>_ Privacy Policy

1. Data controller

2. Hosting

3. Data collected

• Email - login identifier
• Welcome email - one-time transactional signup email with useful links, including Discord; it is sent even when optional notifications are disabled
• Password - bcrypt-hashed (never stored in plaintext)
• Authentication - optional Google identifier and temporary email-verification and password-reset tokens
• Display name - optional, chosen by user
• Minimum age - confirmation that the user is at least 15, without collecting a date of birth
• Progress - completed courses, exercises, quizzes, XP, badges, quests and streaks
• Legal documents and privacy choices - versions shown, acceptance of the Terms and dated history of optional choices
• Activity logs - logins, completions, recent activity and security events
• Security and abuse prevention - signup IP, login attempts, aggregated editor telemetry (keystrokes, paste, copy, large insertions, focus loss, active duration, edit volume and delay before simulation) used to detect abuse and notify the administrator when serious signals are detected
• Public profile - nickname, level, badges, streak and activity only if you enable it
• Community - teams, comments and votes that you choose to publish
• Contact and support - name, email, optional company, message, exercise and page concerned when you use a contact or bug-report form; these messages are sent to the administrator and are not stored in the application database
• Student discount - student address, domain, verification status and expiry
• Certification - certificate identifier, status and issue date
• Payment data - handled by Stripe for Premium and certification; we keep a minimal payment and session log (reference, product, amount, status), never card numbers

4. Legal basis and purpose

5. Third-party processors

• Stripe - Premium and certification payment processing. Data shared: email, purchased product, amount, session reference. Stripe Policy
• Resend - transactional and optional emails, and delivery of forms to the administrator. Data shared: email address and message content required for delivery. Resend Policy
• Google - OAuth authentication (optional). Data received: email, name. Google Policy
• Sentry - technical error monitoring if enabled. Session replays are disabled and the configuration removes cookies, headers, request data and user information before sending events. Sentry Policy
• Transfers outside the EU - some providers may process data outside the European Union. In that case, transfers rely on GDPR safeguards, including standard contractual clauses where required.

6. Retention period

• Account data - retained while the account is active
• Security logs - login attempts retained for 15 minutes; raw editor-session telemetry retained for 90 days; alerts and abuse scores retained while the account exists to support incident review
• Transactional emails - the welcome email is sent only once at signup; send logs are retained while the account exists
• Optional choices - retained with their history while the account exists so choices can be proven and respected; optional emails stop as soon as consent is withdrawn
• Contributions and verification - comments, teams, certification and student verification are retained while the account exists or until deleted; contact messages are not stored in the application database
• Account deletion - personal data erased; internal audit log anonymised (user_id set to NULL)
• Payment data - retained by Stripe per their legal obligations; the local minimal log is retained while the account exists, and references required for disputes or refunds are handled through Stripe

7. Your rights (GDPR)

• Access - view your data in the "My data" tab
• Portability - download a complete JSON export from your account
• Rectification - update your display name from your profile
• Erasure - delete your account from the "Settings" tab
• Restriction - request restriction of processing where GDPR allows it
• Objection / withdrawal - withdraw marketing consent, disable the public profile and object to processing based on legitimate interest where GDPR allows it
• Complaint - you may file a complaint with CNIL (French DPA)

8. Cookies and local storage

9. Security

• Passwords hashed with bcrypt (factor 12)
• Sessions encrypted with iron-session (AES-256)
• Login rate-limited to 10 attempts per 15 min per IP
• HTTPS enforced in production
• Security headers (CSP, HSTS, X-Frame-Options)

10. Contact

For any question or request about your personal data: dangremontjayson.pro@gmail.com. A response is provided within the GDPR time limit, normally within one month.