Privacy

Your data

The publisher below controls Hello World data hosted by OVHcloud: profiles, posts, media, text, associated places and dates, participation, messages, comments and interactions. Permissions, country of residence, adulthood date, parental requests and decisions are also retained.

Sign-in and access

Google Firebase verifies your phone by SMS with reCAPTCHA. Hello World keeps an identifier, protected phone digest and an encrypted phone copy accessible to the authorised administrator. Eligible profiles and posts are visible to authorised members; messages are intended for participants without end-to-end encryption. Administrators review incidents and reports.

Capture checks

With separate permission, OpenAI receives the photo or extracted video frames, caption and any audio, which is transcribed and checked. Faces, voices and visible information may be included; phone numbers and GPS fields are not added. Checks can reject content incorrectly: request human review through support. Withdrawing permission in settings stops future submissions and prevents publishing.

Other recipients

OpenFreeMap and OpenStreetMap supply maps and receive IP addresses and requested areas. country.is infers a country from the IP address. Authorities may receive legally required information.

On your device

Camera, microphone and location require browser permissions. Language, appearance, Firebase sign-in, interactions, captures and drafts remain locally to resume your work. Drafts may include media, audio, location and time; they are submitted only at your request. Signing out does not clear every draft. Delete drafts in the service or clear site data on each device.

Your rights

Contact the publisher or use the “Personal data” form for access, a copy, correction, erasure, restriction, portability where applicable, or objection to processing based on legitimate interests. You can withdraw consent. Proportionate identity verification may be required. You may complain to the Belgian Data Protection Authority or the competent authority in your country.

Data retention

Account data remains while you use the service. Removed posts are immediately hidden; media, caption, location, comments and likes are erased after 30 days. An open report about the post or its author pauses erasure until 30 days after the latest decision. A minimal internal reference remains. Support: handling plus 90 days after closure. Technical events: 90 days; presence: one day; abuse limits: until expiry. Cleanup runs in batches during activity and can be scheduled; these periods are cleanup thresholds. Intermediate checking files are normally deleted after processing. Parental records, reports, administrative logs and financial archives have no general automatic purge. OVHcloud backup and hosting-log periods are unconfirmed. Google states authentication-data deletion can take up to 180 days after a request. OpenAI describes limited retention for the interfaces used, subject to security or legal exceptions; no absolute absence of retention is guaranteed.

Purposes and legal bases

Proposed bases for publisher confirmation: contract for requested account services, conversations; consent for OpenAI submissions; legitimate interests, after a proportionality assessment, for security and reports; applicable legal obligations for accounting, rights and authorities. Browser permission alone does not validate a legal basis.

International transfers

Firebase Authentication operates in the United States. OpenAI and map providers may process data abroad. Applicable contracts, the OVHcloud region and backups still need confirmation from the publisher. Ask them which transfer safeguards actually apply.