This page explains what data ColoTracker keeps, why, who it is shared with and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR).
Data controller
Yohan Boix — bonjour@colotracker.fr .
The data kept, and why
Your account
Email address, first name (and last name if you provide it), encrypted password, username. To log you in, recognize you and send you confirmation codes. Legal basis: the performance of the service you use.
The day of your last visit — the day only, without the time or the pages viewed. It is used to know, in totals, whether members come back to the site; no one looks at it account by account, and it does not leave the server. Legal basis: the legitimate interest in improving the service.
What you put in it
Your books, colored pages, photos, sessions, markers, categories. To make your library work. What you choose to publish — posts, comments, username, profile picture, bio — is visible to everyone, including people without an account. The rest is visible only to you.
Your subscription
If you subscribe: the plan, the dates, your Stripe customer ID, your card type and its last 4 digits (to show them to you). The full card number is never sent to ColoTracker: it is entered on Stripe’s side. Legal basis: the performance of the contract; invoices are kept for 10 years, as required by law.
Audience measurement — only if you accept it
To see how the site is used and improve it, ColoTracker may measure your visit with PostHog: the pages and screens viewed, the buttons tapped, the duration, the type of device and browser, a few key steps (sign-up, book added, pages checked off, photo, post), and a screen recording during the visit — input fields are masked in it: what you type is never recorded. If you are logged in, only your account number is attached to it, neither your email nor your username. The IP address is not kept. The team’s screens are never measured.
None of this happens without your consent: PostHog’s script is not even downloaded before you give it. Legal basis: your consent, which you can withdraw at any time, right here. Your choice is remembered for 13 months if you accept, 6 months if you refuse; you are then asked again. Measurement data is kept for no more than 13 months.
Your current choice: not given yet.
Security
Technical logs (IP address, date, page requested) are kept for a few weeks to protect the site against abuse. Legal basis: the legitimate interest in securing the service.
Who it is shared with
No data is sold or used for advertising purposes. Only these service providers have access to it, each for what concerns it:
- OVH (France) — hosting of the site and its data, on servers in France;
- Brevo (France) — sending confirmation and reset emails;
- Stripe (Ireland, with possible transfers to the United States governed by the European Commission’s standard contractual clauses) — payment of subscriptions;
- PostHog (data hosted in the European Union, in Germany; US company, possible transfers to the United States governed by standard contractual clauses) — audience measurement, only if you have accepted it.
How long
As long as your account exists. If you ask for it to be deleted, your data and photos are erased within 30 days, except for invoices, which the law requires to be kept for 10 years.
Cookies
Without asking you anything, ColoTracker only uses what is strictly necessary: your session cookie (to stay logged in) and protection against fraudulent requests. If you accept audience measurement, PostHog also stores a visit identifier in your browser; if you refuse, nothing. No advertising cookies. Stripe’s payment page sets its own cookies, which are necessary for payment security.
Your rights
You can access your data, correct it, have it erased, ask for a copy of it, object to its processing or have it restricted. Much of this can be done directly from your profile; for the rest, write to bonjour@colotracker.fr . You will receive a reply within one month.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority): cnil.fr.