Privacy policy
What the site records and why: progress stored in your browser, optional account by email link, cookie-free audience measurement and your GDPR rights.
1. Data controller
The publisher of apprendre-ia.qdna.fr, Aurélien Ambert, a private individual who publishes it under the name QDNA (full details on the Legal notice page). Contact for any question or to exercise your rights: contact@qdna.fr.
2. What the site records without an account
Without an account, no progress data leaves your device. The site records in your browser's local storage (localStorage) your progress through the lessons, your quiz answers, your attempts and your proofs of mastery, as well as your display theme, your language choice and the state of the prompt composer. You can erase this data at any time from the My progress page or in your browser settings.
Two processing operations still take place on every visit, described in sections 6 and 7: audience measurement and the technical logs of our host.
3. The optional account
If you open an account, the site processes the following data.
Your email address serves to send you the sign-in link and recognise you. Your language and account creation date are also retained. Your progress (advancement, quiz results and review dates) is copied to our servers to synchronise across devices.
Submitting a proof of mastery records only the lesson concerned and the date. The text typed into proof forms stays in your browser and local portfolio export. It is never sent to our servers. Your badges are stored with their level and issue date.
What you write in a proof of mastery stays on your device, but it stays there in plain text. Do not copy confidential data belonging to your employer into it, nor personal data about your colleagues or your clients: anonymise your examples, as the lesson on confidential data teaches you.
Sign-in uses a single-use link sent to your address, valid for fifteen minutes, with no password. Once signed in, a strictly necessary session cookie, named session, is set for thirty days; it only serves to recognise you and is not used for any tracking. The Sign out button immediately revokes the session on all your devices.
Legal basis: performance of the service you request (article 6.1.b of the GDPR).
4. What the site records when you ask for a sign-in link
To prevent one address from being used to flood another, each link request records for one hour a fingerprint of your IP address and a fingerprint of your email address, within a limit of five requests per hour. Your IP address is never stored in clear text: only its salted fingerprint is kept, and rows older than one hour are deleted on every new request.
The link itself is never stored in clear text on our servers. Only its cryptographic fingerprint is kept, along with your email address, until twenty-four hours after it expires. The row is then permanently deleted.
Legal basis: the publisher's legitimate interest in protecting the service against abuse (article 6.1.f of the GDPR).
5. Badges
An issued badge contains the date, the level, the criteria and an opaque learner identifier. It contains neither your name nor your email address. The same opaque identifier appears on all your badges, so that a badge wallet can link them together.
The verification page of a badge is public: anyone you give its address to can view it. If you delete your account, that page disappears, but a downloaded badge remains verifiable offline by any Open Badges compatible tool.
6. Audience measurement
The site uses Cloudflare Web Analytics. This tool sets no cookie and writes nothing in your browser: no cookie, no local storage, no session storage. As it neither reads nor writes information in your device, it falls outside the scope of article 82 of the French Data Protection Act and does not require your consent.
The General Data Protection Regulation still applies to the IP address transmitted to Cloudflare at the time of measurement. The measurements produced are aggregated, only serve to know which pages are viewed and how fast they render, and are not cross-referenced with any other site. Legal basis: the publisher's legitimate interest in measuring the audience of its own site (article 6.1.f of the GDPR). You may object by writing to contact@qdna.fr.
7. Recipients and processors
| Recipient | Role | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. and Cloudflare Ireland Ltd | Hosting of the site and the database, delivery network, audience measurement, technical and security logs | All account data, IP address, user agent, pages viewed | United States and European Union |
| Proton AG | Delivery of the emails containing the sign-in links | Email address of the recipient, message content | Switzerland |
No data is sold, rented or passed on to an advertiser, a commercial partner or an artificial intelligence provider.
Transfers outside the European Union. Data hosted at Cloudflare may be processed in the United States; the transfer is governed by the standard contractual clauses of the European Commission and by Cloudflare's certification under the EU - US Data Privacy Framework. Emails transit through Switzerland, a country recognised as providing an adequate level of protection by the Commission decision of 26 July 2000.
8. Retention periods
| Data | Period |
|---|---|
| Progress in the browser's local storage | Until you erase it |
| Fingerprint of the sign-in link and the associated email address | Twenty-four hours after the link expires |
| IP address fingerprint and email fingerprint used for rate limiting | One hour |
| Session cookie | Thirty days, renewed at each sign-in |
| Account, progress, proofs and badges | Until you delete them, and at most [inactivity period to be set] after your last sign-in, with a reminder email before deletion |
| Aggregated audience measurements | According to the retention period of Cloudflare Web Analytics |
9. Cookies
The site sets no advertising or tracking cookie. The only cookie used is the session cookie described in section 3, set only after a voluntary sign-in on your part. It is strictly necessary to the service you request and, as such, exempt from consent.
Partner services. A partner service that set or read trackers would stay inactive until you allowed it in the banner shown on that occasion, where refusing is as simple as accepting and has no effect on your reading. No such service is active today.
Your choice. It is kept for six months in your browser's local storage, under the qdna-consentement key, then asked again; this storage alone is exempt from consent. You can change or withdraw your decision at any time with the “Manage cookies” link at the bottom of every page.
Partner links. When a referral link to a third-party site is published, it carries the label “partner link” and the attribute that flags it to search engines. Such a link sets nothing on this site: the partner site applies its own cookie policy once you have reached it.
10. Your rights
You may at any time access your data, rectify it, erase it, object to its processing, request its restriction or its portability.
The My progress page lets you export your portfolio, clear your progress and delete your account without writing to us. The Clear my progress button erases the progress on this device and, if you are signed in, the progress, the proofs and the badges stored on the server. Deleting the account additionally erases your email address, the pending sign-in links and the rate-limiting rows that concern you.
For any other request: contact@qdna.fr. We answer within one month. In case of a complaint, you may contact the French data protection authority, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
11. Security
The site is served exclusively over HTTPS, with an HSTS header and a restrictive content security policy. Sign-in links are single-use, drawn at random over 32 bytes and kept only as a fingerprint. The session cookie is signed, out of reach of page scripts and transmitted only over HTTPS. No data is processed by an artificial intelligence model, and the site takes no automated decision about you.
12. Updates
This policy may be updated. The date of the last update is shown at the top of this page.