Privacy Policy

Last updated: 2026-10-14

1. Introduction

This Privacy Policy explains how EnableUnion SASU ("Lastribe", "we", "us", "our") collects, uses, stores and protects your personal data when you use the Lastribe mobile application, the website www.lastribe.eu and the related services (the "Service").

We apply the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the French Loi Informatique et Libertés (Law No. 78-17 of 6 January 1978, as amended) and the other European data protection rules that apply to us.

In addition to this Policy, the app shows short notices at the points where data is collected -- for example when it asks for the location permission, when you enable notifications, when you record medical information or when you are asked about analytics. These notices complement this Policy, in line with the CNIL's recommendations for mobile applications.

1.1 Languages

This Policy exists in the 24 official languages of the European Union offered in the app. The French and English versions were written by us. The other versions are machine translations that we are having reviewed; each one carries a notice until its review is complete. The version in your language informs you; where a translated sentence leaves a doubt about its meaning, the French version prevails. The French and English versions are always available at www.lastribe.eu/fr/privacy and www.lastribe.eu/en/privacy.

2. Data Controller

EnableUnion SASU — publisher of the Lastribe brand

Registered address: 7A rue Neuve, 57270 Uckange, France, European Union

SIREN: 103 184 941 — SIRET: 103 184 941 00013 — RCS Thionville

Share capital: EUR 3,000 — EU VAT: FR93103184941

President & Publication Director: Alexis Delaforge

Privacy contact: privacy@lastribe.eu

General contact: support@lastribe.eu

3. Privacy Contact

EnableUnion SASU has not appointed a data protection officer: our processing of special categories of data (the optional household medical information, Section 24) is opt-in and not carried out at large scale, so Article 37 of the GDPR does not require one.

All questions and requests about your personal data are handled by our privacy contact:

Privacy contact: privacy@lastribe.eu

Postal address: EnableUnion SASU — Privacy contact, 7A rue Neuve, 57270 Uckange, France

We answer within one month (Section 16).

4. Data We Collect

4.1 Waitlist Data (Pre-Launch)

When you join the waitlist on our website, we collect:

your e-mail address;
your preferred language;
how you heard about us, if you tell us (signup source).

Nothing else. Audience measurement on the website runs only after you accept it (Section 22.1).

4.2 Account Data

E-mail address
Password (stored as a salted one-way hash -- never in plaintext)
Display name
Date of birth (age verification -- 16+ only)
Preferred language
Where we offer sign-in with Google or Apple and you use it: your name, your e-mail address and an identifier from that provider

4.3 Profile Data (Optional)

Profile photo
Bio / personal description
City or region
Home address (optional, see Section 29): the exact coordinates are stored encrypted; a copy rounded to about 1 km serves alert and evacuation matching
Household information (members, pets)
Skills and interests
Referral code and referrals you made

4.4 Preparedness Data

Inventory items (name, quantity, category, expiry date, optional photo)
PrepScore and autonomy data
Course progress and quiz results
Checklists and shopping lists
Places you save (caches, meeting points, shelters you review) and evacuation routes you draw
Monitored places for alerts (chosen from a place search, city level)
Hazard reports you publish (description, position, optional photo)
Event participation and evidence (photos, videos, GPS coordinates, checklists), where Events are enabled
Badges earned and experience points (XP)

4.5 Community and Safety Data

Messages in Tribes and Households, and direct messages
Comments and votes on Risk Radar items and hazard reports
Membership status and role in Tribes and Households
Safety statuses and SOS you send (status, time, position when you share it)
Reports you file about a content (category, explanation, the content reported)
Your mesh node identifier when you use mesh devices (Section 26)

4.6 Payment Data

All payment processing is handled by the Apple App Store (iOS) and Google Play (Android) through their in-app purchase systems. Subscription management is coordinated by RevenueCat. We do not store your card numbers, CVC codes or banking details -- payment information is handled entirely by Apple and Google.

We receive from the app stores (via RevenueCat):

subscription status and plan details;
purchase, renewal and expiry dates.

4.7 Technical and Usage Data

Device type and operating system, app version, browser type (web)
IP address (kept in full in the sign-in security log and in session records for security and evidence purposes; removed from error reports; see Section 13 for retention)
Push notification token
Feature usage events, only if you accepted analytics (Section 22)
Crash reports and error data
Voice input: a recording of about five seconds when you dictate a form field. It is transcribed on our servers and discarded at once; only the value entered in the field is kept (Section 31)
Referral anti-fraud data: a technical fingerprint of the device and the first part of the IP address (/24 block) when an account is created with a referral code (Section 8)

5. Mandatory and Optional Data

Under GDPR Article 13(2)(e), we inform you whether the provision of data is mandatory or optional:

Mandatory for account creation:

E-mail address -- required for authentication and communication
Password -- required for account security (unless you sign in with Google or Apple, where offered)
Date of birth -- required for age verification (16+ only)

Mandatory for the Core Subscription:

Payment information -- processed by Apple or Google via in-app purchase, required for billing

Optional:

Display name, profile photo, bio
City or region -- enables localized features (alerts, Risk Radar, Tribes nearby)
Home address, monitored places -- enable alerts for those places
Household information, medical information, skills, interests
Inventory items, course progress, places, routes, hazard reports -- features you choose to use
Analytics -- off until you accept it

Consequences of not providing mandatory data: without e-mail, password (or a sign-in provider) and date of birth, you cannot create an account. Without payment information, you cannot subscribe to Core. All other data is optional -- the Service works without it, though some features are then unavailable.

