Privacy
Last updated: 3 September 2026
Draft pending legal review. This document was written in-house and has not yet been checked by a qualified lawyer. It nonetheless binds the publisher in the terms in which it is published.
Data controller
The data controller is Jonathan Marcel MONDAUT — Entrepreneur Individuel (EI), 3 avenue de la République, APT G32, 92230 Gennevilliers, France, SIRET 109 251 801 00014. Full details in the legal notice.
Contact for any question about personal data: mondautjonathan@gmail.com — +33 7 69 32 01 82.
The publisher is not required to appoint a Data Protection Officer under article 37 GDPR; the address above serves as the single point of contact.
This English version is provided for convenience. In the event of any discrepancy, the French version prevails.
Scope
This policy covers the site jack-of-all-trades.dev and the mobile applications published under the “Jack of All Trades” brand, including Boxing Combo Timer & Coach, À Deux Pas and Ball of Steel.
An application that processes data specific to its own use has its own policy, which supplements this one and prevails over it on the points it covers: À Deux Pas, for location, and Ball of Steel, for motion controls, advertising and planned purchases.
It does not cover processing carried out by the distribution stores on their own account (user account, payment, purchase history), for which the store is an independent controller.
Data collected on the site
The site is a showcase site: no user accounts, no order forms, no newsletter. No personal data is collected other than in the following cases:
- Analytics — Google Analytics, only after express consent given through the banner. Collects a measurement identifier, the IP address (truncated), pages viewed, visit duration, device type, browser and country.
- Technical logs — the host retains connection logs (IP address, timestamp, user agent, requested resource) for security and service reliability.
- Correspondence — if you write to the contact address, your message, email address and attachments are kept for as long as needed to handle your request.
- Consent preference — your choice about trackers and its timestamp are stored locally in your browser (see “Cookies and trackers”).
Data collected in the applications
Depending on the title and the features you enable, the following categories may be processed:
- Device and advertising identifiers — the Android Advertising ID, or the IDFA on iOS after authorisation through the App Tracking Transparency prompt. Used for ad delivery, frequency capping and measurement.
- IP address — necessary for any network connection; used by ad networks to infer approximate location (country, region) and for anti-fraud security.
- Usage and diagnostic data — screens viewed, usage events, crash and performance reports.
- Precise location — only if a feature requires it and after explicit authorisation through the system prompt. À Deux Pas does, to order events by distance; the detail is in its dedicated policy. That position is never passed to ad networks.
- Data you create in the application (for example the training settings in Boxing Combo Timer & Coach) — stored locally on your device and not transmitted to the publisher.
- Payment data — never collected or viewed by the publisher. Card numbers and banking details are handled directly by the distribution store, which acts as seller.
Purposes and legal bases
Each processing operation rests on one of the legal bases in article 6(1) GDPR:
- Providing the requested application or site, and performing the digital content supply contract — performance of a contract, article 6(1)(b).
- Personalised advertising and sharing identifiers with ad networks — consent, article 6(1)(a), collected through the User Messaging Platform (UMP) and, on iOS, the ATT prompt. Withdrawable at any time.
- Non-personalised or contextual advertising — legitimate interest in funding the application, article 6(1)(f), with data access strictly limited to what is needed for display and frequency capping. On devices, reading or writing information remains subject to consent where article 82 of the French Data Protection Act requires it.
- Site analytics — consent, article 6(1)(a).
- Crash reporting, security, fraud and abuse prevention — legitimate interest, article 6(1)(f).
- Responding to your requests and complaints — legitimate interest, article 6(1)(f), or performance of a contract where they concern a purchase.
- Retention of accounting and tax records — legal obligation, article 6(1)(c).
Advertising and measurement
Free applications are funded by advertising, delivered by Google AdMob.
In the European Economic Area, the United Kingdom and Switzerland, no personalised advertising is served and no advertising identifier is shared before your consent is collected through Google's User Messaging Platform (UMP SDK), which is compliant with the IAB Transparency and Consent Framework. On iOS, the IDFA is used only after explicit authorisation through Apple's App Tracking Transparency prompt.
You can change this choice at any time from the “Privacy” or “Ad settings” screen in the application, and from your operating system settings (Android: Settings › Google › Ads; iOS: Settings › Privacy & Security › Tracking).
Where consent is absent, or where a user is identified as being under the age of digital consent, only non-personalised or contextual advertising is served.
Processors and recipients
The following providers are involved in operating the site and the applications. No personal data is sold, rented or transferred to third parties for commercial purposes.
