Privacy policy

1. Data controller

The data controller is the publisher of the Finamax website, reachable through the contact form.

No data protection officer has been appointed: the Site does not fall within any of the cases making such an appointment mandatory (article 37 GDPR).

2. What the Site does not do

The Site runs without advertising and without third-party audience measurement. In practice:

• no advertising cookies, no social network pixels, no third-party trackers;
• no profiling, no automated decisions producing legal effects;
• no sale, rental or exchange of personal data with third parties;
• no email address used for marketing without an explicit request.

The Site does, however, measure its own traffic by its own means: how many people visit it, which pages, from which country and by which route they arrived. That measurement is described in detail in section 3.3. No data is sent to any analytics provider, and the results are totals only: they cannot tell what any particular person looked at.

No consent banner is displayed because this measurement meets the conditions set by the CNIL for the audience-measurement exemption: strictly statistical use for the publisher alone, no tracking from one site to another, no combination with other processing, IP address never retained, periods capped at thirteen months, and the ability to object at any time with a single click (see section 8).

3. Data collected and purposes

3.1 Contact and missing-asset forms

When you write through the contact page or the missing asset page, the following is recorded:

• your email address (required, so we can reply);
• your name (optional);
• the subject and body of your message, or the details of the asset you report;
• the display language at the time of sending;
• a non-reversible fingerprint of your IP address (SHA-256 hash with a secret key) and your user agent (browser and system), used only as an anti-spam safeguard: the IP address itself is never stored;
• the date and time of sending.

Purposes: replying to your request, correcting reported data errors, and limiting automated abuse. Legal basis: the controller's legitimate interest (article 6(1)(f) GDPR) in handling incoming requests and protecting the Site against abuse.

3.2 User accounts

An account implies recording the following data:

• your email address, which serves as your identifier;
• your password, never kept in clear text: only a fingerprint computed with the argon2id algorithm is stored;
• if you sign in with Google, the Google account identifier and email address passed on by Google, excluding your Google password;
• an opaque session identifier, stored server-side and set in a strictly necessary cookie;
• the portfolios and simulation settings you save, along with the display name you choose if you publish a result to the leaderboard;
• the account creation, last sign-in and last modification dates.

Purposes: creating and securing your account, authenticating you, keeping your portfolios across devices, displaying the leaderboard, and sending you the emails the service requires (address confirmation, password reset, sign-in alert). Legal basis: performance of the terms of use you accept when creating an account (article 6(1)(b) GDPR), and legitimate interest in securing access for anti-fraud measures.

When a password is created or changed, a partial, anonymous fingerprint of it (the first five characters of a SHA-1 hash, a method known as k-anonymity) is sent to the Have I Been Pwned service to check that it does not appear in a known breach. The full password is never sent, and that service receives neither your email address nor your identity.

3.3 Audience measurement

To know whether and how the Site is used, the following is recorded on each visit:

• a random visit identifier, set in the mf_audience cookie. It contains neither your name, nor your address, nor anything that designates you: it is a random draw, of which only a non-reversible fingerprint is kept server-side;
• the pages viewed, reduced to the list of the Site's public pages: neither URL parameters nor identifiers appearing in a link are recorded;
• the time of arrival, that of the last action, and the number of pages viewed;
• the device type (computer, phone, tablet) and the family of your browser and operating system — "Firefox", "Android" — never their version number, which would make your device recognisable;
• your country, derived from your IP address at the time of the visit using a database installed on our own server. The IP address itself is neither stored nor disclosed to anyone: it serves that single calculation, in memory, and is then discarded. No city, region or coordinates are derived from it;
• the site you arrived from — search engine, social network, external link — as its domain name only, never the full address of the originating page;
• the use of certain features: launching a comparison, and the assets it contains.

If you are signed in to an account, the visit is linked to it in order to produce totals — the number of people who came back within the month, for instance. That link is never used to review the activity of an identified person, and it disappears if you delete your account; the totals remain, but anonymous.

Purposes: measuring the Site's traffic, understanding which pages and features are useful, and deciding what to improve. Legal basis: the publisher's legitimate interest (article 6(1)(f) GDPR) in knowing the audience of its own site, balanced against your rights by the safeguards above — no IP address retained, no tracking beyond the Site, capped retention, and the ability to object at any time (section 8).

Never measured: the administration area, the publisher's own visits, indexing robots, and visitors who have objected to measurement.

