- This site uses no cookies and no advertising; fonts and scripts are hosted on the site itself. To count visits, we use Umami, a cookie-free analytics tool that produces aggregate statistics and is not used to identify you. The AI Coach relies on an external service (OpenRouter), only when you write to it.
- The Express Protocol runs entirely in your browser: the stress level you enter is neither sent nor stored.
- Conversations, the journal, events and your progress in the app are stored in your browser and, when you are logged in, in your account (Supabase, European Union) so you can find them on all your devices. Only you have access to them; you can export or delete everything from “My account”.
- Don't give the AI Coach any information that identifies you (name, address, phone number).
- You can create an account (email + password, or “Continue with Google”) to find your space on all your devices: accounts are managed by Supabase, hosted in the European Union.
- Payment for subscriptions (Apex Pro, Apex Club) is handled by PayPal: we never see or store your banking details.
- Donations: if you support the project, payment is made on Ko-fi; we never see your banking details. Ko-fi sends us your display name, your email address and your message, if any.
- Apex Club: if you join a club's or school's space, your coach sees the first name you choose and, only if you agree, your stress level counts anonymously toward a group average (never with fewer than 5 people). They never see your journal, your notes or your conversations.
Data controller
The data controller is the site publisher, Tahé Sfaxi, who can be reached at contact@apexmindset.fr (see the legal notice).
What data, why, and for how long
| Situation | Data | Purpose and legal basis | Retention period |
|---|---|---|---|
| You write to us (demo request, waiting list, question) | Email address, content of your message, any information you choose to provide | To reply to you and, if you ask, to let you know when the service opens. Legal basis: your consent (Art. 6(1)(a) GDPR) or our legitimate interest in responding to requests (Art. 6(1)(f)). | The time needed to handle your request; for the waiting list, until the service opens or you ask to be removed, and no more than 3 years after the last contact. |
| Simply visiting the site | Technical logs (IP address, date and time, pages requested) recorded by the hosting provider | Security and proper functioning of the service. Legal basis: legal retention obligation imposed on hosting providers (Art. 6(1)(c)) and legitimate interest in security. | Period set by law for hosting providers (up to one year), managed by IONOS. |
| Chatting with the AI Coach | The text of the latest messages in the conversation (up to 16) | To generate the coach's reply. Legal basis: your consent, by using the feature (Art. 6(1)(a)). Your message passes through our server (anti-abuse limit per IP address, kept for no more than 1 hour), then is sent to OpenRouter and to the provider of the chosen AI model. | We do not keep the content of conversations on our servers. Providers apply their own rules; free models may log the exchanges. |
| Creating and using an account | Email address, password (stored encrypted by Supabase), account ID; if you use “Continue with Google”, the name and email provided by Google; for the free plan, a daily count of the number of messages sent to the coach (never their content) | To create a personal, secure space for you, synced across your devices. Legal basis: performance of the service you request (Art. 6(1)(b) GDPR). | As long as your account exists; deleted at your request. |
| Apex Pro or Apex Club subscription (payment) | On our side: the PayPal subscription ID, its status, its dates (next payment, end of the paid period) and the Apex account it is linked to. At PayPal: your payment details, which we never see | To manage your subscription, your access and cancellation. Legal basis: performance of the contract (Art. 6(1)(b)) and accounting obligations (Art. 6(1)(c)). | For the duration of the subscription, then the legal accounting retention periods (up to 10 years for accounting records). |
| Apex Club — you lead a group | Name and type of the organization, your coach account, the date of your commitment regarding parental consent, invitation code, trial or subscription status | To provide the club space (inviting members, group dashboard). Legal basis: performance of the requested service (Art. 6(1)(b) GDPR). | As long as the space exists; deleted along with the space or with your account. |
| Apex Club — you join a club | The first name you choose, the date you joined, your confirmation of age or parental consent, and your sharing choice. If you share: your stress level (1 to 10) recorded in the journal, read only to calculate a weekly group average | To let you join your club's space (performance of the service, Art. 6(1)(b)); calculating the group average is based on your consent (Art. 6(1)(a) and 9(2)(a) GDPR), which is optional and can be withdrawn at any time in “My account”. Only averages over at least 5 people are produced; no individual data is passed on to the coach. | Your membership: until you leave the club (or it is deleted). The anonymous weekly averages are kept as long as the space exists. |
| You make a donation (Ko-fi) | Amount and date of the donation; the display name, email address and any message that Ko-fi sends us; depending on the payment method, your name and email sent by PayPal or certain billing information sent by Stripe. We never receive your banking details. | To receive your donation, thank you and reply to your messages; to keep records of our income. Legal basis: performance of your request (Art. 6(1)(b) GDPR) and legal obligations, particularly tax obligations (Art. 6(1)(c)). | The time needed for these purposes, then the legal retention periods for supporting records. |
| Audience measurement | Pages viewed, referring site, device and browser type, country, and a few anonymous events (e.g. “a club space was created”), processed by Umami without cookies | To understand site traffic and improve the site. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). Aggregate statistics only, never used to identify you and never sold. | Retention period set in our Umami account; aggregated statistics. |
| Using the Express Protocol | None: everything stays in your browser | — | — |
We do not sell or rent any data, and we do not send any marketing without your consent.
