The French version of this policy is the only legally binding one. In case of any discrepancy, the French version prevails.
1. Data controller
The data controller is Sabrina Mouedine, publisher of Mes Trouvailles as part of the personal project described in the legal notice.
2. Data processed
| User account | Email address, technical identifier, plan in use, any requests to upgrade to the Member or Founder plan, quotas and the information required for authentication. |
|---|---|
| Saved content | Links, videos, ideas, images, titles, descriptions, notes, markers, subjects, statuses and shared spaces created by the user. |
| Translations | Text submitted to the translation feature, the translated result, and a technical fingerprint used to avoid repeating identical processing. This feature is optional: nothing is sent until you trigger it. When you use it, the text concerned is sent to Google's Gemini API to produce the translation. It is not used by Google to improve its products, but may be logged or temporarily cached to ensure the security and operation of the service. This processing may take place outside the European Economic Area. |
| Bot protection | IP address, technical characteristics of the browser or device, verification token and security signals processed by Cloudflare Turnstile when signing in, signing up or requesting a password reset in the application. |
| Security and operation | Technical logs, errors, IP address and information about the browser or device when needed for security, troubleshooting and abuse prevention. |
| Contact messages | The sender's email address, the content of the message and the technical information needed to receive it when you contact the publisher by email. |
| Payment for the Founder plan | Payment is collected by Stripe. Mes Trouvailles never receives or stores your full card number or its security code: this information is entered and processed directly on Stripe's secure interface. Mes Trouvailles only accesses the information needed to track the payment, activate the plan and meet its accounting obligations, in particular the transaction identifier, its status, the amount and the account it relates to. The Member plan is not yet open: no recurring payment is processed. |
| Usage tips and news | Email address, date and subject of the messages sent, and a timestamped record of your consent or its withdrawal. Two kinds of messages: one or two reminders after sign-up to help you get started, which stop as soon as you save your first find; and, occasionally, usage tips and announcements of new features. These messages contain no third-party advertising. Your address is never sold or shared with partners for advertising purposes. |
3. Purposes and legal bases
Mes Trouvailles does not use your data for targeted advertising or advertising profiling, and does not sell your personal data.
| Replying to messages received | Legitimate interest in replying to messages voluntarily sent to the publisher and, where the message concerns a plan, pre-contractual measures taken at the person's request. |
|---|---|
| Creating and managing an account | Performance of the service relationship requested by the user. |
| Collecting payment for the Founder plan and activating it | Performance of the contract concluded with the user purchasing the plan, and compliance with the resulting accounting obligations. |
| Letting you know when the Member plan opens | Consent, given when you click “Notify me”. Until you click “Notify me”, no request for information about the Member plan is recorded. Your email address is then used only to announce the opening of this plan. You can withdraw this request at any time from your profile or by writing to contact@mes-trouvailles.fr. |
| Helping you get started, then keeping you informed of new features | Consent, collected through a separate checkbox at sign-up, never pre-ticked, and independent of accepting the legal notice. It can be withdrawn at any time from your profile or through the link included in every message, without affecting your account. |
| Storing, syncing and finding content | Performance of the service relationship. |
| Providing translation | Performance of the service relationship when the user enables this feature. |
| Preventing abuse, securing forms and fixing errors | Legitimate interest in ensuring the security and proper operation of the service. |
The Member plan has been announced but is not yet open: choosing it records your interest and your preferred billing frequency, with no payment at all. This policy will be updated before it opens or before a new billing provider is added.
4. Recipients and service providers
Data is accessible to the publisher of Mes Trouvailles and to the technical providers required for the service, within the limits of their functions:
- IONOS for hosting the VPS located in a data center in Europe, on which the Supabase components providing authentication, the database and content storage are self-hosted;
- Cloudflare for hosting and delivering, through Cloudflare Pages, the www.mes-trouvailles.fr home page and the application app.mes-trouvailles.fr, as well as for Turnstile bot protection on the sign-in, sign-up and password reset forms;
- Infomaniak for email and the sending of account-related emails, sign-up confirmation, password reset, informational messages, as well as for the root domain mes-trouvailles.fr, which redirects to the application or the home page;
- Stripe (Stripe Payments Europe, Ltd.) for collecting payment for the Founder plan: Stripe alone collects and stores bank details, under its own privacy policy, and sends Mes Trouvailles the payment status and the account it relates to;
- Google Gemini only when the translation feature is used;
- YouTube (“no-cookie” mode) when a video is played: on the home page, the player for the presentation videos is loaded only after your consent and no request is sent before that; in the application, the player loads when you start playing one of your finds, never before;
Fonts are served directly by the website: no request is sent to Google Fonts, so your IP address is not shared with anyone to display the page.
