Privacy Policy

Data Controller

Fennec Hint is provided by a natural person, not by a company. The controller of your data is Honore Moustapha Pekaou.

• Privacy contact: support@fennechint.com

It is the same address you'll find at the bottom of your profile inside the app. We answer personally: Fennec Hint is a small project — there is no call centre, there is a mailbox that gets read.

What data we handle

Only what the service needs to work. Nothing is collected “in case it turns out useful one day”.

• Account: username, name, email address. Your password is never stored in readable form — the database holds only its cryptographic hash (bcrypt). Along with the account we keep a random code that ties your sessions to that account, and the record of the declarations you made when signing up.
• Signing in with Google or Apple, if you choose to: the identifier Google or Apple assigns to your account for Fennec Hint — a pseudonymous code, not your name — and the email address they give us. With Apple this may be a private relay address created by Apple, which forwards our emails to you without showing us yours. Apple may give us your name only the first time you sign in: we use it only to suggest it in the “name” field, which you can change, and it never becomes your username. If you sign in only with Google or Apple, your account has no password.
• Profile, optional: gender, age, physique, shoe size, preferred sports, preferred brands. You can leave these empty — they make recommendations more relevant, they don't let you in.
• Wardrobe: the clothing, accessories and gear you save, with name, season or category, sport, purchase date and expected lifespan when you provide them.
• Photos: the images you upload for your items and, if you choose to have one, your profile picture.
• City: the one you type. The app neither asks for nor uses your device location. In Pianifica you can enter a different destination — where the activity will take place — and it stays with that plan: it does not change the city on your profile.
• Training sessions: the ones you log yourself, with sport, date and — if you enter them — duration and distance. You type the distance in: it is not measured by GPS, and we keep neither the route nor any coordinates. On paid plans you can also state which gear you used for a session: what we keep is the link between the two, not a copy of the item.
• Saved plans: only if you choose to save one. We keep the sport, the destination of that plan and the time of the activity in that place's local time, the forecast available then, the recommendation we gave you, and the checklist with whatever you had ticked. We keep no coordinates, and none of the raw text exchanged with the model.
• Where to practice: the sport and the city you type to search for places to practise it. They serve that search and are not saved to your account.
• Club: the posts you publish, the message you send to ask to join someone else's, and — once a request is accepted — the messages the two of you exchange in the private conversation for that outing. They are free text: they contain whatever you and others write in them.
• Service usage: how many recommendations and photo recognitions you have used this month, your current plan and, if you watch rewarded ads, which verified rewards you earned and when. They exist to apply the limits, and for nothing else.
• Security: to limit repeated sign-in and sign-up attempts we briefly keep a cryptographic hash of the identifier typed — username or email — instead of the text itself, and never your IP address. It is pseudonymous, not anonymous data: anyone who knows an identifier can recompute its hash.
• Notifications, if you turn them on: the code that identifies your device for notifications (token), linked to your account, along with the type of phone and the app's language (Italian or English), which we use to write your notifications in that language.
• Waitlist: if you sign up from the site, your email address only. We do not ask for your name, country, device, sport or how you got here, and we record none of it.

Why we handle them

Almost everything rests on the contract: without a wardrobe there is no recommendation, without an email address there is no way to recover your account. These are data the service you asked for needs in order to exist.

Among your account data, the profile picture is the one exception, and it rests on consent. The app works exactly the same without it: no recommendation changes, no limit moves. That is why we ask with a checkbox that starts unticked, and why you can remove it whenever you like — removing it deletes the file, the reference and the consent together.

You save a plan yourself, and it stays for one reason: so that you can open it again — to find the recommendation from that day and to work through the checklist while you pack. If you do not save it, nothing is kept. Ticking an item goes through no model: the checklist is simply the list of what we had already recommended.

Training sessions are for you, for the recommendations, and — in one case only — for wear estimates. They are your log, and on paid plans how often you train makes the advice fit the way you actually move.

That one case is running and trail shoes, on paid plans. For that kind of footwear the wear estimate also takes distance into account, and only the sessions you linked yourself to that pair count: those kilometres added up can bring forward our suggestion to check them, compared with the purchase date alone. They can never push it back. For all other gear — and for anyone on the free plan — the estimate stays the one based on time.

Two things worth saying about that calculation: it is ours and goes through no artificial-intelligence model, and it does not measure the real condition of the shoes. It is an indication built on the numbers you entered, not an inspection.

Your declaration that you are at least 18, and the fact that you were shown these documents, are recorded at sign-up so that we can show they were given.

