processing.
Who we share data with
We use service providers who process data on our behalf and only on our instructions. Cloudflare hosts our servers, the database and the course content and recordings the app downloads, so it processes all the data stored on our servers and the IP addresses of connections. Resend sends our emails (password reset and address confirmation codes, parental consent requests, purchase confirmations) and receives the recipient's email address, the learner's name and the content of the email. OpenAI provides the AI features — see the sections on the AI Assistant and on François Live. Sentry monitors crashes and quality — see below. Expo delivers push notifications, through Google Firebase Cloud Messaging (Android) or the Apple Push Notification service (iOS). Google provides the ads and the consent form in the free version (AdMob — see Advertising). Purchases are made in Google Play or the App Store: our server checks each purchase directly with Google or Apple and receives their notifications about renewals, cancellations and refunds. Google and Apple also process data under their own terms as operators of the stores and of your phone's system services. None of our service providers may use your data for their own marketing.
Transfers outside the European Economic Area
Several of these recipients — Cloudflare, OpenAI, Resend, Sentry, Expo, Google and Apple — are based in the United States or may process data there or in other countries outside the European Economic Area. Such transfers take place only with the safeguards required by the GDPR: on the basis of a European Commission adequacy decision — for example the EU–US Data Privacy Framework, where the recipient is certified under it — or of standard contractual clauses approved by the European Commission. You can ask us for information about these safeguards, or for a copy of them, at privacy@monsieurfrancois.app.
AI Assistant, role-plays and text checks
These features are part of Premium Plus and available only to account holders aged 16 or over. Monsieur François in the AI Assistant and the characters in the role-plays are not real people: their replies are generated by artificial intelligence (OpenAI models). When you use them, the app sends your request to our server, which forwards it to OpenAI: in a chat, the conversation so far (at most 40 messages — what you wrote and the earlier replies); in a text check, the text you submitted (up to 2,000 characters) and its topic. Our server adds instructions with your level, the interface language and your grammatical gender. OpenAI does not receive your name, email address, account identifier or IP address — the request comes from our server. We do not store the content of chats or checked texts on our servers (except replies you report — see below); we only count your messages per day and the cost of your AI use. To keep the limit of messages in any 24 hours, we also count your AI messages per hour (without their content); these counts are deleted automatically after 48 hours. OpenAI Ireland Limited (for customers in the EEA) processes the data on our behalf under a data processing agreement (Art. 28 GDPR) to generate the reply; OpenAI does not use it to train its models and, to detect abuse, may keep it for at most 30 days. Do not include sensitive data or other people's data in your messages. Before the AI features are first used, the app explains in a separate window that data goes to OpenAI and asks you to confirm (an App Store requirement); you can withdraw that confirmation in Settings (Privacy) — until you confirm again nothing is sent and the AI features are unavailable. We process this data to perform our contract with you (Art. 6(1)(b) GDPR), not on the basis of that confirmation. Before your message goes to the model and before a reply is shown, OpenAI's moderation service checks it; content that breaks the rules (for example sexual, violent or hateful content) is not sent to the model or shown. You can report any AI reply with the Report button: we then store on our server the reported reply, the message that led to it, the reason you chose and any comment, with your account identifier and the time of the report, so that we can review it and improve our safeguards. Reports are deleted after 180 days or together with your account. We moderate and keep reports on the basis of our legitimate interest in keeping the service safe (Art. 6(1)(f) GDPR).
