PRIVACY POLICY
Beta version · In effect as of 26 juin 2026 · GDPR compliant
1. Data Controller
Evan Tocquet, independent developer
Contact: evantocquet@gmail.com
2. Data Collected
The Application only collects the data necessary for its operation:
| Data | Source | Purpose |
|---|---|---|
| Email address | Registration / OAuth | Account identification |
| Display name | Registration / OAuth | Display in the interface |
| Profile picture | OAuth (Google/Discord) | Display in the interface |
| Riot ID & PUUID | Entered by the user | Match synchronization via the Riot API |
| Match data | Riot API / Manual entry | Push-up calculation and history |
| Password | Email registration | Authentication (stored hashed, never in plain text) |
| Gender, age, weight, height | Beta application and settings | Starting level and estimated energy spent |
| Weekly hours of sport | Beta application and settings | Calibration of the starting level |
| Maximum number of push-ups | Strength test in the Application | Multiplier applied to the debt |
| Beta application | Registration form | Selection of the first hundred accounts (motivation, referral, commitment) |
| Notification subscription | Permission granted to the browser | Sending debt reminders |
| Date of your health-consent answer | Your answer to the request | Proving consent (art. 7.1) and not asking again |
| Problem report | The report form, if you use it | Understanding and fixing the problem (page, version, browser, language, screen size) |
| Debt payment history | Your payments in the Application | Counting your day streak and flagging a late debt |
| Stream counter link | Created by you, if you use it | Showing your counter in broadcasting software; it reveals neither your name nor your matches |
| Exercises set aside, and since when | Your choice in the settings | Sending the debt to your other exercises; no medical reason is asked for or kept |
| Push-up variant | Your choice in the settings | Annotating your history; it changes no calculation and no reason is asked of you |
| The language you picked in the Application | Your choice in the language switcher | Writing to you in your language outside the Application: notification, email. The browser reads it on its own |
| Your device's time zone | Your browser's setting | Knowing what time it is where you are, so a reminder never arrives in the middle of the night |
| Weekly recap: on or off, and when the last one went out | Your choice in the settings | Sending you one email on Monday morning, and not sending it twice; one click turns it off |
Gender, age, weight and height, combined with the physical activity recorded, constitute health data within the meaning of Article 9 GDPR. They are used solely to set your starting level and to estimate the energy you spend. They are never sold, never passed to a third party, and never used for any other purpose. No payment information is collected. The only indication of place we keep is your device's time zone, used solely to choose when a reminder is sent: no address, no position, no city.
3. Legal Basis
Processing is based on your consent (GDPR art. 6.1.a), given when creating your account, and on the performance of the service you subscribed to (art. 6.1.b).
The health data listed in Article 2 falls under Article 9 GDPR. Its processing is based on your explicit consent (art. 9.2.a), collected separately from the rest and withdrawable at any time from your settings.
Refusing does not prevent you from using the Application: without this data, your starting level is set by the strength test alone, and the estimate of energy spent is not shown.
4. Retention Period
Your data is retained for as long as your account is active. In the event of a deletion request, all your personal data is erased within 30 days.
An account with no sign-in for two years is deleted along with all its data, after a warning email sent thirty days beforehand.
5. Data Sharing
Your data is never sold or transferred to third parties for commercial purposes. It is only shared with the technical processors necessary for the operation of the Application:
- Vercel application hosting (United States, Standard Contractual Clauses)
- Neon PostgreSQL database (United States, Standard Contractual Clauses)
- Riot Games API retrieval of public match data
- Google / Discord OAuth authentication (optional)
6. Cookies and Local Storage
The Application uses:
- An encrypted session cookie (Auth.js) to maintain your login session
- The browser's
localStoragefor your local preferences (e.g. "Stay signed in", introduction seen)
No advertising or third-party tracking cookies are used.
7. Your Rights (GDPR)
In accordance with the General Data Protection Regulation, you have the following rights:
- Right of access obtain a copy of your data
- Right to rectification correct inaccurate data
- Right to erasure request the deletion of your account and all your data
- Right to data portability receive your data in a readable format
- Right to object object to processing
- Right to withdraw consent at any time from your settings, without affecting what was processed beforehand
To exercise these rights, contact us at: evantocquet@gmail.com
In the event of an unresolved dispute, you may refer the matter to the CNIL (French Data Protection Authority) at www.cnil.fr.
8. Security
Passwords are stored irreversibly (bcrypt hashing). Communications are encrypted via HTTPS. Access to the database is restricted and authenticated.
9. Changes
This policy may be updated. The date of the last modification is shown at the top of this page. Significant changes will be flagged the next time you log in.
This policy is drawn up in French. Versions in other languages are provided for understanding; in the event of any discrepancy, the French version prevails.