Signing in with Google or Apple is a choice, not a requirement: you can always use email and password, and Apple is available on iPhone only. When you choose them, our server verifies the sign-in proof Google or Apple issues, and from then on the session is Fennec Hint's own. We never link a Google or Apple account to a Fennec account with the same email address on our own: if the address is already registered we ask you to sign in the way you usually do, and you make the link yourself, from your Profile. This processing, too, serves to provide the service you asked for.

Some processing keeps the service safe and fair, and rests on our legitimate interest in doing so: limiting repeated sign-in and sign-up attempts, checking that an advertising reward is valid and has not already been used, keeping Club reports so they can be reviewed. It is limited to what that purpose needs and has its own retention period, set out below. You can object by writing to us: we will consider your request.

Rewarded ads are optional. How Google may use your data for advertising is decided by the choices you make in Google's consent form, where the law requires one; notifications are sent only if you turn them on.

An account that never confirms its email address does not stay forever. If you sign up from the app and do not confirm your address, the account cannot be used and is deleted automatically 7 days after sign-up, together with the declarations you made; requesting a new code does not move that deadline. The username and email become available again.

The waitlist rests on consent too, which you give by signing up, and it serves two things only: telling you when Fennec is ready to try as a demo or beta, and when the app launches. It is not a newsletter: you will receive no promotions, no offers, no product news unrelated to this wait, and nothing from third parties.

Location and weather

Fennec Hint does not ask for location permission and does not read your phone's GPS. This is not a matter of restraint: the permission is not even declared in the app. Nor do we work out your location from your IP address: searches start from the city you type, not from where you are.

You type the city. From there our server does the work: it sends that text to Geoapify, which turns it into the coordinates of the place — the place you typed, not your location. The server uses them for two things: asking MET Norway for the forecast, to whom it sends them rounded, and knowing which time zone that place is in, so that the time you picked is the destination's local time. We work the time zone out from data held on our own servers: we ask no outside service for it. From MET's reply we also read the elevation of the point the forecast is for — a number that arrives with the weather, with no extra request — and use it to tell a seaside place from a mountain one. It is not your location, nor the elevation you will be at: it is the forecast point's.

The result goes into a shared technical cache, which is not linked to your account and exists so the same place is not looked up twice: it keeps the place name in normalised form, its coordinates — in full, because they describe a place and not a person —, the country code, the provider that found them and, when Geoapify states it, the source of the geographic data they come from, so that it can be credited. It is not a history of your movements: it does not say who searched for what, and it has no expiry. Forecasts received from MET Norway, on the other hand, stay in a cache for at most two days. Your device never contacts Geoapify or MET Norway directly.

Where to practice, inside Today, looks for places to practise some sports in the city you type. The places come from a catalogue we keep on our own servers, built from open data published by the Overture Maps Foundation: the search uses the sport and the city's coordinates — again, the place you typed, not your location — and nothing about you or your search reaches Overture. If you open a place's website, you open it yourself, in your browser.

If you choose to save a plan, we also store the city and the time of the activity that plan refers to, together with the forecast available then. It is the city you typed, not a detected location, and coordinates are not part of a saved plan.

The same holds for the distance of a training session: you type that number, your phone does not measure it. Fennec records no routes, tracks no movement and keeps no coordinates for any session.

The forecast stays as it was. Opening a saved plan does not query the weather service again and updates nothing: what you read is a snapshot of the context the recommendation was built on.

Photos and metadata

The photos you choose are sent to our servers over an encrypted connection (HTTPS).

Metadata is stripped on our servers, before the image is stored or passed to an AI provider. GPS coordinates, camera make and model, date and comments are removed.

We are precise about where this happens: the stripping is ours, not your phone's. The image leaves your device carrying its metadata and travels encrypted to us; it is at our end that it loses them. Anyone telling you they are removed before the image leaves would be describing something else.

One technical value survives — orientation — without which every portrait photo would appear lying on its side.

The stores holding your images are private: a public address will not open them. When the app shows you one, the server mints a signed link valid for one hour.

Artificial intelligence

Fennec Hint uses Anthropic models for two things: recognising an item from a photo, and composing the recommendations about what to wear and what to bring.

For recognition we send the already-stripped image, plus the item category and the language you want the answer in. We do not send your name, username, email or city.

