Privacy Policy

Last updated: May 20, 2026

This privacy policy describes how CRAYCRAY SAS (hereinafter "Vice", "we") collects, uses and protects your personal data when you use the Vice application (the "Service").

Vice is built around two principles: strict anonymity on the member side and strict identity verification on the platform side. We collect the minimum data needed to operate the Service and comply with our legal obligations.

To request deletion of your account and data, visit Delete your account.

1. Data controller

2. Data we collect

2.1 Login data

Login to Vice is only via Sign in with Apple or Google. We do not ask for your phone number and do not create a Vice password. Apple or Google share with us a unique identifier and, depending on your choice, your email address (which may be an Apple-relayed alias). Vice has no access to any other data from your Apple or Google account.

2.2 Profile data

  • First name or pseudonym (your choice, never published under your legal name)
  • Date of birth (age verification)
  • Declared gender and discussion preference
  • Text bio
  • No public photos. Media (photos, audio) are disabled by default and can only be enabled by mutual agreement between two members inside a conversation.

2.3 Camera identity verification

To guarantee no bots, no fake profiles and no minors on Vice, every account is verified by camera (selfie with liveness detection) via our processor Didit (GDPR-compliant subprocessor). This verification covers your age, gender, and the fact that you are a real person. Didit shares with Vice only the verification result and the verified attributes (adulthood, gender). Vice never stores your verification video, ID document or legal name.

2.4 Usage data

  • Exchanged messages, likes sent and received, media requests
  • Reports filed or received
  • Login history and online status

2.5 Technical data

  • IP address, device type, operating system, app version
  • Technical logs required for security and diagnostics
  • Authentication tokens (Apple / Google / Firebase)

3. Why we use your data

We use your data solely to:

  • Log you in via Apple or Google
  • Verify your adulthood and authenticity via Didit, to block minors, bots and fake profiles
  • Display you to other members based on your preferences
  • Enable exchanges (messages, likes, media requests)
  • Moderate the platform and handle reports
  • Comply with legal obligations (judicial requests, fight against illegal content)

We perform no targeted advertising, no commercial profiling and we never sell your data.

4. Retention periods

  • Active account: as long as you use the Service
  • After account deletion: up to 3 months, then permanent deletion or anonymisation
  • Messages: kept while the conversation exists, deleted on account deletion
  • Reports and moderation data: 3 years (community safety)
  • Technical logs: up to 12 months

5. Recipients and subprocessors

Your data is accessible only to authorised Vice staff and the following technical subprocessors:

  • Apple (Sign in with Apple): authentication
  • Google (Sign in with Google): authentication
  • Firebase (Google Cloud): database hosting, message and media storage
  • Didit: identity and age verification (KYC), GDPR-compliant

No data is sold or shared with third parties outside these strictly necessary subprocessors.

6. Transfers outside the European Union

Some of our subprocessors (Apple, Google / Firebase) may process data outside the EU. These transfers are governed by the Standard Contractual Clauses approved by the European Commission and by applicable certifications (Data Privacy Framework).

7. Your rights

Under the GDPR, you have at all times the following rights:

  • Access to your data
  • Rectification of inaccurate data
  • Erasure ("right to be forgotten") directly from the app or on request
  • Portability in a structured format
  • Objection to processing based on legitimate interest
  • Restriction of processing
  • Complaint to the CNIL (cnil.fr)

To exercise your rights, write to privacy@vice-app.com. We respond within 30 days maximum.

8. Security

  • Authentication delegated to Apple and Google (no Vice password)
  • Encryption of communications in transit (TLS 1.2+)
  • Independent identity verification via Didit
  • Continuous automated and human moderation, in-conversation reporting
  • Internal data access restricted and logged

9. Minors

Vice is strictly limited to adults (18 years and older). Adulthood is verified by Didit before account activation. Any account belonging to a minor is immediately deleted and reported to the competent authorities where necessary.

10. Vice specifics

  • Member anonymity: your legal name is never displayed. You freely choose your first name or pseudonym.
  • No public photos on profiles. Media (photos, audio) are disabled by default and can only be enabled by mutual agreement between the two participants of a conversation.
  • Conversation first: Vice is a safe discussion space and does not encourage offline meetings.
  • Identity verification: Vice never stores your ID document; only the "verified" result is shared with us by Didit.
  • Reports: reported content is kept for 3 years for community safety, even after account deletion.

11. Identity verification and face data

Vice uses the provider Didit to verify that accounts are tied to a real person and to limit fake accounts, identity impersonation and abusive behaviour.

As part of this verification, Didit may collect and process data from the user's camera, including an image or video of the face, liveness detection data, data needed to compare or analyse the face, as well as the technical results of the verification. This data is processed by Didit to perform identity verification, confirm that the user is a real person, prevent fraud and ensure the security of the platform.

Vice does not store in its own database face images, selfie videos, biometric templates, liveness scores or derived facial attributes. Vice only retains verification metadata needed to operate the service, including the verification status, the Didit session identifier, the verification provider, the verification update date and the information needed to enforce our security rules.

Verification data processed by Didit is stored by Didit in the European Union by default, unless a different contractual configuration applies. Didit acts as a processor of Vice for identity verification. Vice does not sell this data and does not share it with advertising partners.

Face data and biometric data processed by Didit are kept by Didit for a maximum duration of one month, according to the retention setting selected by Vice in Didit. Verification metadata retained by Vice is kept as long as the user account exists, unless a legal obligation or applicable deletion request requires otherwise.

Users can request the deletion of their account and data from the app or by contacting hello@vice-app.com. When the account is deleted, Vice deletes or anonymises the associated data according to the applicable rules, and may request or trigger the deletion of verification data still held by Didit where applicable.

12. Changes

We may update this policy to reflect legal or technical changes. Any substantial change will be notified via the app at least 30 days before it takes effect.

13. Contact

For any question relating to your personal data:
privacy@vice-app.com