Privacy policy
Last updated 7 October 2026
This policy covers the Maison Colette House App, at this address. It is run by the owners of Maison Colette, a private villa in Marrakech, Morocco, for the household and its staff.
Who can use the app
Only the owners of the house and the people who work there. Nobody else can sign in, and there is no way to register.
What we get from Google
When an owner chooses Sign in with Google, the app asks Google for the email address of that Google account and whether Google has verified it (the openid and email scopes). It asks for nothing else: not the name, the profile picture, contacts, Gmail, Drive, Calendar or any other Google data.
How we use it
- To check the address against the short list of people allowed to open the app.
- To show the signed-in person their own address in the app's menu, beside Sign out.
We do not use it for advertising, marketing, profiling or analytics, and we do not use it to train any AI or machine-learning model.
What is kept, and for how long
- A sign-in cookie in that person's browser, holding the address and an expiry date, signed by the server. It lasts 7 days and is removed by Sign out.
- A line in the server's log saying that the address signed in, or tried to. Logs are kept for a short time by our hosting provider and then deleted.
The app does not store the Google address in its database, and it never receives or stores a Google password.
Sharing
We do not sell, rent or share Google user data with anyone. It is not passed to any third party, except that the app runs on servers we rent (Fly.io for the app, Supabase for the database), which process it only to run the app for us.
Google API Services User Data Policy
The app's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Other information in the app
The app holds the working records of the house: repair jobs and their photos, menus, stock, the staff rota and messages between the house and its staff. Staff are identified by the name and phone number they gave the house. These records are seen only by the owners and the staff who need them, and are kept for as long as the house needs them to run.
Security
The app is served only over HTTPS. Sign-in cookies are signed, and personal links expire.
Your choices
You can sign out at any time, which removes the sign-in cookie. You can remove the app's access to your Google account at myaccount.google.com/permissions. To ask what we hold about you, or to have it corrected or deleted, write to maisoncolette.co@gmail.com.
Changes
If this policy changes, the new version is posted here with a new date.
Contact
Maison Colette, Marrakech, Morocco. maisoncolette.co@gmail.com