Privacy Policy — Free Beta

Effective date: November 4, 2026

This Privacy Policy explains how unlokmi.me, operated by Naïm TAHOURI in France, handles personal data when you create a Phone, view a public Phone, contact us or report content.

Controller: Naïm TAHOURI
Privacy contact: naimtahouri@gmail.com
Website: https://unlokmi.me

1. The main principle

Creators decide what they publish. Public Phones may contain personal information about the creator or other people. We do not treat the apparent messages, calls or device notifications inside a Phone as real telephone records. The platform does not access a visitor's actual SMS, contacts, camera, phone calls or device notifications merely because they explore a Phone.

2. Data categories and purposes

Account e-mail, account ID, login session and optional name

Why we use it: Create and secure accounts, manage published Phones
Proposed legal basis (GDPR): Performance of contract (Art. 6(1)(b))

Creator's editor settings, drafts, uploaded media, app content and publishing choices

Why we use it: Deliver editing, hosting and sharing functions
Proposed legal basis (GDPR): Performance of contract (Art. 6(1)(b)); legal duties where relevant

Public Phone content

Why we use it: Display the content chosen for publication
Proposed legal basis (GDPR): Performance of contract for creator; rights of individuals in third-party content are assessed separately

IP address, request logs, technical error and anti-abuse signals

Why we use it: Security, troubleshooting, fraud prevention
Proposed legal basis (GDPR): Legitimate interests (Art. 6(1)(f)), subject to balancing and applicable rules

Support and abuse-report correspondence

Why we use it: Answer requests, investigate complaints and comply with legal duties
Proposed legal basis (GDPR): Legitimate interests and/or legal obligation (Art. 6(1)(f)/(c))

Visitor exploration progress stored in the browser

Why we use it: Optionally remember previously explored apps, scenes or notifications
Proposed legal basis (GDPR): Subject to a specific local-storage/cookie analysis; ask for opt-in where exemption is not established

Optional marketing e-mails

Why we use it: Send product news only where chosen
Proposed legal basis (GDPR): Consent or other appropriate basis where law permits; never assume consent

Audience measurement (Minilytics): pages visited, referrer, approximate city, type of device, a random visitor identifier

Why we use it: Count visits and key button clicks, as anonymous statistics for the publisher only
Proposed legal basis (GDPR): Legitimate interests (Art. 6(1)(f)); audience measurement exempt from consent (CNIL), which you can refuse

To finalize: Align the table with actual implementation. Remove categories not collected, define exact legal bases, and record a legitimate-interest balancing test where relied upon.

3. Public vs private content

Draft Phones should be private until published. When you publish a Phone, its content becomes available to users who access its URL and may be visible to search engines if indexing is enabled. Do not upload information that must remain confidential. No "lock screen" animation makes a publicly shared Phone confidential or protected by a real device passcode.

4. Visitor memory

unlokmi.me may offer a "Remember my visit" feature storing previously opened apps, viewed content and completed narrative steps locally in your browser. Such data should not be used for cross-site profiling. If persistent storage is not strictly necessary and exempt from consent, the feature must be optional and activated only after a valid choice. Visitors should be able to reset their exploration and withdraw the optional setting without creating an account.

5. Service providers and recipients

We expect to use service providers for infrastructure and media storage, such as:

VPS provider: IONOS SARL — hosting of the Next.js service and PostgreSQL database; country: Spain (European Union).
Media (photos, videos, sounds): stored on the same IONOS server in Spain; Cloudflare R2, with storage in its European Union jurisdiction, may replace it later, once this page is updated.
Authentication provider: Internal: unlokmi.me accounts (e-mail address and password, stored only as a salted scrypt hash); no third-party sign-in.
Transactional email provider: Resend, Inc., for the account's transactional e-mails only (address confirmation, password reset); sending region: Ireland (EU); no open or click tracking.
Analytics provider: Minilytics, audience measurement run by the publisher on Cloudflare (Cloudflare, Inc., D1 database): pages visited, referrer, approximate city and type of device, linked to a random visitor cookie; no name, e-mail or IP address is stored, nothing is used for advertising; you can refuse it in Settings → Legal & Privacy.
Weather and music metadata providers: identify their precise roles and possible data transfers before activation.

We do not use Stripe or process paid subscriptions during the free beta. Do not add payment-related categories until a future payment service actually exists.

Where required, we enter into data-processing terms with service providers and assess international data transfers. An R2 EU-only storage jurisdiction, if configured, does not by itself prove that every Cloudflare-related processing operation takes place only in the EU. See the relevant provider documentation and DPA.

6. Retention and deletion

Data is kept only for as long as necessary for its purposes:

Account and Phone content (e-mail address, username, name, password hash, photos, videos, sounds, notes, conversations): as long as the account exists. Content you delete no longer appears on your Phone; every file you sent is erased when you delete your account.
After the account is deleted (Settings → Account → Delete Account, at once; or on request at naimtahouri@gmail.com, within one month): the Phone goes offline and its content and files are deleted. As a host of online content, we keep only what the law requires to identify who published it, then delete it: the e-mail address and name for 5 years, the username and password data for 1 year (French Decree No. 2021-1362 of 20 October 2021, articles 2, 3 and 8).
Links sent by e-mail: 48 hours to confirm an address, 1 hour for a password; each one works only once.
Sign-in session: 30 days at most, or until you sign out. Language choice: a cookie kept for 1 year.
Technical and security logs: 6 months at most, as recommended by the CNIL.
Reports and e-mails exchanged with us: the time needed to handle them, then 1 year.
Backups, when made: replaced within 30 days.
Audience measurement (Minilytics): 25 months at most.

Deleting a creator account should unpublish its Phones and initiate deletion of associated assets from the application and storage, subject to documented exceptions such as legal preservation, fraud investigation and backup lifecycle. Some public copies may remain with external parties beyond our control.

7. Security

We use access controls, encrypted transport, secret management, restricted media access, upload validation, logging and backups appropriate to the risks. This description must match what is actually deployed. No internet service is perfectly secure. Report security issues to naimtahouri@gmail.com.

8. Your rights

Subject to the law and context, you may request access, rectification, erasure, restriction, objection, portability, or withdrawal of consent. Contact naimtahouri@gmail.com and identify the account or content concerned. We may ask for proportionate identity verification. You can also complain to your competent data-protection supervisory authority, including the French CNIL at https://www.cnil.fr/.

If you are depicted or named on someone else's Phone without authorization, you may request review and removal at naimtahouri@gmail.com. You do not have to create a Phone account to report an issue.

9. Children and sensitive content

Creators must be at least 13 years old, which they confirm at sign-up. We do not knowingly accept children under 13 as account holders. Creators should not publish minors' identifiable content without the legally required permissions. Avoid publishing sensitive health, biometric, sexual, precise-location or other highly sensitive information about third parties.

10. Policy updates

We will update this page if the product, vendors or processing changes materially, with the effective date displayed above and an appropriate notice when necessary.

11. Contact

Naïm TAHOURI — naimtahouri@gmail.com — https://unlokmi.me/privacy-rights.