6. How We Collect Data

We collect data through three channels:

Directly from you: when you create an account, fill in your profile, manage your inventory, complete courses, publish or report content, send a safety status, dictate a field or interact with the community.
Automatically: through PostHog analytics (only if you accepted it), Sentry error reports and server access logs.
From third parties: Apple and Google provide subscription status information via RevenueCat. Where we offer sign-in with Google or Apple and you use it, we receive your name, your e-mail address and a provider identifier. We do not buy data from data brokers.

7. Legal Bases for Processing (GDPR Art. 6)

Purpose	Legal basis
Account creation, authentication, sign-in with Google or Apple	Contract performance (Art. 6(1)(b))
Service features (PrepScore, inventory, courses, places, routes, Tribes, messaging)	Contract performance (Art. 6(1)(b))
Alerts: matching public alerts to your city, home and monitored places, and delivering them	Contract performance (Art. 6(1)(b))
Safety tools (SOS, safety status, hazard reports)	Contract performance (Art. 6(1)(b))
Voice input (transcription of a dictated field)	Contract performance (Art. 6(1)(b))
Payment processing and subscriptions	Contract performance (Art. 6(1)(b))
Waitlist registration	Consent (Art. 6(1)(a))
Push notifications	Consent (Art. 6(1)(a)), given through your device's permission
Product analytics (PostHog)	Consent (Art. 6(1)(a))
Household medical information	Explicit consent (Art. 9(2)(a)); vital interests for a person who cannot consent (Art. 9(2)(c))
Error monitoring (Sentry)	Legitimate interest (Art. 6(1)(f))
Security: sign-in log, account lockout, abuse prevention	Legitimate interest (Art. 6(1)(f))
Referral anti-fraud (device fingerprint, /24 IP block)	Legitimate interest (Art. 6(1)(f))
AI model improvement (anonymised feedback)	Legitimate interest (Art. 6(1)(f))
Handling reports of illegal content, statements of reasons, evidence preservation	Legal obligation (Art. 6(1)(c)) -- Regulation (EU) 2022/2065
Accounting and tax records	Legal obligation (Art. 6(1)(c))
Age verification (16+)	Legal obligation (Art. 6(1)(c))

8. Legitimate Interest Details (Art. 13(1)(d))

Where we rely on legitimate interest, the interests are:

Error monitoring: detect and fix crashes and bugs. Error reports are sent to Sentry (EU region) after your e-mail address and IP address have been removed on the device.
Security: keep a 180-day log of sign-ins (e-mail, IP, device), lock an account for 15 minutes after 5 failed sign-ins, and prevent unauthorised access.
Referral anti-fraud: compare a technical fingerprint of the device and the first part of the IP address with the referrer's recent referrals. A suspicious referral is reviewed by a person before any refusal (Terms, Appendix B).
AI model improvement: improve news classification using anonymised, aggregated feedback (votes, corrections). Individual users are not identifiable in training data.
Beta feedback: improve a safety product from the feedback testers send us (Beta Programme Charter, Section 5).

We have carried out a balancing test for each of these interests. You may ask for it at privacy@lastribe.eu and object to any of these processings at any time (Section 15.6).

9. How We Use Your Data

We use the data we collect to:

create and manage your account;
provide the Service features: PrepScore, inventory, courses, places and routes, Tribes and Households;
match public alerts to your city, your home and your monitored places, and notify you;
deliver your safety statuses, SOS and hazard reports to the people and areas you chose;
transcribe a field you dictate;
process payments and manage your subscription;
send transactional e-mails (account verification, password reset, subscription notices, changes to our terms);
send push notifications you enabled;
monitor, diagnose and fix technical issues;
understand how features are used, only if you accepted analytics;
prevent fraud and abuse, including referral fraud;
handle reports of content and moderation decisions (Terms, Section 17);
comply with our legal obligations.

We do not:

sell your data;

use your data for targeted advertising or advertising profiles;

share your data with data brokers;

take automated decisions with legal or similarly significant effects on you (Section 14).

10. Data Sharing & Recipients

Your data is shared only with the recipients below. Section 11 gives the details for each processor.

Our processors, which act on our instructions: OVH (hosting of all our servers in France), Resend (e-mails), Expo (push notifications), RevenueCat (subscriptions), PostHog (analytics, only with your consent), Sentry (error reports).
The app stores, Apple and Google, which process your purchases and, where offered, your sign-in.
Services your device or our server calls for a specific feature, which receive the minimum needed and no account data: Open-Meteo (weather for a position rounded to about 10 km), openrouteservice / HeiGIT (start, end and waypoints of a route you plan), RainViewer (precipitation radar tiles requested by your device), Open Food Facts (a barcode you scan).
Public alert and news sources (EUMETNET/MeteoAlarm, GDACS, USGS, NASA FIRMS, NOAA SWPC, Deutscher Wetterdienst, IODA, GDELT): we fetch their data; nothing about you is sent to them.
Other users, within the limits of Sections 27 and 29: your Household, your Tribe, the recipients of your messages, nearby users for a hazard report.
Authorities, when the law requires it (court order, DSA removal order, criminal referral under DSA Article 18) or to protect a person's life or safety.