François Live and the microphone
François Live is a spoken conversation with Monsieur François, who is an AI, not a person: his voice and replies are generated by OpenAI models. It is part of Premium Plus and available only to account holders aged 16 or over. The microphone is used only during a call you start yourself, and only after you allow it in your phone's system settings. During a call, the sound from your microphone is streamed over an encrypted connection directly from your phone to OpenAI; our server only sets up the call. Because the connection is direct, OpenAI receives your device's IP address. To set up the call, our server sends OpenAI François’s instructions, which include your level, the interface language, your grammatical gender, the chosen topic and correction style — never your name, email address or account identifier. OpenAI also transcribes the conversation into text, which the app shows as captions. After a call in which you spoke, the app sends the text transcript (at most the last 20,000 characters) through our server to OpenAI to prepare François’s notes: corrections, words worth reviewing and a short comment. We do not record calls, and we do not store the audio or the transcript on our servers. If you add a word from the notes to your word list, it is saved with one sentence from the conversation as its example and, like your other words, synced with our server while you are signed in; you can delete it at any time. For each call our server stores the identifier OpenAI gives the call, when it started and ended, the seconds reserved and used, and the AI cost charged to your monthly allowance, to count your minutes; this is kept until the account is deleted. OpenAI Ireland Limited (for customers in the EEA) processes the audio and transcripts on our behalf under a data processing agreement (Art. 28 GDPR); OpenAI does not use them to train its models and, to detect abuse, may keep them for at most 30 days. Before the first call, the app explains this in a separate window and asks you to confirm; you can withdraw that confirmation in Settings (Privacy). A call does not have to be about your real life — you can make things up; the doctor's visit topic is a role-play, and François does not ask about your health, beliefs or other people's details. A call ends when you tap "End", when you leave the app, or when the call's time runs out. We process this data to perform our contract with you (Art. 6(1)(b) GDPR).
Speech recognition in exercises
Pronunciation training and some exercises let you answer out loud. For this the app uses your phone's built-in speech recognition service — on Android usually Google's, on iOS Apple's — after asking for permission to use the microphone. What you say is processed by that service under its provider's terms; depending on your device and settings, it may be processed on the phone or on the provider's servers. The app only receives the recognised text, which it uses to check your answer. The app does not record or store the audio and does not send it to us or to OpenAI.
Advertising
If you do not have Premium or Premium Plus, the app shows full-screen ads from Google AdMob, which may be videos, at natural break points — for example after finishing a lesson or a review session — at most once every 5 minutes and never during an exercise. Without Premium you can also choose to watch a rewarded video ad in the Store for Louis d’or (the number of rewards per day is limited); it is shown only when you tap the button meant for it and follows the same rules as the other ads described in this section — AdMob collects the same data, the same consent choices apply, and we collect no additional data in connection with it. AdMob may collect device identifiers (such as the advertising ID), approximate location derived from the IP address, and data on how ads are shown and interacted with, to serve, limit and measure ads and to prevent fraud. In the European Economic Area, the UK and Switzerland, the app shows Google's consent form (compliant with the IAB TCF standard) on first launch, where you decide about personalised ads and related use of data; you can review and change that choice at any time in the app's Settings. Learners under 18, and anyone whose age the app does not yet know (for example before signing in), get only non-personalised ads suitable for all ages: the app asks Google to treat their ad requests as coming from a user under the age of consent. Personalised ads rely on your consent; non-personalised ads rely on our legitimate interest in funding the free version — where the law requires consent for storing or reading information on your device, the consent form asks for it. On iOS the form may be followed by the system prompt from Apple asking for permission to track (App Tracking Transparency); without that permission ads on iOS do not use the advertising identifier. Google is a separate controller of the data used for ads; for collecting that data in the app and passing it to Google, we are responsible jointly with Google. Google processes this data under its own terms: https://policies.google.com/technologies/partner-sites. The Premium and Premium Plus subscriptions remove ads entirely: for subscribers neither the Google ad SDK nor the consent form is started.
Crash and quality monitoring
To find and fix errors in the app, we use Sentry — only if you switch crash reports on in Settings (Privacy); they are off by default. When the app crashes or hits an error, Sentry receives a technical report: the error and where in the code it happened, your device model, system and app version, and a trail of the last events in the app (such as screens and the addresses of network requests with their result — never their content). The app does not attach your IP address or any account identifier to these reports and does not record your screen or session; passwords and verification codes are never sent. Like any server, Sentry sees the IP address of the connection that delivers a report. If the app shows you a feedback form, what you type there — and your name or email address, if you choose to enter them — goes to Sentry. The legal basis is your consent (Art. 6(1)(a) GDPR), which also covers reading the device information the report needs; you can withdraw it at any time with the same switch. Sentry keeps reports for a limited period under its data retention rules.
