Privacy
Privacy policy
In plain words: what data the Dixit app and the www.dixit-app.com website use, why, how long we keep it, who can access it and how to exercise your rights.
Last updated: October 3, 2026
This is a translation. In case of any discrepancy, the French version prevails.
- We use the minimum needed to run your account and your drops.
- No advertising, no selling of data, no ad tracking, no analytics tools.
- Metadata in your photos and videos, including location, is removed on upload.
- Your date of birth is only used to check your age and is never shown.
- You can download all your data from the app and delete your account at any time.
1. Who is responsible for your data
The data controller is the company that publishes Dixit:
- FIBROWEB, a French SAS with a share capital of 1 EUR, registered with the Grasse Trade and Companies Register under number 884 058 702 (SIRET 884 058 702 00017)
- Registered office: 47 Domaine des Roumeguieres, 06460 Saint-Vallier-de-Thiey, France
- Contact for data matters: hello@dixit-app.com
In this policy, "we" means Fibroweb and "you" means the person using Dixit.
2. The data we use
Account and sign-in
- Email address and Apple or Google identifier: you can only sign in with Apple or Google. The provider sends us a unique identifier and an email address (with Apple, this may be a hidden relay address). We never receive your Apple or Google password.
- Date of birth: requested at sign-up to check that you are at least 15. It is never shown or shared with other users.
Profile
- First name and username (required).
- Profile photo, bio and link (optional).
- Featured badge, stats (number of drops, streak, average, followers), badges earned and, if you apply, your verification request and its status.
Content you post
- Drops: photo or video, "Rate my…" title, chosen audience, drop settings (comments, showing the average), final score.
- Ratings and short notes you give to other people's drops.
- Comments and replies, and the comments you pin under your drops.
Connections and interactions
- Follows: accounts you follow, your followers, requests sent and received, close friends.
- Safety tools: blocked, muted or restricted accounts, filtered words.
- Views: when you watch a drop, the view is recorded. Its author can see the list of people who viewed it, unless you turn off "Appear in views".
- Activity: notifications shown in the Activity tab (new ratings, comments, requests, badges).
Settings and device
- Settings: private or public account, who can rate and comment, showing the average, notification preferences, quiet hours, language.
- Notification tokens: if you allow notifications, a token specific to your device and the type of system (iOS or Android).
- Time zone and language of the device: to count your streak and send reminders at the right time, in the right language.
Technical data
- Server logs: IP address, date and time, requested address, response code and device type, for security and to keep the service running properly.
- App error reports: when the app hits an error, it sends our server a technical report (error message, screen involved, app and system version). These reports do not contain your photos or messages.
Reports and support
- Reports: when you report a drop, an account or a comment, we record the content concerned, the reason, any message you add and your account. The reported person does not know who reported them.
- Support messages: the content of the emails or messages you send us.
Address book (only if you ask)
On the "Find friends" screen, you can choose to look for contacts who are already on Dixit. Only then does the app read your contacts' email addresses, turn them on your phone into unreadable fingerprints (SHA-256 hashing), and send only those fingerprints to our server. The server compares them with existing accounts, returns the matches to you and does not keep the fingerprints. Your contacts' names, phone numbers and plain email addresses never leave your phone. You can also choose not to be suggested to people who have your address in their contacts (privacy setting).
App access to your phone
The app only uses the camera, the microphone (for video sound), the photo library and contacts when you ask it to, after your phone's permission prompt. It does not use your location.
3. What other users can see
- Your first name, username, photo, bio, link, badges and stats are visible to other users, even if your account is private.
- Your drops are only visible according to your settings: to your approved followers (private account), to everyone (public account), or only to your close friends if you choose that audience. Public drops from a public account can appear in Explore and in search.
- When you rate a drop, its author sees your rating, your short note and your username. Once voting has closed, people who can see the drop can see its ratings.
- An account you block can no longer see anything of yours, and vice versa.
Anything other people can see can also be copied by them (for example with a screenshot): we cannot technically prevent this.
4. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR, art. 6) |
|---|---|
| Creating and managing your account, signing you in, showing your profile, posting and displaying drops, ratings, comments and follows according to your settings | Performance of the contract (the terms of use) |
| Checking that you are at least 15 | Legal obligation and performance of the contract |
| Calculating streaks, averages and badges, sending reminders at the right time | Performance of the contract |
| Sending you notifications | Consent, given in your phone settings and withdrawable at any time |
| Finding your contacts who are already on Dixit | Consent, asked when you start the search |
| Suggesting accounts (mutual friends) | Legitimate interest (helping you find people you know), which you can object to in the settings |
| Moderation: handling reports, removing prohibited content, suspending accounts, reviewing verification requests | Performance of the contract, legitimate interest (community safety) and the legal obligations of hosting providers |
| Keeping the service secure, preventing abuse, fixing errors (logs, error reports) | Legitimate interest |
| Answering your support requests | Performance of the contract and legitimate interest |
| Answering requests from the authorities | Legal obligation |
5. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, connections, settings | As long as your account exists |
| Drops (photo or video, title, ratings received) | Voting lasts 24 hours, then the drop stays on your profile with its final score until you delete it or delete your account |
| Ratings, short notes and comments you leave | Until they are deleted by you or by the drop's author, the drop is deleted, or your account is deleted |
| Date of birth | As long as your account exists |
| Deleted account | Hidden immediately, permanently erased within 30 days. During those 30 days, you can cancel the deletion by signing in again |
| Notification tokens | Until the device signs out, notifications are turned off or the account is deleted |
| Fingerprints of your contacts' addresses | Not kept at all: compared, then immediately discarded |
| Server logs and error reports | 12 months at most |
| Reports | While they are being handled, then 12 months (to spot repeat offenders and respond to an appeal or a request from the authorities) |
| Support conversations | 3 years after the last exchange |
How to delete your account is explained on the Delete my account page.
