Privacy policy

Version 2.0 — effective October 4, 2026

Divex is a digital and social dive logbook. This policy explains what personal data we process when you use the Divex app (iOS and Android), why, on what legal basis, for how long, who it is shared with and how to exercise your rights.

It is drawn up in accordance with Regulation (EU) 2016/679 of April 27, 2016 (“GDPR”) and the amended French law no. 78-17 of January 6, 1978 (the “loi Informatique et Libertés”).

1. Who is responsible for your data?

The data controller is Joseph LALOT EI, a sole proprietorship (micro-entreprise) operating under the trade name “44 apps”, 101 route d’Albi, 31200 Toulouse, France, SIRET 102 010 204 00018, which publishes the app under the name “Divex” (hereinafter “Divex” or “we”).

For any question about your data or to exercise your rights, write to app.divex@gmail.com or by post to the address above. Divex has not appointed a data protection officer, as this is not mandatory for its activity.

2. The data we process

• Account: email address, password (stored in encrypted form by our hosting provider: we never have access to it in plain text), display name, username, profile photo, bio, certification level and number, featured certification and species, app language, account creation and last login dates.
• Guest account: an anonymous technical identifier, with no email address, and the content you create.
• Dive logbook: date, times, duration, depths, temperature, visibility, current, weather, site, GPS coordinates and country, dive type, equipment (weights, tank, pressures, gases and mixes), stops, notes, dive number, species sighted, photos and videos (with their caption, depth and date), drafts.
• Data from a dive computer: depth and temperature profile, gases used, events (stops, alarms, ascent rate), oxygen exposure (CNS), mode and algorithm, as well as the model, serial number, firmware version and Bluetooth address of the paired computer.
• Certifications: agency, level, number and date obtained.
• Medical certificates, if you record them: type of certificate (fitness, contraindication, specialized) and issue and expiry dates (see section 3).
• Relationships and interactions: friend requests and friends list, dive invitations and participations (role, notes, personal gases and weights), comments, likes, groups, clubs and centers joined (role, sharing preference), requests for the referent role and their justification, goals, muted users.
• Subscription: purchaser identifier with our provider RevenueCat, plan, status, period dates, purchase platform and promo codes used. We never receive your banking details.
• Notifications: your device’s notification token and your notification preferences.
• Connected services, if you enable them: technical identifier of your Garmin or Suunto account, access tokens (encrypted) and imported dive activities.
• Communications with us: messages sent from the app (issue, suggestion) with the app version and device type, reports about users or species, photo submissions for the species catalog, emails sent to support.
• Technical data: our hosting provider’s technical logs (including IP address), import logs (app version, platform, error messages) and counters used to limit abuse.

We do not collect your date of birth, phone number, postal address or your phone’s contacts. The app contains no advertising tools, no audience measurement and no tracking tools.

Your email address is required to create a full account. If you do not wish to provide it, you can use guest mode, with the limitations described in the terms of use.

3. Medical certificates and documents

Photos of your certifications and medical certificates stay on your phone only: they are not sent to our servers and are lost if you uninstall the app.

If you record a medical certificate, however, its type and dates are stored on our servers, so they can be retrieved on your devices and used for expiry reminders. This is health data. We process it only because you choose to record it, on the basis of your explicit consent (art. 9.2.a GDPR). It is visible only to you. You may withdraw this consent at any time by deleting the certificate: the information is then erased from our servers.

4. Why we use your data, on what basis and for how long

Our legitimate interests are the security of the service and its members, the fight against fraud and abuse, and the reliability of the app. You may object to this processing (section 11).

5. Who can see your dives and your profile in Divex

• “Public” dive: visible to you, to the dive’s participants, to the friends of each participant, to the people you have added individually, and to the members of the groups, clubs and centers you belong to when sharing is enabled for that group (it is enabled by default and can be disabled group by group).
• “Private” dive: visible to you, to the participants and to the people you have added individually.
• Draft: visible only to you and to the participants who have accepted your invitation.
• Private parameters (weights, consumption, tank volume): visible only to you.
• Profile: any logged-in user can find your profile through search and see your name, username, photo, bio, featured certification and species, as well as overall statistics (number of dives, maximum depth, time spent underwater, number of species sighted).
• Leaderboards: your friends (friends leaderboard) and the members of your groups (group leaderboard) can see your rank, number of dives and maximum depth.
• Map: a dive with a location appears on the map of the people allowed to see it.
• Dive sites: the sites you create (name, location, description) are visible to all users and remain in the catalog, no longer linked to you, after your account is deleted.
• Image sharing (story): the image you share may contain the name and photo of your buddies, the location and your dive data. Once shared, it leaves Divex and is subject to the rules of the service on which you post it.
• Divex team: administrators can access accounts (email address, last login, number of dives), dives and photos, solely for moderation, support and security purposes, and are bound by confidentiality.

6. Data about other people

When you name a buddy who does not have an account or a dive center, or mention someone in a note or on a photo, you are passing information about that person on to us. Stick to a first name or a nickname and make sure they agree. This processing is based on the legitimate interest in keeping a complete logbook. As we have no means of contacting these people, we cannot inform them individually (art. 14.5.b GDPR).

Anyone, whether registered or not, can ask us to delete information about them by writing to app.divex@gmail.com.

When a user reports you, we handle the report without revealing the identity of its author to you, unless required by law.

