Data controller
The controller is the publisher named in the legal notice.
Data we process
- Configuration forms, imported files and CUI projects are handled in your browser. Some tools keep a local draft there; we do not keep a server copy of these creations.
- JSON or project exports may include secrets entered by you. You control the downloaded file and its storage.
- For accounts, we retain the email address, a hashed password verifier or linked Google identifier, and sessions needed to sign in. If you link Codefling, we retain the member ID and timestamped purchase-verification result; the Codefling token entered to link is not retained.
- Technical logs may contain minimal details (date, route, status, error), but not complete configurations or secrets.
- After consent, public-page analytics uses bounded events without configuration contents or free-form input.
- Account and configuration data from earlier test versions may remain in backups or private administration; server-side configuration saving is disabled.
Purposes
- Provide and secure the site: performance of the service and legitimate interest in its security.
- Measure public-page use: consent withdrawable through analytics preferences.
- Temporarily retain older data where needed for security, backups and data-subject requests.
Recipients and third parties
Only authorised operators and the hosting provider access necessary technical data. After consent, Google Analytics receives bounded public-page events only; its advertising features remain disabled. Purchases on Codefling follow that third party’s policy.
If you display an externally hosted image in the editor (including a sample image), your browser may contact that host directly to load it. That host may receive your IP address and technical request data. Check the host before previewing a custom URL.
Account emails
Resend receives your address and the message needed for signup or password recovery. Each link expires in one hour, works once and is stored as a hash. New email registrations do not store an account or password before confirmation. Google is involved only when you choose Google sign-in.
Retention
- Local drafts remain in the browser until you, the browser or the tool removes them; they are not portable backups.
- The analytics choice expires after 180 days. GA4 user and event data retention is set to two months, without resetting on new activity. This setting does not delete Google's aggregated reports.
- Technical logs are subject to size-limited rotation.
- Older account data and backups are not erased by this release.
Your rights
Depending on applicable law, you may ask the publisher for access, correction, deletion, restriction or portability of your data and object to certain processing. You may complain to the CNIL. Proof of identity is requested only where there is reasonable doubt.
Changes
This policy will evolve with the site. Its update date and material changes will be shown here.