Privacy Policy

User account: email address, first and last name, hashed password (bcrypt, not readable by Trasimène), registration date, unique identifier.

Service usage: security history of your account (IP address, browser, date, at sign-up and at each sign-in, 7 days), pseudonymised scan events (pseudonymised device identifier, aggregated results), push notifications (Firebase or Apple token, revocable). For protection, our servers also check: the full address of links found in your notifications, including those of your SMS app (Trasimène does not read your SMS messages themselves and does not ask for this permission), judging the domain name first, then the full address with Google Safe Browsing when the site is hosted on a shared platform; for each notification selected, the app that sent it, its time and the words from a list of known scams that it contains (never the message text; result kept for at most 30 days with scan results); the operator code of your SIM cards (never your phone number) to detect a SIM change; and the package name of unknown apps against the public Play Store listing (not linked to your identity).

Address scanner (QR code or typed address): each address you check is sent to our servers, which compare it with their threat list and with Google Safe Browsing. On iPhone, for the “Secure QR code scanner” and “Sites imitating well-known brands” checks, our servers keep for 30 days, linked to your device, the date and result of each verification, together with a hash of the site name computed using a secret key: without this key, the site cannot be recovered from the hash. This is pseudonymisation: Trasimène holds this key, and these hashes remain personal data. When an address is deemed dangerous, the full address is kept in plain text for the same period, so that it can be shown to you in the check result. As an address may contain personal information (for example an identifier placed in a link you received), only addresses deemed dangerous are kept in this way. This data is erased after 30 days, and upon deletion of your account. Legal basis: contract performance.

Installed apps (Android): to deliver the verdict of the checks that concern your apps, the app sends our servers, at each scan and for each app concerned, its package name and display name, the app that installed it, the fingerprint of its signing certificate and its first installation date. From version 1.2.1, it also sends, for each app concerned: technical characteristics (app version, target Android version, declared category, for example “game”, size of its native code); the status of certain sensitive permissions, that is, whether they are actually granted to it (display over other apps, all files access, reading from and writing to shared storage); and, if you have granted usage data access, its usage time over the last 24 hours (screen time, visible time and time spent working in the background). Our servers use this data to deliver the verdict. They keep the result of the checks, until no later than 30 days after the last scan sent by the phone, as well as an inventory of the apps seen on your device (SHA-256 hash of the installation file, package name, signing certificate, source, date), kept for 30 days after the last observation: it avoids re-analysing a known app and, compared with other devices, makes it possible to spot a modified copy of a known app. The hash of an app unknown to our lists may be submitted, as a last resort, to VirusTotal: the hash alone, never the file. Legal basis: contract performance; for usage time, your consent, given by granting usage data access and which can be withdrawn at any time in the phone's settings, in which case the “Suspicious background activity” check remains inactive.

Storage files (Android): to spot dangerous files, the app examines app installation files, archives and files with suspicious extensions (according to a list maintained by our servers) located in your Downloads and Documents folders, at the root of the phone's storage and on a memory card or USB drive that is plugged in. For each of these files, it sends our servers its name, its size, its last modified date and the folder where it is located; for an installation file, it also sends the name of the app it contains and the fingerprint of its signing certificate. From version 1.2.1, it additionally sends a hash (SHA-256) of the content of each file, computed on the phone, to compare it with our database of known malware. The content of the files and their full location are never sent. A hash identifies a specific file: two people who hold the same file obtain the same hash. These hashes are not passed on to any third party. Our servers never keep the hash of a clean file; for a file deemed dangerous, they keep its hash together with the result of the check, which may name it, so that the alert remains displayed as long as the file is on your device, and until no later than 30 days after the last scan sent by the phone. A file that has already been examined is not sent again as long as it does not change. Legal basis: contract performance.

Location (Android): if you allow it, the app accesses precise and approximate location, on all supported Android versions, including when it is not on screen, through its monitoring service, which is indicated by its persistent notification. Android only permits reading cell towers and Wi-Fi access points with this access; this reading is used for two checks. “Fake cell tower detected”: at each scan, the app sends our servers, for each cell tower the phone is attached to, the network type, the signal strength and the tower's identity (LAC/CID, TAC/CI or NCI). “Fake rogue Wi-Fi network”: when several access points broadcast the name of the network you are connected to, the app sends their hardware identifiers (BSSID) and their security type. The app never reads the phone's latitude or longitude, but these identifiers, cross-referenced with public databases of cell towers and Wi-Fi access points, can make it possible to locate the phone approximately, sometimes precisely: we therefore treat them as location data, solely for the purpose of detecting these two attacks. Our servers do not store them; only the result of the check is kept, until no later than 30 days after the last scan sent by the phone. When an anomaly is found, this result states, so that it can be shown to you, the tower concerned (network type, signal strength and, where applicable, identity), or the name of the Wi-Fi network and the BSSIDs of the access points concerned. This detail is erased as soon as the check no longer finds the anomaly. If a technical error occurs during a transmission, these identifiers may appear in the error report sent to our sub-processor Sentry. Legal basis: your consent, given by granting access. You can refuse or withdraw it at any time in the phone's settings: these two checks then remain inactive, as they do when the phone's location is turned off, with no effect on the other checks.