6. Who can access it
Your data is only accessible to other users according to your settings (see section 3), to the people at Fibroweb who need it to run and moderate the service, and to the following providers, who process it on our behalf, on our instructions and in compliance with the GDPR:
| Provider | Role | Data involved | Location |
|---|---|---|---|
| OVH SAS | Hosting of the app server, photos and videos, and the website | All data passing through our server, media, logs | France |
| MongoDB Atlas (MongoDB, Inc.) | Database | Account, profile, content (except photo and video files), connections, settings | European Union |
| Expo (650 Industries, Inc.) | Sending notifications | Notification token, notification text | United States |
| Apple (Sign in with Apple, Apple Push Notification service) | Sign-in, delivering notifications on iPhone | Sign-in identifier, notification token, notification text | European Union and United States |
| Google (Google Sign-In, Firebase Cloud Messaging) | Sign-in, delivering notifications on Android | Sign-in identifier, notification token, notification text | European Union and United States |
| Discord, Inc. | Internal team alerts (new sign-ups, new reports to handle) | Username, reason and link of the report | United States |
For sign-in, Apple and Google also act as controllers of their own processing: their privacy policies apply. Finally, we may disclose data to judicial or administrative authorities when the law requires it.
We never sell, rent or trade your data.
Transfers outside the European Union
Expo, Discord and, for part of their services, Apple and Google are based in the United States. These transfers are covered by the standard contractual clauses adopted by the European Commission and, where the provider participates, by the EU-U.S. Data Privacy Framework.
7. Your photos and videos
- On upload, the metadata in your photos and videos (GPS location, device model, capture date, etc.) is removed: photos are re-encoded and videos re-saved without it.
- Files have random names and are only served through signed, time-limited links, and only to people allowed to see the drop.
- We do no facial recognition and do not use your content to train artificial intelligence models.
8. No ads, no selling, no tracking
Dixit is free and contains no advertising. The app includes no analytics tool, no ad tracker, and does not use your phone's advertising identifier. Your data is not used to build a commercial profile and is never sold.
9. Users aged 15 to 18
Dixit is for people aged 15 and over. Under French law, a minor can consent alone to the processing of their data from the age of 15 (article 45 of the French Data Protection Act, "loi Informatique et Libertés"). If we learn that an account belongs to someone under 15, we delete it.
To protect users aged 15 to 18, accounts are private by default, dates of birth are never shown, sexual content is prohibited and reporting, blocking and filtering tools are available everywhere. A parent or legal guardian can write to us at hello@dixit-app.com with any question or request about a minor's account.
10. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights:
- access to your data and portability: in the app, Me > Settings > Account > Download my data gives you a file with all the data linked to your account;
- rectification: edit your profile at any time in the app;
- erasure: delete a drop, a comment or your whole account from the app;
- objection to processing based on our legitimate interest, and restriction of processing;
- withdrawal of your consent at any time (notifications, contacts), without affecting what was done before;
- setting instructions about what happens to your data after your death.
For any request that cannot be made in the app, write to hello@dixit-app.com, preferably from the address linked to your account. We reply within one month at most and may ask you to prove your identity if there is reasonable doubt.
If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr. You can also contact the data protection authority of the EU country where you live.
11. Security
Communication between the app and our server is encrypted (HTTPS). Sessions use short-lived tokens that renew automatically, access to data is checked by the server according to the visibility rules, media is only served through signed links, and access to admin tools is limited to the team. Since no system is infallible, we will inform you and the CNIL of any data breach that poses a risk to you, as required by the GDPR.
12. The www.dixit-app.com website
The website sets no cookies and uses no analytics tools. Our server records technical logs (IP address, requested page) kept for 12 months at most. The website's fonts are loaded from Google Fonts: your browser then contacts Google's servers, which receive your IP address. Share pages (profile or drop links) make no other requests and send nothing to our server beyond loading the page.
13. Changes
We may update this policy, for example when we add a feature or a provider. The date of the last update is shown at the top of the page. If there is a significant change, we will let you know in the app before it takes effect.
14. Contact
For any question: hello@dixit-app.com, or the Help & contact page. This policy is available in French, English and Spanish; in case of any discrepancy, the French version prevails.