1. Data controller
The data controller is Matteo TUTTI, Valentino ZARRILLO, Matthias YILDIRIM, Antoine MALGAT, publisher of https://flick.d3l.tech. For any question about your data, write to matteo.tutti@epitech.eu.
No data protection officer has been appointed: the nature and volume of the processing carried out do not require one.
2. What we do not do
- no advertising tracker and no advertising;
- no third-party analytics tool;
- no sale, rental or sharing of your data for commercial purposes;
- no profiling and no automated decision producing legal effects for you;
- no account required to send or receive a file.
We ask for neither your real name, nor your phone number, nor your postal address, nor any payment method, the service being free. We do not use geolocation and do not enrich your data from any external source.
3. Data processed, purposes and retention
- Files and metadata
- Name, size, type, Code, integrity checksum, expiry date, remaining download count and optional message. Purpose: carry out the requested transfer. Legal basis: performance of the contract, article 6.1.b GDPR. Retention: until expiry, that is 15 minutes by default and 4 hours at most, or until the last allowed download.
- Transfer password
- Purpose: restrict downloading to whoever knows the password. Legal basis: performance of the contract. Retention: only as an Argon2id hash, erased along with the Transfer. The password is never stored in clear text.
- Account
- Username, email address, Argon2id hash of the password, role and creation date. Purpose: authenticate the user and give access to the history of their shares. Legal basis: performance of the contract. Retention: until the account is deleted.
- Session
- Session token and expiry date, kept server-side, with a copy in your browser's local storage. Purpose: keep you signed in between visits. Legal basis: performance of the contract. Retention: 7 days at most, or until you sign out.
- Sender identifier
- Random identifier generated by your browser or command line client when you upload without an account. Purpose: attach a Transfer to its sender so quotas can be applied. Legal basis: legitimate interest in protecting the Service against abuse. Retention: in your browser until local storage is cleared, and server-side for the duration of the Transfer.
- IP address
- Purpose: route requests to the server and, when rate limiting is enabled, cap abusive uploads. Legal basis: legitimate interest in the security and availability of the Service. Retention: the IP address is processed transiently, for the duration of the request. No access log is configured on the server and the IP address is stored neither in the database nor in a Transfer's metadata.
- Messages you send us
- Email address and content of your reports or requests. Purpose: handle your request and keep a record of it. Legal basis: legitimate interest in replying and documenting reports. Retention: 12 months.
5. Security
Traffic to the Service is encrypted in transit with TLS. Account and Transfer passwords are stored as Argon2id hashes. Transfers expire and are deleted automatically, which mechanically shortens the exposure window. The source code is public and can be audited at https://github.com/Flick-Corp/flick.
To be clear: uploads made from the browser are not end-to-end encrypted, the server handles the file in clear text in order to store it. If you need the server to never be able to read your file, use the command line client with the --encrypt option.
6. Recipients and location
Your data is never sold, rented or passed to third parties for commercial purposes.
The Service runs on a server the publishers administer themselves, with no third-party storage service and no public cloud. TekitUp provides network connectivity and IP addressing: that provider carries the traffic and does not access stored content.
Data is hosted within the European Union. No data is transferred outside the European Union.
It may be disclosed to judicial or administrative authorities where the law requires it.
7. Your rights
Under the conditions set out in the GDPR, you have the rights of access, rectification, erasure, restriction of processing, objection and portability, as well as the right to give directions on what happens to your data after your death.
To exercise them, write to matteo.tutti@epitech.eu, ideally from the address linked to your account. We reply within one month, extendable by two months for complex requests. Proof of identity may be requested where there is reasonable doubt about who is asking.
Transfers sent without an account are not linked to any identity. Without the matching Code, we have no way to find a file you may have sent, which limits in practice the exercise of rights over that data. A Transfer whose Code you give us, on the other hand, is deleted immediately.
You may also lodge a complaint with the French data protection authority, Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, https://www.cnil.fr.
8. Deleting your data
A Transfer can be deleted before it expires by sending us its Code at matteo.tutti@epitech.eu. Otherwise it disappears on its own once the chosen expiry is reached.
Account deletion is requested at the same address: it erases the username, the email address, the password hash and the associated sessions.
9. Minors
The Service is not intended for people under fifteen without the agreement of a parent or guardian. If you notice an account created in those circumstances, report it to matteo.tutti@epitech.eu so it can be deleted.
10. Self-hosted instances
This policy covers only the public instance at flick.d3l.tech. When Flick is installed on a third party's infrastructure, whoever operates that instance becomes the data controller and sets its own retention and security rules.
11. Changes to this policy
This policy may be updated to reflect changes to the Service or to the applicable regulations. The date of the last update appears at the top of this page and, for a substantial change, a notice is published on the site.
The French version of this document prevails. The English translation is provided for information only.