Privacy policy

Who is responsible

The data controller is Alan Crouau, an individual – contact: contact@atoll.day. No data protection officer has been appointed; write to this address for any question.

Without an account

Without an account, everything stays on your device (the browser’s local storage). Nothing is sent to our servers and we cannot see your habits. Clearing the site data erases them.

With an account: what we process

• Account: your e-mail address, the date of creation and sign-in sessions (refresh tokens, hashed; device information needed to list and revoke sessions).
• Synchronised data: your habits, actions and notes. Personal fields (names, notes, photos) are encrypted in your browser before being sent; the key is tied to your account and delivered by the authentication server after sign-in, so this is protection against storage leaks, not end-to-end encryption against the operator. Dates, identifiers and modification times stay readable so that synchronisation works.
• Reminders (optional): the push subscription of your browser (technical endpoint and keys) and the reminder times you set.
• Waiting list and invitations (closed beta): your e-mail address and invitation codes.
• Technical logs: IP address, date and requested URL, kept for security and to meet our hosting obligations.

Why, and on what legal basis

• Providing the account, sign-in and synchronisation: performance of the contract (terms of use).
• Security, abuse prevention and logs: legitimate interest (and legal obligation for hosting logs).
• Reminders (push notifications): your consent, which you can withdraw at any time in Settings or in your browser.
• Waiting list: your consent, given when you register.
• We do not do advertising, profiling or sale of data, and we use no analytics tracker.

Who receives the data (processors)

• alwaysdata (France): hosting of servers, database and files.
• Mailjet (France, Sinch group): sending of sign-in e-mails.
• Your browser vendor’s push service (Apple, Google, Mozilla…): delivery of reminders, which contain no sensitive content beyond the notification text.

Retention

• Account and synchronised data: as long as your account exists; deleted when you ask for the account to be deleted (write to contact@atoll.day), including files, sessions and push subscriptions.
• Technical logs: 12 months at most.
• Waiting list: until the invitation is sent or until you ask for removal, and 12 months at most after the end of the beta.

Cookies and local storage

Atoll sets no cookies. It uses your browser’s local storage and a service worker only to run the application (your data, your session, offline use). These are strictly necessary, so no consent banner is required.

Your rights

You can access, rectify, erase, port your data, object to or restrict a processing, and withdraw your consent at any time. To delete your account or exercise any other right, write to contact@atoll.day. We answer within one month.

If you think your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr), 3 place de Fontenoy, 75007 Paris.

Changes

We may update this policy; the date at the top of the page changes accordingly, and we will inform account holders of any significant change.