The short version
- What Kalibrant keeps for you (breaches found, analysis history, conversations with our experts) is encrypted with a key that never leaves your iPhone. We cannot read it.
- A message you have checked is first masked by your iPhone, analysed in a few seconds, then deleted from our servers. Our European AI provider keeps it for at most 30 days to fight abuse, and never uses it to train its models.
- To watch for breaches, we need to know your email address: it is stored unencrypted and used only for that purpose.
- Your data is hosted in the European Union. It is never sold or used for advertising. The app contains no advertising or tracking tools.
- You can export your data and delete your account in the app, in the Me tab.
1. Who is responsible
The data controller is JONSTOMP Lionel, sole trader (entrepreneur individuel) trading as Kalibrant, Taverny, France, SIREN 883 962 987.
For any question about your data: contact@kalibrant.com.
2. Data we use
Your account
Your email address, or the identifier provided by Apple or Google if you sign in with them. If you choose “Hide My Email” with Apple, we only receive a relay address. We also keep your first name if provided, the app language, your iPhone's public encryption key and the date you confirmed saving your 12 words. The 12 words themselves never leave your iPhone.
Messages you have checked
Before anything is sent, your iPhone masks your personal information: IBAN, card number, social security number, a code received by text, your email, and your first name in “Hello…”. It keeps what helps spot a scam: links, numbers to call back, amounts. The masked message is sent to our servers, passed to our analysis providers (section 4), then deleted. Kalibrant does not keep the analysed content and does not write it to any log. We only keep the number of checks this month, to apply your plan's limits.
The result of each check is added to your history, encrypted with your key (up to 1,000 checks; older ones are deleted beyond that).
Breach monitoring
The email addresses you ask us to watch, after verification with a code. They are stored unencrypted, because we must submit them regularly to Have I Been Pwned. Breaches found are stored encrypted with your key: we cannot read their details.
Conversations with our experts (Sérénité plan)
Messages are end-to-end encrypted between you and our analysts: only you and they can read them, not our hosting provider. We keep anonymous statistics (number of conversations, response times) to monitor service quality.
Your subscription
Payment is handled by Apple: we never receive your bank details. Apple sends us signed information about the subscription (transaction identifier, plan, expiry date, renewal, refund), which we use to activate your plan.
Notifications
If you allow them, your iPhone's notification identifier (up to 10 devices per account) and your notification settings. A notification never contains the name of a breach. Reminders (steps left after a breach, saving your 12 words) are scheduled by your iPhone itself: our servers know nothing about them.
Abuse prevention
Like any online service, our hosting provider keeps technical logs (IP address, time and type of request, without message content). We also keep your account identifier and the time of certain actions (sending a code, a new breach search, a test notification, account deletion), as well as a non-reversible fingerprint of the addresses a code is sent to. This lets us limit repeated requests.
The Journal
Journal articles are collected by our servers, without knowing anything about you. Images in franceinfo articles are displayed directly from the franceinfo website: as with any web page, that site then sees your connection's IP address, but not your account or email. Opening an article takes you to its source's website, which applies its own policy.
When you write to us
Your email address and the content of your message to contact@kalibrant.com, so we can reply.
3. Legal bases
| Use | Legal basis (GDPR, Article 6) |
|---|---|
| Account, checks, history, breach monitoring, conversations, subscription | Performance of the contract you accept by using the app |
| Notifications | Your consent, given in iOS and changeable at any time in the app or iPhone settings |
| Abuse prevention, service security | Our legitimate interest in protecting the service and its users |
| Replying to your messages | Our legitimate interest in replying, or performance of the contract |
We make no automated decision with legal effect on you. A verdict helps you decide: you choose what to do with the message.