Maps and AI models run on our own servers: no map or AI provider receives your data.

11. Sub-Processor List

Sub-processor	Purpose	Data received	Location / transfer	Reference
OVH SAS (OVHcloud)	Hosting of our servers (database, files, AI models, map tiles, backups)	All data of the Service, encrypted at rest for the most sensitive fields (Section 17)	France (EU)	ovhcloud.com/fr/personal-data-protection/data-protection
Apple Inc. (App Store)	In-app purchase processing; sign-in with Apple where offered	Purchase and subscription data; for sign-in: name, e-mail, identifier	Ireland (EU)	apple.com/legal/privacy
Google Ireland Ltd (Google Play / Google Play Billing)	In-app purchase and subscription billing; sign-in with Google where offered	Purchase and subscription data; for sign-in: name, e-mail, identifier	Ireland (EU)	policies.google.com/privacy
RevenueCat, Inc.	Subscription management	Anonymous app user ID, purchase receipts, subscription status	US -- Standard Contractual Clauses	revenuecat.com/dpa
Resend, Inc.	E-mail delivery	E-mail address, display name, content of the e-mail	US -- EU-US Data Privacy Framework + Standard Contractual Clauses	resend.com/legal/dpa
Expo (650 Industries, Inc.)	Push notifications	Push token, title and body of each notification	US -- Standard Contractual Clauses	expo.dev/privacy
PostHog, Inc.	Product analytics, only with your consent	Pseudonymous usage events, device type, app version; names and e-mails are stripped	Hosted in the EU (Frankfurt); US parent company bound by Standard Contractual Clauses for support access	posthog.com/docs/privacy
Functional Software, Inc. (Sentry)	Error monitoring	Error and performance data, device type, app version, user identifier; e-mail and IP removed before sending	EU region (Frankfurt); US company bound by Standard Contractual Clauses for support access	sentry.io/legal/dpa
Open-Meteo	Weather forecasts	A position rounded to about 10 km; no account data	Switzerland (European Commission adequacy decision)	open-meteo.com/en/terms
HeiGIT gGmbH (openrouteservice), Heidelberg	Route calculation (walking, cycling, driving)	Start, end and waypoints of the route you plan; no account data	Germany (EU)	heigit.org/legal-notice-and-privacy-policy
RainViewer	Precipitation radar tiles (Radar tab)	Device-side request: your device's IP address and the requested tile; no account data	Global tile CDN	rainviewer.com
Open Food Facts (association, France)	Barcode lookups when you scan a food item	Device-side request: the barcode number only; no account data	France (EU)	openfoodfacts.org

Public alert and news sources (EUMETNET/MeteoAlarm, GDACS, USGS, NASA FIRMS, NOAA SWPC, Deutscher Wetterdienst via Bright Sky, IODA, GDELT) receive no personal data: our server fetches their public feeds. Our map tiles and our AI models (Ollama, Whisper) are self-hosted on OVH and involve no other provider.

Sentry is active only in builds where error monitoring is configured. We update this list when a sub-processor changes and inform you of substantial changes (Section 32).

12. International Data Transfers

Primary storage: France, European Union (OVH).
EU-based recipients (Apple Ireland, Google Ireland, HeiGIT Germany, PostHog EU hosting, Sentry EU region, Open Food Facts): no transfer mechanism needed.
Switzerland (Open-Meteo): covered by the European Commission's adequacy decision.
US-based providers (RevenueCat, Resend, Expo) and the US parent companies of PostHog and Sentry: Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework, with encryption in transit and at rest.
RainViewer (global CDN): only your device's IP address and the tile requested reach it.

We have carried out Transfer Impact Assessments for the US-based providers, following the CJEU's Schrems II judgment and the CNIL's guidance. They are available to the CNIL on request.

13. Data Retention

Data category	Retention period
Waitlist e-mail	Until the launch notification is sent or you ask to be removed
Account, profile and preparedness data	Duration of the account; erased at the end of the 30-day grace period that follows a deletion request
Messages (Tribe, Household, direct)	Until you delete them or your account is erased -- deleted, not anonymised; a position shared in a message is deleted after 30 days
Hazard reports, comments, votes, places, routes	Until you delete them or your account is erased
Evidence files (photos, videos)	Until you delete them or your account is erased
Voice input recordings	Not stored: transcribed and discarded at once
Safety statuses and SOS	24 hours active, erased 7 days after expiry (position encrypted)
Reports of content and their evidence	30 days after a dismissed report; 6 months after any other decision; longer only under a legal hold requested by an authority
Moderation decisions	Kept with an opaque identifier after the account is erased (Regulation (EU) 2022/2065)
Subscription and payment records	10 years (French accounting and tax law)
Analytics events (with your consent)	Until you withdraw consent or your account is erased; the PostHog person is then deleted
Error reports	90 days
Server access logs	12 months (French legal requirement)
Sign-in security log	180 days (e-mail, IP, device -- purged nightly)
Failed sign-in counters	30 days after the last attempt (never while a lockout is active)
Consent records (IP, timestamp)	Duration of the account; erased with it
Sessions (IP, device)	7 days after the last activity (auto-extended while you use the app; deleted on sign-out)
Unsubscribe tokens (e-mail)	30 days after expiry or use
Notification history	90 days (titles and bodies of pushes sent to you -- purged nightly)
Beta feedback	Duration of the beta programme + 12 months
Admin audit log	Life of the platform (tamper-evident chain; opaque identifiers, no personal content)
AI training data	Anonymised and aggregated, not linked to individual accounts
Backups	Encrypted; local copies kept 7 days, off-site copies 30 days. Data you delete leaves the backups within 30 days

