Privacy policy
Last updated: June 3, 2026
This privacy policy describes how Booster Dakar (“we”, “our”, “us”) collects, uses, and protects your personal data when you use our website https://booster-dakar.com and our mobile application “Booster Dakar” available on the App Store.
This policy complies with the General Data Protection Regulation (GDPR), the Senegalese Law n°2008-12 of January 25, 2008 on the protection of personal data, and the requirements of the Commission de Protection des Données Personnelles (CDP) of Senegal.
1. Data Controller
Booster Dakar
Point E, Rue 1 X A, Face Fondation Kéba Mbaye
Dakar, Senegal
Phone: (+221) 77 773 18 18 / (+221) 33 868 80 40
Email: contact@booster-dakar.com
2. Data We Collect
2.1. Data you provide directly
- Account: first name, last name, email, password (bcrypt encrypted, 12 rounds), phone number, profile photo (optional).
- Fitness profile: goal (muscle gain, weight loss, fitness, endurance), current weight, target weight, height, activity level.
- Body measurements: weight, body fat percentage, waist, thigh, arm, chest (entered voluntarily).
- Progress photos: only if you choose to upload them — stored privately and accessible only to you.
- Shop orders: delivery address, payment method (Wave, Orange Money, or cash on delivery).
- Messages: content of conversations with coaches or support.
- Reviews and comments: ratings and comments left on programs.
2.2. Data collected automatically
- Technical identifiers: device ID, OS version, device type, language, time zone.
- Activity logs: completed sessions, programs viewed, recipes seen, meal scans, hydration logged.
- Website navigation data: pages visited, visit duration, cookies (see section 7).
- Firebase Cloud Messaging (FCM) push token: required to send you notifications.
2.3. Apple HealthKit data — iOS app only
If you activate Apple Health synchronization, we read from HealthKit:
- Daily step count
- Active calories burned
- Distance traveled (walking / running)
- Sleep data (hours, quality)
Important: this data is encrypted in transit and stored on our servers solely to display your progress in the app. It is never shared with third parties, never used for advertising, never sold. You can revoke access at any time in iOS Settings → Privacy → Health → Booster Dakar.
2.4. Third-party authentication (Google / Apple Sign-In)
If you sign in with Google or Apple, we receive only your email, first name, and last name (according to what you authorize). No Google/Apple password is ever transmitted to us.
2.5. Photos taken from the app (meal scan, profile photo)
- Profile photo / measurements: uploaded to our secure servers.
- Meal scan: sent to the OpenAI API for nutritional analysis, then stored on our servers linked to your account. OpenAI does not retain these images (zero-retention policy).
3. Purposes of Processing
| Purpose | Legal Basis (GDPR) |
|---|---|
| Creating and managing your account | Contract performance (art. 6.1.b) |
| Processing shop orders | Contract performance (art. 6.1.b) |
| Personalizing programs and daily missions (AI) | Contract performance (art. 6.1.b) |
| Sending push notifications (session reminders, new programs) | Legitimate interest (art. 6.1.f) — can be disabled at any time |
| Re-engagement emails, weekly recap | Legitimate interest — opt-out via link in each email |
| Anonymous usage statistics | Legitimate interest (art. 6.1.f) |
| Responding to support requests | Contract performance (art. 6.1.b) |
| Fraud prevention | Legitimate interest (art. 6.1.f) |
4. Third-Party Processors
We share certain data with the following providers, strictly necessary for the service to function:
| Provider | Role | Data processed | Location |
|---|---|---|---|
| Railway (USA) | Backend hosting + PostgreSQL database | All account data | USA (EU standard contractual clauses) |
| Amazon Web Services (S3, CloudFront) | Media storage (videos, images) | Uploaded photos, program videos | EU (eu-west-1, Ireland) |
| Firebase Cloud Messaging (Google) | Push notifications | Anonymous device token | USA (EU standard contractual clauses) |
| Apple HealthKit | iOS health data source | Steps, sleep, calories (read only) | Local to iOS device |
| OpenAI | AI coach, meal scan, personalized missions | User messages, meal photos (zero-retention) | USA |
| Resend | Transactional emails | Email, first name | EU |
| Sentry | Anonymous error monitoring | Stack traces, anonymous identifier | USA |
| Wave / Orange Money | Payment processing | Amount, phone number | Senegal |
Your data is never sold, rented, or exchanged with third parties for advertising or external marketing purposes.
5. Data Retention
- Active account: as long as your account exists.
- Account inactive for 3 years: notification sent, deletion after 30 days without response.
- Voluntarily deleted account: immediate anonymization, complete deletion within 30 days (except legal obligations).
- Invoices and accounting data: 10 years (tax obligation).
- Connection logs: maximum 12 months.
- Cookies: maximum 13 months.
6. Your Rights (GDPR + Senegalese Law)
You have the following rights at any time:
- Right of access: obtain a copy of all your data.
- Right of rectification: correct inaccurate data.
- Right to erasure (“right to be forgotten”): request deletion of your account and data.
- Right to data portability: receive your data in a structured format (JSON).
- Right to object: oppose processing based on legitimate interest.
- Right to restriction: request suspension of a processing activity.
- Right to withdraw consent: for processing based on consent.
To exercise these rights: write to contact@booster-dakar.com with proof of identity. Response within 30 days maximum.
To file a complaint: you may contact the Commission de Protection des Données Personnelles (CDP) of Senegal or, if you reside in the EU, your national data protection authority.
7. Cookies (website only)
Our website uses strictly necessary cookies (session, cart) and anonymized analytics cookies. The mobile app does not use cookies but uses secure local storage (AsyncStorage) for the user session.
8. Security
- Passwords hashed with bcrypt (12 rounds).
- Communications encrypted via HTTPS/TLS 1.3.
- JWT authentication tokens with limited duration (15 minutes access, 7 days refresh).
- Regular encrypted database backups.
- Server access restricted by SSH authentication.
Despite our best efforts, no system is 100% secure. In the event of a data breach, we will notify the relevant authorities and affected users within 72 hours in accordance with GDPR.
9. Children
The Booster Dakar app is not intended for children under 13 years of age. For users between 13 and 16, parental or guardian consent is required. If we discover that an account belongs to a child under 13, we will delete it immediately.
10. International Data Transfers
Some of our providers are based outside the EU / Senegal (Railway and OpenAI in the USA). These transfers are governed by Standard Contractual Clauses approved by the European Commission, or by adequacy decisions where applicable.
11. Account Deletion
You can delete your account at any time:
- From the app: Profile → Settings → Delete my account
- By email: send “DELETE MY ACCOUNT” to contact@booster-dakar.com from your account email.
Your data will be anonymized within 30 days (except invoices retained for 10 years).
12. Changes
This policy may evolve. We will notify you by email or push notification for any substantial change.
13. Contact
Data Protection Officer (DPO)
Email: contact@booster-dakar.com
Mail: Booster Dakar — Point E, Rue 1 X A, Dakar, Senegal
Point E, Rue 1 X A, Face Fondation Kéba Mbaye,
Dakar, Senegal
© 2026 Booster Dakar. All rights reserved.