Messaging notifications (Android): if you grant the app notification access, it examines, for the “Unknown device linked to the account” check, the notifications of monitored messaging apps (Signal, WhatsApp and Telegram, a list maintained by our servers), in order to spot the alert a messaging app displays when a new device is linked to your account. From the title and text of each notification, the app keeps only hashes: each sequence of one to four words is transformed by a hash function (truncated SHA-256), and the text is neither kept nor sent. These hashes, kept in memory for the last 200 notifications from these messaging apps, are sent to our servers at each scan, together with the messaging app that sent each notification and its time. Our servers compare them with the hashes of a list of phrases announcing that a device has been linked, then erase them immediately, without logging or keeping them. The result that is kept (until no later than 30 days after the last scan) states only the number of notifications examined, the number of phrases recognised and, if usage data access is granted, the monitored messaging apps used recently. A hash is not encryption: a sequence of common words can be recovered by computing the hashes of known words. This is pseudonymisation, and these hashes remain personal data. Legal basis: your consent, given by granting notification access; you can withdraw it at any time in the phone's settings, in which case this check remains inactive. For the people whose messages appear in these notifications (your correspondents), the legal basis is legitimate interests (Art. 6.1.f GDPR): the security of your account against a device being linked to it without your knowledge. Safeguards: pseudonymisation by hashes, no text sent, hashes erased immediately after the comparison.

Digital vault: your passwords and the content of your notes and files are encrypted on our servers with AES-256-GCM, using a key unique to your account, randomly generated and held in Google Secret Manager, never sent to your phone. This design is what lets you open your vault from each of your devices and from trasimene.com, share an item by link, and be warned if one of your passwords appears in a breach (Tessin): our servers decrypt your vault in memory, just long enough to serve it to you, and access to these keys is restricted to Trasimène's systems and authorised staff. For instant search and display, the titles of your notes, the labels, usernames and site addresses of your entries, and the names, types and sizes of your files are stored without this key, protected like all our data by Google Cloud encryption. We never sell or share the content of your vault.

Payment: no card data is stored by Trasimène. All transactions are handled exclusively by our PCI-DSS certified payment provider.

Measuring our advertising campaigns, with your consent: when you create an account with your email address in the Android app or on trasimene.com, an unticked box offers to help us learn which ads bring new users. If you tick it, our servers report two events to the advertising platforms that run our campaigns: the creation of your account and the purchase of a subscription. Without your consent, no signal is sent. An account created with Google or Apple sign-in sends none, unless you later turn the measurement on in your account settings; no signal is sent for an account created on iPhone, nor for a subscription taken on the App Store. The signal leaves our servers, not your phone: the app shows no ads and embeds no tool from these platforms. At sign-up, Meta, TikTok and Snapchat receive a hash (SHA-256) of your email address, your IP address and the technical description of your browser or phone (user-agent); LinkedIn receives the hash of your address and, if there is one, the identifier of the click on its ad. At subscription, these four platforms receive the hash of your address, the identifier of the click that brought you, if there is one, and the amount paid; no IP address or user-agent. Google Analytics receives an internal identifier of your account, the Google click identifier if there is one and, at subscription, the amount paid; never your email address. A hash cannot be turned back into the address; a platform that already knows this address can recognise it, and these platforms also process this data on their own behalf, under their own policies. We keep a record of each report (platform, click identifiers, result) until your account is deleted. Legal basis: your consent (Art. 6.1.a GDPR). You can withdraw it at any time in your account settings (“Advertising campaign measurement”), in the Android app or on trasimene.com, or by writing to contact@trasimene.com: no further signal is then sent for your account.

Installation source: on first launch, the app sends our servers the source of its installation, so that we know which campaign or website led you to Trasimène. On iPhone, this is an attribution token provided by Apple (AdServices): our servers exchange it with Apple for the Apple Search Ads campaign, ad group, keyword and country, when the installation comes from one of these ads. This Apple service asks for no tracking permission, and nothing is sent to advertising platforms from an iPhone. On Android, it is the install referrer provided by Google Play (source, campaign and, if there is one, click identifier). This source is linked to your account and erased with it. Legal basis: our legitimate interest in measuring the effectiveness of our campaigns.

