Privacy policy
In short. This service processes only what is strictly needed for authentication, plus an optional audience measurement that starts only if you accept it.
Data controller
QDNA. Contact: contact@qdna.fr.
Account and authentication
The service stores your username and a fingerprint of your password, derived with PBKDF2 using a salt and 100 000 iterations. The password itself is never stored. The legal basis is the performance of the service you are accessing.
Session cookie
Signing in sets a session cookie, flagged HttpOnly, Secure and SameSite=Lax. Its only purpose is to keep you signed in: it is a cookie strictly necessary for the service you request, exempt from consent under article 82 of the French Data Protection Act (loi Informatique et Libertés). It is removed when you sign out.
Display preferences
Your language (mmr_lang cookie, set when you sign in, and mmr_lang key in local storage) and your light or dark theme (mmr_theme key in local storage) are kept in your browser only, to display the service according to your choices. They contain no identifier and are exempt from consent (strictly technical purpose requested by you).
Audience measurement
Nothing is read from or written to your device. Checked on the actual rendering on 5 September 2026: the Cloudflare Web Analytics beacon leaves no cookie, no local storage entry and no session storage entry. Article 82 of the French Data Protection Act covers only reading from or writing into terminal equipment, so it does not apply here, and no banner is imposed on you. The legal basis is legitimate interest, under article 6(1)(f) of the GDPR: knowing how the pages are visited so we can maintain them.
The beacon collects, through your browser's Performance API, the country, the domain name, the path, the referring page, the device type, the browser, the operating system and loading times. Without cookies and without any identifier allowing you to be tracked from one site to another. The recipient is Cloudflare, Inc., established in the United States, acting as a processor. The transfer to the United States relies on the European Commission's standard contractual clauses and on Cloudflare's certification under the EU-US Data Privacy Framework, verified at the source on 1 September 2026.
Objecting, at any time. Article 21 of the GDPR lets you object to processing based on legitimate interest. Write to contact@qdna.fr and we stop counting you. A content blocker also prevents the beacon from loading.
Retention
Account data is kept as long as the account exists. No traffic data is kept on our side: we consult the totals Cloudflare aggregates.
Your rights
You have the right of access, rectification, erasure, objection and portability, exercised by writing to contact@qdna.fr. You may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL, the French data protection authority).