Privacy policy
What the site records and why: progress stored in your browser, optional account by email link, cookie-free audience measurement and your GDPR rights.
1. Data controller
QDNA, publisher of apprendre-ia.qdna.fr (full details on the Legal notice page). Contact for any question or to exercise your rights: [email protected].
2. What the site records without an account
Without an account, no progress data leaves your device. The site records in your browser's local storage (localStorage) your progress through the lessons, your quiz answers, your attempts and your proofs of mastery, as well as your display theme, your language choice and the state of the prompt composer. You can erase this data at any time from the My progress page or in your browser settings.
Two processing operations still take place on every visit, described in sections 6 and 7: audience measurement and the technical logs of our host.
3. The optional account
If you open an account, the site processes the following data.
Your email address, to send you the sign-in link and to recognise you. Your language and the date the account was created. Your progress, that is your advancement, your quiz results and your review dates, copied to our servers so that you can find it on another device. The fact that you submitted a proof of mastery, that is only the lesson concerned and the date: the text you type in the proof forms stays in your browser and in your portfolio export, and is never sent to our servers. Your badges, with their level and their issue date.
What you write in a proof of mastery stays on your device, but it stays there in plain text. Do not copy confidential data belonging to your employer into it, nor personal data about your colleagues or your clients: anonymise your examples, as the lesson on confidential data teaches you.
Sign-in uses a single-use link sent to your address, valid for fifteen minutes, with no password. Once signed in, a strictly necessary session cookie, named session, is set for thirty days; it only serves to recognise you and is not used for any tracking. The Sign out button immediately revokes the session on all your devices.
Legal basis: performance of the service you request (article 6.1.b of the GDPR).
4. What the site records when you ask for a sign-in link
To prevent one address from being used to flood another, each link request records for one hour a fingerprint of your IP address and a fingerprint of your email address, within a limit of five requests per hour. Your IP address is never stored in clear text: only its salted fingerprint is kept, and rows older than one hour are deleted on every new request. The link itself is never stored in clear text: only its fingerprint is kept, along with your email address, until twenty-four hours after it expires, after which the row is deleted.
Legal basis: the publisher's legitimate interest in protecting the service against abuse (article 6.1.f of the GDPR).
5. Badges
An issued badge contains the date, the level, the criteria and an opaque learner identifier. It contains neither your name nor your email address. The same opaque identifier appears on all your badges, so that a badge wallet can link them together. The verification page of a badge is public: anyone you give its address to can view it. If you delete your account, that page disappears, but a badge you have downloaded remains verifiable offline by any Open Badges compatible tool.
6. Audience measurement
The site uses Cloudflare Web Analytics. This tool sets no cookie and writes nothing in your browser: no cookie, no local storage, no session storage. As it neither reads nor writes information in your device, it falls outside the scope of article 82 of the French Data Protection Act and does not require your consent.
The General Data Protection Regulation still applies to the IP address transmitted to Cloudflare at the time of measurement. The measurements produced are aggregated, only serve to know which pages are viewed and how fast they render, and are not cross-referenced with any other site. Legal basis: the publisher's legitimate interest in measuring the audience of its own site (article 6.1.f of the GDPR). You may object by writing to [email protected].
7. Recipients and processors
| Recipient | Role | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. and Cloudflare Ireland Ltd | Hosting of the site and the database, delivery network, audience measurement, technical and security logs | All account data, IP address, user agent, pages viewed | United States and European Union |
| Proton AG | Delivery of the emails containing the sign-in links | Email address of the recipient, message content | Switzerland |
No data is sold, rented or passed on to an advertiser, a commercial partner or an artificial intelligence provider.
Transfers outside the European Union. Data hosted at Cloudflare may be processed in the United States; the transfer is governed by the standard contractual clauses of the European Commission and by Cloudflare's certification under the EU - US Data Privacy Framework. Emails transit through Switzerland, a country recognised as providing an adequate level of protection by the Commission decision of 26 July 2000.
8. Retention periods
| Data | Period |
|---|---|
| Progress in the browser's local storage | Until you erase it |
| Fingerprint of the sign-in link and the associated email address | Twenty-four hours after the link expires |
| IP address fingerprint and email fingerprint used for rate limiting | One hour |
| Session cookie | Thirty days, renewed at each sign-in |
| Account, progress, proofs and badges | Until you delete them, and at most [inactivity period to be set] after your last sign-in, with a reminder email before deletion |
| Aggregated audience measurements | According to the retention period of Cloudflare Web Analytics |
9. Cookies
The site sets no advertising or tracking cookie. The only cookie used is the session cookie described in section 3, set only after a voluntary sign-in on your part. It is strictly necessary to the service you request and, as such, exempt from consent.
10. Your rights
You may at any time access your data, rectify it, erase it, object to its processing, request its restriction or its portability.
The My progress page lets you export your portfolio, clear your progress and delete your account without writing to us. The Clear my progress button erases the progress on this device and, if you are signed in, the progress, the proofs and the badges stored on the server. Deleting the account additionally erases your email address, the pending sign-in links and the rate-limiting rows that concern you.
For any other request: [email protected]. We answer within one month. In case of a complaint, you may contact the French data protection authority, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
11. Security
The site is served exclusively over HTTPS, with an HSTS header and a restrictive content security policy. Sign-in links are single-use, drawn at random over 32 bytes and kept only as a fingerprint. The session cookie is signed, out of reach of page scripts and transmitted only over HTTPS. No data is processed by an artificial intelligence model, and the site takes no automated decision about you.
12. Updates
This policy may be updated. The date of the last update is shown at the top of this page.