Usage measurement in the apps: to learn which screens are used and improve the app, it sends Firebase Analytics (Google) and PostHog (servers in the European Union) the screens displayed, the steps of the journey (sign-up, subscription, opening the vault), the phone model and the system version; PostHog links them to your account identifier. The content of your checks and of your vault is never part of it. This measurement is on from installation; you can turn it off at any time in the app's settings, “Analytics” section, “Usage analytics” switch. Error reports (Sentry and Firebase Crashlytics: crash trace, model, versions, without your name or email address) do not depend on this setting, because they are used to fix failures. The app does not ask for tracking permission on iPhone and turns off collection of the advertising identifier on Android. Legal basis: legitimate interest (improving the service), with the option to refuse in the settings.

What our servers keep: the content of your traffic is neither read nor recorded. Our servers keep the history of your VPN connections (server chosen, your device's public key, address assigned in the tunnel, connection and disconnection times), erased 72 hours after your access ends, and the volume of data exchanged each month, kept for 13 months to make sure the service runs properly. For 48 hours, they also keep, linked to your account: the sites from our threat and advertising lists that you contacted, with how many times; the most requested non-existent site names; and figures about your connections and the names requested (count, ports, duration, length), without any address or site name. Your public IP address is not recorded in this history.

Flagging dangerous sites: the site names requested in the tunnel go through our own DNS servers, which keep no log of the requests and compare them with our lists (malware, phishing, command servers, Tor network, text-sharing sites, advertising and trackers). A name that appears in these lists is recorded, with its category, linked to your account for 48 hours, to show you the alert in the app; the most repeated non-existent names, described above, are added to it. The ordinary sites you visit are never recorded and no browsing history is kept. Our servers flag these sites to you, they do not stop them themselves: resolution is handed to Quad9, a Swiss service that sets aside on its side the malicious domains it knows. Quad9 sees the names requested from our server's address, never from yours.

Servers run by Trasimène: your traffic passes through WireGuard servers that we set up and run ourselves, on virtual machines rented from Google Cloud in 19 countries (list in the “International Transfers” paragraph). Only the site names requested are sent to Quad9 for resolution, from our server's address (see “Flagging dangerous sites”).

No monetization: we never sell, share, or redirect your traffic for advertising or commercial purposes.

Automatic connection: for subscribers, automatic VPN connection is enabled by default. On Android, once the VPN has been authorised for the first time, it reconnects when monitoring starts (for example when the phone starts up) and when the VPN screen is opened; on iPhone, a system “on-demand” rule re-establishes the tunnel as soon as a network is available. You can turn it off at any time in the VPN screen. On iPhone, when the end of your subscription is established, the app removes this rule and the VPN configuration from the phone.

On-device access: for protection, the app uses the following access rights. Those the phone asks you to authorise can be refused or withdrawn at any time in its settings; the checks that depend on them then remain inactive. On Android: list of installed apps and Wi-Fi status (granted at installation); notifications (alerts and the persistent protection notification); camera (QR code scanner only); Bluetooth (Bluetooth status, connected devices, nearby Bluetooth attacks); location (cell towers and Wi-Fi access points, see “Location” above); contacts and calendar (counting only, to detect mass deletion); phone state (mobile network type, SIM card change); usage data (volume of data sent, number of connections, dual-account apps, usage time of each app over the last 24 hours); notification access (links in notifications and SMS messages, hashes of messaging notifications, see above); all files access (installation files, archives and suspicious files in storage, see “Storage files” above). On iPhone: notifications (alerts); camera (QR code scanner only); Bluetooth (nearby devices, to spot a Bluetooth attack: for each device seen, the signal strength and whether or not it broadcasts a name or services; neither its identifier nor its name is sent); location while using the app, solely to read the name and security type of the Wi-Fi network you are connected to, this name being kept with the check result; Face ID (unlocking the vault, on the device). This data is never sold.

Contract performance (Art. 6.1.b GDPR): user account management, provision of security service, subscription management.

Consent (Art. 6.1.a GDPR): newsletter delivery, placement of analytics and marketing cookies, measurement of our advertising campaigns (box to tick at sign-up, in the Android app and on trasimene.com, consent can be withdrawn in the account settings), reading of cell towers and Wi-Fi access points enabled by location access (Android), hashes of messaging notifications enabled by notification access (Android), app usage time enabled by usage data access (Android). For these three types of access, consent is given by granting the access and can be withdrawn at any time by revoking it in the phone's settings.

