Privacy Policy

This policy explains what personal data Painting Puffin collects, why, how long we keep it, who else receives it, and what you can ask of us. It covers the website paintingpuffin.com, the account service id.paintingpuffin.com, the library library.paintingpuffin.com, the licence service license.paintingpuffin.com, and the desktop application Painting Puffin Studio.

The short version: we collect what we need to run your account, your licence and the library, and to keep them safe. We do not sell data and we do not show advertising. About your work in the application:

• The Painting Puffin integration does not upload your project files. Painting Puffin Studio stores your project files on your computer and does not upload the project file itself to our servers or to an AI service. Some project information is sent to Anthropic if you choose to start a Claude session (section 5). Your own Claude Code configuration or add-ons may provide additional capabilities, including capabilities that access or send other files.
• The built-in AI nodes run on your computer and do not send your images to any outside AI service.
• One optional feature sends information about a project, never the project file: if you start a Claude session in a project, the application sends information about that project to Anthropic, and pictures of your work only if you also tick a separate box (section 5). In its default configuration, the application does not give Claude tools to open files on your computer.

1. Who is responsible

Painting Puffin is run by Alexander Sebag, an individual based in Gif-sur-Yvette, France, who is the controller of your data. For anything about your data, write to support@paintingpuffin.com. Our postal address and the other details French law requires of a website publisher are in our legal notice. We have not appointed a data protection officer. Having assessed the criteria in Article 37 of the GDPR, we consider that our activities do not currently require us to appoint one.

Hand-over to a company. A company, Painting Puffin EURL, is being registered to run the service. Once it is registered, Alexander Sebag will transfer the whole activity to it: accounts, the founding-member list, licences, subscriptions and the records described in this policy, so that the service you use continues without interruption. This transfer relies on our legitimate interest, and yours, in that continuity. We have assessed, and documented, why the transfer is necessary for that continuity and why it does not override your interests: the company will provide the same services, to the same people, for the same purposes. In practice:

• we will tell you by email at least 30 days before the transfer, with the company’s full name, registered office and registration number, and publish a new version of this policy naming it. The transfer will not take place before that period has ended;
• before the transfer, you can object to the transfer, withdraw any consent you have given, or ask us to delete your account or your founding-member entry. If you object to the transfer, we will not transfer your personal data unless compelling legitimate grounds allow us to do so. If you withdraw a consent or ask for deletion, we will stop the processing concerned or delete the data concerned, as described in this policy. Information we are entitled to keep for a separate purpose, such as the minimal suppression record described in section 2, is handled on that separate basis;
• we transfer the records of what you accepted and consented to so that the company can retain evidence of those past choices. The company will continue consent-based processing only where the original consent remains valid for that processing; where a new consent is required, it will ask you separately. The company will use the transferred personal data only for the purposes described in this policy, unless it informs you of a new purpose and, where required, obtains your consent or establishes another lawful basis before carrying it out;
• your contract with us (our terms of service) is a separate matter, which this policy does not settle: it passes to the company only as our terms of service provide, with written notice to you, or otherwise only with your agreement;
• from the date of the transfer, the company is responsible for the processing; Alexander Sebag remains responsible for what happened before it.

2. The founding-member list

On paintingpuffin.com you can leave your email address to be told when founding membership opens. If you do, we store:

• your email address, and a pseudonymous fingerprint of it (section 6) used to avoid duplicates;
• the date and time you agreed, and the version of this policy in force at that moment;
• your browser’s language, the page you used, and your country.

What we use it for: only to tell you that founding membership is open, and on what terms. Joining this list does not subscribe you to our newsletter: that is a separate choice you make once, and you can then unsubscribe at any time, from a link in every newsletter or from your account.

Your country is worked out on our own server from your IP address, using a database stored on that server (DB-IP’s IP to Country Lite); your IP address is not sent to anyone for this. The IP address is also used to limit repeated attempts and for the anti-bot check (section 8). It is never stored in the list itself.

Legal basis: your consent, given by ticking the box.

How long: your entry remains on the list until founding membership closes, and in any case no longer than 12 months after you joined. If you submit your address again while your entry is still active, or after it has expired, that counts as a new consent and restarts the 12 months. If you have withdrawn your consent, submitting the form again does not undo that withdrawal (see above). After expiry, your entry is reduced to a minimal record (section 9).

Withdrawing your consent and deleting your entry are two different things.