For recommendations (Today and Plan) we send the situation: the chosen sport, the name of the city or destination you typed, the day, time and season of the outing, the forecast, the items in your wardrobe with the names you gave them and, for gear, the estimated useful-life phase and whether it is safety equipment. On paid plans we add your gender and age band if you provided them, your preferred sports and how often you train. We never send who you are: username, name, email, coordinates, photos and their references, purchase dates and kilometres stay out, and the request leaves our server without any identifier of your account.

We do not promise you that Anthropic retains nothing. That would be a promise about infrastructure that is not ours, and we are not making it. We tell you what we send and what we don't, which is what we can actually guarantee.

The Club

The Club board is anonymous: whoever reads a post sees the sport, the place, the day and the note, but not who published it.

Whoever wants to join sends a request with a message. The person who posted sees that message and the username behind it — the only two things they have to decide on — and can accept or decline. Your username does not reach the poster before you send the request, and theirs does not reach you before they accept it.

If the request is accepted, a private text conversation opens between the two of you, tied to that one outing. It is the only way to write to each other inside Fennec Hint: there are no direct messages to anyone, there is no group chat, and people joining the same outing cannot see each other's conversations. You cannot send images, files, audio, video or locations.

Messages are text on our servers: they are not end-to-end encrypted, and we do not claim that nobody can read them. There are no read receipts, and we do not record whether or when a message was read.

A conversation does not outlive what justifies it: it disappears when the outing is deleted, when either person deletes their account — and in that case the messages written by the other person in that conversation disappear too — and in any case within the 12 months we keep outings for. If you report a message, we separately keep the minimum needed to review that message: its text, who wrote it, when, and which outing it belongs to. That copy follows the retention of reports — up to 24 months — not that of the conversation, and it remains even if the person who wrote the message later deletes their account: it contains their username and the reported text.

There are no public profiles and there is no feed to follow. If you turn notifications on, we let you know when you receive a new message in the private conversation: the section on notifications explains how.

Any content can be reported, and any person can be blocked.

Subscriptions and purchases

Payment does not go through us. If you choose Premium, the purchase happens on Apple's App Store or on Google Play, depending on your phone: they collect the payment and handle the payment method and the renewal. We do not see or keep your card or payment method details.

To know whether you have an active subscription we use RevenueCat, a service that receives purchase information from the store and passes it on to us. RevenueCat does not collect payments: it processes this data on our behalf, for this purpose.

We do not tell RevenueCat who you are. Your account is linked to a random identifier, generated by our server and used only for this: it is not your username, your email or your name, and none of these is sent to RevenueCat.

The app talks to RevenueCat directly to show you the plans with the store's prices, to complete a purchase and to restore purchases you have already made. It connects to RevenueCat as soon as it opens, even before you sign in: at that point RevenueCat gives the installation its own anonymous identifier, which after sign-in is associated with your account's random identifier. RevenueCat therefore receives these identifiers, the purchase and subscription information the store provides to it and, as with any network connection, your IP address and ordinary technical request metadata.

When a subscription starts, renews or expires, RevenueCat tells our server, which updates your plan. Of the subscription we keep only what is needed to apply it: the plan, whether it is active, the expiry date, when it was last updated and the identifier RevenueCat knows you by. We do not keep prices, amounts or transaction identifiers.

If you delete your account, we also delete your plan and the link between your account and the random identifier: the purchase information that remains with the store and with RevenueCat is no longer linked to your Fennec Hint account. We do not ask RevenueCat to delete its own purchase history: it remains with RevenueCat under its own rules and the obligations it is subject to. Deleting your account does not cancel an active subscription: to stop being charged you need to cancel it in the settings of the store you bought it from.

Advertising

On the free plan the app may offer you rewarded ads: you watch an ad to the end and, once the reward has been verified, you get one extra AI credit — at most 3 in any 24 hours and 9 in a month. They are optional, you do not need them to use the free plan, and they appear only when our server makes them available to you: not with Premium.

When rewards are offered to you, your consent status is refreshed through Google's form when the app opens, and the advertising SDK starts only if your choices allow it. When they are not offered — for example with Premium — the app starts neither the form nor the SDK.

Ads are provided by Google through Google Mobile Ads. In the European Economic Area, the United Kingdom and wherever the law requires it, before loading an ad the app shows you Google's consent form (UMP): the choices you make there decide how Google may use your data for advertising, and you can change them at any time from Privacy options in your profile.

Google's SDK collects on its own, directly from your device, data such as your IP address, technical and ad-interaction information and device identifiers — on Android including the advertising ID, which you can reset or delete in Android settings — and uses it to show and measure ads, for analytics and to prevent fraud. On iPhone we do not ask you for tracking permission: the app does not allow access to Apple's advertising identifier.

