1. Data controller
SAS SYNBIOTIQUE, Passage de la Plagne, 09420 Rimont, France, 995 378 114 RCS Foix, is the data controller. Privacy and data rights contact: sassynbiotique@gmail.com, or by post to the registered office. Telephone: +33 7 69 39 26 60.
2. Data, purposes and legal bases
| Purpose and data | Legal basis (GDPR) |
|---|---|
| Provide accounts and practice: verified email, unique identifier, display name, language, dates, sessions, security settings, answers, scores, duration, history, palaces, associations and completed lessons. | Perform the service requested, Article 6(1)(b). |
| Verify sign-in and prevent abuse: email codes, password and token hashes, an encrypted authenticator secret if enabled, hashed recovery codes, and attempt limits derived from email and IP. The host receives technical connection information. | Perform the service for authentication; legitimate interest in protecting users for abuse prevention, Articles 6(1)(b) and 6(1)(f). |
| Suggest a language: approximate IP country from the host, device language and manual choice. No GPS. Full IP addresses are not stored in the account database. | Legitimate interest in an understandable interface; perform your language choice, Articles 6(1)(f) and 6(1)(b). |
| Answer support and rights requests: email, message and technical details provided voluntarily, and records needed to follow up or meet legal obligations. | Perform the service for support, legitimate interest for general enquiries, legal obligations for your rights, Articles 6(1)(b), 6(1)(f) and 6(1)(c). |
Email and ownership verification are required for private accounts; without them we cannot create the account or verify its owner. Display name, personal content, manual language choice and two-factor authentication are optional. Offline mobile practice works without an account. Avoid sensitive data and private information about other people.
3. Accounts, family and local data
The website saves practice in your private cloud account. Family mode is shared: anyone with its password can access its profiles and data. It does not provide individual private accounts.
On mobile, local profiles, answers, palaces and progress stay on the device, without automatic website synchronization. Anyone who can open the app can choose those profiles. Exports contain all local profiles and their data in readable JSON, without sign-in tokens; Synbiotique does not receive them. Sharing destinations and system backups follow their own rules. Protect your device and exported files.
4. Recipients and international transfers
Necessary data is accessible to authorized Synbiotique personnel and service providers: OpenAI Sites for the publishing platform, Cloudflare for hosting and database services, Plus Five Five, Inc. (Resend) for sign-in emails, and Google/Gmail for support messages. For any future mobile purchase, Apple or Google handles its accounts, payments and transactions; Loci does not send us your bank card details.
These services may process data outside the European Economic Area, including in the United States. Storage is not guaranteed to be exclusively European. Resend describes European standard contractual clauses in its data processing agreement. Cloudflare describes the EU–US framework and, depending on the transfer, standard contractual clauses. See provider documents below or contact us for details or a copy of the applicable safeguards.
Resend DPA · Resend privacy · Cloudflare privacy · OpenAI privacy · Google privacy
5. Retention and deletion
- Account and cloud practice: while the account exists, then removed from the active database on deletion. The current version does not automatically delete inactive accounts.
- Email codes: valid for 30 minutes. Sessions: twelve hours without Remember me, up to thirty days with it. A used code cannot be reused. Expired records are cleaned during subsequent sign-in activity, not necessarily at their expiry time.
- Account attempt limits: records older than seven days are cleaned during subsequent sign-in activity. Family sign-in fingerprints are separate records, without plain IP addresses.
- Support and rights requests: as long as needed to handle and follow up. Evidence needed for a dispute or by law may be retained for the applicable legal period, with limited access.
- Local data, language and exports: until you delete or reset them, or the device clears them. Providers apply their own retention periods to technical logs, delivery logs and backups; physical erasure is not necessarily immediate after account deletion.
Account deletion removes practice and security data from the active database. It requires recent sign-in and the second factor if enabled. Start from the deletion page. Delete exports and local backups separately.
6. Security
Passwords use salted hashes, sessions and recovery codes are hashed, and authenticator secrets are encrypted on the server. Remembered mobile tokens use secure device storage. Two-factor authentication is optional. No service guarantees that an incident will never occur. On shared devices, turn off Remember me and sign out.
7. Your rights
Subject to GDPR conditions: access, correction, erasure, restriction, portability and objection to processing based on legitimate interests. French law also allows instructions about your data after death. If future processing relies on consent, you can withdraw it without affecting prior processing.
Write to sassynbiotique@gmail.com with “Loci — personal data”, the relevant account and your request, or to the registered office. Identity is verified proportionately: do not send ID documents, passwords or codes without a justified request. A response is due within one month; complex requests can take two additional months, with notice of the extension within the first month.
You can complain to the CNIL or your competent authority. Scores compare answers in exercises; they do not make legal or similarly significant decisions about you.
8. Cookies and updates
Fonts are served by Loci; opening a page does not require a connection to Google Fonts.
The current version has no advertising or tracking/analytics SDKs. Cookies and preferences are detailed in the cookie notice. This policy will be updated if processing changes. Future trackers requiring consent must be offered before activation.