Push notifications
Study reminders you set yourself are scheduled by the app on your device. The evening streak reminder — sent at about 21:00 your phone's time if your streak is still alive and you have not studied yet that day — is sent by our server, because only the server knows whether you studied on another device. Competition notifications (a gift from a friend, a Défi invitation or completion, being overtaken in your league, being in the relegation zone) and the notice that you have earned a referral reward are also sent by our server. Server notifications are sent only if you allow notifications. For this we store your device's notification token, its platform (Android or iOS), interface language, whether study reminders are switched on and a daily log of which notifications were sent, and — while study reminders are on — the phone's time zone (its offset from UTC). To decide whether to send the streak reminder, the server checks the progress you sync anyway (XP, flashcards, exercise results and days covered by a streak freeze); it does not keep anything new about it. You get the streak reminder, being overtaken and the relegation warning at most once a day; being overtaken is never sent between 22:00 and 8:00 your time. Other notifications arrive when the event happens. Notifications are delivered by Expo through Google Firebase Cloud Messaging or the Apple Push Notification service. They never contain your name or email address — at most a friend's leaderboard nickname. We process this data to send the notifications you switch on in the app (performance of the contract, Art. 6(1)(b) GDPR); showing notifications at all also needs your permission in the phone's settings. You can turn off competition notifications or study reminders in Settings — the streak reminder from our server stops when either is off — or withdraw the permission in your phone's settings. We delete the token when you turn off competition notifications in the app, when you withdraw the permission in your phone's settings (the next time the app starts) and when you sign out.
How long we keep data
We keep account data until you delete your account (available in Settings) or ask us to delete it. Once deleted, your account and everything linked to it — sessions and codes, synced progress, your word list and Louis d’or balance, exam history, purchase records, AI feature and François Live data, notification tokens, parental consent records, and friends leaderboard, league, Défi and referral data — is permanently and irreversibly removed from our servers, and that account's local copy of your progress is removed from the device. If several accounts use the same device, each keeps its own separate copy of its progress. The copy stored on your device is also removed when you uninstall the app. Exceptions: records of failed sign-in attempts are deleted after a successful sign-in, a password reset or the deletion of the account and in any case automatically about one day after the last attempt, once no lock is in force; the daily log of sent notifications is deleted automatically after 7 days; IP addresses are used to limit requests only within a 60-second window; reports in Sentry and data at OpenAI are kept for the periods described above; what Google and Apple keep about your purchases is governed by their terms. Sessions are deleted 7 days after they expire, or 30 days after you sign out of them; password reset and email confirmation codes one day after they expire. A parental consent request that nobody answered, or that a newer request replaced, is deleted together with the parent's email address after 30 days; a confirmed or refused consent is kept until the account is deleted. The record of the documents you accepted and of the statements made before a purchase is kept until the account is deleted. Database backups, which may still contain deleted data, are deleted within 30 days. So that the same Louis d’or pack can never be credited twice, for every pack credited we keep a one-way hash (SHA-256) of the store's transaction number, together with the store and the date; this record contains no account, product or amount, is kept after the account is deleted, and is deleted automatically 3 years after the transaction.
Your rights
You have the right to access your data and receive a copy of it, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on our legitimate interests. Where processing relies on your consent, you can withdraw it at any time. You can delete your account yourself in the app Settings or — without the app — as described on the page “Deleting your account and data” on our website; for anything else, including a copy of your data in a machine-readable format, write to privacy@monsieurfrancois.app — we reply without undue delay, within one month at the latest. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR); the automatic grading and promotion in L’Examen de François and the choice of your level are not such decisions — they serve your learning only, and you can retake the exam. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you live or work — in Poland, the President of the Personal Data Protection Office (UODO), and in France the Commission nationale de l’informatique et des libertés (CNIL).
Data security
All communication between the app and our servers happens over encrypted HTTPS, and François Live audio over an encrypted connection. Passwords are salted and hashed, sign-in is protected against password guessing by limits on attempts, and session tokens are stored on your device in the secure, encrypted OS keystore (Keychain/Keystore) rather than in plain app storage.
