Privacy policy
Content is available without an account. If you create one (optional), we collect only what is strictly needed to operate and secure it. No advertising trackers, no third-party analytics.
Data controller
Wariss Paraiso — contact: bonjour@neurosec.fr. See the legal notice.
Without an account
- In your browser only (localStorage): quiz scores, visited domains, theme preference. Nothing is sent to the server.
- Functional cookie: language preference (
fr/en), set only if you accept it.
With an account (optional)
If you sign in (magic link or passkey), we process:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| E-mail address | Identify the account, send the sign-in link | Performance of the service | Until account deletion |
| Passkey public keys | Passwordless sign-in (WebAuthn) | Performance of the service | Until passkey/account deletion |
| Progress (scores, domains) | Sync across your devices | Performance of the service | Until account deletion |
| Sign-in timestamps | Account security | Legitimate interest (security) | ≤ 12 months |
| Last sign-in IP + country | Detect abnormal access | Legitimate interest (security) | ≤ 12 months (overwritten each sign-in) |
| Audit log (sign-in events) | Security, traceability | Legitimate interest | ≤ 12 months |
No password is stored. Sign-in and session tokens are kept only as a hash. Any SMTP password is stored encrypted.
Cookies
lang— language preference (functional, optional).sid— sign-in session (set only if you sign in;HttpOnly,Secure,SameSite=Lax).csrf— anti-CSRF security cookie for forms (strictly necessary, no tracking).
Country geolocation
To show the last sign-in country, the IP address is sent to a third-party geolocation service (ipwho.is) at sign-in time. This feature can be disabled server-side.
Processors / recipients
- Hostinger — hosting (EU/EEA), may keep technical logs.
- ipwho.is — IP geolocation (country) at sign-in.
- No resale, no advertising. No data shared for commercial purposes.
Your rights (GDPR)
You have the rights of access, rectification, erasure, portability and objection:
- Access / portability: JSON export from My progress; for account data, contact us.
- Erasure: remove your passkeys from your account, or request full account deletion by e-mail (handled within 30 days).
- Complaint: you may lodge a complaint with your data protection authority (in France, the CNIL).