3.4 Display preferences

Your light or dark theme, language and currency choices are saved in your browser's local storage (keys mf:theme, mf:lang and mf:currency). This information never leaves your device, is not sent to the server, and can be erased at any time by clearing the site data in your browser.

3.5 Administration area

Access to the administration area reserved for the publisher sets a session cookie (admin_token, strictly necessary, valid for 24 hours). It does not concern visitors to the Site.

3.6 Technical logs

As with any web server, the host records technical logs containing the calling IP address, the date, the page requested and the response code. They serve the operation of the service, incident diagnosis and security, and rest on legitimate interest (article 6(1)(f) GDPR).

4. Retention periods

Deleting an account cascades, by design of the database, to the portfolios and leaderboard results attached to it.

5. Recipients and processors

The data is accessible only to the publisher of the Site. It is hosted and carried by the following providers, acting as processors within the meaning of article 28 GDPR:

• OVH SAS (France) — hosting of the website, the server functions and the database, on a single server;
• Resend (United States) — delivery of service emails, once user accounts are enabled;
• Google Ireland Ltd / Google LLC — optional sign-in with a Google account, and delivery of the typefaces (Google Fonts);
• DeepL SE (Germany) — machine translation of the name and description of the portfolios you choose to show on the leaderboard, at the moment you save them. A private portfolio is never sent.
• flagcdn.com — delivery of flag images.

The Site's pages load Google Fonts and flags from third-party servers: doing so passes your IP address and your browser's technical information to those providers. No cookie is set by these requests.

Data may also be disclosed to administrative or judicial authorities where the law so requires.

6. Transfers outside the European Union

The Site and its database are hosted in France by OVH SAS: the data you enter does not leave the European Union. Some of the other processors listed above are, however, established in the United States, which entails a transfer of data outside the European Union. These transfers are covered by the European Commission's standard contractual clauses and, where applicable, by the providers' certification under the EU-US Data Privacy Framework. The hosting data centre, in Strasbourg, is stated in the legal notice.

7. Security

• all exchanges are encrypted in transit (HTTPS);
• passwords are hashed with argon2id and cannot be read back, including by the publisher;
• IP addresses from the public forms are kept only as a salted, non-reversible fingerprint;
• session cookies are flagged HttpOnly and Secure, which makes them unreachable from the page's JavaScript, and restricted by the SameSite attribute — Lax for the account cookie, Strict for the administration cookie;
• rate limits and anti-robot questions protect the forms and sign-in attempts.

As no system can guarantee absolute security, a data breach presenting a risk to your rights would be notified to you under the conditions set out in articles 33 and 34 GDPR.

8. Cookies and local storage

No tracker on the Site requires consent under article 82 of the French Data Protection Act. Most are strictly necessary; the last one falls under the exemption for audience measurement:

• admin_token — session cookie for the administration area, reserved for the publisher, 24 hours;
• user session cookie — set only after you sign in, once accounts are enabled; 30 days after last use, 6 months at most;
• mf:theme, mf:lang, mf:currency — local storage, never sent to the server, holding your display preferences;
• mf_audience — random audience-measurement identifier, 13 months from when it is first set and never extended by later visits (section 3.3);
• mf_audience_optout — set only if you decline measurement below. It holds nothing but that refusal, and serves only to honour it.

You can block or erase these items in your browser settings. The Site remains usable, but your preferences will reset on every visit and signing in to an account will become impossible.

Opting out of audience measurement

The button below stops measurement for this browser immediately and erases the mf_audience cookie. No further traffic data about you will be recorded. Your choice can be reversed at any time, from this same page.

9. Your rights

You have the rights of access, rectification, erasure, restriction of processing, objection on legitimate grounds and portability, as well as the right to give instructions on what happens to your data after your death.

These rights are exercised through the contact form. You will receive an answer within one month; proof of identity may be requested where there is reasonable doubt about the identity of the requester. Once accounts are enabled, you can also delete your account at any time from your settings, without making a request.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.

10. Minors

The Site is not intended for people under 15 and does not knowingly collect their data. Should such data have been recorded, it would be deleted as soon as it is reported to the controller.

11. Changes to this policy

This policy may change along with the features of the Site. The last-updated date shown at the top of the page is authoritative; in the event of a substantial change affecting your rights, account holders are informed by email.