Dinouna • Privacy policy

Privacy

Dinouna keeps as little data as possible. This page says which data, why, and how to erase it.

Last updated: 22 October 2026

1. Who is responsible for your data

Dinouna is published:

• on Google Play, by INSTITUT OUMAYNA LLC, À COMPLÉTER PAR LE SPONSOR : adresse postale du siège;
• on the App Store, by Alexandre Bert, À COMPLÉTER PAR LE SPONSOR : adresse postale.

Each is responsible for the data of the players who downloaded Dinouna from their store. On this page, “we” means the publisher of your app.

For any question about your data, including questions from parents, write to us: À COMPLÉTER PAR LE SPONSOR : adresse e-mail du support, or call us: À COMPLÉTER PAR LE SPONSOR : numéro de téléphone. À COMPLÉTER PAR LE SPONSOR : INSTITUT OUMAYNA LLC ou Alexandre Bert answers for both publishers.

2. What stays on your phone

To play, the app keeps on the phone:

• the players’ first names, which you type in to play with others;
• your settings: sounds, level, game options;
• your progress: grids started and finished, questions and words that have already come up (so you do not see them again too soon), your Daily Challenge scores for the last 60 days, and the number of challenges you have completed;
• the counter of the day’s free rounds;
• the last known status of your subscription, so you can play even without the internet;
• if you are signed in, the sign-in key to your Dinouna account, stored in the phone’s secure vault (the keychain).

None of this is sent to us. “Sign out” erases the sign-in key. To erase everything, delete the app from the phone.

3. What our server keeps, if you create an account

The account is optional: you can play perfectly well without one. It is used to find your subscription on another phone, even from an iPhone to an Android. You create it with “Continue with Apple” or “Continue with Google”.

Our data retention policy. This table and the paragraphs below are our written data retention policy. Each piece of data is kept only as long as its purpose requires, and never indefinitely. “Last used” means the last time the app, signed in to the account, contacted our server. Deleted data cannot be retrieved.

What we do not keep: your name, your email address, your age, your photo, your phone number, your location, your bank card.

• With Apple, Dinouna asks for neither your name nor your email address.
• Google’s sign-in token contains other information, such as your email address. Our server does not use it and does not keep it: it only keeps the number of your Google account.

Messages from the stores. Apple and Google notify our server when a subscription changes: renewal, cancellation, refund. We keep the number of each message for 60 days, so as not to process it twice, then it is erased. This number says nothing about you.

Technical logs. Like any server, ours sees the IP address of the devices that connect to it. Dinouna’s code does not keep it. The server’s technical logs, which are used for its security and to fix faults, are kept for 30 days.

Backups. Our server’s backups are kept for 30 days. Data deleted from an account disappears from the backups after that time.

4. Payment and the subscription

• You pay through Apple or Google. We never see your bank card or your payment details.
• If you subscribe without an account, the app checks the subscription directly with Apple or Google, on the phone. Our server keeps nothing about it.
• If you are signed in, the app sends the proof of purchase to our server. It checks it with Apple or Google, then records it on your account (see the table above).

5. Why we keep it

The European General Data Protection Regulation (GDPR) requires us to state the legal basis on which we keep each piece of data.

• The account and the subscription: to provide the service you ask for, finding your subscription everywhere. This is the performance of the contract (Article 6(1)(b) of the GDPR).
• The numbers of the store messages and the technical logs: so that the server works well and stays secure. This is our legitimate interest (Article 6(1)(f) of the GDPR).

We do no advertising, no profiling and no automated decision-making about you.

6. Who with

• Apple, for signing in (“Continue with Apple”) and for payment in the App Store. When you delete, from the app, an account opened with Apple, our server also asks Apple to remove the link between your Apple ID and Dinouna.
• Google, for signing in (“Continue with Google”) and for payment in Google Play. Our server asks Google for the status of a subscription, and confirms to Google that a purchase has been received.
• Our host, OVH, which rents us the server where the accounts run. The server is located in France, in Gravelines.

Apple and Google also process data on their side, under their own rules: see Apple’s privacy policy and Google’s privacy policy. They are American companies: data exchanged with them may be processed outside the European Union, with their own safeguards.

