Privacy policy

The principle

InYourGeek is a static site: no account, no comments, no advertising, no analytics. The only form is the optional sign-up to the Monday letter. No third-party service is loaded by your pages — no Google Analytics, no remote font, no tracking share button, no captcha: the form's anti-bot protection is a computation done by your browser and checked by our server. You can verify this yourself in your browser's network tab.

The video publishing tool that publishes InYourGeek's videos to TikTok and YouTube has its own privacy policy: it does not concern visitors to the site.

What is nonetheless recorded

Like any web server, the one hosting this site keeps a technical access log containing:

• your IP address;
• the date and time of the request;
• the address of the page requested;
• your browser type (user agent) and the referring page.

Data controller: SOULIER Sébastien EI (see the legal notice).
Purpose: keeping the server running and secure, diagnosing failures, detecting abuse.
Legal basis: legitimate interest (GDPR article 6.1.f).
Retention: 30 days. Logs are rotated nightly and deleted automatically after thirty days — well below the six months French data protection guidance allows for connection logs, and enough to investigate an incident.
Recipients: the publisher only. These logs are not shared, sold, or used for commercial or advertising purposes.

Processor and location

Hosting is provided by Scaleway (Online SAS), a French company, on a server located in the Netherlands. The site's data (logs, sign-up service) does not leave the European Union. For the letter's mailing list, see its provider.

Cookies

This site sets no cookies. Details are on the Cookies page.

The Monday letter

If you sign up for the Monday letter, we process your email address and the language of the letter you chose.

Controller: SOULIER Sébastien EI (see the legal notice).
Purpose: sending you the letter, once a week, and nothing else — no advertising, no commercial offers, never sold or shared.
Legal basis: your consent (GDPR article 6.1.a), collected by double opt-in: nothing is sent until you click the link in the confirmation email. An unconfirmed address is added to no list.
Withdrawing consent: at any time, in one click, via the unsubscribe link in every letter, or by writing via the contact page. Withdrawal is immediate and needs no reason.
Retention: as long as you are subscribed. When you unsubscribe, the address is removed from the list; our provider keeps it in a suppression list for the sole purpose of never writing to you again. Proof of your consent (date and IP address of the confirmation click) is kept while you are subscribed, then for three years at most as evidence.
Recipients: the publisher and its mailing provider.

Mailing provider (processor): Brevo (Sendinblue SAS), a French company, stores the list and sends the emails on our behalf, under a data processing agreement compliant with GDPR article 28. Brevo states that it hosts this data in the European Union; if one of its own sub-processors accesses it from outside the Union, that transfer is governed by the European Commission's standard contractual clauses (see its privacy policy).

Open and click measurement: like any mailing tool, Brevo technically measures email opens and link clicks. InYourGeek only looks at totals (how many letters were delivered, opened, how many unsubscribes), never per-person statistics, and builds no profile. The letter also contains the articles' illustrations, served by inyourgeek.com: if your mail client loads them directly (Gmail goes through its own relay), that request appears in the server's technical log described above, kept 30 days and never used for measurement. To send nothing at all, display the letter without images or read it in the RSS feed.

Form protection: to stop a bot from signing up addresses in bulk, or a third party from flooding yours with confirmation emails, our server limits requests per IP address (one hour) and per email address (twelve hours). It only keeps an encrypted fingerprint, in memory only: nothing is written to disk, and everything disappears when these periods expire or the service restarts. Legal basis: legitimate interest (GDPR article 6.1.f) in protecting the service and people whose address might be entered without their knowledge. No cookie is set.

The donation button

The "Buy me a coffee" button is a plain link: until you click, nothing is loaded from Buy Me a Coffee and no data is sent to it. If you donate, you do so on its site, and Buy Me a Coffee (Publisherr Inc., United States) then processes your data (name or nickname, email address, payment through its provider) as a separate controller, under its privacy policy; that data is processed in the United States.

InYourGeek receives from the platform the displayed name or nickname, the amount, the date and any message. Purpose: thanking you and bookkeeping. Legal basis: the legal accounting obligation (GDPR article 6.1.c). Retention: ten years, as required for accounting records (French Commercial Code, article L123-22). This data is never published or reused without your consent.

If you write to us

An email sent to our contact address is kept for as long as needed to handle your request, then for one year at most as evidence. It is never added to any mailing list.

The video publishing tool (TikTok and YouTube)

The tool that publishes InYourGeek's videos to TikTok and YouTube has its own privacy policy: data accessed and stored, use, sharing, revoking access. It does not concern visitors to the site.

Your rights

You have rights of access, rectification, erasure, restriction and objection over your data. To exercise them, write to the contact page. You will receive an answer within one month.

In practice, identifying a person from an access log requires you to supply your IP address and a precise time window; without that, the publisher has no way to link those records to you.

If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority, CNIL, or with your own national supervisory authority.

Data protection officer

No DPO is appointed: processing is limited, non-systematic and involves no sensitive data, which does not make an appointment mandatory.

Changes

Any change to this policy will be published on this page, with its update date.