Privacy

Who is responsible?

Baptiste DUBOC-FIORIN, the individual publisher and administrator of Papyrus, is the data controller. Contact: support@getpapyrus.eu.

This information covers the getpapyrus.fr and getpapyrus.eu websites and the app.getpapyrus.eu platform. Papyrus is a free personal project, without advertising or a paid subscription.

The data we use

• Account: email address, optional first name or nickname, a password verification hash, and dates of creation, verification and sign-in. An email address and password are required to create an account.
• Saved work: notes, passages, links, time markers, places and coordinates, versions and preferences. Any older timelines and images belonging to the same account remain separate from the Papyrus vault.
• Support: messages you send, and, when you use a feedback form, its category, account identifier and any reply address provided.
• Operation: sessions, IP address during connections, temporary abuse-prevention counters, and technical information about errors and requests needed to operate the service.
• Voluntary support: contributions take place through Revolut. The recipient may see the amount, date, reference and, depending on the payment, your identity, contact details or a message.

Why is this data used?

Managing your account and storing your work are necessary to provide the service you request. Support, security and the handling of voluntary contributions rely on the legitimate interest in operating and protecting the project. Data is not used for advertising profiling, and no automated decision with legal effects on you is made.

The public website does not require an account and does not install advertising or audience-measurement tools. Loading a page still sends technical information to the server providing it. The platform uses the cookies and local copies described on the dedicated page.

Who can access it?

Your notes and older account timelines are not published or accessible to other accounts. The administrator may access data for support and service operation. Content is not end-to-end encrypted.

Providers perform the tasks described below. External links open at your request. An authorised external image in an older timeline may contact its host when displayed; this is separate from the locally hosted website assets.

Hosting and providers

• OVHcloud: the main server is in the United Kingdom; application backups are encrypted before being sent to storage in Paris, France; OVHcloud also provides support email. The location of email and email backups is not inferred from the application server’s location.
• Brevo: sends email verification, account recovery and messages submitted through the feedback form. It handles recipients, message content and delivery information. These functions do not send your notes vault.
• Healthchecks.io: receives server and backup status signals and the sending server’s IP address. The checks do not send users’ notes, email addresses or messages.
• Revolut: payments take place on its website after you follow a support link. Papyrus does not automatically load a payment component, or add your account address or notes to the link. Payments are subject to Revolut’s privacy notice.

Fonts, icons and map backgrounds provided by Papyrus are served by Papyrus. Loading them does not contact Google Fonts or unpkg.

Where data is processed

The United Kingdom is outside the European Economic Area. It benefits from a European Commission adequacy decision. Provider operations may extend beyond the server and backup locations stated here. You can ask support for the available information on recipients, processing locations and applicable safeguards. These checks remain part of the service’s ongoing review; exclusively French hosting is not promised.

How long is it kept?

Security counters are temporary: sign-in limits use 15-minute windows, and feedback limits use one hour. Expired sessions are cleared periodically. Brevo is configured not to track opens or clicks without recorded consent; Papyrus does not collect that consent.

Deletion, images and backups

Deleting an account closes access and removes its Papyrus notes and older timelines from the active service. Removing an image from an older entry does not automatically remove the file: archives, undo history or drafts may still need it. Images and their metadata are included in account deletion; failed clean-up is retried.

Backups retain all copies for 30 days, followed by 7 daily, 4 weekly and 6 monthly reference copies. The last copy in each group and protected copies may remain longer. There is no guarantee that every backup copy disappears after six months.

A private erasure register keeps the internal identifier, account creation date and erasure request date to prevent reintroduction during restoration. It contains no email address, password or note content. Image references remain until clean-up. Markers remain necessary while backups could restore the account, with no current automatic purge. A request made after the last recoverable copy of the register may need to be repeated.

Account deletion does not remotely remove exported files, all browser copies, support correspondence immediately or Revolut transactions. Those records follow their own retention criteria.

Your rights and requests

You can request access, correction, erasure and, subject to the GDPR’s conditions, portability or restriction. You can object, on grounds relating to your situation, to processing based on legitimate interests.

Email support@getpapyrus.eu, preferably from the account address, and explain your request. Proportionate identity checks may be necessary. We respond within one month; complex or numerous requests may require up to two additional months, with reasons provided during the first month.

You may also lodge a complaint with the CNIL. The “Your data and rights” page explains how available exports differ from a full access request.