Your voice belongs to you

Privacy Policy

October 23, 2026 · Version 1.2 (notifications, emails, widget)

The publisher and data controller of HAHA is Yannis Mesbah, private individual. Contact: mesbahyannis@outlook.fr. There is no data protection officer (not obligatory for this service).

Private recordings

The microphone is only used when you start recording. Your laughs, their name, their little note, your moods and your preferences stay on your device until you choose to publish or send a file. Uninstallation may erase this data; System backups depend on your settings.

Invited session

Without an account, the app opens a guest session: Firebase Authentication assigns it a random ID, without email or name. It is used to count your views only once per laugh, to keep your hearts, your votes in the arena and the credits earned by voting. Your blocks stay on your device. A guest session is automatically deleted by Firebase 30 days after its creation; the counters she contributed to remain, as totals. If you create an account, the guest session becomes your account and keeps its votes and credits.

Country declared

You choose your country by hand (no GPS location, no address). It is saved in your profile, guest or account. It serves to offer you the laughter that travels to your country and to count the views, hearts and victories of a laughter per country. These statistics are aggregated: the author of a laugh sees totals by country and by day, never who listened or voted.

Account and publication

Firebase Authentication processes your email, authentication information, and an account ID. Your email is never public. Account creation and publication are reserved for people aged 16 and over.

A publication proposal transmits the audio file, its name, its little note, its moods, your pseudonym, the chosen country and, if you wish, its destination countries. We also record the dates and version of the rules you accepted. Before validation, only you and moderation can consult it.

After validation, they become public: the audio, its name, its rating, its moods, your pseudonym, the chosen country, its destinations, the date of publication, its counters (listenings, hearts, number of countries affected), its score and its victories in the arena, the indication that it is propelled, and a technical account identifier which links your publications to your public profile. Your email, your purchases and proof of your consent remain private. The audio file is decoded then re-encoded by our servers: the metadata of the original recording is not preserved. Your voice is never used to identify you. Public audio can be copied and reused by third parties.

Arena and votes

For each duel, we temporarily record which two laughs were offered to you and your vote, so that a vote only counts once; these tickets are automatically deleted within 48 hours. Your vote updates the two laughs score and country totals; it is never published with your identity. Your number of votes and your credits are linked to your session or your account.

Public profile, search and Verified badge

Public profile. As soon as one of your laughs is validated, HAHA displays a public profile which groups them together: your last pseudonym, the country of your last laugh, your most frequent mood, the number of your public laughs and, if you have chosen to appear on the founders' wall, the Founder badge. It is calculated automatically from your public laughter and disappears when you no longer have any. You can hide it at any time (Settings › Profile): it then leaves the search and the list of personalities, and your pseudonym is no longer used for the search. Your published laughs remain public until you remove them. Legal basis: your consent to publication (article 6.1.a).

Research. To enable searching, our servers extract keywords from the title, rating, pseudonym, moods and country of each public laugh. These keywords are public like laughter and are erased when it is no longer so. HAHA does not save the searches you type.

Verified Badge. If you request it, we process the indicated public name, your category, the link to your official account or site, a verification code, your sworn declaration, the dates of the request and decision, and the moderation rating. Only you and moderation see this information. If the badge is granted, only your public name and category become public, and your pseudonym is reserved. Moderation consults the indicated account to find the code. A request without a response is deleted after 180 days, a request refused 90 days after the decision, and an granted badge is kept as long as your account exists. Everything is deleted with your account. Legal bases: your consent for the publication of the public name and category (article 6.1.a); our legitimate interest in combating identity theft for the verification and reservation of the pseudonym (article 6.1.f). Anyone can report a profile that is pretending to be someone else.

Video story, public web link and HAHA networks

Video story. When you create a video story of one of your laughs, our servers create an MP4 file from the audio, the title, your nickname and the mood. For a laugh kept on your phone and not published, the audio is sent temporarily then deleted just after production (at the latest within an hour). The video can be downloaded via a private link valid for 15 minutes and deleted from our servers within 24 hours. What you do with it afterwards (publication on a social network) depends on you and the chosen network.

Public web link. Disabled by default. If you activate it for one of your published laughs, it becomes listenable to anyone who has its link, on a page haha-rires.web.app/r/… not referenced by search engines. You can cut it at any time; the page can remain cached for up to an hour.

HAHA Networks. HAHA only uses user laughter on your own social networks if you have checked the box provided for the publication. You can withdraw this agreement by writing to us.

In-App Purchases

The Founder's Pack, Card Styles, “Propel My Laughter” (individually or in sets of three) and credit packs are sold and collected by Apple (App Store) or Google (Google Play). We never receive your bank details. We receive from the store: the product purchased, the transaction ID and date, the environment (real or test) and a pseudonymous token that links the purchase to your account, to verify the purchase, assign it once and process refunds. Your balance of credits and propulsions and your final purchases (Founder badge, styles) are saved in your account and can be restored on another device. The Founder badge is only shown to others if you choose to appear on the Founders' wall, with your nickname.