Supabase is not an external host here: it is open-source software self-hosted on the IONOS VPS.
These providers process the data needed to deliver their technical services, in accordance with their contractual commitments and the applicable regulations.
5. Retention periods
- Messages sent by email are kept for as long as needed to handle them, then for no more than 12 months when no longer obligation applies.
- Account data and content are kept for as long as the service is used, until they are deleted by the user or the account is deleted.
- Technical and security logs are kept for a limited period, proportionate to troubleshooting, security and abuse-prevention needs.
- Records of consent to account-related communications are kept for as long as needed to demonstrate it, then for no more than 3 years after the last contact.
- Translations already produced are kept in a technical memory as long as the original find exists, so the same text is not translated again; they are deleted along with it.
- Requests for information about the Member plan are kept until its opening is announced, until the request is withdrawn, or at the latest three months after that announcement.
- Payment records are kept for the period required by accounting obligations, namely 10 years.
- Database backups are kept for 14 days, then overwritten: deleted data may therefore remain in them for up to two weeks.
6. Transfers outside the European Union
Your content and your account are hosted in Europe, on the IONOS VPS. Some technical providers, including Stripe, Cloudflare, Google and YouTube, may nevertheless occasionally process certain data outside the European Union, in particular in the United States.
These transfers are governed in accordance with the GDPR by the mechanisms put in place by the providers concerned, such as an adequacy decision or the European Commission's standard contractual clauses. For more information, you can consult their privacy policies.
7. Your rights
You can request access to your data, its rectification or erasure, restriction of processing, data portability, or object to certain processing. You can also withdraw your consent where processing is based on it.
Send your request to contact@mes-trouvailles.fr. Proof of identity may be requested only when necessary to avoid disclosure to another person.
If a difficulty remains unresolved, you can lodge a complaint with the CNIL, the French data protection authority.
8. Cookies and local storage
The landing page uses Google Tag Manager and Google Analytics to measure its audience and to better understand, in aggregate, website traffic and where visits come from. These tools are only activated after your consent, collected through the Tarteaucitron cookie manager and Google Consent Mode. You can accept, refuse or change your choice at any time from the cookie management panel. Mes Trouvailles does not use these tools for personalized advertising and does not sell your data.
The application also uses mechanisms that are strictly necessary for sign-in, security, syncing and remembering preferences. Cloudflare Turnstile processes the technical information needed to protect the sign-in, sign-up and password reset forms against automated submissions.
9. Browser extension
The Mes Trouvailles extension is available for Microsoft Edge, Google Chrome and Mozilla Firefox. It acts only when you click the extension or use its keyboard shortcut. It then reads the address and the title of the active tab. On a YouTube page it can also read the video identifier and the current timestamp, and pause playback in order to create a timestamped note.
That information, together with the note you write, is sent to your Mes Trouvailles account to be saved there. The sign-in session and any drafts not yet sent are kept in your browser’s local storage. The extension never reads or stores your password: you type it on a Mes Trouvailles page, and it goes straight to the authentication service.
Signing in on Firefox. Firefox does not give extensions a stable redirect address: it is drawn at random for each installation. The Firefox version therefore opens the sign-in page in an ordinary tab, and a component of the extension, active on that page alone, receives the session once sign-in succeeds. That component reads neither the form, nor the password, nor the content of the page. It is not loaded on any other site.
The extension does not monitor your browsing, does not inspect your other tabs, and runs no remotely downloaded code: everything that executes is contained in the package you install. Data handled by the extension is not sold, not transferred to third parties, not used for advertising, not used for purposes unrelated to the extension, and not used to assess creditworthiness. It follows the same retention, security and data-subject-rights rules as the rest of the service.
The categories of data handled are declared on each store: on Firefox in the extension’s manifest, shown by the browser at install time; on the Chrome Web Store on the extension’s listing.
| Identification | The account email address, used to show who is signed in. |
|---|---|
| Authentication | Session tokens, kept on your device. |
| Web history | The address of the page you choose to save. One page at a time, on an explicit action of yours; the extension does not read your browsing history. |
| Website content | The page title, the YouTube video identifier, its timestamp and the note you write. |
10. Security
Mes Trouvailles implements technical and organizational measures designed to limit unauthorized access, loss, alteration and disclosure. However, no system can guarantee zero risk.
11. Changes to this policy
This policy may change as the service's features and providers evolve. The update date shown at the top of the page identifies the applicable version.