• Withdrawing stops all contact at once. You can withdraw your consent using the withdrawal form on our website or by writing to us. The withdrawal form is as easy to use as the form through which you joined the list. We then erase your email address and the other details, and keep only a suppression record: the fingerprint of your address and the dates you agreed and withdrew. Its only use is to prevent us from contacting you again during a three-year suppression period, which is our legitimate interest and yours. During those three years, submitting the form again does not undo the withdrawal: to join again, write to us. After three years the suppression record is deleted (section 9), and a new submission of your address then counts as a fresh consent.
• Deleting (write to us) removes your entry completely, suppression record included. If you later leave your address again, that counts as a new consent.

We do not send email yet, so nobody has been asked to confirm their address. When we start, we will ask everyone on the list to confirm it before writing to them about anything else.

3. Your account

One account, held by id.paintingpuffin.com, signs you in to every Painting Puffin service.

• Identity: your email address, your name if you give one, and, if you choose a password, a bcrypt hash of it (a method designed to make passwords very hard to recover).
• “Continue with Google”: Google tells us your name, email address and profile picture, and gives us an identifier for your Google account and sign-in tokens, which we store only so that Google sign-in works. We never receive your Google password.
• Sessions: for each signed-in device, when the session started and when it ends. For sign-ins with a password, also the browser or application description and a pseudonymous fingerprint of the IP address, so you can recognise and end your sessions. A session lasts 30 days unless you end it sooner.
• Acceptance of the terms of service, and acknowledgement of this policy: which version of the terms of service you accepted, which version of this policy was presented to you and you confirmed having read, when, in which language, how (at sign-up or at a later prompt), and the network this was recorded from: your IP address with its last part removed (for an IPv4 address, the last of its four numbers, for example 203.0.113.0 instead of 203.0.113.7; for an IPv6 address, everything after its first three groups), which shows roughly where it came from without pointing to one connection. We never keep the full address on this record. It is our evidence of what was agreed if that is ever disputed; no page of our services displays it.
• Trials and plans: which free trials you started, and the plans and seats attached to your account or your organisation. A pseudonymous fingerprint of your email address records that a trial was used (section 9).
• Organisations: if you belong to a team, its members, the addresses invited to join it (an invitation lasts 30 days), and a log of changes to its settings. Where an organisation administrator provides us with information about another person, such as an email address to invite them to join the organisation, we use that information to manage the invitation and the organisation. We provide the relevant privacy information to that person when required by law.

Legal basis: the contract between us, for the account and the services you signed up for; our legitimate interest in keeping the services secure and in limiting each address to one free trial; and, for records of acceptance and acknowledgement, our legitimate interest in being able to prove what was agreed.

What you need to provide. Your email address is required to create an account; without it, we cannot provide the account service. Your name is optional. You do not have to use Google sign-in. Information sent to Anthropic is optional and is sent only if you choose to start a Claude session and agree to it. Once paid plans open, the information Polar’s checkout asks for (such as your payment details and billing country) is necessary to complete a purchase and to meet invoicing and tax requirements; without it, the purchase cannot be completed.

4. The library

When you use library.paintingpuffin.com, we also store:

• your library profile and preferences (language, currency, and a public handle and bio if you set them);
• a pseudonymous fingerprint of the IP address you signed up from, to detect many accounts created from one place to take free offers several times;
• for each session, the browser description, so you can recognise your sessions;
• which images you downloaded and when, to apply your plan’s download allowance;
• images and albums you upload, if you use personal cloud storage;
• support requests you send us, and notifications we show you (section 9 says how long each is kept);
• billing details you enter (company name, postal address, country, VAT number), once paid plans open. They are deleted with your account; our accounting records of each sale are kept as the law requires (section 9).

Members cannot publish images in the public library yet. Before that opens, we will publish the terms that govern it and a new version of this policy.

How we measure use of the library

What is recorded. The library measures its own usage, without cookies and without any outside company. For each page you view we record the page (without the identifiers in its address), the site you came from (its name only), your browser, system and device type, your country and your time zone; when you open an image, which image and album. When a search finds nothing, we record the search words, not linked to you.

How visits are grouped. Visits are grouped under a pseudonymous fingerprint computed from your IP address, your browser description and the date, with a secret key kept on our server. Because the date is part of it, the fingerprint changes every day and visits on different days cannot be linked by it. Your IP address itself is not written down. This is not anonymous when you are signed in: the visit is then also linked to your account.