Notifications

Notifications are optional and the app works without them. The app only asks for authorization after an action on your part (for example sending a laugh in moderation), never on the first launch; you can remove it at any time in your phone's settings.

For each device (maximum five per account or guest session), we record: the notification token assigned by Firebase Cloud Messaging, platform (iOS or Android), language, time zone, app version, and save and update dates. We also keep your settings (activated categories, laugh time of the day, date of your last opening of the app) and sending counters. The time zone is used to respect the time you choose and quiet hours: no notifications between 9:30 p.m. and 9 a.m. local time. The counters limit sendings to one notification per day and four per week, excluding moderation results.

There are three categories. “My laughs” warns you of what happens to your laughs: validation or refusal, travel, arena, end of a propulsion, free credit of the week. It is part of the service and cuts out at any time. “Laughter of the day” and “News from HAHA” (news, events, offers from HAHA, and at most one reminder every two weeks if you have not opened the app for 7 days) are deactivated by default and are only sent if you activate them. For today's laugh, your token is subscribed, by our servers, to a Firebase Cloud Messaging topic that corresponds to your language and the chosen time.

Each notification is also stored in the app's inbox (title, text, link, date, read or not), visible only to you and automatically deleted after 90 days. On iPhone, notifications are delivered by the Apple Push Notification service (APNs); on Android, through Google Play Services.

Emails

With an account, Firebase Authentication sends you address verification and forgotten password emails. We also send you emails necessary for the service, without promotion: a welcome after verifying your address, a one-time reminder if it is not verified 24 hours after creating the account, and confirmation of the deletion of your account (your address is read just before deletion for this sending, then is not kept).

HAHA news by email (tips for publishing your first laugh, recap of the month, reminder after 30 days without opening the app, news, events and offers from HAHA) are only sent with your agreement: an unchecked box when creating the account, a setting in the app (verified address required) or registration on this site. Two emails per month at most, at least seven days apart. Each contains a one-click unsubscribe link and the header that allows your email to display an “Unsubscribe” button.

Registration from the site. On the home page you can receive news without an account. We record your address, your language, the status of the registration and its dates, then we send you a confirmation email (double opt-in): without clicking on its link within 48 hours, the pending registration is automatically deleted. The same address does not receive more than one confirmation email per 24 hours, and the form responds in the same way whether the address is already known or not. To limit abuse, it uses the network fingerprint described below and an invisible trap field. Like the app, the news is aimed at people aged 16 and over.

Our emails do not contain any open tracking pixels or click tracking links. Each shipment goes through a queue (address, model, language, shipment status) cleared after 90 days, then through our shipping service provider, who processes your address and the content of the message to deliver it.

Proofs of consent and suppression list

Each time you activate or deactivate the laughter of the day, the news by notification or the news by e-mail, we record your choice, its date, its origin (account creation, app settings, site form, e-mail link) and the version of the text that was presented to you. For registration from the site, the proof is the date of the request and that of the confirmation click. This evidence is used to demonstrate your agreement, as required by the GDPR.

When you unsubscribe from everything or delete your account, we keep a fingerprint of your email address (a SHA-256 hash, not the address itself) in a suppression list, so we don't send you any more news. It is pseudonymized data which is only used for that. If you re-register later, your new agreement prevails.

“Laugh of the day” widget

The widget downloads the laugh of the day from our site, without account or device ID. As with any page on the site, the host sees the IP address in its technical logs.

Interactions and security

The hearts, listens and blocks of an account are synchronized; only the meters are public. Reports and their details are accessible to moderation, never to the reported author. To limit abuse (serial votes, reports, mailings, news subscriptions), we use a fingerprint of the network address calculated with a secret key: this is pseudonymized data, which expires after two days.

App Check and the Apple and Google platforms process technical application and device integrity information to block unauthorized clients. The host processes the IP address in technical delivery and security logs. Firebase SDKs transmit technical information not related to your account, such as SDK and system versions.

Legal bases

Guest session, account, hearts, listens, votes, credits, travel and purchases: execution of the service you request (article 6.1.b of the GDPR). It is also the basis for “My laughs” notifications, the inbox, the registration of your devices and your settings, the sending counters and the emails necessary for the service. Publication of your voice and your profile: your consent (article 6.1.a), which you can withdraw at any time by removing the publication, without effect on past use. Laughter of the day, news by notification and news by e-mail, from the app or from this site: your consent (article 6.1.a of the GDPR and, for e-mails, article L. 34-5 of the postal and electronic communications code). Proof of consent and suppression list: our obligations to demonstrate your agreement and respect your opposition (articles 6.1.c, 7.1 and 21 of the GDPR). Conservation of proof of purchase: our accounting and tax obligations (article 6.1.c). Moderation, reporting, anti-abuse and anti-fraud limits (registration form included), App Check and logs: our legitimate interest in protecting the service and its users (article 6.1.f) and our obligations as a host (article 6.1.c).

