>_ Privacy Policy

Last updated: September 29, 2026 · Version 2026-09-29.2

1. Data controller

Jayson Dangremont - Individual entrepreneur operating under the trade name Jaytudie, France

SIREN: 914 947 825

Registered office SIRET: 914 947 825 00032

APE code: 85.59B

Registered office: Graulhet, France

Website: fpgapourtous.fr

Contact: dangremontjayson.pro@gmail.com

Phone: +33 7 70 72 59 54

2. Hosting

Hosting provider: HOSTINGER operations, UAB

Provider entity address: Vilnius, Lithuania (this is not the server location).

The main application database is hosted in the European Union by Hostinger, as recorded in the hosting information. The application and backups are hosted by Hostinger. Some processing by the providers listed below may take place outside the European Economic Area; the applicable safeguards are described in “Third-party processors”.

3. Data collected

Email - login identifier
Welcome email - one-time transactional signup email with useful links, including Discord; it is sent even when optional notifications are disabled
Password - bcrypt-hashed (never stored in plaintext)
Authentication - optional Google identifier and temporary email-verification and password-reset tokens
Display name - required for an account, chosen and editable by the user
Minimum age - confirmation that the user is at least 15, without collecting a date of birth
Progress - completed courses, exercises, quizzes, XP, badges, quests and streaks
Guide marker - account-linked flag recording whether the first-circuit guide has been opened, used to adapt the learning-path button
Projects - phase progress, one-attempt quiz choices, architecture notes and code files you choose to save; this content remains private and only catalog metadata (title, subtitle, sectors and phase count) plus the completion date of a fully completed project may appear on an enabled public profile
Simulations - the GHDL/Icarus simulator runs your HDL code on a remote server. It receives the code, testbenches and required technical parameters, then returns the result. Files are deleted when the run ends and are not stored in the account database. The transmitted content does not include your account or contact details.
Legal documents and privacy choices - versions shown, acceptance of the Terms and dated history of optional choices
Activity logs - logins, completions, recent activity and security events; a minimal last-activity date is kept with the account to apply the inactive-account rule
Aggregated usage statistics - daily counters by event type, functional source (Club, exercise or direct) and plan: exercise opens, simulation results, searches without query text, and certification or purchase steps. These counters do not retain individual journeys, accounts, browser identifiers, UTM campaigns, landing pages or referrers. You can object to optional event counters in “Cookie preferences”; this does not affect account, progress, payment or security data needed to provide the service
Site search - entered terms are processed temporarily to return the requested results; they are not stored in the application database or included in usage statistics
Campaign attribution - it is no longer measured or attached to signups. A signup is not attributed to a visit or campaign
Security and abuse prevention - HMAC pseudonym of the signup IP retained for 24 hours, HMAC rate-limit identifiers stored in the database for 15 minutes, and temporary keys for other limits stored in memory. Detailed editor-session telemetry is linked to the account and exercise for 90 days (keystrokes, paste, copy, large insertions, session duration, edit volume and delay before simulation); it is used to detect abuse and may produce an alert reviewed by the administrator.
Public profile - nickname, level, badges, streak and activity only if you enable it
Community - teams, comments and votes that you choose to publish
Contact and support - name, email, optional company, message, exercise and page concerned when you use a contact or bug-report form; these messages are sent to the administrator and are not stored in the application database. For the contact form, if you are signed in to the account concerned and use its email address, only its activity date is updated for the inactivity rule; the message and address are not added to the database
Student discount - student address, domain, verification status and expiry
Certification - certificate identifier, status and issue date, timestamped contractual consent, first and latest download dates, and download count
Payment and subscription data - handled by Stripe for Club and certification; we keep a minimal log (customer, payment or subscription reference, product, amount, status and expiry). The Stripe customer portal also processes billing changes, cancellation and any optional cancellation reason. We never receive your card number

4. Legal basis and purpose

Processing of your data is based on:

