Privacy Policy

Last updated: October 7, 2026

By using one of the applications developed by me, Simon Braillard, you will provide and I will collect a certain amount of information about you, including some information that can identify you. This is what we call your « Personal Data »: data that can identify you directly, such as your name or image, or indirectly, such as a device identifier or your browsing and interaction data. It is important that you know how this data is collected, what I do with it, for how long, and that you are informed about your rights. This is the purpose of this document, which I try to make as clear and simple as possible. If despite my efforts you still have questions, feel free to contact me through the contact page.

This privacy commitment applies to all applications developed by Simon Braillard, except Helvet Bill and Finish Line, which each have their own privacy policy: see the Helvet Bill privacy policy and the Finish Line privacy policy. In addition, not all applications collect the data described below. To know exactly what information is collected by each application, you can refer to its page on the Apple App Store or Google Play, for example.

Who is responsible for processing your personal data?

It’s me, Simon Braillard. I am a student and an independent Swiss developer based in Lausanne, Switzerland. The processing of your data is governed by the Swiss Federal Act on Data Protection (FADP) and, for users located in the European Union or the European Economic Area, by the General Data Protection Regulation (GDPR). The applications covered by this document are:

Buvons: an application without user accounts, which never asks for your name or email address. It collects, in pseudonymous form, browsing data from the app, an advertising ID and your approximate location derived from your IP address (through Google Analytics). It can also send you push notifications.
SudoDuo: an application for playing Sudoku. Data is collected in the same way as on Buvons, push notifications included.

What data do I collect?

My applications do not require an account. I collect (I) usage data, through Google Analytics, and (II) the data needed for push notifications, through my own notification service.

(I) Usage data (Google Analytics)

This data is used to improve the applications and fix bugs. It is not linked to your name or to an account, but it is not anonymous either: it is pseudonymous, because it is tied to device identifiers. I automatically collect:

Your approximate location (country, city), which Google Analytics derives from your IP address.
Your device’s language, the version of the application, your device model and operating system, and other technical information about the device or the application.
Your interactions with the application (screens viewed, actions taken).
An advertising ID used by Google Analytics. You can reset it or limit its use in your device settings.
Crash data and technical logs from the applications.

(II) Push notifications

To send you notifications, Buvons and SudoDuo use a notification service I developed. When installed, the app creates a random identifier that is not linked to your identity, to an account or to an advertising identifier.

As soon as you allow notifications, the app sends my server: this identifier, the platform, the app’s language and version, whether you allowed notifications, your choice about statistics, the notification topics you chose, and the technical token Apple or Google provides to route notifications. This lets me send a notification only to the devices concerned, based on the language, the app version (for example to invite you to update the app) or the topics chosen. My server also records when you last used the app, which is used to automatically delete inactive installations.

Only if you accept statistics, the app also sends the receipt and opening of the notifications I send, the system version, the device model, the region set on the device (a language and region setting, not your location) and its time zone offset; I then keep the history of your notification permission. I use them to know, in aggregate, how many notifications are received and opened and when to send them, and to send some notifications only to the devices concerned, based on the system version, the region set or when you last used the app (for example an update reminder, or a message if you have not opened the app for a while). You can turn statistics off and delete those already sent at any time in the app’s settings; you will keep receiving notifications.

Topics and promotional notifications. You can choose in the app’s settings the topics of the notifications you receive. Promotional notifications (« Offers and news »: my offers and news, including the promotion of my other apps) are off by default: you only receive them if you turn them on yourself, and you can turn them off at any time in the app’s settings. I keep the date you turned them on, as proof of your consent, until you turn them off. They are never targeted using statistics, only, where applicable, by language, app version or topics chosen.

IP address. My server receives your IP address with each connection. It is not associated with the data above, is not used to locate you and is only used to protect the service against abuse, in hashed form kept for a few minutes at most. The hosting provider’s technical logs may contain it temporarily.

On your device, the app stores the installation identifier, your notification choices and the receipt and open records not yet sent (30 days at most). Everything is deleted with the app, except, on iOS, the installation identifier, which the system keeps in the keychain but which is no longer used: reinstalling the app creates a new one.

The notification service does not collect your name, email address, phone number, contacts, location (GPS or IP), advertising identifier, screens viewed or content typed in the app.

What are the legal grounds for processing?

