Privacy policy

Who is responsible for your data

gratos.app and 0xloucash.com are published by Louca (0xLoucash), a sole trader established in France, who is the controller of the processing described here. Details about the publisher are in the legal notice.

For any question about your data or to exercise your rights: [email protected].

The Tuesday newsletter

Data: your email address and the page you signed up on. Purpose: sending you the new alternatives in the library every week. Legal basis: your consent, given when you sign up; every email has a one click unsubscribe link.

Retention: until you unsubscribe. Recipient: Brevo (Sendinblue SAS, France), which sends the emails.

A guide or a video sent by email

Data: your email address and, if the request comes through Instagram, your handle and the conversation with the messaging bot. Purpose: sending you the resource you asked for, then the related emails. Legal basis: your consent; you unsubscribe in one click.

Retention: until you unsubscribe. Recipients: Brevo (France) for the emails, and Manychat, Inc. (United States) for Instagram conversations, covered by the EU-US Data Privacy Framework and standard contractual clauses. Instagram (Meta) remains responsible for its own platform.

The “Suggest an alternative” space

Data: your email address, verified with a 6 digit code kept for as long as it is valid, a session cookie valid for one year so you are not asked for the code again, then your suggestions (a repository link) and your votes. Your suggestions and votes are published without your name or email.

Purpose: letting you suggest tools and vote once per suggestion. Legal basis: performing the service you ask for, under the terms of use. You only get the newsletter if you tick the dedicated box, which is never ticked in advance.

Retention: your account is kept until you ask for its deletion; your suggestions then stay published, with no link to you. Recipient: none, the data stays in a PocketBase database hosted on my server (Contabo, Germany).

Booking and paying for the consultation

Data: your name, email address, phone number, your answers to the booking form and the slot you chose. Payment goes through Stripe: I never see your card details. Purpose: organising the consultation, sending you the confirmation, the calendar invite, the video link, the confirmation and the reminders by text message and email, then the invoice.

Legal basis: the contract you enter into when booking, and the legal obligation to keep invoices. Retention: 3 years after the consultation, then deletion; invoices are kept 10 years, as French commercial law requires.

Recipients: the booking tool hosted on my server (rdv.installclaw.io, Contabo, Germany) and my client follow up tool, also hosted on my server; Google (Calendar and Meet), covered by the Data Privacy Framework; Resend, Inc. (United States) for emails, covered by standard contractual clauses; Stripe Payments Europe, Ltd (Ireland), whose transfers to Stripe, Inc. are covered by the Data Privacy Framework; OVHcloud (France) for confirmation and reminder text messages.

Audience measurement

I use Umami, an open source tool I host myself. It sets no cookie and does not keep your IP address: it counts page views, the page you came from, your country and approximate city (derived from your IP address, which is not kept) and your device type, anonymously. Purpose: knowing which pages are useful. Legal basis: my legitimate interest; this measurement meets the conditions of the French data protection authority (CNIL) for being exempt from consent.

Retention: 25 months at most, then automatic deletion. Recipient: none, everything stays on my server.

Serving the site and keeping it secure

Pages go through the delivery network of Cloudflare, Inc. (United States), which sees your IP address while delivering them and filtering attacks. It may set a short lived technical cookie to tell robots from humans. Legal basis: my legitimate interest in protecting the site. This transfer is covered by the Data Privacy Framework.

My server keeps no visit log. Against abuse, the number of code requests per IP address is counted in memory for a few minutes, without being stored.

Images loaded from Google and GitHub

Some software icons are served by Google's icon service, and some screenshots are loaded from GitHub (and its storage at Amazon Web Services). To display these images, your browser sends your IP address to these services. Legal basis: my legitimate interest in illustrating the pages. Google, GitHub and Amazon take part in the EU-US Data Privacy Framework.

What stays in your browser

The site keeps a few settings in your browser, without sending them anywhere: whether you have already seen the first visit guide, your selection of paid software, and, for the length of your visit, the link that brought you here, to know where bookings come from. These are settings the service needs or anonymous audience measurement: they need no consent, and you can clear them in your browser settings.

When you write to me

If you write to [email protected], your message and address are used to reply. Legal basis: my legitimate interest in replying. Retention: for the length of the exchange, then 3 years at most. Recipient: Google (Gmail, Google Workspace), which hosts the mailbox, covered by the Data Privacy Framework.

Your rights

You can access your data, correct it, have it erased, object to its use, restrict its use, get it back in a readable format (portability), and withdraw your consent at any time, without affecting what was done before. You can also give instructions about what happens to your data after your death.

To exercise these rights, write to [email protected]. I reply within one month; I may ask you to prove your identity if there is a doubt about who is asking.

If you think your rights are not respected, you can file a complaint with the CNIL: cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Security and changes

The sites are served over HTTPS, the data is hosted in Germany on servers with restricted access, and no data is sold or used for advertising.

This policy changes when the site changes (new tool, new form); the date at the top shows the latest version.