Privacy & personal data

Information notice under the General Data Protection Regulation (GDPR, EU 2016/679) and the French Data Protection Act (loi Informatique et Libertés). Last updated: 14 October 2026. This is a translation; the French version prevails.

Strictly personal useYour data is only used to run the app for you.

No commercial useNo advertising, no resale, no profiling, no marketing.

Never sharedNobody has access to it, except the people you share a notebook with.

1. Who is responsible for your data?

The "Orbite" app is hosted on a personal server (NAS) by its operator, who is the data controller. For any question or request: through the app administrator.

It is offered privately and on a non-profit basis, to a small circle of users.

2. What data is stored?

Category	Data	Source
Your account	Name, email address, password (stored only in an irreversible encrypted form), Google ID and profile photo if you use "Continue with Google", creation date, address confirmation status.	You / Google
Usage	Date of last sign-in, number of sign-ins, sign-in log (date and method, kept 12 months), browser type of open sessions, language chosen for the app (French or English). The app does not keep any IP address; only the technical logs of the NAS web server may contain them temporarily, for security.	Automatic
Your notebooks	Whatever you choose to enter: contact pages for your loved ones (name, nickname, date of birth, contact details, company, family links, notes), tastes, diets and allergies, events and appointments, meals and dishes served, who invited and who paid, loans of books, DVDs and items.	You

3. Why? A strictly limited use

The data is used only to:

let you sign in and secure your account (including confirming your email address);
display and organise your information (calendar, birthdays, meals, loans);
generate your reminders in the calendar you subscribe to;
share a notebook, only with the people you explicitly invite;
keep the platform running and protected: overall statistics (number of accounts, sign-ins, contacts and events) and blocking an account in case of abuse.

It is never sold, rented, transferred, used for commercial or advertising purposes, used for profiling, or passed on to anyone. No advertising cookies or audience measurement tools are used.

4. Who can see your data?

Only you by default: each account has separate notebooks.
The people you invite to a shared notebook (read-only or with editing rights), until you remove their access.
The platform super admin only sees the list of accounts (name, email, status) and counts (sign-in dates, number of contacts, events, loans), never the content of your notebooks.

5. Legal basis

Processing is based on providing the service you request by creating an account (Art. 6(1)(b) GDPR) and, for security and abuse prevention, on the operator's legitimate interest (Art. 6(1)(f)).

6. Data about your loved ones and sensitive data

The information you enter about other people (family, colleagues, their children) is your responsibility: record it for personal use, keep to what is useful, and do not share it outside a private setting.

Allergies and diets may be health data. Only enter what you need to host your loved ones well (e.g. "dairy allergy"), without medical details.

7. Where and for how long?

Hosting: on the operator's personal server, in the European Union. Exchanges are encrypted (HTTPS) and backups remain under the operator's control.
Duration: as long as your account exists. Deleting your account immediately erases the account, the notebooks you own and all their data (backups are overwritten as they rotate).
Unconfirmed accounts: deleted automatically after 30 days.
Sign-in log: 12 months.

8. Third-party services

Google, only if you choose "Continue with Google": Google authenticates you and sends us your name, email and photo. See Google's privacy policy.
jsDelivr (file delivery network) provides the layout (Bootstrap): your browser connects to it to download these public files, without any of your data being sent to it.
Google Fonts provides the typefaces: your browser connects to it to download them, which sends your IP address to Google (no cookie).
Sending emails: the confirmation email goes through the operator's email service.
Language selection: on your first visit to the sign-in page, the server sends your IP address to the api.country.is service, which only returns the matching country, so that French (French-speaking country) or English can be offered. Neither the IP address nor the country is stored by the app. The operator can turn this detection off; your browser language is then used.

9. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. In the app:

Access / portability: Settings → Export my data (complete JSON file);
Rectification: edit your contacts and profile directly;
Erasure: Settings → Delete my account.

For any other request, contact the app administrator. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.

10. Cookies and local storage in your browser

The app itself sets no cookies. It only keeps the following items in your browser (localStorage); they never leave your device, except the token, which is sent to the server to identify you:

prm.token: your sign-in token, erased when you sign out;
prm.scope: the notebook shown;
prm.lang, prm.lang.auto: the interface language, kept so the sign-in page is shown in your language;
prm.recent: the last 5 records opened from search (record numbers only), erased when you sign out;
prm.consent.google: your choice about the Google cookies below.

These items are strictly necessary for the service or remember your display preferences: they do not require consent. You can clear them at any time in your browser settings.

Google cookies (non-essential). The "Continue with Google" button is provided by a Google script, which sets and reads its own cookies (google.com domain). This script is only loaded if you accept it in the banner on the sign-in page. If you decline, email and password sign-in remains available. You can change your mind at any time in Settings → My data; cookies already set by Google can be removed from your browser or your Google account.