Nobody else receives your data: no advertising network, no measurement tool, no account service. The accounts are kept on our own server.

7. Children

Dinouna is for everyone, from age 7, as a family. Children use it, so it is designed for them:

• no ads, no trackers, no audience measurement tools;
• no chat between players, no photos: you play together, on a single phone. A child cannot make any personal information public in Dinouna;
• an adult can send a result from the app, for example the Daily Challenge score, after the question for parents. The message has no first name and no personal information: only the date, the score and the website address. It goes through the app the adult chooses, and nothing is sent to us;
• players are round badges with their initial, and their first names stay on the phone;
• the account is optional: a child can play perfectly well without one.

The parental check. A question for adults comes before the subscription offer, before the “My account” screen, before sharing a result, and before any link that leaves the app. It is a multiplication written in words, different every time, for example “What is seven times eight?”, which you answer with a number keypad. It keeps young children away from these screens; it is not a way of checking age.

The account is for adults. Before signing in, the app asks for the month and year of birth, without suggesting any answer. If the person is under 18, the app does not offer to sign in, and suggests asking a parent. This answer stays on the phone and is never sent to us. When the App Store or Google Play gives the app the user’s age range, the app uses it in the same way, and does not keep it.

A child cannot agree alone to an online service using their data: under 13 in the United States and the United Kingdom, under 15 in France. That is why only an adult can create a Dinouna account. If a child has created an account, delete it from the app or write to us.

For parents in the United States (COPPA)

• What we collect from children: nothing that says who they are: no name, no email address, no photo, no voice, no location. When a parent has signed in on the phone, the app sends our server, whoever is playing, only numbers: the Dinouna account number and the proof of a purchase. The server also sees the phone’s IP address.
• What these numbers are used for: only the internal operations of the app: recognising the account, unlocking Dinouna Complete on the account’s phones, checking purchases with Apple or Google, and keeping the server secure.
• How we make sure of it: the app has no advertising, no analytics tool and no tracker; our server keeps nothing else; nobody uses these numbers to contact a person, to show ads or to build a profile; they are never sold. Apple or Google receive a purchase’s numbers to check it, and our host, OVH, stores the data for us.
• Your rights as a parent: at any time, you can ask to see the information we hold, have it deleted, and refuse any further collection. The quickest way: “Delete my account” in the app. Otherwise, contact us (see section 1). We first check that you are the account holder.
• To complain to the regulator: the Federal Trade Commission (FTC), at reportfraud.ftc.gov.

For families in the United Kingdom

• The UK GDPR applies, with the rights listed in section 8.
• We follow the Information Commissioner’s Office (ICO) Children’s code: the most private settings by default, no profiling, no location.
• Our representative in the United Kingdom: À COMPLÉTER PAR LE SPONSOR : nom, adresse et e-mail du représentant au Royaume-Uni.
• To complain to us: write to À COMPLÉTER PAR LE SPONSOR : adresse e-mail du support with the subject “Complaint”. We confirm receipt within 30 days, keep you informed, and tell you the outcome.
• To complain to the regulator: the ICO, at ico.org.uk/make-a-complaint.

8. Your rights

You can ask to see your data, to correct it, to erase it, to receive it in a file, or object to its use. You can also ask us to restrict its use.

• The simplest way: delete your account. Everything the server keeps about you is erased straight away. See Delete my account.
• For anything else, write to us: À COMPLÉTER PAR LE SPONSOR : adresse e-mail du support. We reply within one month at most. As we know neither your name nor your email address, we will ask you for something to check that the account really is yours.
• If you are not satisfied with our reply, you can complain to the CNIL, the French data protection authority: cnil.fr/fr/plaintes (in French).

9. This website

The dinouna.com website sets no cookies and uses no audience measurement tool. Its fonts and images are served by the website itself: your visit goes through no other service.

10. Security

• Exchanges between the app and our server are encrypted (HTTPS).
• The server checks each sign-in with Apple’s or Google’s public keys, and each purchase with the store.
• The sign-in key to your account is stored in the phone’s secure vault.

11. Changes to this page

If this policy changes, we update this page and the date at the top. Previous versions remain available on request.