Recipients and processors
Your data is accessible only to the publisher. It is processed on our behalf by IONOS SARL (site hosting and the contact@apexmindset.fr mailbox), a processor established in the European Union. When you click a “mailto:” link, it is your email software and your email provider that send the message: their own rules apply to your mailbox.
For the AI Coach, the text of your messages is sent to OpenRouter (OpenRouter, Inc., United States), which routes it to the provider of the AI model used. This may involve a transfer outside the European Union, covered by these providers' own safeguards (standard contractual clauses or equivalent). You are free not to use the AI Coach; the rest of the app works without sending any data.
For accounts, authentication is provided by Supabase (hosted in the European Union); if you choose “Continue with Google”, Google identifies you and sends us your email and your name. For subscription payments, PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) processes the transaction and stores the banking information on our behalf, in accordance with its own privacy statement; the payment button is loaded from PayPal only when you choose to subscribe.
For audience measurement, we use Umami Cloud, published by the creators of the open-source software Umami; according to its publisher, its servers are located in the United States and the European Union. No cookies are set and the statistics are aggregated.
For donations, payment is processed by Ko-fi (Ko-fi Labs Limited, United Kingdom) and its payment provider (PayPal or Stripe), in accordance with their own privacy policies. The United Kingdom benefits from an adequacy decision by the European Commission.
For Apex Club, the data stays in our Supabase database (European Union); the organization's coach receives only group averages calculated over at least 5 people, and the first name chosen by each member.
Apart from the services described above (AI Coach, accounts, payment, donations, audience measurement), we make no other transfer of personal data outside the European Union.
Cookies and trackers
The site sets no cookies: no advertising, no embedded social networks, no fonts loaded from an external service. The only exception to “everything is hosted on the site” is the Umami analytics tool, which works without cookies and is used only to produce aggregate traffic statistics, with no cross-site tracking and no reselling. The browser's local storage is used only to keep your app data on your device. That is why there is no cookie consent banner. If this were to change, we would ask for your consent before setting anything.
Your rights
In accordance with the GDPR and the French Data Protection Act (“Informatique et Libertés”), you have the following rights: access, rectification, erasure, restriction, objection, portability, withdrawal of consent at any time (without affecting what was done before), and the right to set instructions regarding what happens to your data after your death.
To exercise them, write to contact@apexmindset.fr. We reply within one month, and we may ask you for proof of identity in case of reasonable doubt. If you believe your rights are not being respected, you can file a complaint with the CNIL (www.cnil.fr).
Minors
In France, a minor can consent alone to the processing of their data from the age of 15; below that age, the consent of a holder of parental authority is required. If you are under 15, ask a parent or legal guardian to write with you. To join a club via Apex Club, you confirm that you are 15 or older or have your parents' consent, and the organization undertakes to obtain parental consent for members under 15. Our page dedicated to the protection of minors details our commitments.
Security
The site is served over HTTPS (encrypted connection) and hosted in the European Union. Service keys (AI, payment) stay on the server, never in your browser. Passwords are encrypted by Supabase and are never accessible to us; payments are secured by PayPal. Emails received are accessible only to the publisher. The AI Coach is not a healthcare professional and does not replace medical advice.
Changes to the service
User accounts and the Pro subscription are being introduced gradually. The space for clubs and schools (Apex Club) involves well-being data, which is more sensitive: it relies on optional, revocable consent, group averages only (never with fewer than 5 people) and parental consent for under-15s. You will be informed of any significant change.