Providers and transfers

Google Firebase provides Authentication, Firestore, Cloud Storage, Cloud Functions, App Check, Cloud Messaging (notifications), and Hosting. The database, audios and functions are hosted in Europe. Authentication, App Check, Cloud Messaging, site hosting, and certain logs are global Google services that may process data in the United States: Google LLC is certified to the EU–US Data Privacy Framework, and the European Commission's standard contractual clauses are included in its data processing terms. See the Firebase information and the Google policy. On iPhone, Apple remits notifications (APNs). Purchases are processed by Apple and Google according to their own policies. The emails will be sent by Brevo (Sendinblue SAS, France), the intended sending service provider: its designation will be confirmed on this page before the first sending. Support emails are hosted by Microsoft (Outlook.com).

There is no third-party advertising, no advertising network, no sale of data, no advertising tracking, no audience measurement tool. When we talk about “advertising” or “offers”, it only refers to the promotion of HAHA itself (new products, events, Propulse, credit packs), sent only to people who have accepted it.

Shelf life

Account: until deleted. Invited session: 30 days after its creation. Publications: until they are removed or the account is deleted. Pending proposals: until decision or withdrawal. Abandoned shipments: approximately 24 hours. Proposals refused: 30 days at most. Hearts, listening and blockages: until their withdrawal, that of the laughter concerned or that of the account. Duel tickets: 48 hours at most. Credits and promotions: until their use, their expiration or the deletion of the account. Proof of purchase: 6 years (tax obligations), detached from your account if it is deleted. Reports: 90 days at most. Anti-abuse counters: 2 days. Suspended accounts: for the duration of the suspension. Devices registered for notifications: until disconnected, deleted account or guest session, “unknown device” notice from the notifications service, or 270 days without an update. Notification settings and sending counters: until the account or guest session is deleted. Inbox: 90 days. Notification sending queue: 30 days. Email sending queue: 90 days. Site registration awaiting confirmation: 48 hours. Site registration confirmed: until you unsubscribe, and at most 3 years after your last action (registration, confirmation or change of preferences). Proof of consent: 3 years after the end of the relationship (withdrawal of consent or end of registration), then deleted; deleted earlier with your account. Deletion list: 3 years after unsubscription or account deletion. Technical logs: 30 days. Database backups: 7 days. Assistance exchanges: the duration of processing, then 12 months at most.

Deletion

Me → My Account allows permanent deletion of account, publications, votes, remaining credits and community data, with password confirmation. Unused credits and propulsions are lost. Deletion also erases your registered devices (and their subscriptions to notification topics), your inbox, your notification and email settings and queues, and your proof of consent; a final email confirms the deletion, and the imprint of your address joins the deletion list. A recovery task handles technical interruptions. The database backups disappear no later than 7 days later. A external request is also possible. Local private files are deleted separately, and copies sent to third parties cannot be recalled.

Withdraw your consent

You can withdraw your consent at any time, as simply as you gave it, without affecting what was sent before: in the app (Settings › Notifications), via the one-click unsubscribe link present in each news email, or on the page My emails opened from this link. You can also mute all notifications in your phone settings. You can object at any time, without having to justify yourself, to receiving news from HAHA.

Your rights

You can request access to your data, their rectification, their deletion, the limitation of processing or their portability: we will then send you your data (JSON file and audios). You can also object to processing based on legitimate interest. Write from your account address (or, for site registration, from the registered address) to support: we will verify the request by responding to this address. Response within one month, extendable by two months for complex requests; we will notify you. To correct your pseudonym, your rating or your declared country, modify them in the app, remove then republish your publication, or write to us. You can contact the competent protection authority, in particular the CNIL in France.

Parents

If your child under 16 has created an account, published their voice or subscribed to the news, write to support indicating the pseudonym and title concerned, or the address listed. We remove their publications, delete the account and registration, without asking for identification.

Automated decisions

No decisions are made automatically about your content. Technical controls (format, duration, silence, prohibited links) refuse an invalid file or text. A laugh reported for a serious reason by a verified account, or by several verified accounts, is hidden while waiting for a moderator to listen to it again. Automatic limits may not count a vote in the ranking (for example too many votes from the same network): the vote is then recorded without changing the score. The timing of sending a notification or email (local time, quiet hours, ceilings, reminder after a few days without opening) follows simple rules, without legal or material effect for you.

Developments

Significant changes to your data will be brought to your attention.

Family memories on the phone

Starting with HAHA 1.2.1, a memory's title, date, category, note, and laugh selection are saved locally on your device. This feature does not create a family album on our servers. Sharing is voluntary and uses the apps you choose. Deleting a card does not delete audio files from your library. To keep the memory elsewhere, export the map and audio files; copies sent to relatives are managed separately.