How long. These visit records are deleted after 90 days. What we keep after that is daily totals: counts per page, site of origin, browser, system, device type, country, album and empty search. A value counted fewer than five times in a day is not kept at all, so rare values, such as an unusual search, are dropped. These totals contain no account, no fingerprint and no IP address. Dropping rare values lowers the risk that a total points to one person, but does not remove it entirely, so we treat the totals as statistics to be handled with care, not as anonymous data. They are kept 25 months, long enough to compare the same season across two years, and then deleted.

Why. Our legitimate interest in running and improving the library: knowing which pages and images are used, which searches fail so we can add the missing pictures, which browsers and screens we must support, and how much capacity we need. The account link lets us see how signed-in members use what their plan includes.

Your choice. You can object at any time. Signed in, switch off “include my visits in the usage statistics” on your library account page: we stop recording your visits and delete your existing records. Signed in or not, if your browser sends the Global Privacy Control signal, your visits are not recorded. You can also write to us. The library is the only one of our services that measures use: the website and the account service do not (section 7), and the desktop application has no telemetry (section 5). So this switch and this signal cover all the usage measurement we do.

Legal basis for the rest of the library: the contract between us; and our legitimate interest in preventing abuse of free offers.

5. The desktop application

Painting Puffin Studio works on your computer. Your projects, brushes and settings are stored there. The application has no telemetry: it does not report how you use it, and it sends no crash reports by itself. After a crash it can open an email draft for you, which you decide whether to send; the crash file it mentions may contain file paths from your computer.

It contacts our servers on its own for two things only:

• Update check: shortly after launch and then once a day, it asks our licence service whether a new version exists, sending your operating system and update channel. You can turn this off in the preferences.
• Licence: when you sign the application in, it registers this computer with our licence service: a random installation number, your computer’s name, your operating system, the application version, and a hash derived from your computer’s system identifier, designed not to reveal that identifier. While signed in, it confirms the licence about every ten minutes, and releases your seat when it closes. If you share seats in an organisation, the other members may see your computer’s name when a seat moves between computers.

Other connections happen only when you ask for them:

• The library inside the application is the library website shown in an embedded browser, which keeps its own cookies and storage in your user folder on your computer; section 4 applies.
• Downloading AI models: only when you click to download a model and accept its licence, the application downloads its files, and for some models the program that runs them, from our own download server, models.paintingpuffin.com (stored in the European Union by Cloudflare, section 8). The server receives what any download gives it: your IP address, the file requested, and “Painting Puffin Studio” as the program’s name. The application sends no account, licence or computer identifier. We keep no record of these downloads, neither in the application nor on our side; Cloudflare processes the request information needed to deliver the files (section 8). The application never downloads model files from the models’ original publishers. A model’s licence text opens in your own web browser, only if you click its link, and is then loaded from the publisher’s website (such as Hugging Face or GitHub) like any page you visit. The AI nodes then run on your computer.
• Report a problem: this builds a file on your computer and opens your own email program, so you decide whether to send it to us. The file holds the application version and build, your operating system, your graphics card, driver and display scale, whether you are signed in and which features your plan includes, the description you write, and, unless you untick it, recent application logs with your user folder masked. It never holds a project.

Claude sessions

The application can work with Claude, Anthropic’s AI assistant, through the Claude Code program installed on your computer and signed in to your own Anthropic account.