I process your Personal Data:

to give you access to my applications, ensure they work correctly and send you the notifications you allowed (Art. 6(1)(b) GDPR);
based on my legitimate interest in improving my applications, fixing bugs and protecting the service against abuse (Art. 6(1)(f) GDPR);
based on your consent for notification statistics, for promotional notifications and, where the law requires it, for the advertising ID (Art. 6(1)(a) GDPR). You can withdraw your consent at any time, without affecting processing carried out before;
to comply with a legal obligation, for example answering a request from an authority (Art. 6(1)(c) GDPR).

How do I use the data I collect?

I use the collected data to run the applications, improve them, fix potential bugs, send you notifications and measure, in aggregate, how they are received and opened. This data is never sold. The notification service’s data is never used for targeted advertising and is not combined with data from other companies.

How long do I retain your data?

Usage data (Google Analytics): 14 months at most; after that, only aggregated reports remain.
Crash reports: 90 days at most.
Receipt and open records, history of your notification permission: 90 days, or until you delete your statistics or withdraw your consent.
Device profile (system version, model, region set, time zone offset): as long as you accept statistics.
Recipient details of a notification campaign: 90 days.
Installation data (identifier, token, language, version, topics chosen): deleted automatically after 13 months without using the app, or at the latest 30 days after unregistering from notifications.
Date you turned on promotional notifications: until you turn them off.
IP address (hashed, against abuse): a few minutes at most.

After these periods, only anonymous totals are kept. You can also ask for your data to be deleted earlier (see « What are your rights? »).

Who has access to the data I collect?

I am the only one with access to the data stored on my server, and none of your data is sold or given to third parties. To run the applications, I do however rely on service providers (processors), which process some data on my behalf:

Google LLC (Google Analytics): usage data, advertising ID and crash data.
Infomaniak Network SA: hosting of my notification server and its database, in Switzerland.
Apple Inc. (Apple Push Notification service): routing notifications to iPhone, iPad and Mac (technical token and notification content).
Google LLC (Firebase Cloud Messaging): routing notifications to Android (technical token and notification content).

I may also be required to disclose data to an authority that requests it under the law.

Is your data transferred outside Switzerland or the European Economic Area?

The notification service’s data is stored on a server in Switzerland, at Infomaniak. Switzerland is recognized by the European Commission as providing an adequate level of protection.

However, Google Analytics data and the routing of notifications by Apple and Google may pass through other countries, in particular the United States. These transfers are covered by the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework, under which these companies are certified, or otherwise by standard contractual clauses.

How is your data protected?

Communication between the applications and my server is encrypted (HTTPS). Each installation’s secret is only stored on the server in hashed form, the IP address is only kept hashed and for a few minutes, and the keys used to send notifications are never stored on the server. For Google Analytics, I rely on Google’s security measures.

However, zero risk does not exist on the Internet, and I cannot guarantee 100% security of Personal Data. This is why it is important to notify me immediately if you believe you are a victim of a security breach of your Personal Data, through the contact page.

What are your rights?

You have the right to access your Personal Data and request that it be rectified, completed or updated. You can also request its deletion, object to its processing or request that it be restricted, under the conditions of applicable law.

You can exercise your right to data portability, i.e., the right to receive your Personal Data in a structured, commonly used format, and to transfer it to another data controller.

Where applicable law provides for it, you also have the right to define instructions regarding the fate of your Personal Data after your death.

Directly in the applications, you can at any time:

turn notifications off in your device settings;
choose the topics of notifications and turn promotional notifications on or off in the app’s settings;
turn notification statistics off and delete those already sent in the app’s settings;
reset or limit the advertising ID in your device settings.

To exercise your other rights, contact me through the contact page. Since my applications do not use accounts, I will need the installation identifier to find the notification service’s data: pressing the header of the app’s notification settings for 2 seconds copies it to the clipboard. Proof of identity may be requested.

I will do my best to satisfy your requests, but these rights are not unlimited and must be exercised under the conditions defined by current regulations. Requests to exercise rights should not be abusive. If applicable, I will explain the reasons why I cannot fulfill your request.

If you believe your rights are not respected, you can contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are located in the European Union, the data protection authority of your country.

Additional Information

This document is available in French, English, German and Italian. If in doubt about the terms, or in case of a difference between versions, the French version prevails.

This document is governed by Swiss law. The place of jurisdiction is Lausanne, Switzerland, subject to the mandatory places of jurisdiction provided by law, in particular for consumers, and to the rights the GDPR grants you in your country of residence.