4. Our providers
They act on our behalf and only receive what their task requires.
| Provider | Role | Data received | Location |
|---|---|---|---|
| Supabase | Hosting of the database, functions and sign-in | All data described in section 2 (analysed content passes through without being stored) | Servers in Paris; US company |
| Mistral AI | AI analysis of the message | Masked message text | France (European servers) |
| APIVoid | Reputation of links and websites | Links and domain names in the message | Italian company; analysis mainly in the United States (Google Cloud) |
| rdap.org | Creation date and holder of a domain name | Domain names in the message | International registries |
| Abstract API | Phone number checks | Numbers found in the analysed message | United States |
| Have I Been Pwned | Data breach search | Watched email addresses | Australian company; hosted in the United States |
| Mailjet | Sending codes by email | Your email address | France |
| Apple | Notifications, Sign in with Apple, purchases | Notification identifier, notification text, Apple identifier, subscription | United States |
| Sign in with Google | Your Google account identifier and email | United States | |
| Proton | Mailbox for contact@kalibrant.com | Emails you send us | Switzerland |
| Cloudflare | Hosting of this website | IP address of website visitors | Global network; US company |
Our analysts can access Sérénité conversations, since they are the ones replying to you. They cannot access your breaches or your history.
5. Data outside the European Union
Your data is hosted in Paris. Some one-off checks do, however, leave the European Union. Each transfer is covered:
- Supabase (US company, servers in Paris), Abstract API (phone numbers, United States) and Have I Been Pwned (Australian company, hosted on Microsoft Azure in the United States): European Commission standard contractual clauses, included in their data processing agreements.
- Apple, Google and Cloudflare: companies certified under the EU–US Data Privacy Framework.
- Proton (Switzerland): Switzerland benefits from a European Commission adequacy decision.
- APIVoid (Italian company) analyses links partly with US hosting providers. The links and domain names it receives come from the suspicious message, not from you: your iPhone removes your email from links before sending.
6. How long we keep it
| Data | Retention |
|---|---|
| Analysed message | Not kept by Kalibrant. At most 30 days at Mistral AI, to fight abuse. |
| Analysis history (encrypted) | Until you clear it or delete your account; up to 1,000 checks. |
| Watched addresses and breaches found | Until you stop watching the address or delete your account. |
| Conversations with our experts | Deleted when the conversation is closed, or after 24 hours without a new message. |
| Abuse prevention logs | 2 days. |
| Hosting provider technical logs | 7 days. |
| Journal articles | 120 days (no personal data). |
| Emails sent to contact@kalibrant.com | As long as needed to handle your request, then at most 3 years. |
| Account and everything linked to it | Until the account is deleted. Deletion is immediate and erases all linked data. Our hosting provider's technical backups then disappear within 7 days at most. |
Apple keeps its own record of your purchases, under its own rules.
7. Security
Your breaches, history and conversations are encrypted with a key that never leaves your iPhone, protected by your iPhone's security chip. Even if our servers were hacked, this data would remain unreadable. Traffic between the app and our servers is encrypted, and access to each piece of data is limited to its owner.
Your 12 words are the only way to recover this data on a new iPhone. If you lose them along with your iPhone, you keep your account and breach monitoring (breaches are searched again), but your history and past conversations are lost: we cannot decrypt them.
Think you have found a security flaw? Write to contact@kalibrant.com.
8. Your rights
At any time, you can access your data, correct it, erase it, receive a copy in a machine-readable format (portability), object to processing based on our legitimate interest, or ask for it to be restricted. You can also set instructions for what happens to your data after your death.
- Export your data: in the app, Me tab, “Export my data”. The file is prepared on your iPhone, encrypted data included, since your iPhone decrypts it.
- Delete your account: in the app, Me tab, “Delete my account”. Remember to also cancel your subscription in your iPhone settings: deleting the account does not stop it at Apple.
- Any other request: contact@kalibrant.com. We reply within one month.
If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr/fr/plaintes), or with the authority of your country of residence.
9. This website
This website sets no cookies, uses no audience measurement and loads no external resource. If you choose dark mode, that choice is saved in your browser, on your device only: it is never sent to us. Cloudflare, which hosts it, processes visitors' IP addresses to serve the pages and protect them against attacks.
10. Minors
Kalibrant is intended for people aged 15 and over. Below that age, a parent's consent is required. A parent who believes their child has given us data can write to us to have it erased.
11. Changes
If this policy changes significantly, we will let you know in the app before the change applies. The date at the top of this page shows the latest version.