• Off until you start a session. Nothing is sent until you start a Claude session in a project and agree to it for that project. Opening another project ends the session, and the application never gives Claude access to a project you have not agreed for. Your organisation’s administrator can also switch the feature off. Your choice is remembered for that project until you withdraw it. We ask again if the information made available or the purposes of the integration materially change.
• What is sent: your requests; the project’s nodes (their names, types, settings, positions and how they are connected), what is selected and which part of the project you are viewing (settings can include the names and folder paths of files a node reads or writes, such as the images it uses or the folder an Export node saves to, and text you typed into a node); the project’s name, folder path and general information (such as canvas size, colour space, number of nodes, version number and whether there are unsaved changes); the application version and your operating system. The Painting Puffin integration tools do not send the project file itself, your library sign-in or your brushes. Your own Claude Code configuration, add-ons or actions in the session may nevertheless access or send files or information outside the Painting Puffin integration, as explained below.
• What Claude can reach. The application starts Claude Code with its own tools for reading files, running commands and browsing the web switched off, and connects it only to the application’s own tools, which give the information listed above. It also stops Claude Code from loading note files (named CLAUDE.md) from the folders around your project, and its own memory notes. In this configuration, the application gives Claude no tool to open files on your computer. Claude Code also uses your own Claude Code configuration (for example your personal instructions, or add-ons you installed in it), and anything you type, paste or attach in the session yourself, including a file you attach with “@” or the result of a command you run in it, is sent to Anthropic too. These additional capabilities come from your own Claude Code configuration and add-ons, or from actions you take in the session. They are not part of the tools provided by Painting Puffin, and the restrictions described above do not control what those additional tools may do. You should check your configuration and add-ons before using them with a project.
• Pictures, only if you tick the box. Previews of your images and pictures of the application window are sent only if you tick “allow previews and screenshots”, which is unticked to begin with. Claude sessions work without it. Sending pictures relies on this separate, optional consent, which you can withdraw on its own, by unticking the box, without withdrawing your consent to the session.
• Who is responsible for what. We decide what the application makes available to Claude, which kinds of data it can send, when, and how you agree to it. We are therefore responsible for collecting that data and transmitting it, which relies on your consent, given project by project, even though the data goes straight from your computer to Anthropic and we receive none of it. Anthropic independently determines the purposes and means of its processing after receiving the information, subject to the terms and privacy settings applicable to your Anthropic account (for users in Europe, Anthropic Ireland, Limited). Anthropic is therefore a separate controller for that processing.
• Which Claude accounts this describes. This section describes Claude Code signed in to a personal Claude account (Free, Pro or Max). If you sign Claude Code in with an organisation’s account (such as Claude for Work) or with an API key, Anthropic processes the data under its commercial terms on behalf of that organisation or key holder, whose own rules then apply. If you have set Claude Code up to reach Claude through a cloud provider (such as Amazon Bedrock or Google Cloud Vertex AI), the information goes to that provider instead, under your own agreement with it. In every case, what Painting Puffin sends, and our responsibility for it, stay as described here.
• Anthropic’s own rules. Anthropic decides how long it keeps information and whether it may use it to improve its models, under the terms and privacy settings that apply to your Anthropic account. Its rules may differ depending on your account, your settings, safety reviews, feedback and any separate opt-ins. Read Anthropic’s current privacy policy (anthropic.com/legal/privacy) and the retention guidance in its Privacy Center (privacy.anthropic.com) for details. Anthropic states that it transfers data to its servers in the United States using the European Commission’s standard contractual clauses.
• Stopping: end the session; to withdraw your agreement for a project, use “Forget consent” in the project’s Claude settings (Manage Project). Both take effect at once, for everything Claude asks after that. Unticking the pictures box stops further previews and screenshots from being sent. Withdrawing your consent using “Forget consent” stops further transmission of all project information through the Painting Puffin integration. Neither action recalls information already sent to Anthropic or causes Anthropic to delete it. Information already sent remains subject to Anthropic’s retention and deletion rules and your Anthropic account settings. To disconnect your Anthropic account, sign out of Claude Code.

Legal basis: the contract between us, for updates, licensing and model downloads; and our legitimate interest in preventing misuse of licences. For that, the licence service keeps a security log of sign-ins and seat changes, including the IP address of each sign-in (section 9).

For Claude sessions, we rely on your consent, given separately for each project. You can withdraw it at any time using “Forget consent” in the project’s Claude settings. This does not affect processing that took place before you withdrew it.

6. IP addresses and pseudonymous fingerprints

A pseudonymous fingerprint, in this policy, is a SHA-256 hash of the original (an email or IP address) combined with a secret value kept on our server. The original cannot simply be read back from the result. It still counts as personal data, because someone holding the secret value could compute the fingerprint of a known address and compare it. We use it wherever we need to recognise something without keeping the original.

Your IP address is handled in seven different ways, depending on the purpose:

7. Cookies and similar storage

French law (article 82 of the Data Protection Act) requires consent before a website stores or reads information on your device, except when it is strictly necessary for a service you expressly asked for. As the CNIL applies it, that exception covers, for example, signing in, security, and remembering an interface choice you make when that is an expected part of the service. We checked each item our websites use against that test, item by item, below: on our documented assessment of each item, none needs consent, and the table gives the reason for each. None is used for advertising, for measuring visits, or to follow you on other sites, and our websites load no outside scripts except Cloudflare’s anti-bot check on the forms that use it (section 8).

Messages you close in the library (announcements, including service notices such as planned maintenance, promotional messages and the trial banner) are not stored in your browser: their dismissal is remembered only while the page stays open.

