In short
Fenua Move shows ferry timetables between Tahiti and Moorea and the Leeward Islands, and the flights at Tahiti-Faa'a airport. It is an independent app, free, with no account and no advertising, and uses anonymous usage measurement with no tracker, which you can turn off. We do not know your name, email address or phone number, and we never sell or rent any data.
What stays on your phone
The following is stored only in the app's storage, on your device, and is never sent to us:
- your settings: theme, language, direction of travel, notification preferences;
- the departures and flights you follow (with notifications on, our server also receives a copy, see below);
- your trips and your travel party, used to estimate a fare;
- alerts you have read or dismissed;
- a copy of the latest timetables, so the app works without a connection;
- reminders scheduled before a departure.
Location. If you allow it, and only while you are using the app, it compares your position with the location of the Papeete and Moorea quays to offer you to report on a departure. This happens on the phone: your position is never sent to us or to anyone else. The app never reads your location in the background.
Uninstalling the app erases all of this.
What our servers receive
Viewing timetables. The app and its widget ask our server (api.fenuamove.com) for timetables, flights, fares and alerts. They carry a signature proving they come from the app; it is the same for every phone and does not identify you.
Anonymous usage measurement. To know how many people use the app, and to be able to show it to our partners, each request also carries, while measurement is on:
- a random install identifier, created by the app when it is first opened, with no link to your identity, your number or the phone's advertising identifier;
- the phone's system (Android or iOS), the mode shown (boat, plane, taxi or bus) and the app's language.
As soon as it arrives, our server replaces this identifier with a fingerprint computed with a secret key: the identifier itself is never stored. It also notes the country the request comes from, which Cloudflare derives from the IP address, and the screen viewed, derived from the request itself; the IP address is not kept for this measurement. We only draw totals from it — users per day, week and month, how many come back from one week to the next, the split by platform, mode, language, country and screen — and only those totals are shown, to us and to our partners. No tracker, no third-party analytics tool, nothing is passed to anyone.
You can turn measurement off in the app's settings: the identifier is then no longer sent, and nothing more is counted for your phone.
Following a departure. If you accept notifications and follow a departure, the app sends our server:
- a notification token issued by the Expo service, used only to send you notifications;
- your phone's system (Android or iOS) and the app's language (French or English), to write the notification;
- the identifier of the departure.
We use them to tell you about a time change, a departure removed from the schedule, a carrier alert, or what other travellers report. One device can follow at most twenty departures.
Following a flight. Following a flight sends the same information, with the flight's identifier instead of the departure's. We use it to tell you about a delay, a cancellation, take-off, landing, or a flight removed from the airport board. One device can follow at most twenty flights.
Reporting on a departure. If you say a ferry is on time, not at the quay yet, has left, has not left yet, or has a problem (breakdown, weather, full, cancelled), we store your choice from a fixed list, with the notification token and the departure. You cannot type any free text. A report is shown to other travellers only when several devices agree, and never with who made it. So that one device cannot pass for several, a fingerprint of the IP address, made with a random key of the day that is deleted two days later, is kept in memory with the report for three hours at most; the address itself is never stored.
Estimating a taxi fare. Where the taxi mode is offered, the estimate asks our server for the address under the pin you place. It sends only the pin's location rounded to about 11 metres, with no identifier; our server passes it to OpenStreetMap (Nominatim) to get a street name, and keeps only that place's address, linked to no device. The same rounded point of the destination is also used to ask Open-Meteo for its altitude, to point out a likely “hills” supplement; only that place's altitude is kept, linked to no device. When you type an address, the app sends what you type and a point rounded to about a kilometre, to suggest the nearest places; none of it is kept. The "Where I am" button, if you allow it, puts the pin on the phone's position: that position is read on the phone only.
Visiting fenuamove.com. The site counts its visits itself, on our server, with no cookie and no third-party service: a small script of the site, served by fenuamove.com and not by a third party, tells our server that the page was shown, then how long it stayed visible (30 minutes at most). Nothing is stored on your device; everything is kept on our server. To tell two visitors of the same day apart, it computes a fingerprint of the IP address and browser with a random key of that day, deleted after two days; neither the address nor the browser is stored, and a fingerprint cannot recognise you from one day to the next. It also notes the page viewed and how long it was shown, the language, the country (derived by Cloudflare), the kind of device (phone, tablet or computer), the site you came from and, if any, the link's campaign parameters, as well as clicks on the App Store and Google Play buttons. Only daily totals are kept.
Site theme. If you pick the light or dark mode on fenuamove.com, the choice is kept in your browser only (localStorage): nothing is sent.
IP address. As with any website, your IP address is visible to network intermediaries and to our server when it receives a request. It appears in the server's technical logs, used only for security and troubleshooting, and is not linked to any other data.
How long we keep it
- A followed departure: deleted as soon as you unfollow it, and in any case automatically 1 h 30 after departure time. It is also deleted when Expo tells us the token is no longer valid, for instance after the app is uninstalled.
- A followed flight: deleted as soon as you unfollow it, and in any case automatically 2 hours after the flight ends. It is also deleted when Expo tells us the token is no longer valid.
- A report: deleted automatically two to three days after the departure.
- Usage measurement: an install's fingerprint and its days of use (with, for each day, the system, mode, language and screens viewed) are deleted after 13 months without use, as are days older than 13 months for installs still in use. Totals, which designate no one, are kept.
- Server technical logs (IP address): 14 days.
- Backups: the database is backed up every night and only the last ten backups are kept, so deleted data may remain there for up to ten days.
Third-party services
We do not share your data with anyone for commercial purposes. The following providers are involved only to run the service:
- Expo (650 Industries, United States): receives the notification token and the notification text, and delivers it to your phone. To create the token, the app sends Expo a random installation identifier specific to the app.
- Firebase Cloud Messaging (Google): carries notifications to Android phones. No other app data goes through Firebase.
- Cloudflare: protects and routes traffic between the app and our server, tells our server which country each request comes from, and stores the backups.
- OVHcloud: hosts our server, located in Canada.
- OpenStreetMap: provides the quay map background. When the map is shown, your phone downloads its images directly from OpenStreetMap's servers, which see your IP address. On fenuamove.com, the maps in the guides (Tahiti–Moorea ferry, Leeward Islands ferry, Tahiti-Faa'a airport) also load their images from OpenStreetMap when you scroll down to them. Its Nominatim service receives from our server the rounded location of a taxi pin, to give its address.
- Carrier websites: the "Book" button opens the carrier's website in your browser. What happens there is covered by the carrier's own privacy policy.
Some of these providers may process data outside French Polynesia and the European Union.
Security
All traffic between the app and our server is encrypted (HTTPS). Our server never sends the notification token back out.
Your rights
You can unfollow a departure or a flight at any time, turn off notifications or location in your phone's settings, turn off usage measurement in the app's settings, or uninstall the app. You also have the right to access, correct, erase and object to the processing of data about you. Since we do not know who you are, we cannot link a request to specific data: unfollowing a departure deletes it immediately, and the rest is deleted automatically within the periods above. For any question, write to us. You may also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
Children
The app is not specifically aimed at children and asks for no identity information. We do not knowingly collect personal data from children under 13.
Changes
If this policy changes, the new version is published on this page with its update date.
Contact
Fenua Move — [email protected]