Privacy Policy

Data controller

dlesieur is the data controller for Prismatica.

Privacy contact: dev.pro.photo@gmail.com.

Data we collect and why

• Account data: email address, username, password (stored only as a hash) and account timestamps. Used to create your account and sign you in. Legal basis: contract and legitimate interest in account security.
• Preferences: theme and notification settings, and newsletter consent if you give it. Used to apply your settings. Legal basis: contract for service preferences and consent for optional communications.
• Sessions and security logs: the IP address and browser user agent of each signed-in session, the IP address in the sign-in audit log, and timestamps. IP addresses are personal data. Used to keep you signed in and to secure your account. Legal basis: legitimate interest in security, fraud prevention and troubleshooting.
• Tokens: password-reset, email-verification and session tokens. Used for secure authentication. Legal basis: contract and legitimate interest in secure authentication.
• Workspace profile: display name, username and, if you add them, a bio, a headline and an avatar. A hash of your email address links the profile to your account. Your profile appears in the workspace people directory unless you opt out. Used to show who you are to the people you work with.
• Content you create: pages, comments, chat messages and their attachments, tasks, favourites, notifications, connection requests, blocks and reports, and whiteboard drawings. Used to provide the workspace.
• Push notifications: if you turn them on, your browser's push endpoint and its keys.
• Mail and Calendar: if you connect a mail or calendar account, its address and display name, a copy of message details (sender, recipients, subject, a short snippet, labels) and of calendar events (title, description, location, attendees). Used to show your mail and calendar inside the workspace.

Retention

There is no automatic deletion. No scheduled job deletes or anonymises accounts, content, sessions, tokens or logs, so data is kept until it is deleted from the database. Some items you delete, such as whiteboards and chat messages, are marked as deleted rather than erased.

Where your data is stored and who receives it

Prismatica is self-hosted. All data is stored on the machine that runs the service, in its PostgreSQL, MongoDB and MinIO (file storage) databases. Emails the service sends are delivered to Mailpit, a mail catcher running on the same machine, and do not leave it. We do not sell personal data.

Personal data leaves that machine only in these cases:

• When Cloudflare Turnstile is enabled, the sign-up and sign-in pages load Cloudflare's script, and the sign-in service sends the Turnstile token and your IP address to Cloudflare to check that you are not a bot.
• When you connect a Gmail, Outlook or Google Calendar account, the service fetches your mail and events from that provider.

International transfers

The service is hosted on a single machine. Personal data reaches other countries only through the third parties listed above.

Your rights

You can exercise your rights of access, rectification, erasure, restriction, portability and objection under GDPR Articles 15 to 21. You can also withdraw consent at any time where processing is based on consent.

Use the Data Rights form or contact dev.pro.photo@gmail.com. There is no self-service data export or account deletion yet: requests are handled through this contact.

You also have the right to lodge a complaint with the CNIL: https://www.cnil.fr/fr/plaintes.

Cookies and local storage

The service uses a sign-in cookie and stores your preferences, consent choices and a workspace cache in your browser's local storage. It has no analytics or marketing scripts: the consent banner records your choice, and nothing else loads. See the Cookie Policy for the full list.