The library has a referral programme that is not running. If it runs one day, opening someone’s referral link would store a cookie for up to 30 days so that they can be credited if you sign up. That cookie is not strictly necessary, so before the programme starts we will ask for your consent to it and publish a new version of this policy.

paintingpuffin.com and id.paintingpuffin.com do not measure visits at all. If that changes, we will publish a new version of this policy first.

8. Who else receives data

Some of our providers are processors: they handle data only on our instructions, under a contract that binds them to security, confidentiality and deletion as the GDPR requires. Others are separate controllers: they decide how they use the data, under their own privacy policies. Where we transfer personal data to a provider in the United States, as controller or as processor, the transfer is covered by the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the US company that receives the data is covered by a certification (certified companies, and the subsidiaries each certification covers, are listed at dataprivacyframework.gov), or by the European Commission’s standard contractual clauses, as applicable; the arrangements for each provider are described below. We checked each recipient against those records on 2026-11-05. You can ask us for a copy of the clauses that apply. Some services you independently connect to from your computer may make their own international transfers under their own responsibility. This does not apply to the Painting Puffin integration with Anthropic: as explained in section 5, we decide what the integration makes available and sends, and we are responsible for that disclosure.

Providers we use today

• OVHcloud (OVH SAS, France), processor: rents us the dedicated server, located in France, that runs our websites, accounts, library and licence service and holds their databases and recent backups. The server is administered by us.
• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg), processor: stores library images, images you upload, and our backup archive, in its Paris region. AWS commits not to move this data out of that region except where needed to provide the service or to comply with the law. Should AWS’s United States company need access, that is covered by the Data Privacy Framework (Amazon Web Services, Inc. is covered by Amazon.com, Inc.’s certification) and by the standard contractual clauses in AWS’s data processing addendum.
• Cloudflare (Cloudflare, Inc., United States), for two things:
  • the anti-bot check on our sign-up, sign-in, password-reset and founding-member forms. Your browser loads Cloudflare’s check, which examines technical information about your browser (including your IP address and browser description); our server then sends Cloudflare the result with your IP address to confirm it. Cloudflare is our processor for running the check, and a separate controller for the data it uses to improve its bot detection;
  • our model download server (section 5): the files are stored in a Cloudflare bucket restricted to the European Union, and Cloudflare delivers them, as our processor. We have not enabled download logs, so we receive no record of who downloaded what.
  How long: Cloudflare does not publish a fixed period. As our processor it keeps data only as long as needed to provide these services, under its data processing addendum; for improving its bot detection, under its own privacy policy and Turnstile privacy addendum. Transfer: Data Privacy Framework (Cloudflare, Inc. is certified), with standard contractual clauses as a fallback.
• Google sign-in (Google Ireland Limited for users in Europe), separate controller, only if you choose “Continue with Google”: Google confirms your identity and tells us your name, email address and profile picture. Google handles your Google account and the sign-in itself under its own terms and privacy policy, which you have accepted with it; we do not decide how Google processes that data, and we receive only what is listed in section 3. We therefore treat Google, for sign-in, as a separate controller. Transfer by Google: Data Privacy Framework (Google LLC and its wholly owned US subsidiaries are certified).
• Google Cloud Vision (Google Cloud France SARL, France), processor: suggests descriptions for library photos that we import ourselves; it never receives images you upload. Transfer: Google’s cloud data processing addendum, which relies on the Data Privacy Framework (Google LLC and its wholly owned US subsidiaries are certified) and on standard contractual clauses.

Providers we will use when paid plans open

• Polar (Polar Software, Inc., United States) will sell you subscriptions as merchant of record: Polar, not us, is the seller. Its role depends on the activity, not only on the labels in its contracts:
  • when it handles the account details we send it (your account number and email address, so that a purchase is attached to your account) on our instructions, it acts as our processor;
  • for the checkout and the administration of your purchase as seller, for payment and tax compliance, and for the security of its own service and its legal obligations, it decides the purposes and means itself and is a separate controller, under its own privacy policy.
  Your card details go to Polar and its payment providers, never to us. Transfer: standard contractual clauses, as provided in Polar’s data processing agreement and privacy policy (Polar is not certified under the Data Privacy Framework).

