Privacy policy

Data controller

David Meunier, a French sole trader operating under the business name CodeCrafted, whose full identity appears in the legal notice. No data protection officer has been appointed; requests go to [email protected].

What we collect, and why

Account creation and management — e-mail address, username, bcrypt fingerprint of the password. Legal basis: performance of the contract (art. 6.1.b). Retention: for the life of the account.

Vault hosting — encrypted content (titles, notes, categories, passwords, PIN, PUK code, pattern) and key envelopes. Legal basis: performance of the contract. Retention: for the life of the account.

Transactional e-mails — e-mail address, username, time-limited tokens: one hour for sign-up validation and password reset, ten minutes for trusted-contact confirmation.

Transmission to the trusted contact — the contact’s e-mail address, your username, backup password. Legal basis: performance of a service you expressly requested. Retention: until changed or the account is deleted.

Security and connection monitoring — salted SHA-256 fingerprint of the IP address, network prefix (/24 or /48), user agent, timestamps, username, session duration. Legal basis: legitimate interest (art. 6.1.f). Retention: 365 days, automatic erasure.

Application error tracking — crash reports from the Windows client, sent to a Sentry instance operated by our hosting provider. Legal basis: legitimate interest. Retention: 90 days, a period set by the operator of that instance and not by us.

Administration audit log — action, administrator, reason, state before and after. Legal basis: legitimate interest and accountability. Retention: 1,825 days, immutable log.

Information for trusted contacts

If you have been named as a trusted contact by a user, your e-mail address was given to us by that person, not by you. This information is owed to you under article 14 of the GDPR.

The data concerning you is limited to that address. It is used solely to send you the courtesy message and, where applicable, the transmission message. You may request its erasure at any time — the user who named you will be informed, since their setting will cease to be valid.

Recipients and processors

A single provider is involved across the whole technical chain, and we would rather say so plainly than scatter it across three separate lines: RAHONA HOSTING hosts the server and the database, routes our e-mails, and operates the Sentry instance that receives the software’s crash reports.

The consequence deserves to be stated frankly: the backup password sent to your trusted contact passes through their outbound mail server. It is the most sensitive link in the whole arrangement, and it is also the one where we depend most on a third party.

The second party involved is Cloudflare, acting as a technical intermediary in front of all our domains. There are no other recipients: no third-party analytics tool, no ad network, no data resale.

Transfers outside the European Union

Your vault data is hosted within the European Union, and our e-mails are routed within it. No transfer takes place on that account.

Cloudflare, a company incorporated in the United States, acts upstream as a technical intermediary. SafeTale’s traffic is handled by its Paris point of presence, but a transfer to the United States cannot be ruled out. Its data processing addendum provides two safeguards for that case: the European Commission’s standard contractual clauses and Cloudflare’s participation in the EU–U.S. Data Privacy Framework.

Your rights

Access, rectification, erasure, restriction, objection and portability are exercised by writing to us from your account’s e-mail address.

In full transparency: export and deletion are not yet available in the application. We handle them manually, and confirm when done, within one month at most.

You may lodge a complaint with the CNIL, the French data protection authority.

Post-mortem directives

Article 85 of the French Data Protection Act lets you set directives on what happens to your data after your death, and designate a person to carry them out.

SafeTale is, in practice, a technical implementation of that right: the trusted contact you name is the person to whom you entrust the execution of your directives. You may change or revoke that choice at any time from the application.

Cookies

This site sets no analytics or advertising cookies. You will therefore not be asked for consent through a banner.

The only local storage used holds your light or dark theme preference. It serves a strictly functional purpose and is not subject to consent.