Privacy policy

Last updated: 30 September 2026

Who we are

Covoit26 is a free app that helps carpool groups track their trips and split costs. It is published by Matthieu Boesse, the controller of your data. Contact: contact@covoit26.eu.

Data we collect

Account: your email address (to send you sign-in codes), your first name and language. If you choose “Continue with Google” or “Continue with Microsoft”, we only receive your email address, first name and, where applicable, your Microsoft organisation ID from that provider: never your password, nor access to your emails, files or contacts. We record the sign-in method used and, for each signed-in device, the browser type and last activity date (shown in My account).
Team data: team name, members' first names, trip dates, driver and passengers of each trip, amounts and cost-sharing rules, expenses and settled months. This data is entered by you or other members of your teams, and visible to all team members.
Technical data: IP address and browser type, used for security (sign-in attempt limits, technical logs), and a strictly necessary session cookie to keep you signed in.

We don't collect GPS location, contacts or payment data. No ads, no analytics, no data selling.

Why

Only to provide the service: sign you in, display and sync your teams' data, compute balances. Legal basis: performance of the service you request (GDPR art. 6.1.b) and, for technical data, our legitimate interest in securing the service (art. 6.1.f).

Who we share it with

Members of your teams see those teams' data (never your email address).
Our email provider (Brevo, a French company) receives your email address to deliver sign-in codes.
If you sign in with Google or Microsoft, that provider knows you use Covoit26, under its own privacy policy.
Company-managed accounts: if your email address is on a domain name whose ownership a company (usually your employer) has proven, the administrators it appoints see your email address, first name, sign-up and last sign-in dates, the sign-in method used and how many teams and sessions you have. They can deactivate your account, end your sessions and require sign-in with the company's Google or Microsoft account. They never see the content of your teams (trips, amounts, other members). You are informed of this in My account. Legal basis: the company's legitimate interest in managing access tied to its work addresses (GDPR article 6.1.f); its administrators act under its responsibility.
Data is hosted on our own servers in the European Union.

How long

Account and team data: as long as your account exists. A team is deleted when its last member with an account deletes it or deletes their account.
Sign-in codes: 2 days. Sessions: 1 year of inactivity (extended each time you use the app; you can end your other devices' sessions in My account).
Encrypted backups: rolling 30 days.

Your rights

You can access, correct and export your data (My account › Export my data) and delete your account at any time (My account › Delete my account, or see this page). When you delete your account, your first name stays in your teams' trip history (other members' balances depend on it), but is no longer linked to any account or email address. For any request: contact@covoit26.eu. You may also contact your data protection authority (in France, the CNIL).

Security

Encrypted connections (HTTPS), single-use sign-in codes never stored in clear text, encrypted backups, limited and logged admin access.

Minors

The service is intended for people aged 15 and over.