A service you choose to connect to

This receives data straight from your computer, only when you use it; we do not send it data from our servers. Because the application makes these connections at your request, section 5 says exactly what it receives. It is a separate controller for what it does with the data once received, under its own privacy policy:

• Anthropic (for users in Europe, Anthropic Ireland, Limited), when you use a Claude session in the application with your own Anthropic account. We remain responsible for what the application makes available and sends, as section 5 explains. Anthropic is not certified under the Data Privacy Framework; it says it relies on standard contractual clauses (section 5).

The application does not connect you to Hugging Face or GitHub: AI models come from our own download server (section 5). If you open a model’s licence page, your browser visits that site like any page you choose to visit.

We do not send email yet. Before we do, we will name the email provider in a new version of this policy.

9. How long we keep data

Deleting your account

Deletion happens in three steps, each with its own timeline:

1. Our services, within one month. When you ask us to delete your account, we delete the personal data linked to it in all our services within one month of your request, apart from the exceptions below. If you close your library account from its own account page instead, the account closes at the end of any period you have already paid for, and your uploads are then kept for 90 days in case you change your mind; then they are deleted. When closing, you can choose to have them deleted at once instead, or ask us to.
2. Stored files, within a further 35 days. The files of your private images are erased from storage, including any earlier copies the storage keeps, within 35 days after they are deleted.
3. Backups, at the latest 120 days after deletion. Copies held in backups disappear as those backups expire. Backups are used only to recover from an incident, never as ordinary storage, and only we can access them. We keep a register of the deletions we carry out; if we ever restore a backup, we apply every deletion in that register again before the service reopens, so deleted data does not come back.

We keep a record of each deletion request, for 5 years, as proof that we handled it and to defend any claim about it (our legitimate interest). It holds only a reference, the date we received the request, how we checked that it came from you (not any identity document), and the date each step was completed. Until your data has left our backups (at most 120 days), it also holds your account email address, so that we can apply the deletion again if we ever restore a backup. We do not keep our correspondence about the request once it is completed.

What is kept after deletion:

• A pseudonymous fingerprint of the email address, with the dates of the free trials it used, kept for one purpose: to stop a new account with the same address from starting a second free trial. It is still personal data. We keep it only while we offer free trials, and delete these fingerprints when we stop. You can object to it; we will then delete it unless preventing repeated free trials outweighs your interests in your particular case.
• Records of acceptance of the terms of service and acknowledgement of this policy, for 5 years (table above).
• The record of your deletion request, for 5 years (above).
• Records the law requires us to keep, such as our accounting records of sales.

10. Your rights

You can ask us:

• for a copy of your data (access);
• to receive the data you gave us in a structured, reusable format, or to have it sent to another service (portability). This applies to data processed by automated means on the basis of your consent or of our contract;
• to correct it (rectification) or to delete it (erasure);
• to limit what we do with it while a question is being settled (restriction);
• to object, for reasons relating to your particular situation, to processing based on our legitimate interests (objection);
• to follow instructions you leave about your data after your death.

Where we rely on your consent, you can withdraw it at any time, as easily as you gave it. This does not affect what we did on the basis of your consent before you withdrew it.

Automated decisions. We make no decision about you based solely on automated processing that has legal effects or similarly significant effects. A few automatic rules refuse an action to protect the services: limits on repeated attempts, the anti-bot check, and the rule of one free trial per email address. You can ask for a person to review any such refusal.

To use your rights, write to support@paintingpuffin.com, if possible from the address on your account. We answer within one month. In complex cases, or if we receive many requests, we may extend this by two further months; we will tell you within the first month if we do, and why.

You also have the right to lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or, where applicable, with another competent data protection supervisory authority in the European Union, if you think we have not respected your rights.

11. Security

All our services are reached over encrypted connections. Passwords are stored only as bcrypt hashes. Where we do not need an original email or IP address, we keep only a pseudonymous fingerprint of it (section 6). In the desktop application, the secret that links your computer to your account is stored encrypted by your operating system.

12. Children

Our services are not intended for children under 15, and we do not knowingly collect their data. We do not verify ages. If you think a child under 15 has given us personal data, write to us and we will delete it.

13. Changes to this policy

Every version of this policy keeps its own page, and its words never change once published. When we publish a new version, our services show it to you at your next sign-in and ask you to confirm that it has been presented to you and that you have read it; the founding-member list records which version each person agreed to. Where a change needs your consent, for example a new use of your data that relies on consent, we ask for that consent separately and nothing changes for you until you give it.

14. Languages

This policy is published in English and in French, with the same content and the same date. If the two versions ever differ, the French version prevails.