Privacy policy

The data controller is [company name], a simplified single-shareholder joint-stock company, with its registered office at [registered office address]. Contact for any data question: [email address, for example privacy@kintaya.eu]. Data protection officer: [if applicable].

Kintaya collects the strict minimum: your email address for passwordless sign-in, a technical identity-provider identifier if you use Google or a personal Microsoft account, your balance and a timestamped token ledger, and technical data needed to run the service. No audience measurement, no third-party tracker, no sensitive data.

We keep no history of your distributions: not who holds which share, not the make-up of your groups, not whether a secret was reconstructed. This guarantee is about the secret; the following sections describe the more ordinary operational data.

Providing the service (account, sign-in, tokens): performance of the contract. Syncing your address book across devices: your consent, withdrawable at any time. Securing the service and preventing email-sending abuse (hashed fingerprints): our legitimate interest. Tracking overall service activity (token aggregates, no individual detail): our legitimate interest.

The database (accounts, tokens, synced address book, fingerprints) is hosted in the European Union (Neon). Email sending goes through Resend (United States): only your email address and the sign-in link transit there, under [transfer safeguards to confirm]. Secret material is never transferred, since it never leaves your browser.

Account: as long as it is active; deletion cascades to sessions, token balance and the server copy of the address book. Magic-link tokens: single use, short expiry. Token consumption ledger: kept pseudonymously after account deletion for overall statistics. Rate-limit fingerprints and technical logs: brief, bounded retention ([periods to specify]).

You have the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. Account deletion is self-service from your account page. For the other rights: [contact email address]. You may also contact the French authority (CNIL, www.cnil.fr).

Kintaya uses only strictly necessary cookies: keeping the session, anti-CSRF form protection and remembering the language. They are exempt from prior consent. No audience-measurement cookie or advertising tracker is used.