Data collected
- Account: email address, username, password hash, creation date. The username can be a pseudonym: no legal identity is requested.
- Profile: bio, profile image URL and external links, all optional and provided by you.
- Submitted content: geolocations, media, proofs, sources and tags, published under your username. EXIF metadata is stripped from images on receipt.
- Authentication log: account identifier, event type (login, failed login, logout, password reset request, completed reset, password change and registration events) and timestamp. Neither IP address nor user agent appears in it.
- Reports: the reason, the optional report text and, if the report comes from an account, that account's identifier. An anonymous report is not linked to anyone.
- Connection data: your IP address is used only, and without being stored, as a request rate-limiting key. No table on the platform keeps it.
- Cookies: a session cookie and an anti-CSRF cookie, both required for the site to work. No advertising cookies, no cross-site trackers.
Purposes
- Maintain your account, authenticate you and send you service emails (registration confirmation, password reset).
- Publish the content you submit and attribute it to its author.
- Handle reports and moderate content that is illegal or was not flagged as sensitive.
- Protect the platform from abuse: request rate limiting and the authentication log, which serves to detect unusual activity on an account.
Retention periods
- Account data and published content are kept for as long as the account exists.
- An unconfirmed registration expires after 24 hours and its row is deleted.
- Expired confirmation and reset tokens are deleted as soon as they expire; used tokens are deleted after 30 days.
- The authentication log and the reports are kept without a time limit: they are the records that establish what happened on an account and what was decided about a content item.
- Deleting an account removes the account and its contributions from all public view; permanent deletion, which also erases the stored files, is carried out on request.
Recipients
Data is neither sold nor transferred. It is processed by the technical providers the site needs to run: application and database hosting, file storage, service email delivery, aggregate audience measurement and error reporting. The content you publish is, by nature, public.
Your rights
You have the right to access, rectify and delete your data, as well as the right to object to and to restrict processing. The username, bio, profile image and external links can be edited directly from your settings.
For everything else, write to support@vidit.app from the address linked to the account. You can also lodge a complaint with the CNIL, the French data protection authority.
Publisher and hosting providers
The identity of the hosting providers and how to send notices are set out in the legal notice.