When you delete your account, you have 30 days to change your mind by signing in again. After that, your personal data is erased, except where a longer retention period is required by law (payment records) or by the Digital Services Act (reports of illegal content). Content you shared with other members is deleted, not anonymised. When the last member of a Household deletes their account, the Household and all its data (members, pets, inventory, medical information) are deleted with it.

14. Automated Decision-Making & Profiling (Art. 22)

We use automated processing in the following features:

PrepScore computation -- from your inventory, courses, events and community activity. An informational metric only: it affects no access and no right.
Badges and XP -- awarded automatically for your activity. Gamification only.
Next-step suggestions -- rules that propose courses or actions from your PrepScore. No artificial intelligence, no effect on your rights.
AI news classification and situation briefs -- processing of public content (news, alerts), not of your personal data (Section 31).
Referral anti-fraud -- a suspicious referral is flagged automatically but refused only after a person has reviewed it.
Account lockout -- after 5 failed sign-ins, sign-in is blocked for 15 minutes. A security measure with no lasting effect.

We do not use artificial intelligence to moderate your content or to take decisions about you. None of these processes produces legal effects or similarly significant effects on you. You may ask for a human review, express your point of view and contest an outcome at privacy@lastribe.eu.

15. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

15.1 Right of Access (Art. 15)

You can request a copy of all personal data we hold about you, along with information about how we process it. You can export your data directly from Profile › GDPR & Privacy › Export my data or by e-mailing us.

15.2 Right to Rectification (Art. 16)

You can request correction of inaccurate or incomplete personal data. Most profile information is editable directly in the app. Profile visibility (who in the Lastribe community can find and see you) is controlled by a dedicated toggle under Profile › Profile visibility; the default is private and you can opt in or out at any time without contacting us (Section 27).

15.3 Right to Erasure (Art. 17)

You can delete your account from Profile › GDPR & Privacy › Delete Account, which schedules the erasure of your personal data after a 30-day grace period. Some data is kept where the law requires it (Section 13). The full procedure, including the e-mail fallback for users who can no longer access the app, is published at /legal/delete-account. To delete part of your data without closing your account, see /legal/delete-data.

15.4 Right to Restriction of Processing (Art. 18)

You can request that we restrict processing of your data while we verify its accuracy or assess an objection you have raised: (a) when you contest the accuracy of your data; (b) when the processing is unlawful but you prefer restriction over erasure; (c) when we no longer need the data but you need it for legal claims; (d) when you have objected to processing and we are verifying whether our legitimate grounds override yours.

15.5 Right to Data Portability (Art. 20)

You can receive your personal data in a structured, commonly used, machine-readable format (JSON), from Profile › GDPR & Privacy › Export my data or on request.

15.6 Right to Object (Art. 21)

You can object to processing based on legitimate interest (error monitoring, security log, referral anti-fraud, AI model improvement). We stop the processing unless we demonstrate compelling legitimate grounds that override your rights.

15.7 Right to Withdraw Consent (Art. 7(3))

Where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of the processing carried out before:

Analytics: Profile › Analytics (app) or the "Cookie settings" link in the website footer;
Household medical information: Profile › Profile visibility › Health data › "Withdraw consent and erase" -- the information is erased immediately;
Push notifications: your device settings or Profile › Notifications;
Waitlist: the unsubscribe link in our e-mails.

15.8 Right Regarding Automated Decision-Making (Art. 22)

We do not make automated decisions that produce legal or similarly significant effects on you (Section 14). You may ask for a human review of any automated processing.

15.9 Right to Object to Direct Marketing (Art. 21(2))

You have an unconditional right to object to any processing of your personal data for direct marketing. On receiving such an objection, we stop immediately. To exercise it, contact privacy@lastribe.eu or use the notification preferences in the app.

15.10 Right to Lodge a Complaint (Art. 77)

You have the right to lodge a complaint with a supervisory authority: the authority of your country of residence, of your place of work or of the place of the alleged infringement (Section 33).

