Protecting your privacy and your child's is a starting condition, not an option. This policy describes what Dikivo collects, why, for how long, and what you can demand. It applies the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and French data protection law.
In one sentence: we collect the minimum needed to run the routines, we collect no health data, we show no advertising and we sell nothing.
This is a translation. The French version prevails in the event of a discrepancy.
1. Data controller
BjX Tech, SASU with share capital of €100.00, SIREN 101 470 334, France.
Publication director: Ramzi BEJAOUI.
Contact: contact@dikivo.app.
2. Data we collect
2.1 Parent account
- First name, last name and email address.
- Password, stored hashed, never in clear text. If you sign in with Google or Apple, we store no password at all.
- Account identifier generated at sign up.
- App language and notification preferences.
2.2 Child profile
This information is entered by you, under your parental authority, and is used only to personalise how routines are displayed.
- The child's first name or nickname.
- Date of birth, used to suggest age appropriate routines.
- Gender and illustrated avatar.
No health data. Dikivo collects no diagnosis, no declared condition, no special needs, no photo and no biometric data. Fields of that kind that existed in an earlier version were removed from the app and erased from the database in August 2026.
2.3 Routine usage
- Routines created, step cards and their order.
- Completed steps, stars earned, reward chosen by the parent.
- Routine start and end times, used to compute the progress shown to the parent.
2.4 Technical data
- Device model, operating system and app version.
- Connection data: date, time and IP address.
- Notification token, only if you turn reminders on.
- Anonymised crash reports.
2.5 Subscription data
Payment is collected by the App Store or Google Play. We neither receive nor store any bank or card data. We keep only what is needed to activate and maintain your access:
- the transaction identifier passed on by the store;
- the plan purchased and its status (trial, active, expired, cancelled);
- the start, end and renewal dates.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, authenticating you | Performance of the contract |
| Running the routines, cards, stars and rewards | Performance of the contract |
| Showing progress and the independence report to the parent | Performance of the contract |
| Sending the daily reminder and service notifications | Consent (can be turned on and off at any time) |
| Activating and maintaining the subscription, preventing fraud | Performance of the contract and legitimate interest |
| Measuring usage in aggregate and fixing crashes | Legitimate interest |
| Keeping accounting records | Legal obligation |
We do not sell your data and never use it for advertising. The app contains no advertising and no advertising identifier is collected.
4. Recipients and processors
Your data is shared only with the providers strictly required to run the service, each bound by a contract compliant with article 28 GDPR and acting solely on our documented instructions.
| Processor | Role | Location | Safeguard |
|---|---|---|---|
| Railway Corp. | Server and database hosting | European Union (Amsterdam) | Standard contractual clauses |
| Google LLC (Firebase) | Push notifications, aggregate usage measurement, crash reports | United States | Google Data Processing Addendum + standard contractual clauses |
| Google LLC (Play) | App distribution and subscription billing | United States | Google Play terms + standard contractual clauses |
| Apple Inc. | App distribution and subscription billing | United States | Apple Developer Program terms |
| IONOS SARL | Hosting of the dikivo.app website | France | Processing within the European Union |
For providers established outside the European Union, transfers are covered by the European Commission's standard contractual clauses. You can request information about these safeguards at contact@dikivo.app.
Data may also be disclosed to competent authorities where the law requires it.
This list is exhaustive. No artificial intelligence provider appears on it: the content you enter is sent to no external model.
5. Retention periods
| Category | Period |
|---|---|
| Account and child profiles | Lifetime of the account, then 3 years after the last activity |
| Routines and completion history | Lifetime of the account, deleted on request |
| Technical and connection data | 12 months maximum |
| Billing records | 10 years (accounting obligation) |
Once these periods expire, data is deleted or irreversibly anonymised.
6. Security
- Encryption in transit (TLS 1.2 or above).
- Encryption at rest.
- Strictly limited and logged access to production data.
- Token based authentication, with expiry and rotation.
- Pseudonymisation of children's data.
No system is infallible. In the event of a data breach posing a risk to your rights, you would be informed without undue delay, in line with article 34 GDPR.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent at any time, without retroactive effect.
Two dedicated procedures are available:
- Delete your account and all associated data.
- Delete part of your data without closing your account, for example a child profile or a routine.
You can also exercise your rights directly in the app (Settings) or by writing to contact@dikivo.app. We answer within one month. If our answer does not satisfy you, you may lodge a complaint with the French supervisory authority, the CNIL, or with your own national authority.
8. Children
Dikivo is aimed at parents, who are adults. Children have no account, do not sign in and enter no personal information: they tick off cards created by their parent.
A child's data is entered by their parent, under parental authority, and is never used for advertising or commercial purposes. The parent exercises all the rights listed in section 7 on the child's behalf.
9. Cookies and trackers
The dikivo.app website sets no cookies. The app uses only technical identifiers needed to run, never for advertising or cross app tracking. Details are in the cookie policy.
10. Changes to this policy
This policy may change. Any substantial change is announced in the app or by email. The last updated date appears at the top of this document, and the version in force stays available from the app settings.
Data protection contact: contact@dikivo.app.