Data collected
- Account: email address, username, password hash, creation date. The username can be a pseudonym: no legal identity is requested.
- Profile: bio, profile image URL and external links, all optional and provided by you.
- Submitted content: geolocations, media, proofs, sources and tags, published under your username. EXIF metadata is stripped from images on receipt.
- Authentication log: account identifier, event type (login, failed login, logout, password reset request, completed reset, password change and registration events) and timestamp. Neither IP address nor user agent appears in it.
- Release email consent: whether you asked for emails about major releases, when, where (sign-up or settings), and when you withdrew it. Each grant and withdrawal is kept as a record, and each email sent is logged with its delivery status.
- Reports: the reason, the optional report text and, if the report comes from an account, that account's identifier. An anonymous report is not linked to anyone.
- Push notification devices: for each browser or app where you turn on push notifications, the address its push service gave it, its encryption keys, its user agent and when it last received a notification. Turning push off on the device deletes the record.
- Connection data: your IP address is used only, and without being stored, as a request rate-limiting key. No table on the platform keeps it.
- Cookies: a session cookie and an anti-CSRF cookie, both required for the site to work. No advertising cookies, no cross-site trackers.
Purposes
- Maintain your account, authenticate you and send you service emails (registration confirmation, password reset).
- With your consent only, email you once per major release of Vidit, never for a patch. Consent is off unless you turn it on. Withdraw it at any time in Settings or with the unsubscribe link in each of these emails, which works without signing in.
- Publish the content you submit and attribute it to its author.
- Handle reports and moderate content that is illegal or was not flagged as sensitive.
- Protect the platform from abuse: request rate limiting and the authentication log, which serves to detect unusual activity on an account.
Retention periods
- Account data and published content are kept for as long as the account exists.
- An unconfirmed registration expires after 24 hours and its row is deleted.
- Expired confirmation and reset tokens are deleted as soon as they expire; used tokens are deleted after 30 days.
- The release email consent record is kept for as long as the account exists, so it can show when you gave and withdrew it.
- The authentication log and the reports are kept without a time limit: they are the records that establish what happened on an account and what was decided about a content item.
- Deleting an account removes the account and its contributions from all public view; permanent deletion, which also erases the stored files, is carried out on request.
- Deleting an organization, which only a site administrator does, removes its profile, picture, memberships, invitations, review requests and the approvals given in its name. The administration log keeps its name and what was removed.
- A geolocation credited to several analysts belongs to the record of each. When its owner's account is deleted or permanently deleted, it passes to the analyst credited earliest and stays published with its files, including those the deleted account uploaded.
Recipients
Data is neither sold nor transferred. It is processed by the technical providers the site needs to run: application and database hosting, file storage, service email delivery, aggregate audience measurement and error reporting. The content you publish is, by nature, public.
A push notification travels through the push service of your browser's vendor (Google, Mozilla, Apple or Microsoft). It is encrypted for your device, so that service cannot read it.
Your rights
You have the right to access, rectify and delete your data, as well as the right to object to and to restrict processing. The username, bio, profile image and external links can be edited directly from your settings.
For everything else, write to support@vidit.app from the address linked to the account. You can also lodge a complaint with the CNIL, the French data protection authority.
Publisher and hosting providers
The identity of the hosting providers and how to send notices are set out in the legal notice.