Privacy policy

Who is responsible

The data controller is the publisher of Cayer, the person registered under the SIRET number shown in the legal notice. For any question or request: contact@cayer.fr.

What we keep

Your email address

To recognize you when you log in. It’s your username. Until you confirm it, Cayer also keeps a fingerprint (hash) of the confirmation link it sent you, never the link itself.

Reminder emails

You may get up to four over time: three if you write nothing or you stop (opening your notebook, discovering a way to write in it, picking it back up after a break), and one about referrals, sent to EVERY account, active or not. Each one carries an opt-out link that stops all four at once, and Cayer keeps only its fingerprint, never the link itself.

The date of your last write

Decides whether a reminder is due when you haven’t written anything since you signed up (“discovering a way to write in it”), or when you stop after you’ve started (“picking it back up after a break”).

The date of your first return after 24 hours

Decides whether the “you never come back” reminder is due; once it’s set, it closes that door for good.

Your password

Never in plain text. It’s stored by Supabase Auth, which only keeps a fingerprint (hash) of it: nobody, the publisher included, can read it back.

Your date of birth

Only to check that you are at least 15, the age of digital consent in France (article 45 of the French Data Protection Act, “loi Informatique et Libertés”). Under that age, a parent creates the account.

Your username, if you picked one

Optional. It stays linked to your account.

How you heard about Cayer, if you told us

Optional. It helps us see how people find us. Cayer deletes it with your account. If you accepted measurement, Google Analytics also got it at sign-up.

A friend’s invite link, if you arrive through one

The code it carries stays on your device (your browser’s storage), 30 days at most, and is only sent to Cayer when you create your account; it’s deleted from your device right after. Cayer then keeps a record of who invited whom. You get your own month of Pro once you’ve confirmed your email and written on Cayer on at least 3 different days in your first 7 days. Whoever referred you gets a month of Pro every three friends they’ve helped become active this way, up to four months at most. If you’re the invited friend, Cayer notes the date of each day you write, as long as your gift hasn’t been paid out; these dates are deleted with your account. Cayer notes nothing for other accounts. Nothing else is shared.

What’s in your notebooks

The pages you write, their subjects, their drawings, and the voice notes you record. That’s the product: without it, there’s nothing to give back to you.

Your subscription, if you check out

As soon as you pick a plan, your email address and your account ID are sent to Stripe, which opens a customer record for you, even if you don’t finish paying. If you subscribe, Cayer keeps the plan, its status, its renewal or end date, and the ID Stripe gives your account. Your card is entered at Stripe, and Cayer never sees it.

Your session

A cookie, needed to keep you logged in. It’s used for nothing else, and its token isn’t stored in plain text either.

No trackers, no ads. The only cookie set without asking you is your session cookie, strictly needed to keep you logged in.

Audience measurement, only with your consent

Cayer measures its traffic with two tools: Google Analytics 4 (Google Ireland Limited) and Microsoft Clarity (Microsoft Ireland Operations Limited). They count page views, time spent, mouse or finger movements on the screen: never what’s in your notebooks, never your email address. If you told us how you heard about Cayer, Google Analytics also gets that answer, at sign-up. Google Analytics receives no advertising signal: the measurement is there to understand what’s useful, not to target you elsewhere.

Neither one starts before you agree. A banner asks you on your first visit: until you click “Accept”, neither the script nor the cookie that goes with it is set. Clicking “Reject” closes the banner without loading anything, and right away removes anything already set if you take back consent you gave earlier. Whatever you choose, your choice is kept for six months in your browser; after that, the banner asks again. You can change your choice anytime: “Manage cookies”, at the bottom of every page.

The cookies this sets: Google Analytics cookies (_ga, _ga_<identifier>) last thirteen months at most, the duration Cayer sets for them itself, the maximum recommended by the CNIL (the French data protection authority), consent or not. Microsoft doesn’t publish the exact duration of its own cookies (_clck, _clsk) in its documentation; what Microsoft does say is what they do: _clck recognizes your browser from one visit to the next, _clsk links the pages viewed during a single visit.

