foodjis
EN

Legal notice

Publisher

The foodjis application and this site are published by the association “Friends of OpenPGP” (foopgp), a French non-profit association registered under RNA number W052008166.

75, impasse Serre des Isnards — 05000 Pelleautier, France
info@foopgp.org

Its statutes, and the association’s own legal notice, are on foopgp.org.

This site

This site holds neither cookie nor tracker. It asks you for no account and holds no form of its own; the security keys page embeds HelloAsso’s, through which the association’s subscription is paid. That form is loaded only when you press “Subscribe”: from then on you are dealing with HelloAsso, under its own terms and privacy policy.

Like any web server, the one hosting this site may keep an access log.

The foodjis application

Privacy

foodjis shows no advertising, measures no audience, asks for no account and collects no data behind your back.

Here is what the application exchanges over the network, and with whom:

  • The certificate servers listed in its settings. It sends them your certificate when you publish or change it, and looks there for your contacts’ certificates. The application offers default servers, the association’s among them; you may replace them as you wish.
  • OpenStreetMap, while an identity is being generated: the map on which you point at a place comes from that service, which then sees your IP address and the area displayed.
  • The domain of a contact’s address, when it publishes the certificates of its own addresses (WKD) and you look that contact up.

These exchanges use HTTPS. Like any web server, those may keep access logs.

A PGP certificate is public by nature. It carries what you put in it, at least:

  • an e-mail address;
  • a name or a pseudonym;
  • an identifier (EID). A natural person’s identifier derives from their civil status and from their country and date of birth; that of any other entity (a legal person) is defined by a moment and a place of first appearance.

A published certificate cannot be erased. Certificate servers copy one another and delete nothing: that is the very nature of PGP. What can be done, and what you can do from foodjis, is to revoke: to declare publicly that an identity or a certificate is no longer valid.

Your cryptographic secrets are stored on the QR codes you print when your identity is generated. They are then loaded onto your security key without ever being exposed. They cannot leave it. This physical security key then lets you sign digitally, decrypt your data, or authenticate to third-party services.

The security key requires a PIN that you choose, which foodjis may keep in memory for the time you choose. The session journal disappears with the session.

The contacts, certificates and settings the application keeps stay on your phone.

Permissions

  • NFC, to read your security key;
  • camera, to read a QR code, when you ask for it;
  • approximate location, only if you press “Here” while generating an identity;
  • network, for the exchanges described above;
  • notifications and running in the background, for persistence: keeping the PIN for the time chosen and refreshing your certificates. It can be turned off in the settings.

Licence

foodjis is free software, distributed under the GPL-3.0-only licence. The source code of each version is given to whoever holds the application and asks info@foopgp.org for it.

Trademarks

Google Play and the Google Play logo are trademarks of Google LLC.