Privacy policy

Who is responsible

Belouar-Pruvot Mathis, Sainte Geneviève des Bois, is the controller of the personal data of NiceTiming Cloud. Contact: contact@filarr.com.

The VS Code extension keeps your data on your computer. Nothing reaches the Cloud unless you connect the extension to it.

What the Cloud keeps

Your account: email address, display name, time zone and preferences; your password only as a salted scrypt hash; your sessions and API tokens only as SHA-256 hashes, with the browser name of each session.

What the extension syncs: activity records (the time, the project, the file’s path in the project unless you hide file names, the language, the branch, the task, the category, tags, line counts, whether an agent worked, the computer’s random id), the numbers of AI usage (tokens, cost, model, agent, project: never the text of a request), your edits (entries, projects’ settings, rates, clients) and the facts of the island’s journal. With the “game only” scope, only times, kinds of activity and project keys that do not reveal names.

The island and the game online: its state and the log of every action the server ran for it, your teams and what you share with them, the messages in bottles you send or receive, your published island if you publish it.

Fair play: when your synced data arrived, and patterns no person produces. For referrals and contest votes, a keyed hash of the network, never the address itself. Addresses stay in memory for the rate limits, for a few minutes.

Billing: your Stripe customer id, your subscriptions and purchases with their dates and status, your trial, the computers that sync (their random ids and last sync). Card details go to Stripe and never reach NiceTiming.

Why

To provide the service you asked for (the contract, article 6(1)(b) of the GDPR); to keep accounting records (a legal obligation, article 6(1)(c)); to protect the service and keep the game fair (a legitimate interest, article 6(1)(f)).

There are no analytics, no advertising and no third-party scripts on the site. Two cookies only: the session (to stay signed in) and the language. They are needed for the site to work, so no consent is asked.

How long

Account data and synced data: until you delete them, or delete the account. Sessions: 30 days after the last visit. Billing records: 10 years, as French accounting law requires (Commercial Code, article L123-22), kept apart and used for nothing else.

When you delete your account, everything else is deleted at once. Backups of the server are overwritten within 30 days.

Where, and who else

The data is stored by the host, Belouar-Pruvot Mathis.

The site is reached through Cloudflare (Cloudflare, Inc., United States), which serves its domain name, carries its connections and protects it from attacks: your IP address and each request, with its headers, pass through Cloudflare’s network on their way to the server and back. Cloudflare handles them for that purpose, under its own privacy policy; some of this can take place outside the European Union, under the EU-US Data Privacy Framework and standard contractual clauses.

Stripe processes payments (Stripe Payments Europe, Ireland), under its own privacy policy; some processing can take place in the United States under the EU-US Data Privacy Framework and standard contractual clauses.

If you choose to support NiceTiming on GitHub Sponsors, GitHub handles that under its own terms.

Your rights

You can access, correct, download (Settings, Download my data) and delete your data, and ask for its processing to be limited or object to it, by writing to contact@filarr.com. You can complain to the CNIL (cnil.fr), the French data protection authority.

Security

Passwords and tokens are stored hashed, connections are encrypted (HTTPS), and every change to an account is checked against cross-site requests.