16. How to Exercise Your Rights

In the app: Profile › GDPR & Privacy -- export your data (JSON) or delete your account

By e-mail: privacy@lastribe.eu -- give the e-mail address of your account and describe your request

By post: EnableUnion SASU — Privacy contact, 7A rue Neuve, 57270 Uckange, France

Identity verification: we may ask you to confirm your identity before acting, to prevent someone else from accessing your data

Response time: one month. For complex or numerous requests, we may extend it by two further months and tell you why (Art. 12(3))

Cost: free, unless a request is manifestly unfounded or excessive

Format: data exports are provided in JSON

17. Data Security

We implement technical and organisational measures to protect your data:

Encryption in transit: TLS 1.2+ (HTTPS) for all communications; certificate pinning in the mobile app.
Encryption at rest: database-level encryption; passwords stored as salted hashes.
Application-layer encryption (AES-256-GCM) for the most sensitive fields, in addition to database-level encryption:
- home coordinates (a copy rounded to about 1 km stays readable for alert matching);
- evacuation routes;
- household medical information, with a dedicated key;
- message content (Tribe, Household and direct messages), with an optional end-to-end layer for mobile clients;
- SOS and safety-status positions;
- admin credentials and sign-in provider tokens.
Access control: role-based access, least privilege, separate administrator authentication, audited administrator reads of reported content.
Infrastructure: servers in France with firewalls, automated security updates and intrusion monitoring.
Input validation: every input is validated and sanitised.
Backups: encrypted daily backups; local copies kept 7 days, off-site copies 30 days.
Breach response: Section 18.

18. Data Breach Notification (Art. 33-34)

In the event of a personal data breach:

Assessment: we assess the breach within 24 hours of discovery.
Authority notification: if the breach is likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours (Art. 33).
User notification: if the breach is likely to result in a high risk to your rights and freedoms, we notify you without undue delay by e-mail (Art. 34), describing the nature of the breach, its likely consequences, the measures taken or proposed and our contact point.
If e-mail is compromised by the breach, we use alternative channels: in-app notice and a prominent notice on our website.
Documentation: every breach is recorded in our internal breach register, whatever its severity.
Remediation: we take immediate measures to contain the breach and prevent recurrence.

Breach notifications include information about your right to lodge a complaint with a supervisory authority (Section 33).

19. Privacy by Design & Data Minimization (Art. 25)

Data protection is built into the architecture of Lastribe:

EU-first infrastructure: all primary data stored in France.
Location by default at city level: your home address is optional and encrypted; positions shared with other users are rounded to about 1 km, except for an SOS or a safety status you send to your Household and Tribe (Section 29).
Self-hosted AI and maps: no data is sent to an external AI or map provider.
Minimal data collection: we only collect the data each feature needs; voice recordings are discarded after transcription.
Privacy defaults: new profiles are private; analytics are off until you accept them; the PrepScore notification is off by default.
Anonymisation: analytics and AI training data are pseudonymised or anonymised before processing.
Emergency contacts on the device: never on our servers (Section 25).

20. Record of Processing Activities (Art. 30)

We maintain a Record of Processing Activities (ROPA) as required by GDPR Article 30. It describes every processing activity, its purpose, legal basis, categories of data subjects and data flows. It is available to the CNIL on request.

The ROPA includes a dedicated entry for the household emergency medical information (blood type, allergies, medications, conditions -- Section 24), recorded as special-category processing under Article 9: purpose -- emergency preparedness within the user's Household; lawful basis -- Article 9(2)(a) explicit consent, or Article 9(2)(c) for a person who cannot consent; data subjects -- the account holder and the Household members they record; security -- AES-256-GCM encryption with a dedicated key; recipients -- none outside the Household.

21. Data Protection Impact Assessment (DPIA)

Because the Service processes location data, uses AI-based features and may record health information about vulnerable people, we conduct Data Protection Impact Assessments under GDPR Article 35 and the CNIL's list. Our DPIA register:

DPIA	Scope	Status
01 -- Location data	City, home coordinates, monitored places, routes, hazard reports, SOS positions	Draft v0.1 of 24 April 2026; validation by the controller before public launch
02 -- AI-assisted classification and scoring	News classification, situation briefs, recommendations, feedback loop	Draft v0.1 of 24 April 2026; validation before public launch
03 -- Gamification and behavioural profiling	PrepScore, badges, XP, leaderboards	Draft v0.1 of 24 April 2026; validation before public launch
04 -- Household health information	Medical fields recorded for Household members, including minors and persons who cannot consent	Planned; to be completed before public launch

Each DPIA assesses the risks to your rights and freedoms, the necessity and proportionality of the processing and the mitigation measures. The validated versions are available to the CNIL on request.

22. Cookies & Tracking

22.1 Website

Our website sets no cookie and loads no analytics script before you consent. Audience measurement (PostHog, hosted in the EU) is loaded only after you accept it in the consent banner; your choice is stored in your browser. If you decline or ignore the banner, no analytics runs and no cookie is set. We use no tracking pixel and no advertising tracker. You can change your choice at any time from the "Cookie settings" link in the footer of every page.

22.2 Web Application

Strictly necessary cookies: the session cookie of our authentication system (better-auth.session_token, duration of the session, extended while you use the app) and, when you change language, your language preference. No consent is required for them (ePrivacy Directive, Article 5(3)).
Analytics (PostHog): hosted in the EU, loaded only after your consent through the banner; names and e-mail addresses are stripped from events. Change your choice from the "Cookie settings" link in the footer.
We do not use: advertising cookies, social media trackers, Google Analytics, Facebook Pixel or any ad network script.

