Privacy policy

EI Meidy BAFFOU — SIRET: 80473268300045

Contact: contact@crackandreveal.com

CrackAndReveal collects the following data:

• Email address — used for authentication (sign-up, login, password reset). Provided by the user or via Google OAuth.
• First name and last name — optional, entered in the user profile.
• IP address — recorded with each lock unlock attempt, for security and rate limiting purposes.
• User-Agent — recorded with attempts to detect automated abuse.

Data is used exclusively for:

• Managing your account and authenticating your requests
• Providing statistics for your locks (attempts, successes)
• Protecting the service against abuse (IP rate limiting)

We do not sell, rent or share any personal data with third parties for commercial purposes.

• User account — retained as long as the account is active. Deleted upon request.
• Attempts (IP, user-agent) — retained for 90 days, then automatically deleted.
• Locks and content — retained as long as the account exists. Deleted with the account.

Lock codes are stored as bcrypt hashes. Communications are encrypted via HTTPS. Authentication uses ES256-signed JWTs (asymmetric keys).

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

• Access — obtain a copy of your personal data.
• Rectification — correct inaccurate data.
• Deletion — request the deletion of your account and all your data.
• Portability — receive your data in a structured format.

To exercise these rights, contact us at contact@crackandreveal.com. You can also delete your account directly from the Profile page of your dashboard.

CrackAndReveal does not use third-party cookies or advertising trackers. Only authentication session data is stored locally in the browser (localStorage).

For any questions about privacy: contact@crackandreveal.com