Privacy policy

Data controller

The publisher of WhatBox, a private individual (see the legal notice), is responsible for processing your personal data. Contact: whatbox@hdussert.com.

Data we collect

• Your email address.
• Your password, stored only as a secure hash: we can never read it.
• The content you add: box names, items, quantities and photos.
• Security data: failed sign-in attempts, temporary account locks and the time of your last password-reset request.

Why we use it

We use this data only to provide the service: creating and securing your account, storing and displaying your boxes and items, and sending password-reset emails you request. The legal basis is the performance of the service you signed up for (GDPR, art. 6(1)(b)) and, for security data, our legitimate interest in protecting accounts (art. 6(1)(f)). We don't sell your data, use it for advertising, or track you.

How long we keep it

Your account data and content are kept for as long as your account exists, and deleted when the account is deleted. Password-reset links expire after one hour.

Photos

Photos are stored with our hosting provider behind long, random links that can't be guessed. The links are not protected by your sign-in, though: anyone who has a photo's link can view it. Avoid uploading photos that show sensitive information.

Service providers

Your data is processed by the following providers, only as needed to run the service:

• Vercel Inc.: Hosting and photo storage (Vercel Blob) (United States)
• Neon Inc.: Database (European Union (Frankfurt, Germany))
• Resend Inc.: Sending password-reset emails (United States)

Transfers to the United States rely on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

Cookies

WhatBox only sets cookies that are strictly necessary, so they don't require your consent:

• auth_token: keeps you signed in (up to 30 days).
• sidebar_state: remembers whether you collapsed the sidebar.

No analytics or advertising cookies are used.

Your rights

You can delete your account and all its data at any time from your settings. You can also access, correct or export your data, and object to or restrict its processing: to exercise these rights, write to whatbox@hdussert.com. We answer within one month.

If you think your rights aren't respected, you can file a complaint with the CNIL, the French data protection authority (cnil.fr).