Legitimate interests (Art. 6.1.f GDPR): platform security, fraud prevention, error reports (Sentry, Firebase Crashlytics), usage measurement in the apps (see “Usage measurement in the apps”), installation source (see “Installation source”).

Legal obligation (Art. 6.1.c GDPR): retention of your payment history (date, plan, price, store used), including after your account is deleted, for the period required by French commercial and tax law.

Google Cloud (Google LLC): hosting of the website, the API and the data (accounts, results, encrypted vault) in region europe-west1 (Belgium, EU); vault keys and secrets in Secret Manager, encrypted and automatically replicated by Google to stay available; VPN server machines in 19 countries (see “International Transfers”). https://cloud.google.com/security/compliance/gdpr

Google LLC: Google sign-in, Play Integrity (which proves to our servers that the Android device and app are genuine), Google Play install referrer (see “Installation source”) and Google Maps for the map on the VPN screen on Android, https://policies.google.com/privacy

Firebase (Google LLC): Cloud Messaging for notifications (device token, title and text of the notifications sent), Analytics for usage measurement and Crashlytics for crash reports (see “Usage measurement in the apps”), https://firebase.google.com/support/privacy

Apple Inc.: notifications on iPhone (APNs), Apple sign-in, App Attest, which proves to our servers that the app is genuine, and attribution of installations from Apple Search Ads (AdServices, see “Installation source”), https://www.apple.com/legal/privacy

PostHog Inc.: usage measurement in the apps; servers in the European Union (see “Usage measurement in the apps”), https://posthog.com/privacy

Sentry (Functional Software Inc.): error reports from the apps, the website and the API; servers in the European Union for the apps and the website. On the website, some errors (10%) come with a reconstruction of the page, in which text and images are masked, to find the cause of the failure. https://sentry.io/privacy

Have I Been Pwned (Troy Hunt, Australia): data breach monitoring. For each email address you monitor, our servers send it the address itself, over an encrypted connection, when it is added and then every 24 hours, to find out whether it appears in a known breach. Nothing else is sent to it. For the passwords in the Tessin vault, only the first 5 characters of their SHA-1 hash are sent to the Pwned Passwords service: the password never leaves our servers. https://haveibeenpwned.com/Privacy

RevenueCat Inc.: management of subscriptions taken on the App Store, Google Play and trasimene.com (account identifier, purchases, subscription status), https://www.revenuecat.com/privacy

Stripe Inc.: card payment on trasimene.com, via RevenueCat; card details are entered at Stripe and never pass through our servers, https://stripe.com/privacy

VirusTotal (Google LLC): reputation of installed Android apps (SHA-256 hash of the installation file, as a last resort, never the file), of site names, and of a file you choose to check on iPhone (hash only), https://support.virustotal.com/hc/en-us/articles/115002168385-Privacy-Policy

Google Safe Browsing (Google LLC): checking of the addresses you scan and of the links found in your notifications; as a rule the domain name, and the full address when the site is hosted on a shared platform or when you scan the address yourself, https://safebrowsing.google.com/

Resend Inc.: sending of our emails (address confirmation, alerts, newsletter); for the newsletter, your address and, if you subscribe from your account, your name are on our mailing list at Resend, https://resend.com/legal/privacy-policy

Infomaniak Network SA (Switzerland): mailbox of contact@trasimene.com, where your messages to support arrive, https://www.infomaniak.com/fr/cgv/politique-de-confidentialite

Quad9 Foundation (Switzerland): resolution of the site names requested in the VPN tunnel, from the VPN server's address, never yours (see “VPN”), https://quad9.net/privacy/policy

ip-api.com: approximate country and city shown on the VPN screen, from your public IP address (or that of the VPN server if you are connected); nothing else is sent, https://ip-api.com/docs/legal

Meta, TikTok, Snapchat, LinkedIn and Google Analytics: measurement of our campaigns, with your consent given at sign-up in the Android app or on trasimene.com (see “Measuring our advertising campaigns”)

Essential cookies (no consent required): authentication session (NextAuth.js), language preferences.

Analytics cookies (consent required): Google Analytics and our own audience measurement for the site, to improve the service.

Marketing cookies (consent required): Meta Pixel, TikTok, LinkedIn, X, targeted advertising and campaign measurement. The reports made by our servers to advertising platforms, with the consent given at sign-up, are described in the “Measuring our advertising campaigns” paragraph.