22.3 Mobile Application

The mobile app uses no browser cookies. Authentication relies on a Bearer token stored in your device's secure storage (SecureStore), strictly necessary for the Service.

The following SDKs are integrated in the mobile app:

SDK	Purpose	Processing location	On device / server	Legal basis and control
PostHog	Product analytics	EU (Frankfurt)	On-device collection, server processing	Consent -- off by default; Profile › Analytics
Sentry	Error monitoring (only when configured in the build)	EU (Frankfurt)	On-device collection, server processing	Legitimate interest; e-mail and IP removed on the device
Expo Notifications	Push notifications	US (SCCs)	On-device token, server delivery	Consent through the device permission; Profile › Notifications
RevenueCat	Purchases and subscription status	US (SCCs)	On-device SDK, server sync	Contract performance
MMKV	Local encrypted storage (cache, preferences, emergency contacts)	Device only	On device only	Contract performance
SecureStore	Authentication token storage	Device only	On device only	Contract performance (strictly necessary)

No advertising SDK is integrated. OS-level permissions (camera, microphone, location, Bluetooth) are separate from GDPR consent: granting a permission allows the technical access, and the in-app notices tell you what we do with the resulting data.

23. Photos & Videos

Supply photos (inventory): visible to you and your Household.
Hazard report photos: visible to the users who see the report (nearby users, Section 29).
Event evidence (where Events are enabled): visible only to Lastribe administrators and event organisers, for verification. If you submit GPS evidence, the coordinates are stored encrypted for that event only and never added to your profile.
Storage: our servers in France; deleted when you delete the item or your account.
AI processing: no facial recognition and no biometric analysis. The evidence-checking model is inactive while Events are disabled (Section 31).

24. Special Categories of Data (Art. 9)

Lastribe does not collect or process:

biometric data (no facial recognition, fingerprint analysis or voice-print; voice input is transcribed to text and the recording discarded);
racial or ethnic origin;
political opinions, religious or philosophical beliefs;
trade-union membership;
genetic data;
data concerning sex life or sexual orientation.

24.1 Household emergency medical information

You may record, for yourself and for the members of your Household, medical information useful in an emergency: blood type, allergies, medications, conditions. This is health data within the meaning of Article 9 of the GDPR.

For yourself, we process it on the basis of your explicit consent (Art. 9(2)(a)), collected before the first entry. You can withdraw it at any time from Profile › Profile visibility › Health data. Withdrawal erases this information immediately.

For another adult, you may record this information only if that person has allowed you to. If they have a Lastribe account, they enter it and consent themselves. For a minor in your care, you consent as the holder of parental authority. For a person who cannot consent, record only what responders need -- blood type, allergies and vital treatments; we then process it to protect that person's vital interests in an emergency (Art. 9(2)(c)). Before you record information about someone else, the app asks you to confirm that you are allowed to.

This information is encrypted (AES-256-GCM) with a dedicated key, visible only to the members of your Household, never used for the PrepScore, advertising or model training, and never passed to a third party. If you enable the medical card on the lock screen (Android), anyone holding your phone can read it.

25. Offline Mode & Cached Data

The Service includes an offline crisis mode that caches data locally on your device:

What is cached: your inventory, Household information, emergency contacts, downloaded maps and courses, and the preparedness data you need offline.
Emergency contacts: stored only on your device -- never on our servers -- so that they stay available offline and to minimise the processing of third parties' data. They cannot be included in the server-side data export.
Security: cached data is protected by your device's encryption.
Freshness: cached data may be outdated; the app shows the time of the last synchronisation.
Deletion: cached data is removed when you sign out, delete your account or uninstall the app.
No server access: in offline mode, no data is transmitted to or from our servers.

26. Safety Tools, Mesh and Peer-to-Peer Communications

SOS and safety status: when you send one, your status and, if you share it, your exact position are stored encrypted on our servers for 24 hours, then erased 7 days after expiry. They are shown to your Household and your Tribe. They are not transmitted to the emergency services.
Panic mode: sends SMS from your own phone to the emergency contacts stored on your device. We receive no copy of these SMS.
Mesh messaging (Bluetooth Low Energy and LoRa, via Meshtastic-compatible devices): messages travel through the radio mesh and may be relayed by other nodes in range. Your node identifier and radio metadata (signal strength, hop count) are visible to nearby nodes. A mesh SOS broadcasts your node identifier and, if you choose, your position to all nodes in range. Mesh messages are stored on your device and are not transmitted to our servers unless you explicitly synchronise them.
Legal basis: contract performance (Art. 6(1)(b)); your position is sent only when you choose to share it.

27. Community Content Visibility

Default: private. In line with GDPR Article 25, every new profile is created private -- not discoverable by other users. You must switch "Profile visibility" to "Visible" in your Profile tab before other users can find you in Tribe search, leaderboards or attendance lists. You can switch back at any time.