We do not give Google your account data: no username, email, wardrobe, training sessions or messages. To confirm that an ad was actually watched, Google passes our server an opaque identifier we generated, which does not contain your username; our server checks that confirmation before granting the credit.

Records of verified rewards — needed to check the limits and to stop the same ad from counting twice — are kept for the current month and the previous one, then deleted.

Push notifications

Fennec Hint uses push notifications for one purpose only: telling you when you receive a new message in a private Club conversation. They are off until you turn them on, and the app asks for permission, which you can review from Notifications in your profile or in your phone settings.

Notifications go through Google's Firebase Cloud Messaging and, on iPhone, Apple's notification service (APNs). Your device therefore gets a notification code, which we store linked to your account together with the type of phone: at most five devices per account.

The notification text is generic: it says you have a new message, not who wrote it or what it says. You read the message by opening the app.

When you sign out we remove the device code from our servers; a device on which the app has not been opened for 30 days stops receiving notifications, and if the app does not refresh its code for 90 days we delete it; deleting your account removes them all. Google and Apple keep their own notification data under their own rules.

Who we share data with

We do not sell your data and we do not hand your account data — profile, wardrobe, training sessions, messages — to anyone for advertising or commercial profiling. Advertising, where present, works as described above. These are the providers involved, and the only ones:

• Supabase — the infrastructure running the database, the image store and the server functions.
• Anthropic — the AI models, for photo recognition and recommendations.
• Geoapify — turning a city name into coordinates. For each result Geoapify states the source of the geographic data it comes from, which may be, for example, OpenStreetMap, OpenAddresses or GeoNames.
• MET Norway — the weather forecast.
• Resend — sending service email, from the address noreply@fennechint.com: address confirmation, password recovery, waitlist confirmation and operational messages. To deliver them it receives the recipient's address and the text of the message, and it keeps sending data according to its own rules. Emails sent before the switch to Resend went out from a Gmail mailbox by Google: copies of those emails remain in that mailbox, and we do not delete them automatically.
• RevenueCat — the technical handling of subscriptions: it receives purchase status from the store and passes it on to our server.
• Google Mobile Ads and UMP — rewarded ads and the advertising consent form.
• Firebase Cloud Messaging (Google) — sending push notifications.
• Apple Push Notification service — delivering push notifications on iPhone.
• Google and Apple, for sign-in — only if you choose to sign in with them (Apple on iPhone only): they verify who you are and give us the identifier and email address described above. What they keep about your sign-in is governed by their own rules.
• Cloudflare — hosts this site and forwards email written to support@fennechint.com to our mailbox.
• Overture Maps Foundation — receives no data: it is the source of the open data we used to build the Where to practice places catalogue.

From the app, your device contacts directly only RevenueCat for subscriptions, Google for advertising and notifications, Apple on iPhone for notifications and, if you choose to sign in with them, Google and Apple for sign-in: every other call — database, artificial intelligence, weather, city lookup, email — starts from our server. From the site there is one exception, and it is joining the waitlist: when you press the button, your browser sends the address straight to Supabase infrastructure. As with any network connection, your IP address and ordinary request metadata are therefore processed by the infrastructure providers in order to route and protect it — we cannot claim they are never logged by them, and we do not claim it. Cloudflare already serves this site's pages and processes their ordinary connection metadata. The database is in London; the server functions run in the region closest to whoever calls them, and may therefore run elsewhere. Infrastructure providers may keep technical request data, such as the IP address, in their own logs for periods they decide.

Transfers outside the European Economic Area

Some of the providers listed above are based or run infrastructure outside the European Economic Area — for example in the United Kingdom or the United States — so your data may also be processed there: the database is in London, and Anthropic, RevenueCat, Google, Apple and Cloudflare operate on international infrastructure.

These transfers take place through the providers, within the safeguards set out by data-protection law. To find out which safeguard applies to a given provider, write to support@fennechint.com.

