Privacy policy

Last updated: 27 October 2026

This policy explains what data Sqwat collects, why, who it is shared with, how long it is kept and how to exercise your rights. Sqwat is for people aged 18 and over. Sqwat does not sell your data and does not use it for targeted advertising. The French version prevails.

1. Data controller

The data controller is Bricault Conseils, a French simplified joint-stock company with a sole shareholder (SASU), registered with the Paris Trade and Companies Register under number 938 630 217, with its registered office at 14 rue de l’Échiquier, 75010 Paris. For any question about your data: privacy@sqwat.co.

2. The data we collect

• Account: first name, last name, email address, password (stored only as an irreversible hash), or the identifier Apple or Google provides if you sign in with them.

• Phone number, if you verify it: it secures your account (a number can be verified on one account only) and, in hashed form, lets your friends find you in their contacts. Other members only see a "Phone confirmed" badge, never your number.

• Date of birth and gender: to check that you are 18 and for sqwats a host keeps to an age range or gender.

• Profile: photo, bio, job, languages, favourite dish — what you choose to show, and to whom.

• What brings you to Sqwat, if you answer that sign-up question: it helps us improve Sqwat and is never shown to other members.

• Your guest and host promises: the date you made each one, so we only ask once.

• Host address: the address, door code and directions of your sqwats and saved addresses. It is only revealed to guests whose place is confirmed; before that, Sqwat only shows an approximate area of about 300 metres.

• Diet, allergies and habits: this is health data. You provide it voluntarily, with your explicit consent. It is used to flag a clash with a menu and to filter sqwats; the host of a sqwat you ask to join sees it, and otherwise you choose who can see it. You can remove it at any time.

• Your children, if you add them to bring them along to a sqwat: first name, date of birth and, if you wish, a photo, their diet and their allergies. You provide them as their parent; only the host sees the photo, other guests see only the first name and age. Their details leave your profile on their 18th birthday, or when you remove them.

• Phone contacts, if you turn on contact sync: numbers are turned into hashed fingerprints (SHA-256) on your phone before anything is sent. Sqwat never receives names or plain numbers, only these fingerprints, which are deleted when you turn sync off.

• Photos you post: photos of your sqwats, your table, your dishes and your profile picture.

• Messages: chat messages, including GIFs and voice messages, reactions, and what you have already read.

• Comments, toques (Sqwat's "likes") and reviews: what you write and the ratings you give and receive after a sqwat.

• Notifications: your phone's push token (issued by Apple or Google via Expo) and the device language, to send you notifications in your language.

• Payments: the history of your payments, refunds, credits and payouts, in each sqwat's currency, and the country of the bank you receive your earnings in. Card numbers are entered directly with our payment provider Stripe: Sqwat neither sees nor stores them.

• Location: when you look for sqwats near you, your phone's position is sent with the search, used for that request only, then forgotten. Sqwat does not store it and does not track your movements.

• Reports and blocks: reports you make or that are made about you, and the members you block.

• Technical data: IP address, device type and connection logs, to keep the service secure.

• Crash reports: when the app crashes or hits an error, the phone model, iOS or Android version, the open screen and the error, so we can fix it. No name, email or IP address.

• Beta waiting list: if you leave your email address (and, if you like, a message) on sqwat.co, we use it only to send you your invitation and the link to the app. The site also counts its visits and sign-ups anonymously, to compare two welcome videos and see how far the page is read, where visitors come from (Instagram, Google…) and in which language: daily totals, with no cookie and nothing that identifies you.

3. Why we use it, and on what basis

• Running Sqwat (account, sqwats, chat, payments, reviews): performance of the contract formed by our terms of use.

• Warning you of a conflict between a menu and your allergies or diet: your explicit consent, which you withdraw by deleting that information.

• Finding your friends through your contacts: your consent, which you withdraw by turning sync off.

• Security, fraud prevention, moderation of reported content: our legitimate interest in protecting members.

• Accounting and tax obligations on payments: our legal obligations.

• Sending you your beta invitation: your consent, given by leaving your email on sqwat.co, which you withdraw by writing to us.

• Writing aids (menu suggestions, recipes, descriptions): our legitimate interest in saving you time. Only the meal itself (dishes, ingredients, type of meal) is sent, never your identity.

4. Who sees your data

Other members see your profile according to the privacy settings you choose for each part of it. Your email address and phone number are never shown to other members.

We rely on providers for some tasks; they only process your data on our behalf:

• Scalingo (France): hosting of the app and database.

• Scaleway (France): photo storage.

• Stripe (Ireland / United States): payments and payouts to hosts.

• Brevo (France): sending emails and phone verification texts.

• Expo (United States), with Apple and Google: push notifications.

• Sentry (United States): app crash reports.

• Anthropic (United States): help writing and translating menus, recipes and descriptions, from the meal details and the table's dietary constraints, added up and without any names.

• Apple and Google: signing in with your Apple or Google account, if you choose to.

• Google Maps: maps in the app.

• Giphy (United States): GIF search in chats; only the search words are sent.

• Base Adresse Nationale (French State) and Photon (Germany): typing and recognising addresses.

When a provider is outside the European Union, the transfer is covered by the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

We may also disclose data to the authorities when the law requires it.

5. Where, and for how long

Your data is hosted in France.

We keep it for as long as your account exists. When you delete your account from the app's settings, we erase your profile, photos, saved dishes, messages and private conversations, comments, addresses and door codes, allergies and diet, your children's details, the first names you gave to invite friends, your friendships and cercles, contact fingerprints, push tokens and sign-in identifiers, and your customer record at Stripe is deleted. An account cannot be deleted while an upcoming sqwat is waiting for you, as host or guest.

What remains, in a form that no longer identifies you ("Deleted account"), are the records that also belong to other members' history: past sqwats, numeric ratings and the cercles you created, while other members are in them. Payment records are kept for 10 years, as accounting law requires. Reports are kept for 1 year after they are handled, and technical logs for 1 year. Emails left for the beta are erased on request, and at the latest 12 months after the app opens to the public.

If your account was suspended for breaking Sqwat's rules and you had verified it with a phone number, we keep a hashed fingerprint of that number (never the number itself), even after the account is deleted. It is used only to stop that number from being used to open a new account.

6. Your rights

You can access, correct and delete your data, ask for a portable copy, object to or ask to restrict some processing, and withdraw your consent at any time. Most of this can be done directly in the app; for the rest, write to privacy@sqwat.co. We reply within one month.

If you believe your rights are not respected, you can complain to the CNIL, the French data protection authority (www.cnil.fr).

7. Security

Connections to Sqwat are encrypted (HTTPS), passwords are stored as irreversible hashes, and access to data is limited to the people who need it.

8. Changes

We may change this policy. If the change is significant, we will tell you in the app or by email before it takes effect.