When you participate in Tribes and Households:

Tribe members see your display name, city, PrepScore summary, skills, the messages you post in the Tribe and, when you share them, your safety status and SOS.
Household members see the Household's shared data, including the medical information recorded for its members.
Tribe leaders additionally see your join date, activity level and role.
Nearby users see the hazard reports you publish, with a position rounded to about 1 km.
Administrators (Lastribe team) can access community content for moderation and safety purposes; every read of reported content is logged.
The public cannot see your Tribe membership, messages or activity: all community features require authentication.
After leaving a Tribe: the messages you posted in it are deleted. After deleting your account: everything you shared is deleted, not anonymised (Section 13).

28. Push Notifications

Types: civil alerts and risk-level changes for your places; expiry warnings; welfare check-ins from your Household or Tribe; hazard reports nearby; community updates; news and monthly recap, if enabled; referral completed; PrepScore changes (off by default). We send no "daily streak" reminders and no badge or level pushes.
Consent: push notifications require your opt-in through your device's permission system.
Granularity: you can enable or disable each category from Profile › Notifications; critical safety alerts bypass quiet hours.
Withdrawal: disable notifications at any time from your device settings (iOS: Settings › Notifications › Lastribe; Android: Settings › Apps › Lastribe › Notifications) or in the app.
Data: your push token is stored; the title and body of each notification pass through Expo's servers and are kept by us for 90 days so that you can review what was sent (Section 13).

29. Location Data

Data	Precision	Protection	Who sees it
City and region of your profile	City	--	You; the members of your Tribe
Your home address (optional)	Exact if you enable "precise position"	Encrypted; a copy rounded to about 1 km is kept for alert matching	You
Monitored places	City level (chosen from a place search)	Stored as map points	You
Places you save (caches, meeting points)	The one you choose	Stored as map points; shared at a precision rounded to about 1 km	You; your Household or Tribe if you share them
Evacuation routes	The one you draw	Encrypted	You; your Household or Tribe if you share them
Position sent with an SOS or a safety status	Exact	Encrypted; erased 7 days after expiry	Your Household and your Tribe
Position shared in a message	Exact	Encrypted with the message; deleted after 30 days	The recipients of the message
Hazard report	Exact	Shown to others rounded to about 1 km	Nearby users
Event evidence GPS (where Events are enabled)	Exact	Encrypted	You; administrators reviewing the evidence

To calculate a route, we transmit the start, end and waypoints to openrouteservice (HeiGIT gGmbH, Heidelberg, Germany). For the weather, we transmit a position rounded to about 10 km to Open-Meteo (Switzerland). To find your city, your phone uses the geocoding service of its operating system (Apple or Google). Civil alerts are matched to your places on our own servers. We never track your position in the background, we never share it with a third party beyond the cases in this table, and we never sell it.

30. Children & Age Restrictions

Lastribe is intended exclusively for users aged 16 and over. We do not knowingly collect personal data from anyone under 16: the date of birth is checked when the account is created.

If we discover that a user is under 16, we delete the account and the associated data. If you believe we may have collected data from a child, contact privacy@lastribe.eu.

31. AI & Automated Processing

Self-hosted in France: all our AI models run on our own servers (Ollama for language models, Whisper for speech-to-text). No data is sent to an external AI provider.
What the models do: classify and summarise news for the Risk Radar; generate regional situation briefs from alerts and news; help us plan which courses, events and posts to publish next (editorial planning, no personal data); compare two versions of a model on the same news (A/B tests); transcribe and interpret a form field you dictate. An evidence-checking model for Events exists but is inactive while Events are disabled.
Voice input: the recording of about five seconds is sent to our server, transcribed, interpreted for the field concerned and discarded at once. Only the value entered in the field is kept. No voice-print is created.
No decisions about you: AI outputs are informational and produce no legal or similarly significant effect. We do not use AI to moderate your content.
Labelling: AI-generated content (summaries, translated titles, situation briefs) carries the label "AI-generated" in the app.
Oversight: every model, prompt and parameter is controlled and auditable by our team.
Training data: anonymised, aggregated feedback (votes, corrections). Anonymisation is verified with k-anonymity checks so that no user is identifiable in a training set. When you opt out, your feedback is excluded from all future training exports; feedback already incorporated into a deployed model cannot be extracted individually.
Opt-out: e-mail privacy@lastribe.eu.

32. Changes to This Policy

This version 2.0 takes effect on publication. Existing users are informed by e-mail and in the app.

For future changes:

We update the "Last updated" date and the version number, and summarise the changes in Section 33b.
For substantial changes (a new purpose, a new category of recipients, a change of legal basis), we inform you by e-mail and in the app at least 30 days before they take effect.
Where a processing based on your consent changes, we ask for your consent again before applying the change.
You can object to a change by closing your account at any time (Section 15.3).

33. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. Under GDPR Article 77, you may file a complaint with:

the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement -- whichever you prefer;
the list of all EU data protection authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

As a French company, our lead supervisory authority is:

CNIL (Commission Nationale de l'Informatique et des Libertés)

3 Place de Fontenoy, TSA 80715

75334 Paris Cedex 07, France

Website: www.cnil.fr

We encourage you to contact us first at privacy@lastribe.eu so we can try to resolve your concern directly.