How long we keep them

Your account data stays for as long as your account exists. Some things have a life of their own:

• Club posts — 12 months from the date of the session.
• Reports — 24 months. They exist for whoever has to decide whether content breaks the rules. For a reported message we also keep a copy of the message, with the username of whoever wrote it: it stays for the same period even if that person deletes their account.
• Accounts never confirmed — 7 days from sign-up, then deleted automatically.
• Training sessions — until you delete them, or until you delete your account. A link to a gear item disappears with the session, or with the item if you remove it from your wardrobe.
• Saved plans — until you delete them, or until you delete your account. They do not expire on their own.
• Monthly usage counters — the current month and the previous one.
• Verified advertising rewards — the current month and the previous one.
• Device codes for notifications — for as long as the device stays linked: we remove them when you sign out, and delete them if the app does not refresh them for 90 days.
• Password recovery and address confirmation codes — until used or expired.
• Hashes used to limit attempts at sign-in and sign-up — roughly one day.
• Signing in with Google or Apple — the link between your account and the Google or Apple identifier stays until you disconnect it from your Profile or delete your account. We do not keep Google's or Apple's sign-in tokens: we verify them and discard them, keeping for at most one hour only a cryptographic hash of them, which stops the same sign-in being reused.
• Technical caches — an already computed recommendation for at most 24 hours, a forecast for at most two days (and the same forecast is reused for one hour, partly because the provider requires it). The places cache is not linked to any account and has no expiry.
• Technical operating records — how many requests to the AI models the service handled, with what outcome and how long they took: they contain no username or other identifier, and we keep them to measure the service.
• Sent emails — Resend keeps data about the emails it delivers according to its own rules. Copies of emails sent before the switch to Resend remain in the Gmail mailbox they were sent from until we delete them: there is no automatic deletion.
• Waitlist — until the beta ends or the app launches, that is for as long as the reason you signed up still exists, and in any case no longer than 12 months. After that the address is deleted without you having to ask.

Your rights

You may ask us to access your data, correct it, delete it, restrict its processing, object to the processing, or receive it in a machine-readable format. Where processing rests on consent — the profile picture, and the advertising choices made in Google's form — you may withdraw it at any time, and withdrawing it does not make what happened before unlawful.

Write to support@fennechint.com. Many of these things you can do yourself, immediately: the profile is edited in the app, the picture is removed by tapping the avatar, and the account is deleted from the profile without writing to us at all.

For the waitlist, withdrawal is immediate: write to support@fennechint.com and we remove your address. Withdrawing consent does not make unlawful the processing carried out before the withdrawal, which was lawful when it happened.

If you believe the handling of your data breaks the law, you have the right to complain to the competent supervisory authority.

Deleting your account

You can delete your account from inside the app, without asking anyone: Profile → Delete account. Deletion is immediate and irreversible.

Some things do remain, and it is right that you know which: the reports you had submitted, in anonymised form, and those about your content, with the copy of any reported message, for at most 24 months; technical operating records that contain no identifier at all; data about the emails we had sent you, held by the provider that sent them; and whatever outside providers keep on their own account — in particular the purchase history held by RevenueCat and the store, no longer linked to your account.

If you connected Apple, when you delete your account from your iPhone we ask you to confirm with Apple, and we ask Apple to revoke the authorisation you had given Fennec Hint. If you do not confirm or Apple does not respond, our data is deleted anyway, and you can remove Fennec Hint yourself in your Apple ID settings.

The dedicated page walks through the steps.

How we protect your data

Passwords are stored as a bcrypt hash, never in readable form. Traffic between the app and our servers is encrypted.

No database table is reachable directly from the app: every read and every write goes through a server function that establishes who you are from a signed token and filters the data to your account.

The image stores are private and open only through short-lived signed links.

A session is valid only for the account it was opened for, and resetting the password closes every open session on that account. Repeated sign-in and sign-up attempts are limited.

A Google or Apple sign-in proof works only once: every sign-in uses a single-use code issued by our server, and the same proof presented twice is refused. Disconnecting Google or Apple from your Profile signs out the sessions open on your other devices.

What we do not do

This list is verified against the app's code; it is not a statement of intent:

• No behavioural analytics tooling of our own: we collect no statistics on how you use the app.
• No install-attribution tooling for Fennec Hint.
• No cross-app tracking request on iPhone, and no access to Apple's advertising identifier.
• None of your account data handed to advertisers.
• No location permission.

The site you are reading uses no cookies and loads no third-party tracking tools: the typefaces are served from here. The only data-collection form is the waitlist one, and it asks for an email address only.

Minimum age

Fennec Hint is for people aged 18 or over. At sign-up you are asked to declare it, and our server refuses the registration if the declaration is missing.

It is a declaration, not a verification. We do not ask for a document and we do not check a date of birth: no system can establish someone's age without verifying their identity, and we do not verify identity. We would rather say so than let you believe otherwise.

Changes to this policy

If the product changes in a way that affects your data, this page is updated when necessary. The version in force is always the one published here, with the date it applies from at the top, and the rights the law gives you are unaffected.