Privacy notice

Antoine Laborderie is the publisher and data controller of Placette, a non-commercial personal project in France. Placette is a public noticeboard for town events.

For requests, see the contact section below.

Your account holds your name, email address, a bcrypt password hash if you set a password, home town, the two email preferences (weekly digest and new-event alerts), and the account creation date. These let you log in, choose your town, manage your account and receive the emails you choose. Settings let you change your name, email address and password; accounts with a password must give their current password to change their email or password. Your name appears on the events you post. New-event alert emails show the first name or name of the member who posted the event to subscribers of that town.

If you use social login, your name and, when supplied, email address come from the provider you choose: Google, Facebook, Instagram, X or Microsoft. We store the provider and its opaque identifier to recognise your account. When a provider supplies no verified email address, we use a generated placeholder until you add your own.

Sessions hold a hashed token, your account reference and an expiry date, to keep you logged in for 30 days. We also store town admin grants where applicable, so only authorised members can moderate a town.

Events you post are public: their title, category, date and times, venue and optional address, description, organiser, source link, town, author reference and posting date are stored to run the board.

Event reports store the event, reporter, reason, optional comment, date and resolution (including its date and resolving admin). Reports are visible to the town's admins for moderation.

Password-reset tokens are stored hashed, with an account reference, creation and expiry dates, and a use date when used or invalidated. Links expire after one hour and can be used once.

Weekly-digest delivery records track the town, week, account, delivery status, attempt counts, delivery times and any delivery error, to avoid repeat emails and retry temporary failures. The hosting server also records IP addresses in technical logs.

To protect against abuse and password guessing, rate-limit counters are keyed on the visitor's IP address (or IPv6 network), an account identifier, a hash of the log-in or password-reset email, or an address-and-email pair; their windows range from 15 minutes to 24 hours. They stay in memory only, are cleared after expiry by the minute scheduler and are lost at restart. This processing relies on our legitimate interest in securing the service (Article 6(1)(f)).

Under the GDPR, account management and event posting rely on performance of the service you ask for (Article 6(1)(b)). Optional emails rely on your consent (Article 6(1)(a)); withdraw it at any time in settings or with the unsubscribe link in each message. Security logs rely on the legitimate interest in keeping the site secure (Article 6(1)(f)).

The site and its database are hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. An email delivery provider, used only when emails are enabled, processes recipient addresses and messages to deliver them; a provider established in the EU where possible is preferred.

There is no advertising, no analytics and no sale of personal data. Apart from these service providers, we do not share your private account data with anyone else. Public events can be read by anyone.

Browsing does not load third-party resources: fonts are self-hosted. Social-login providers are US companies with their own privacy policies. The site sends them nothing beyond the log-in request and the authentication exchanges needed to complete it.

Account data and its linked social identities and admin grants stay until you delete the account. Sessions expire after 30 days, ending access immediately. A daily purge removes session records expired for more than seven days. Digest delivery records are kept for 90 days from creation, and digest completion records for 90 days from completion; both are removed by the daily purge. Account-linked delivery records are also removed when the account is deleted.

Events stay public until removed by their author, a town admin or during account deletion if you choose that option. Otherwise deletion removes their author reference but keeps the event text, including any personal information you wrote in it.

Reports, including resolved reports, are kept until the event or the reporter's account is deleted. Deleting a resolving admin's account clears that reference and keeps the report. Reports on events retained without an author remain subject to the same rule.

Password-reset tokens are stored hashed for at most a day after expiry: the daily purge removes expired rows, used or unused, even when mail is disabled. Reset requests also remove rows more than a day past expiry. Deleting the account removes all its reset tokens.

The hosting server keeps technical logs for a limited period for security and troubleshooting; the precise period is being confirmed with the host.

All cookies serve strictly necessary functions, so no cookie consent banner is needed. They are not used to track you for advertising or analytics.

• placette_session keeps you logged in, for up to 30 days.
• placette_csrf protects forms against forged requests; it is a browser-session cookie.
• placette_city remembers the town you choose, for up to one year.
• placette_flash carries a one-off confirmation or error message, for up to one minute, and is cleared when read.
• placette_oauth protects a social-login attempt, for up to ten minutes, and is cleared at the callback.

You can request access to your data, rectification, erasure, portability of data you provided, restriction of processing and objection to processing based on legitimate interests, subject to the GDPR conditions for each right. You may also give instructions on what happens to your data after your death under Article 85 of the French Loi Informatique et Libertés.

Use settings to view and correct your account details, withdraw email consent or delete your account. You can edit or remove your own events from their pages. For a copy of your data, portability, an objection or another request, use the contact section below.

You may also complain to the French data protection authority, the CNIL.

A contact address will be published shortly.

Everything you write in an event is public. Avoid posting personal information that you do not want others to read. Events link to organisers' original pages on other websites; Placette does not control those pages or their handling of personal data.