33b. Version History

Version	Date	Summary of Changes
1.0	March 26, 2026	Initial publication
1.1	April 6, 2026	Added mesh communications disclosure, SDK transparency, mandatory/optional data distinction, extraction routes and monitored locations, AI training details, Transfer Impact Assessment reference, civil alert processing, enhanced data subject rights detail, updated sub-processor locations, compliance with CNIL 2024 mobile app recommendations
1.2	April 24, 2026	Filled EnableUnion SASU identifiers (SIREN/SIRET 103 184 941, RCS Thionville, share capital EUR 3,000, registered address, VAT, president); replaced VPS provider placeholder with OVH SAS (Roubaix, FR) in sub-processor list; explicit brand attribution (Lastribe published by EnableUnion SASU). No change to data processing scope.
1.3	April 24, 2026	Profile visibility is now private by default (§27) — implements GDPR Article 25 recommendation from DPIA 3 §12.1. A new user-facing toggle under Profile → Profile visibility lets users opt in to community discovery; §15.2 updated to reference the toggle. No new data processing, no new sub-processor — only a change in defaults + UI control.
1.4	April 24, 2026	App-layer encryption of home coordinates (§17, §29) — implements DPIA 1 §14.1 recommendation. `profiles.house_lat` / `house_lng` are now AES-256-GCM encrypted before INSERT; §29 corrected to reflect that home coordinates can be stored (opt-in) and protected by that encryption layer rather than the misleading "never precise GPS coordinates" wording. Hazard-notification dispatch logic moved from SQL-level Haversine to JavaScript post-decrypt. See plan 071.
1.5	April 25, 2026	Encryption extended to `event_evidence.gps_lat/gps_lng` and `user_monitored_locations.latitude/longitude` (L.7c-follow). §29 documents the two new encrypted classes alongside profile home coordinates. Same AES-256-GCM pattern, same threat model (defense in depth against backup/dump compromise).
1.6	May 14, 2026	Editorial alignment across the Lastribe legal corpus (Mentions legales + Terms): consumer-mediation provider designated (Société Médiation Professionnelle, CECMC-validated 16/10/2018, convention signed 13/05/2026) and ODR/RLL platform references removed (platform permanently closed 20/07/2025 by EU Regulation 2024/3228) -- these changes affect Mentions legales and Terms; this Privacy Policy is unchanged in text and data processing scope, version bumped to keep all user-facing legal docs in sync (same "Last updated" date 14/05/2026).
1.7	May 14, 2026	Full French translation added (bilingual document, FR-first prevailing in case of discrepancy for French users). Top-of-file structure now matches `accessibility_statement.md` pattern (`# ENGLISH VERSION` then `# VERSION FRANCAISE`). No change to data processing scope, sub-processors or legal bases.
1.8	May 14, 2026	French diacritics reinstated in the FR part (deprecation of the historic "no accents" convention). The Lastribe legal corpus now uses proper UTF-8 French accents everywhere (`Médiation`, `Données`, `Confidentialité`, etc.). EN content unchanged.
1.9	September 20, 2026	Corrections from the 2026-09-19 security & privacy audit (plan 162 R1/R4): §4.7 IP retention wording (consent ledger + sessions); §11 adds Google Play Billing, RainViewer and Open Food Facts (device-side requests) and states Sentry is only active when configured; §13 adds consent records, sessions and unsubscribe tokens + household deletion with the last member; §22.1 landing analytics only after cookie-banner consent; §28 notification history kept 90 days; §29 monitored locations are coarse PostGIS points (not encrypted — only the home point is) and the household position is a ≈1 km coarse copy of the home point (S18).
2.0	October 14, 2026	Plan 176 wave F (EU legal audit, draft D-1). §3 "Privacy contact" with postal address replaces the former data-protection-officer statement. §4 lists the real data: waitlist signup source, sign-in with Google/Apple where offered, home address, places and routes, safety statuses and SOS, reports, voice input (discarded after transcription), referral anti-fraud fingerprint. §7 legal bases from the register: alerts and safety tools under contract, analytics under consent, health data under Art. 9(2)(a)/(c), referral anti-fraud and security under legitimate interest, DSA handling under legal obligation. §10-12 real recipients: OVH (France), Apple/Google, RevenueCat, Resend, Expo (notification text), PostHog EU with US parent, Sentry EU region, Open-Meteo (Switzerland, ~10 km), openrouteservice/HeiGIT (Germany), RainViewer, Open Food Facts, public alert sources (no personal data), self-hosted maps and AI. §13 retention from the code: shared content and messages deleted (not anonymised), consent records erased with the account, report evidence 30 days / 6 months, backups 30 days. §14 and §31 list the real automated and AI processing. §21 DPIA register with dates. §22 "Cookie settings" link and Profile › Analytics. §24.1 household medical information rewritten (self, other adults, minors, persons who cannot consent, lock-screen card). §26 safety tools. §28 real notification types. §29 single location table with routing, weather and geocoding hops. §32 information 30 days before substantial changes, new consent when a consent-based purpose changes. New §1.1 Languages (24 languages). Changelog rows reordered.

34. Contact

EnableUnion SASU

7A rue Neuve, 57270 Uckange, France, European Union

Privacy contact: privacy@lastribe.eu

General support: support@lastribe.eu

Website: www.lastribe.eu