Why, and on what legal basis

To provide the service you ask for: that’s the performance of a contract (article 6(1)(b) of the GDPR). Invoices for a subscription are also a legal obligation (article 6(1)(c)). Audience measurement relies on your consent (article 6(1)(a)) and on it alone: that’s why it stops immediately if you click “Reject” or withdraw your consent from the bottom of the page. The reminder emails and the referral email rely on Cayer’s legitimate interest in keeping a notebook you already created alive, and in growing by word of mouth (article 6(1)(f)): a few messages spread over time, never after you’ve opted out. Your data is used for nothing else. It is not sold, not rented, and not passed on to third parties for their own purposes.

Where it is

Stored in the European Union. The servers that host it and the database that holds it are in Germany and Ireland, and emails are sent from France. Two exceptions: Stripe Payments Europe, Limited also processes payments in the United States, for those who check out. And, if you accept audience measurement: Google Analytics 4 and Microsoft Clarity then transfer data to the United States, both under the Data Privacy Framework, the framework the European Union and the United States agreed on for these transfers, and which Google and Microsoft have joined. Rejecting audience measurement avoids that transfer. There are seven service providers, and no others:

Hetzner Online GmbH

Server hosting · Germany (European Union)

Supabase

Database (accounts, notebooks, voice notes), passwords and the forgotten-password email · Ireland (European Union)

Google Ireland Limited

“Continue with Google” sign-in, if you choose it; audience measurement (Google Analytics), only if you accept cookies · Ireland (European Union)

Microsoft Ireland Operations Limited

“Continue with Microsoft” sign-in, if you choose it; audience measurement (Microsoft Clarity), only if you accept cookies · Ireland (European Union)

Sentry (Functional Software, Inc.)

Technical crash reports: the message of a crash may quote part of the data that caused it · Germany (European Union)

Brevo (Sendinblue SAS)

Sending emails: forgotten password, account deletion link and confirmation, inactivity reminders and the referral invitation · France (European Union), with some of its own subprocessors in the United States under standard contractual clauses

Stripe Payments Europe, Limited

Payment for the Pro subscription, for those who check out. Your card is entered at Stripe, never at Cayer · Ireland (European Union), with transfers to the United States under standard contractual clauses

Stripe is also responsible, on its own behalf, for fraud prevention and for its legal obligations as a payment provider: for that part, its privacy policy applies.

Five of them belong to groups based outside the European Union. Apart from the payment and audience measurement mentioned above, the data stays hosted in the EU, but a US parent company can, in cases set out by law, receive a request for access. If you’d rather avoid this, create your account with a password instead of with Google or Microsoft.

For how long

As long as your account exists. When you delete it, everything goes right away: the account, the notebooks, the voice notes, the sessions. If you have a subscription, it is first canceled at Stripe and your customer record there is deleted. No copy is kept “just in case”.

What remains is no longer linked to your account. If your account had a username, it stays reserved, so nobody else can take it. The reviews, the reports and the study sheets you posted stay, without your account: they say something about a sheet, and other people use them. Two technical traces also remain, with no name or address: the fingerprint of the deletion link, to answer “already deleted” if it’s opened again, and the account ID, so the app can clear the copy of your notebooks kept in your browser. Only one other exception, required by law: invoices for a subscription are kept at Stripe for as long as accounting and tax obligations require.

Your rights, and how to use them

You can ask to access your data, correct it, delete it, take it with you (portability), or object to its processing (articles 15 to 22 of the GDPR).

Also good to know

• Your email address must be confirmed within 7 days. When you sign up, an email asks you to confirm it through a link. You can start writing right away; if it isn’t confirmed after 7 days, your account is paused, your notebooks are kept, and everything opens again as soon as you confirm. Until it’s confirmed, nothing stops someone from having signed up with an address that isn’t theirs. With Google or Microsoft, the address is already confirmed by them.

Complaints

If you’re not satisfied with an answer, you can file a complaint with the CNIL (the French data protection authority): www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.