- Google Ireland Limited / Google LLC — Google AdMob: ad delivery, advertising identifier, IP address, ad interaction data. Privacy policy — how advertising data is used.
- Google Ireland Limited — Google Analytics: site analytics, measurement identifier, truncated IP address, pages viewed. Subject to consent. Privacy policy.
- Google Ireland Limited / Google LLC — Google Play: distribution, billing, subscriptions, Android Vitals crash reporting. Independent controller for the account and payment. Privacy policy.
- French administration (DINUM / IGN) — Base Adresse Nationale: geocoding and address search, for À Deux Pas only. A public service, queried with no key and no identifier. Information.
- Vercel Inc. — site hosting, connection logs. Privacy policy.
- Cloudflare, Inc. — D1 database and R2 file storage, network protection. Privacy policy.
Transfers outside the European Union
Some of these providers are established in the United States or may transfer data there. Depending on the provider, those transfers rest on the European Commission's adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework where the recipient is certified under it, or otherwise on the standard contractual clauses adopted by the European Commission, supplemented by appropriate technical and organisational measures.
A copy of the applicable safeguards can be requested from the contact address.
Retention periods
- Analytics — 13 months for identifiers and trackers, 25 months maximum for aggregated data.
- Tracker consent preference — 6 months, then you are asked again.
- Host technical logs — 12 months.
- Advertising data held by the ad network — per Google's policy, generally 14 months for data linked to an identifier.
- Correspondence — 3 years from the last exchange.
- Accounting records and proofs of sale — 10 years, under article L. 123-22 of the French commercial code.
Your rights
Under the GDPR you have the rights of access (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18), portability (art. 20) and objection (art. 21), together with the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. You may also give directions on what happens to your data after your death.
These rights are exercised free of charge by email to mondautjonathan@gmail.com or by post to the publisher's address. A reply is provided within one month, extendable by two months for complex requests. Proof of identity may be requested where there is reasonable doubt as to your identity.
You may lodge a complaint with the CNIL, the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.
Data breach
In the event of a personal data breach, the publisher notifies the CNIL within 72 hours of becoming aware of it, under article 33 GDPR, unless the breach is unlikely to result in a risk to your rights and freedoms. Where the breach is likely to result in a high risk, affected individuals are informed without undue delay (article 34).
California residents (CCPA / CPRA)
This section applies to residents of the State of California and supplements the above.
Categories of personal information collected in the last twelve months: identifiers (advertising identifier, IP address), internet activity information (interactions with the application and with ads), approximate geolocation inferred from the IP address, and commercial inferences drawn by the ad networks.
The publisher does not sell personal information for monetary consideration. However, sharing advertising identifiers with Google AdMob for cross-context behavioural advertising constitutes a “sale” or “share” under the CCPA as amended by the CPRA.
The publisher does not knowingly collect personal information from minors under 16 for sale or sharing without opt-in.
Do Not Sell or Share My Personal Information — to opt out of sharing your identifiers for advertising: in the application, open the “Privacy” screen and turn off personalised advertising; on the site, open and decline analytics. You may also send a request to mondautjonathan@gmail.com stating “Do Not Sell or Share”. Browser opt-out preference signals (Global Privacy Control) are honoured. You will not be discriminated against for exercising these rights.
Children (COPPA and the age of digital consent)
The published titles are not primarily directed to children, but may address a mixed audience including minors — this is the case for Boxing Combo Timer & Coach.
No personal data is knowingly collected from a child under 13 without verifiable parental consent, within the meaning of the Children's Online Privacy Protection Act (COPPA). The same applies below the age of digital consent in the European Union, set between 13 and 16 depending on the member state — 15 in France.
Where a user is identified as being below the age of consent, or where a session is treated as child-directed, the Tag For Child-Directed Treatment (TFCD) and Tag For Users under the Age of consent (TFUA) settings are passed to the ad network: no persistent advertising identifier is used for targeting, no profile is built, and only contextual, non-personalised ads are served.
The COPPA exception for persistent identifiers used solely to support the internal operations of the service — frequency capping of the same ad, aggregated measurement, security and fraud prevention — is applied strictly, with no other use.
If you hold parental authority and believe a child has provided personal data, write to mondautjonathan@gmail.com: the data will be deleted without delay.
- Google Play rating
- Content rating and target audience declared in the Play Console — to be reported here
- Families programme
- The application is not published in the Google Play “Designed for Families” programme, nor in a restricted “Kids” category.
Changes to this policy
This policy may be updated to reflect changes in processing or in the law. The date of last update appears at the top of the page. Where a change is material, a notice is shown on the site and, where relevant, in the application.