Privacy policy — BeHundred

Last updated: November 6, 2026

This English version is provided for convenience. The French version prevails in case of any discrepancy.

1. Introduction

This Privacy Policy describes how BeHundred, published by BeHundred, a French simplified joint-stock company (SAS) with a share capital of €1,000, whose registered office is at 47 rue Vivienne, 75002 Paris, France, registered with the Paris Trade and Companies Register under number 106 082 191 (hereinafter "we", "our" or "the Publisher"), collects, uses, stores and protects the personal data of its users (hereinafter "you" or "the User").

It covers the BeHundred app and the behundred.com website (formerly behundred.fr), including its contact form.

BeHundred is committed to respecting its users' privacy in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the French Data Protection Act (loi Informatique et Libertés).

Data controller contact: contact@behundred.fr

2. Data we collect

2.1 Data provided by the User

When you sign up and use the app, we collect the following data: email address (to create the account and communicate with you), first name (displayed on your profile), username (the public identifier of your profile), password (stored encrypted, never in plain text), gender (female or male, asked at sign-up: it is only used to offer the period freeze described in 2.6 and is not shown to other users), profile photo (optional), sports you practice (optional), weekly workout goal, bio (optional), and personal records you choose to add to your profile (event name, time, year, description and photo).

2.2 Data generated by your use of the app

Using the app generates the following data: photos proving your workouts (Proofs) — main photo and selfie, commitment scores, the history of their changes and training statistics, messages exchanged with other users, connections and memberships of groups/clubs/challenges, likes and comments on Proofs, and the history of planned and completed workouts.

Depending on the features you use, this also includes: photo reactions posted on Proofs (realmojis) and the reaction templates you save; encouragements and congratulations sent or received (Monday Verdict and missions: text, emoji or photo); missions (title, description, deadline, proof photo); your duo or commitment partner (your partner sees your progress and your training log); tagging friends on a Proof and sharing a Proof you are tagged in; badges earned and freezes (number available, protected weeks); content reports (Proof concerned, reason) and user blocks; messages sent to support from the app (email address, subject, message).

An encouragement sent anonymously hides your identity from the recipient, but it remains linked to your account in our database.

2.3 Technical data

We automatically collect the following technical data: push notification token (to send notifications), device type and operating system (iOS), and a unique session identifier.

2.4 Data we do NOT collect

BeHundred does NOT collect location data about you (neither GPS position nor city of residence). The only exception: when you create a group, you can enter the city where it meets; this optional information is visible to other users and describes the group, not your home. BeHundred also does not collect data from HealthKit/Apple Health, bank or payment data (no transaction is processed in the app to date), data from third-party social networks, or cookies (neither the app nor the behundred.com website uses cookies).

The only health-related data processed by BeHundred is the period freeze, described in 2.6.

2.5 Analytics and stability data

With your consent, the app records usage events to understand how BeHundred is used and to improve it: app opened, sign-up completed, onboarding completed, Proof posted, week completed, reaction to a Proof, and connection with another user. These events are linked to your internal user ID, never to your email address. No cookies are used: the analytics identifier is kept in the app's local storage (localStorage). As long as you have not accepted, no event is sent, and if you decline, analytics remain disabled.

Regardless of this consent, the app sends technical error reports when something goes wrong, to keep the service stable and secure: device type and operating system, app version, screen concerned, technical error trace, and your internal user ID. These reports contain neither the content of your messages, nor your photos, nor your email address.

2.6 Period freeze: health data

The period freeze lets you protect your commitment score during a week of your period. It is only offered to accounts whose stated gender is "female". Using it reveals health-related information: it is a special category of data within the meaning of Article 9 of the GDPR.

Data recorded: the fact that you activated the period freeze, the protected week, the activation date and the number of period freezes available. No other information is requested (no period dates or duration, no symptoms).

Purpose: keep your score unchanged during the protected week, and not send you workout reminders that week.

Who has access: you. People who can see your training log (your duo, or any user if your profile is public) only see that a week is protected by a freeze, without knowing which kind of freeze. This data is shared with neither PostHog nor Sentry. It is stored with Supabase, through Lovable Cloud (see 4.1); apart from you, only the people in charge of the technical administration of the service at BeHundred can access it.

Retention period: as long as your account exists. It is deleted with the account.

Legal basis: your explicit consent (Article 9(2)(a) of the GDPR), collected when you activate the period freeze.

3. Purposes of processing

Your data is processed for the following purposes:

Managing your account and authentication rely on the performance of the contract (Terms of Use). Showing your profile and your Proofs to other users relies on your consent. Calculating your commitment score relies on the performance of the contract. Sending push notifications (workout reminders, social interactions) relies on your consent. Messaging between users relies on the performance of the contract. Connection suggestions and profile discovery rely on our legitimate interest. Improving the service and fixing bugs rely on our legitimate interest.

Reactions, encouragements, missions, duos and friend tags rely on the performance of the contract. Handling reports and blocks relies on our legitimate interest in keeping the community safe. Answering messages sent to support, from the app or through the website form, relies on our legitimate interest in answering the requests we receive. The period freeze is processed under the conditions described in 2.6.

4. Data storage and security

4.1 Hosting

Data is hosted by Supabase (https://supabase.com) on servers located in the European Union (EU-West region, Ireland). Photos are stored in the Supabase Storage service, also in the European Union. The app's Supabase environment is provided and administered through Lovable Cloud (Lovable).

The behundred.com website and the contact@behundred.fr mailbox are hosted by IONOS SARL (France).

