Privacy policy, ChastiTime

1. Data collected

We collect only the data necessary for the service to work:

Account data: username, email address (encrypted in the database via AES-256)
Profile data: BDSM role, experience level, vocabulary level (stored in the clear)
Sensitive data: sexual orientation, journal notes (encrypted server-side)
Technical data: hash of IP address at sign-up (for security), login logs

Interests (step 3 of onboarding) are stored only in your browser (localStorage) and never sent to our servers.

2. Encryption of sensitive data

Data classified as sensitive under the GDPR (article 9), notably sexual orientation, is encrypted via AES-256 before any write to the database. The encryption key is separate from the database and your explicit consent is collected before any collection of this data.

3. Legal basis for processing

Performance of the contract: data necessary for the service to work (email, username)
Explicit consent: sensitive data (sexual orientation)
Legitimate interest: security (logs, IP hash)

4. Retention period

Your data is kept for the entire duration of your active account. In the event of account deletion, your identifying and sensitive data (email, sexual orientation, free text) is immediately erased and your username is replaced by an anonymous identifier. Residual data is permanently purged within 30 days, with the exception of contributions to shared spaces, kept in anonymized form in order to preserve the history of other members. Security logs are kept for 12 months.

5. Your rights

In accordance with the GDPR, you have the following rights:

Right of access to your data
Right to rectification
Right to erasure ("right to be forgotten")
Right to portability (export in JSON format)
Right to withdraw consent at any time
Right to lodge a complaint with the CNIL

To exercise these rights: rgpd@chastitime.fr

6. Cookies

ChastiTime uses only session cookies necessary for operation (authentication, CSRF). No tracking or advertising cookie is used.

7. Data transfer

Your data is hosted in the European Union and is never transferred outside the EU. It is never sold, rented or shared with third parties for commercial purposes.