Contract performance (Art. 6.1.b GDPR) - account management, access to courses and exercises, one-time welcome email, Premium activation, certification delivery
Consent (Art. 6.1.a GDPR) - marketing communications and public profile activation (withdrawable at any time)
On-device saves - prior consent is required under Article 82 to read or write optional drafts and learning markers in the browser; where this data is personal, processing is also based on consent (Art. 6.1.a GDPR). Each category can be refused or withdrawn in “Cookie preferences”
Legitimate interest (Art. 6.1.f GDPR) - site security, payment fraud prevention, anti-cheat and aggregated service improvement
Legal obligation (Art. 6.1.c GDPR) - records required for accounting and tax obligations
Required data - email, username, age confirmation and acceptance of the Terms are required to create an account; registration is not possible without them. Public profile and optional emails remain optional.
Automated decisions - no decision with legal effect is made solely by automated means; serious abuse signals are reviewed by an administrator.

5. Service providers

Stripe - Club and certification payment processing, invoices, and the subscription management/cancellation portal. Data shared: email, purchased product, amount, customer, session and subscription references, cancellation status and any reason entered in the portal. Stripe Policy
Resend - transactional and optional emails, and delivery of forms to the administrator. Data shared: email address and message content required for delivery. Resend Policy
Google - OAuth authentication (optional). Data received: Google identifier and verified email; Google profile and photo are no longer requested. Accounts created before August 2026 may have had their editable username initialised from the Google name. Google Policy
Transfers outside the EEA - Stripe, Resend and Google may process some data outside the European Economic Area, including in the United States. Their transfer terms and safeguards are described in their documents: Resend, Stripe and Google. You can request a copy of the applicable safeguards using the contact address in this policy.

6. Retention period

Inactive free account - after 24 months without a sign-in, learning activity or a contact-form request submitted from that account's session with its email address, a transactional notice is sent at least 30 days before deletion. Signing in, submitting the contact form from that session with the same address, or confirming “Keep my account” from the email cancels deletion. Opening the email alone does not count as a response
Accounts excluded from automatic deletion - administrator accounts and accounts with a payment history, certificate, Premium right or current student verification are not deleted by this automation; their retention is reviewed under the applicable rights and records
Project data and guide marker - quiz attempts, architecture notes, code files and the guide-opened flag are retained while the account exists under the preceding rules, included in the JSON export and deleted with the account
Logs - HMAC rate-limit identifiers stored in the database for 15 minutes; detailed editor-session telemetry linked to the account and exercise for 90 days; alerts, abuse scores, operational logs and administrative security and verification notifications for no more than 365 days; detailed learning activity for 400 days; the signup legal-notice record remains linked to the account
Usage counters - event counters aggregated by day, type, functional source and plan, deleted after no more than 180 days. Statistics derived from account, progress or payment records follow the retention periods for those data and do not create an additional individual analytics history
Emails and tokens - the welcome email is sent once; the send anti-abuse counter is retained for one hour; unused tokens expire after one hour for password reset and seven days for verification and are stored only as digests
Account-linked choices - the history of marketing choices and documents presented remains linked to the account for as long as needed to demonstrate them; optional emails stop as soon as consent is withdrawn
Local-storage choices - permissions, refusals and objections are remembered on the device for no more than 180 days. For signed-in members, preferences saved to the profile remain linked to the account until changed or the account is deleted. Withdrawing permission immediately erases persisted items in the affected category; remaining local data expires when removed from the browser
Contributions and verification - comments, teams, certification and student verification are retained while the account exists or until deleted; contact messages are not stored in the application database and are deleted from the work mailbox no later than 12 months after the request is closed
Account deletion - for monthly or annual subscriptions, non-renewal is scheduled first; account-linked data and logs are then erased from the active database. Protected rolling backups expire within 14 days. A separate pseudonymised technical ledger (random account identifier, internal identifier, creation and deletion dates) is kept for 30 days to reapply erasures after a restore, then deleted
Payment data - retained by Stripe per their legal obligations; the local minimal log is retained while the account exists, and references required for disputes or refunds are handled through Stripe