4.2 Security measures

We implement the following security measures: password encryption (hashing), encrypted communications (HTTPS/TLS), database-level security policies (Row Level Security) ensuring that each user only accesses their own data and the data they are allowed to see, OTP code verification for sign-up and password reset (codes hashed with SHA-256, never stored in plain text), a 10-minute lock after 5 wrong attempts at a code received by email, and validation and sanitization of all user input.

4.3 Push notifications

Push notifications are delivered through Firebase Cloud Messaging (Google) and the Apple Push Notification service (APNs). The device token is stored in our database so that notifications can be sent. You can turn notifications off at any time in your iOS device settings.

5. Data sharing

Your personal data is NOT sold, rented or shared for advertising purposes.

Your data is only shared with other BeHundred users according to your visibility settings (public/private profile, Proofs visible in the feed), with Supabase as hosting provider and technical processor (data stored in the EU), with Firebase Cloud Messaging (Google) to deliver push notifications (device token only), with Resend as the provider sending transactional emails (verification codes, password resets), with Lovable (Lovable Cloud), which provides and administers the app's Supabase environment, and with IONOS as the host of the behundred.com website and of the contact@behundred.fr mailbox, which receives the messages from the contact form.

Two technical providers complete this list.

PostHog provides product analytics. Legal basis: your consent. Data sent: the usage events described in 2.5 and your internal user ID. The data is hosted in the European Union (eu.i.posthog.com). You can withdraw your consent at any time from Settings > Profile & privacy > Analytics.

Sentry provides error and performance monitoring for the app. Legal basis: our legitimate interest in keeping the service stable and secure. Data sent: the technical error reports described in 2.5, including your internal user ID. The data is hosted in the European Union (Germany region). Your screen is never recorded.

6. Retention period

Account data is kept as long as the account is active. Notifications shown in the app are deleted after 7 days. Email verification codes expire after 5 minutes and are deleted after use; the password reset link is valid for 1 hour. Technical debugging logs, including the error reports sent to Sentry, are kept for 30 days maximum. Analytics events are kept by PostHog for 1 year.

Account deletion. When you delete your account from the app, the following are deleted immediately and irreversibly: your login account, your profile and the data linked to it in our database (Proofs, workouts, goals and scores, messages, comments and likes, reactions, encouragements, missions, connections, duos, groups you administer, badges and freezes, period freeze included, notifications, registered devices, messages to support). The files of your profile photo, your Proofs and your personal records are also deleted, up to 100 files per category.

Not deleted automatically to date: the photo files of your reactions (realmojis), your missions, messages and groups, files beyond 100 per category, and the history of your score changes, which remains stored without any link to an existing account. You can ask for their deletion at contact@behundred.fr. Technical logs are erased after 30 days.

Website contact form. Your name, email address, subject and message are sent to the contact@behundred.fr mailbox (IONOS), where they are kept for as long as needed to handle your request, and then for at most 3 years after the last exchange. The website does not keep these messages; to limit abuse, it keeps a non-reversible fingerprint of the sender's IP address for 1 hour, never the address itself.

7. Waiting list

Before the app opens, the behundred.com website (formerly behundred.fr) lets you join a waiting list. To do so, BeHundred SAS collects: your first name and email address; the date and version of your consent; the invite code of the friend who invited you, if any, and where your sign-up came from; an encrypted, irreversible fingerprint of your IP address, used only to fight abuse.

This data is used to: confirm your sign-up and send you the link to your personal page (service emails); send you the launch email with your early access, if you agreed to it; show your first name to the friend who invited you, and the first names of the people you invited on your page; if the friend who invited you and you both create a BeHundred account, add you as friends automatically; calculate the number of spots left (aggregate, anonymous data).

Legal basis: your consent for the launch email; carrying out your request for the service emails. You can unsubscribe at any time using the link in the email.

Recipients: the BeHundred team and its technical processors: Supabase (database), Resend (sending emails) and Cloudflare (bot protection). This data is never sold and never used for advertising.

Retention: waiting list data is deleted by February 16, 2027 at the latest. If you unsubscribed, an encrypted, irreversible fingerprint of your email address is kept, only so that we never write to you again.

Your rights: you can exercise your rights of access, rectification, erasure and objection, and withdraw your consent, by writing to contact@behundred.fr. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

8. Your rights (GDPR)

Under the GDPR, you have the following rights.

Your right of access lets you request a copy of all the personal data we hold about you. Your right to rectification lets you correct your personal data directly in the app (Settings > Profile). Your right to erasure lets you delete your account from the app (Settings > Delete my account), under the conditions described in section 6, and ask us to erase data that is not deleted automatically. Account deletion cannot be undone. Your right to data portability lets you request an export of your data in a structured format. Your right to object lets you object to the processing of your data for suggestions/discovery. Your right to restriction lets you request that the processing of your data be restricted in certain circumstances.

To exercise these rights, contact us at: contact@behundred.fr. We will reply within 30 days.

If you have a complaint, you can contact the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.

9. Minors

BeHundred is intended for users aged 16 and over. Users aged 16 to 18 need the consent of a legal guardian to sign up.

We do not knowingly collect data from children under 16. If we learn that a child under 16 has created an account, it will be deleted.

10. Changes to this policy

We reserve the right to change this Privacy Policy. In the event of a substantial change, Users will be informed through a notification in the app at least 15 days before the changes take effect.

11. Contact

For any question about the protection of your personal data:

Data controller: BeHundred SAS, represented by its President, Sacha Petitjean
Email: contact@behundred.fr
Address: 47 rue Vivienne, 75002 Paris, France

Supervisory authority: CNIL — www.cnil.fr