Privacy
What Cybridia records, and what it does not
An account, a progress record, a session. No advertising tracker, no resale, no third-party analytics. Here is the exact list of what is stored and how to erase all of it.
This page describes how the Cybridia service processes personal data. The controller is the publisher of the site, identified in the legal notice.
What the service records
Without an account, the site keeps nothing that identifies you. No sign-up is required to read the course, the glossary or the blog. Your browser keeps the language and theme you picked in its own local storage: those values never leave your device.
With an account, the following are recorded:
| Data | Why |
|---|---|
| Email address | Identify the account and allow you to sign in |
| Display name | Name you in the leaderboard — you choose it, it can be a pseudonym |
| Password | Never in clear text: only an argon2id hash is stored |
| Progress | Questions answered, correct answers, streaks, achievements, level |
| Open sessions | Keep you signed in from one visit to the next |
An open session keeps its date of last use, the browser it declares (user agent) and the IP address it connected from. Those last two serve exactly one purpose: letting you recognise a session you did not open, and close it.
Signing in with Google
Signing in with Google is optional — an email address and a password work just as well.
If you use it, Cybridia asks Google for three scopes and nothing else: openid,
email and profile. From the response, the service stores three items:
| Data received from Google | Why |
|---|---|
Your Google account identifier (sub) |
Recognise the same account on the next sign-in |
| Your email address | Identify the account, exactly as with a password sign-in |
| Your display name | Pre-fill the name shown in the leaderboard — you can change it afterwards |
Nothing else is requested and nothing else is kept: no profile picture, no contacts, no Google Drive, no calendar, no access to any other Google service. An account whose email address Google reports as unverified is refused.
These three items are used for one purpose only — creating and identifying your account. They are never sold, rented, shared with a third party, used for advertising, or used to train an artificial-intelligence model. Deleting your account, from My space → Settings, erases them along with the rest.
Cookies
A single cookie is set, and only once you are signed in: the session cookie. It
is HttpOnly — the page's JavaScript cannot read it — SameSite=Lax, and it
lasts 30 rolling days.
There is no advertising cookie, no tracker, no third-party analytics. No Google Analytics, no ad network, no social-network pixel. That is also why this site does not ask you to consent to cookies: the session cookie is strictly necessary to the service you are requesting.
Who else handles your data
The service is self-hosted. Three providers are nonetheless involved in making it work, each for one narrow task:
| Provider | Task | What it sees |
|---|---|---|
| OVH (France) | Hosting the server | Everything stored, as the hosting provider |
| Cloudflare, Inc. (United States) | Proxy, TLS and protection against abuse | Connection metadata: IP address, browser, pages requested |
| Brevo (France) | Sending service emails — address verification, password reset | Your email address and the content of those emails |
Because Cloudflare is a US company, connection metadata may be processed outside the European Union, under the standard contractual clauses that frame that transfer. Signing in with Google likewise involves an exchange with Google LLC, under Google's own privacy policy. No other transfer takes place in the normal running of the service.
What the service does not do
- Your data is neither sold, nor rented, nor passed on for advertising purposes.
- No advertising profiling, and no automated decision producing legal effects concerning you.
- No use of your data, your answers or your progress to train an artificial-intelligence model.
Retention periods
- Account and progress: as long as the account exists.
- Sessions: 30 days after last use, then expiry.
- After account deletion: sign-in data is erased immediately, the rest within 30 days at most.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data.
Two of those you exercise directly in the application, without asking anyone: My space → Settings lets you change the display name and the password, close every open session, and delete the account.
For anything else, write to [email protected]. You may also lodge a complaint with your national supervisory authority — in France, the CNIL (cnil.fr).
Security
Passwords are hashed with argon2id. The session identifier is a random token of which only a hash is stored: the database holds nothing that would let a session be replayed. Exchanges with the API happen on the same origin as the site.
Changes
Online payment is not open yet. The day it is, the payment provider will process card data without the site ever having access to it, and this page will be updated before it opens, not after.