7. Your rights (GDPR)

Access - view your data in the "My data" tab
Portability - download a complete JSON export from your account
Rectification - update your display name from your profile
Erasure - delete your account from the "Settings" tab
Restriction - request restriction of processing where GDPR allows it
Objection / withdrawal - withdraw marketing consent from the account or through each email's one-click unsubscribe link, disable the public profile, change local saves and object to usage counters or other legitimate-interest processing where GDPR allows it; “Cookie preferences” is available at the bottom of every page
Complaint - you may file a complaint with CNIL (French DPA)

8. Cookies and local storage

FPGAPourTous does not use advertising trackers, third-party audience-measurement trackers or social-network trackers. Standalone measurement requests are sent without cookies, account identifiers or referrers. A simulation-result counter is added server-side while processing the simulator request, which may carry the session cookie needed for authentication; the measurement code does not copy that cookie, and no account, session or browser identifier is stored in the counter. Counters are summed by day, event type, functional source and plan. No UTM values, search text or individual journeys are retained. The IP address sent with an HTTP request may be processed separately by the hosting provider and for temporary rate limiting and security; it is not added to the counters. These statistics do not read or write a tracker on your device; they rely on legitimate interests. You can object using the choices here or in your profile. To honour an objection saved to a signed-in profile, the application checks that preference on authenticated requests; this check does not add your account to the counters. Contributions already summed cannot be isolated by person and expire after 180 days. Objection does not disable logs needed for accounts, payments or security. Optional local saves described below start only after your prior consent.

fpga_session - encrypted HTTPOnly session cookie required to stay signed in; maximum lifetime: 7 days.
NEXT_LOCALE - technical session cookie that remembers the requested language; deleted at the end of the browser session.
google_oauth_* - temporary HTTPOnly cookies required for the security of optional Google authentication; maximum lifetime: 5 minutes, deleted after the OAuth callback.
fpgapourtous_storage_choice_v1 - your choice to allow or refuse each local save, with the decision date and consent-mechanism version. It remains on this device for up to 180 days. If you save your choices while signed in, their values are also kept in your profile until changed or the account is deleted, and applied to your other devices the next time you sign in.
fpgapourtous_optional_expiry_v1:* - expiry date for each optional save; the site does not restore a value after it expires and deletes it the next time that value is accessed.
fpgapourtous_usage_statistics_objection_v1 - separately remembers your objection on this device. When signed in, it is also saved to your profile until changed or the account is deleted; the application applies it to authenticated requests from your devices. In all cases, it prevents the relevant counters from being added without including your account in those counters. The hosting provider's HTTP-log settings must be verified in production. You can change your choices at any time using “Cookie preferences” at the bottom of every page or in Privacy.
Drafts and schematics - if you allow it, code, testbenches and Block Design schematics are saved in this browser's local storage so you can resume later. They expire no later than 180 days after their last change and are deleted after expiry when the value is next accessed, or when the site opens after the choice has expired. Consent under Article 82 is requested before persistent reading or writing.
Learning progress - if you allow it, offline progress, quiz order and exercise timing are saved locally. They expire no later than 180 days after their last update and are deleted after expiry when the value is next accessed, or when the site opens after the choice has expired. Consent under Article 82 is requested before persistent reading or writing.
Without a choice, after refusal or after withdrawal, these categories are not read or persistently saved. The editor remains usable; values needed on the current page stay in memory only and are not restored after reload or closing the tab. Draft and learning content never leaves the device or syncs to the profile. Withdrawal deletes persisted items in the affected category.
Sign-in, Google OAuth security-flow and language-preference cookies are necessary for the requested function. They do not depend on permission for optional local saves. Legacy attribution and funnel identifiers have been removed.

9. Security

Passwords hashed with bcrypt (factor 12)
Sessions encrypted with iron-session (AES-256)
Login rate-limited to 10 attempts per 15 minutes per network and pseudonymised account
Passwords require at least 8 characters and 3 character categories; account deletion requires reauthentication
HTTPS enforced in production
Security headers (CSP, HSTS, X-Frame-Options)

10. Contact

For any question or request about your personal data: dangremontjayson.pro@gmail.com. A response is provided within the GDPR time limit, normally within one month.

Chargement…