Privacy and GDPR

The golden rule

No data leaves your device in the Coach Timi (cards) flow. The 7 advisors and 8 signal detectors run locally on your phone. The orchestrator is purely client-side.

[!note] This decision is deliberate. It avoids any dependency on an external LLM for proactive advice, and guarantees that your mission calendar or fiscal deadlines do not leak to a third-party server.

And the LLM (OpenAI, Anthropic)?

Timint uses an LLM only in two very precise contexts:

1. AssistantSheet — the reactive chat accessible via lateral swipe from the Home. This is NOT Timi, it is a different feature. On some queries, the AssistantSheet sends an anonymised snapshot (no names, no IDs) to the backend, which may query an LLM. With explicit consent on first use.
2. Tool advisor — the contextual AI recommendation after a tool calculation (useToolAdvisor). Sends anonymised inputs and results to a Cloud Function endpoint.

In both cases, no Coach card is generated by an LLM today. Phase 8 plans this integration, but with:

• A blocking consent modal on first use (upcoming).
• All fiscal, banking, and investment disclaimers auto-attached.
• A forbidden-phrases list applied post-LLM (no "buy X", no "subscribe to Y", etc.).

Your GDPR rights

• Portability — full export of all your data via requestDataExport (Settings > Account).
• Rectification — correction request via requestDataRectification.
• Erasure — account deletion via requestAccountDeletion (immediate soft delete + hard delete at D+30).
• Granular consent — recordUserConsent: each processing category can be revoked.

Legal bases per processing

| Processing | Basis | DPIA reference | |---|---|---| | Signal detection + proactive cards | Art. 6.1.b (contract performance) | §2.2 | | Deterministic personalised advice | Art. 6.1.b | §2.2 | | Transfer to third-party LLM (future) | Art. 6.1.a + Art. 49.1.a (explicit consent + Standard Contractual Clauses) | §2.5 | | Anonymised analytics | Art. 6.1.f + opt-in | §2.2 |

Cross-border (transfers outside the EU)

If an LLM is called from the US (roadmap case for Anthropic/OpenAI), Standard Contractual Clauses (SCC) apply, plus a documented DPIA. Migration planned to AWS Bedrock EU or Anthropic EU as soon as parity is reached.

Permanent disclaimer

At the bottom of the /coach inbox, you permanently see: Timi provides personalised analyses for informational purposes. Il ne se substitue pas à un conseiller en investissement, un avocat fiscaliste ou un expert-comptable.

AI Act — transparency Art. 50

• Every card with aiGenerated=true shows an AI generated — verify with a pro badge. Today no card carries this badge (all deterministic).
• Permanent footer disclaimer on the inbox.
• Blocking consent modal on first use (upcoming Phase 8).

[!info] Going further: see the Data privacy section — detailed GDPR rights, exports, and rectification procedures.