Privacy policy

Noa De Almeida, sole trader (EI), trading under the business name Keyforge — 173 rue de Courcelles, 75017 Paris, France.
Contact: support@keyforge.fr

This site collects only what it needs to work.

Customer account — only if you create one. With email: email address, chosen name, and a password stored in encrypted form by our authentication provider. With GitHub or Google: that service sends us your name, email address, the address of your profile picture and a technical identifier — never your password, and no access to your repositories, contacts or any other data. Builds you save are linked to your account. Legal basis: performance of the service you requested.

Partner access — if you enter through a token link, the token and its label are stored in your browser so you are not asked again. The pages you open are then recorded under that label, with their date, country and device type, so we know whether and when the invitation was viewed. Legal basis: legitimate interest in restricting access and following up the business relationship.

Anonymous audience measurement. To understand how the site is used, we record the pages opened and a few configurator steps (screen shown, product page viewed, build completed and its value at catalogue prices), with only the following information: the date, the country (derived from the connection by our host, without the IP address being kept), the device type (phone, tablet or computer), the browser language and, if you arrive from another site, its domain name. No measurement cookie, no IP address, no identifier: this data cannot recognise you from one visit to the next. Legal basis: legitimate interest in measuring the site’s traffic.

This site includes neither Google Analytics nor any other third-party statistics or advertising tool. No profiling, no resale, no transfer for commercial purposes.

Every cookie set is strictly necessary for the site to function, and therefore does not require prior consent.

• kf_preview — stores the partner access token. 30 days.
• kf_preview_label — displays the label in the preview banner. 30 days.
• kf_lang — stores the language you chose (FR / EN switch). 1 year.
• Session cookies issued by Supabase (sb- prefix) — keep you signed in if you have an account. Duration set by the provider.

You can delete them at any time from your browser. The “Exit” link in the preview banner immediately clears the first two.

• Vercel Inc. (United States) — hosting and execution.
• Supabase, Inc. (Singapore) — database and authentication.
• OVH SAS (France) — domain name and email, including the site’s emails (sign-up confirmation, forgotten password).

If you choose to sign in with GitHub, Inc. or Google LLC (United States), that service identifies you under its own privacy policy, as controller of its own processing. It is not involved if you use an email account.

Your account data is stored within the European Union: the database is located in Ireland (region eu-west-1).

The application processing, however — the code that builds the pages and refreshes your session — runs on Vercel infrastructure in the United States (Washington DC region). Your data passes through it without being stored there. This transfer is covered by the European Commission’s standard contractual clauses.

Account data is kept for as long as the account exists. You can delete it at any time from the “My account” page: the account, profile and saved builds are then erased immediately and permanently. Cookies expire after the durations listed above.

Traffic statistics, including those of partner access, are kept for 25 months and then erased. Sign-in attempts to the site’s administration area are logged with their IP address, for security purposes, for 90 days.

Under the General Data Protection Regulation, you have the right to access, rectify, erase, restrict, object to and port your data. Correcting your name and erasing your account are done directly from the “My account” page. For anything else, write to support@keyforge.fr.

You may also lodge a complaint with the CNIL, the French data protection authority, 3 place de Fontenoy, 75007 Paris — cnil.fr.