PRIVACY POLICY

OFF is built so that public browsing does not require an account. This Privacy Policy explains what information may be processed when you browse OFF, use personal features or submit material.

1. Data controller

ANOMALIA PARIS SAS is the data controller for personal data processed through OFF where it determines the purposes and means of processing.

ANOMALIA PARIS SAS
66 Avenue des Champs-Élysées
75008 Paris, France
RCS Paris 894 960 137
Privacy contact: distribution@anomaliaparis.com

2. Browsing without an account

You can browse Discover, Finds, Places and People without creating an OFF authentication identity.

Technical service providers may nevertheless process limited connection and security information such as IP address, request metadata, timestamps and device or network information necessary to deliver and protect the service.

3. Data collected when you use personal features

If you use Keep, Karma, choose an OFF name or submit material, OFF may process:

• an anonymous user identifier;
• your optional alias and city;
• saved items and Karma actions;
• submission text, selected images, links and moderation status;
• for a Place submission, the place name and map coordinates derived from the location you enter.

OFF does not ask you to provide your legal name, email address or phone number merely to browse the app.

4. Photos and location

OFF uses Apple’s system photo picker. The app receives only the images you deliberately select for a submission and does not require general access to your full photo library for this purpose.

OFF does not request continuous or precise device location for browsing.

When you submit a Place, the location text you enter may be sent to Apple’s map search service to resolve map coordinates for that Place.

5. Why we process data

We process data to:

• provide requested personal features and submissions;
• maintain your private Cabinet;
• moderate and publish approved contributions;
• display Places on the map;
• protect OFF against abuse, bots, fraud and security incidents;
• respond to rights, privacy or support requests;
• comply with legal obligations;
• maintain the reliability and security of OFF.

Depending on the processing involved, the legal basis may be performance of the service requested by you, our legitimate interests in operating and securing OFF, compliance with legal obligations, or consent where applicable.

6. Service providers and recipients

Access to personal data is limited to people and service providers who need it for the purposes described above.

OFF uses:

• Supabase infrastructure for authentication, database and media storage;
• Apple services for app distribution and, where applicable, system photo selection and map search.

We do not sell personal data. OFF does not use third-party advertising or cross-app advertising tracking.

7. International processing

Some technical providers may process or support data from countries outside the European Economic Area.

Where the GDPR requires safeguards for such transfers, appropriate contractual or other lawful transfer mechanisms are relied upon by the relevant controller or processor.

8. Retention

Data is kept only for as long as reasonably necessary for the relevant purpose.

Approved submissions may remain while they are published or needed for the editorial record.

Rejected submissions may be retained for up to 30 days after rejection for moderation, safety and abuse-prevention purposes before becoming eligible for deletion.

If you use the in-app DELETE MY OFF IDENTITY function, the personal OFF identity and associated kept items, Karma, submissions and submitted media are scheduled for immediate permanent deletion, except where retention is required by law or necessary to establish, exercise or defend legal claims.

Security and infrastructure logs are retained for limited periods determined by operational and provider requirements.

9. Your rights

Where the GDPR or other applicable law applies, you may have rights including access, rectification, erasure, restriction, portability, objection and the right to withdraw consent where processing is based on consent.

If you have a personal OFF identity, you can initiate permanent account deletion directly inside the app through Cabinet → DELETE MY OFF IDENTITY.

You may also exercise applicable privacy rights by contacting distribution@anomaliaparis.com. You have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL) or your competent supervisory authority.

10. Security

OFF applies technical and organisational measures intended to protect data, including access controls, private media storage for submissions, moderation, rate limits and server-side permissions.

No online system can be guaranteed to be completely secure, and security measures are reviewed as the service evolves.

11. Children

OFF is not designed to collect personal information from children who cannot lawfully consent to the relevant processing.

Where local law requires parental or guardian authorisation, a minor should not use personal submission features without that authorisation.

12. Changes to this Privacy Policy

This Privacy Policy may be updated when OFF, its service providers or applicable legal requirements change.

The current version is available through OFF and on this page. App Store privacy disclosures will also be updated when data practices materially change.