Friends leaderboard
The friends leaderboard is optional and only switches on when you join it. We then create a profile with a French nickname generated by the app (for example "Loup Curieux 417") and a friend code. Our server stores the experience points (XP) you earn while studying, with the date and week they were earned. Friends — people who entered your code or whose code you entered — see only the nickname and the number of points earned this week, never your name, email address or photo. The leaderboard has no messaging and no way to search for other people. At any time you can hide yourself, remove or block a friend, or leave the leaderboard, which deletes the profile and the friends list. We process this data on the basis of your consent, given by joining the leaderboard (Art. 6(1)(a) GDPR), which you withdraw by leaving it; for learners under 16, a parent or guardian gives that consent (Art. 8 GDPR), and a learner aged 16 joins on their own consent but, as an additional safeguard, also only once a parent or guardian consents.
Weekly leagues and gifts
Leagues are optional and open to learners aged 17 or over. Once you join, each week you are placed in a group of up to 30 participants from the same timezone, who see your nickname and this week's XP. We store the group, the timezone (offset from UTC), the league and the week's result. Gifts can only be sent to friends; we store the sender, the recipient, the kind of gift and when it was opened. Gifts never move Louis d’or between accounts. You can leave the leagues at any time, and league and gift data are deleted together with the account. We process this data to provide the service you asked for (Art. 6(1)(b) GDPR).
Weekly Défi
A Défi is an optional shared weekly goal for 2 to 4 friends. We store who started it, who was invited, who accepted or declined, the goal, and whether it was reached. Members see each other's nicknames and this week's XP. You can step out of a Défi at any time, and its data is deleted together with the account. We process this data to provide the service you asked for (Art. 6(1)(b) GDPR).
Referrals
If you share your referral code and someone enters it after creating their account, we store the link between the two accounts, when the code was entered and whether the reward has been paid. To decide when the reward is due, we check whether the new account has a confirmed email address and on how many days it has studied. Neither person sees the other's data: whoever shared the code only sees how many people used it and how many rewards were paid. The link is deleted together with either account. We process this data to provide the service you asked for (Art. 6(1)(b) GDPR).
Children and minors
An account can be created from the age of 13; between 13 and 16 (inclusive), the person registering states that a parent or guardian agrees — this is their own statement, not a parent's consent within the meaning of the GDPR. Age is what you enter at registration; the app counts it forward from the date the account was created. A learner aged 16 or under can join the friends leaderboard only once a parent or guardian consents: we email them — at an address that must not be the address of any account in the app — a description of the feature and a link where, stating that they are the parent or legal guardian, they confirm or refuse. We keep the parent's email address and the history of that consent to be able to show it was given (Art. 6(1)(f) GDPR), until the account is deleted. The parent can withdraw consent at any time from the same link — the leaderboard is then switched off and the profile and friends list are deleted. Weekly leagues are open only to learners aged 17 or over. The AI features (François Live, the AI Assistant and role-plays, text checks) are available only to learners aged 16 or over, so Premium Plus is not offered to younger learners. Learners under 18 see only non-personalised ads and lose no Louis d’or for missed days. Minors can buy a subscription or Louis d’or only through a parent or guardian, on the parent's or guardian's store account. Parents and guardians are responsible for supervising how their child uses their phone, the internet and the app. Where your app store (Apple App Store or Google Play) provides an age range for your account — as required in some US states — the app reads it on your device solely to apply age restrictions (for example to AI features, leagues and social features). We do not send this information to our servers, share it with advertisers or any other party, or use it for any other purpose.
Changes to this policy
We may update this policy, for example when the app gains new features or the law changes. We will tell you about significant changes in the app before they take effect: after signing in, the app shows the new version. The date and version number at the top show the current version; earlier versions are available on request at privacy@monsieurfrancois.app.
Contact
For anything concerning your personal data, write to privacy@monsieurfrancois.app. For other matters, write to contact@monsieurfrancois.app. Our full details are in the section "Who is responsible for your data".