7. Our service providers and third-party services

We use the following service providers, who process your data only on our instructions:

Apple and Google also act as separate controllers when you download the app or pay for a subscription in their store: their own privacy policies then apply.

To display certain content, your device connects directly to the following services, which receive your IP address and the request:

• Base maps: OpenFreeMap (map) and Esri World Imagery (satellite view), which receive the area displayed.
• Place search: OpenStreetMap Nominatim (OpenStreetMap Foundation, United Kingdom) and your system’s geocoding service (Apple or Google), which receive the address searched for or a dive’s coordinates to find the nearest place.
• Mapping library: jsDelivr (content delivery network).
• Species photos: iNaturalist, which hosts some of the catalog’s images.
• Internet connection check: a Google service, which receives a simple technical request.

If you connect your Garmin or Suunto account, we exchange the necessary authorizations with these services and receive your dive activities; they act as separate controllers under their own policies. When you share content (Instagram, system share sheet, maps app), it is sent to the service you choose.

We never sell or rent your data and never share it for advertising purposes. We may disclose it to the authorities upon a legally valid request.

8. Transfers outside the European Union

Our hosting provider stores your data in the United States. This transfer is governed by the standard contractual clauses adopted by the European Commission. Transfers to our other providers established outside the European Union are governed by these same clauses or, where the provider has signed up to it, by the EU–US Data Privacy Framework. Transfers to the United Kingdom are covered by an adequacy decision of the European Commission.

You can obtain information about these safeguards by writing to app.divex@gmail.com.

9. What the app stores on your device

• Your login session, in the system’s secure storage (Keychain on iOS, Keystore on Android).
• A copy of your logbook and profile, and the queue of changes not yet synced, for offline use.
• Your preferences (language, sharing style, guides already viewed), your trophies and your completed goals.
• Photos of your certifications and medical certificates (section 3).

This information is strictly necessary for the service you request and does not require your consent (art. 82 of the loi Informatique et Libertés). The offline copy is erased when you log out, except for a guest account, which is kept so that you can recover it on the same device.

10. Permissions requested by the app

• Location, only while the app is open: center the map, locate a dive, fill in a club’s city. Your location is recorded only if you add it to a dive.
• Bluetooth: communicate with your dive computer.
• Camera: take photos of your certifications and medical certificates, stored on your device.
• Photos: choose dive or profile photos and videos, save story images.
• Files: import dive files (.fit).
• Notifications: alert you to invitations, comments and other activity.

You can withdraw each of these permissions at any time in your phone’s settings. The feature concerned then stops working, without affecting the rest of the app.

11. Your rights

• Access: obtain a copy of your data.
• Rectification: correct inaccurate data.
• Erasure: have your data deleted.
• Restriction: have the use of your data frozen in certain cases.
• Objection: object to processing based on our legitimate interest.
• Portability: receive the data you have provided to us in a machine-readable format.
• Withdrawal of consent: for medical certificates and phone permissions, at any time, without affecting what was done before.
• Post-mortem instructions: decide what happens to your data after your death (art. 85 of the loi Informatique et Libertés).

From the app’s Settings, you can edit your profile, delete your account and export your data: one file contains your profile, dives, the sites you created, your sightings, participations, certifications, medical certificates, goals, subscription and friend requests; a second file, in UDDF format, can be read by other dive logbooks such as Subsurface.

For any other request, in particular to obtain data not included in these files, write to app.divex@gmail.com. We reply within one month, which may be extended by two months for a complex request; we may ask you to prove your identity in case of reasonable doubt.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr), or with the data protection authority of your country of residence.

12. Deleting your account

You can delete your account at any time from the app’s Settings, or by writing to app.divex@gmail.com from the address associated with your account. Your profile, dives, dive photos and videos, certificates, comments, relationships, dive computers, Garmin and Suunto access tokens and preferences are then deleted from our databases. Our hosting provider’s backup copies are erased at the end of their retention cycle. You can also revoke the access granted to Divex from your Garmin or Suunto account.

• The dive sites you created remain in the catalog, no longer linked to you.
• Photos accepted in the species catalog remain published under the license provided for in the terms of use, unless you request their removal.
• Other users’ dives in which you took part remain in their logbook; your personal notes and data on those dives are deleted.

Deleting your account does not cancel a Premium subscription taken out on the App Store or Google Play: cancel it in your store’s settings to stop being charged.

13. Security of your data

• Encryption of communications between the app and our servers (HTTPS/TLS).
• Passwords stored in hashed form by the authentication service.
• Garmin and Suunto tokens encrypted (AES-256).
• Session stored in the phone’s secure storage.
• Access control rules enforced by the database.
• Administrator access limited and reserved for moderation, support and security.

If a data breach were likely to result in a high risk to you, we would inform you without delay and notify the CNIL within 72 hours.

14. Minors

Divex is reserved for people aged 16 and over. If we learn that an account belongs to a younger person, we delete it. A parent can write to us at app.divex@gmail.com to report it.

15. Automated decisions

Divex makes no decision producing legal effects concerning you based solely on automated processing. Leaderboards, trophies and statistics are calculations made available to you, with no effect on your rights.

16. Changes to this policy

We may change this policy, in particular to reflect changes in the app or the law. In the event of a material change, we will inform you by appropriate means (in the app or by email) before it takes effect. The version and effective date appear at the top of the document; previous versions are available on request.