ppiquel

Piquel

Privacy policy

Last updated 3 November 2026.

This policy explains what Piquel knows about you, why, and for how long. It covers the sign-in service at auth.piquel.fr, with its account settings and developer console, the website piquel.fr, and the emails Piquel sends.

The short version

  • We keep only what Piquel needs to sign you in and to keep your account safe. Nothing else.
  • We never sell your data, show you ads, track you across websites, or use your data for anything other than running Piquel.
  • Your data is stored in France. A few trusted services help us send emails and deliver the website, and only get what that job needs.
  • You can see, download and delete your data yourself, at any time, from your account settings.
  • Piquel's code is public, so you can check how your data is handled for yourself.

1. Who runs Piquel

Piquel is a personal, non-commercial project, run by an individual developer in France. Write to [email protected] about anything in this policy, or to exercise your rights.

As French law allows for a non-professional publisher, the developer's identity is held by our host instead of being published here: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, +33 9 72 10 10 07.

2. What we keep, and why

  • Your account: your username, which Piquel calls your handle, and your display name. Your handle is public: apps you sign in to see it, and anyone can find out whether a handle is taken. Handles you stop using stay reserved, so nobody can take them to pretend to be you.
  • Your email addresses, and which ones you have confirmed. We use them only to send you security alerts, confirmation links and account recovery links. An address you don't confirm is removed from your account after a day.
  • Your passkeys: the public half of each passkey, which lets us check that a sign-in really comes from it, the name you gave it, sometimes the model of device or password manager that holds it, and when it was added and last used. The secret half never leaves your device, and we never see your fingerprint, your face or your device's PIN.
  • Your signed-in devices: for each one, when and how it signed in, when it was last used, its IP address, and the type of browser and system, such as "Firefox on Linux". You see the list in your settings, and can sign any device out.
  • Your security history: a record of sign-ins and of changes to your account, such as a passkey added or removed, with the IP address and browser they came from. It lets you spot anything you didn't do. If an administrator ever changes something on your account, the history says so.
  • GitHub and Google, only if you choose to sign in with them. They tell us your account number there, your name and your email addresses. We keep only the account number and your main confirmed email, to recognise you next time. We don't look at anything else in your GitHub or Google account.
  • Apps you use with Piquel: which apps you allowed, and what each may see.
  • Account recovery: if you ever lose all your passkeys and we help you back in, when that happened and which passkey it added.
  • Apps you register as a developer: each app's name, web addresses and settings.
  • Protection against attacks: to stop someone from guessing their way in, flooding Piquel or flooding an inbox, we briefly count requests by IP address, by account and by email address. The counts are stored in a scrambled form, used for nothing else, and deleted within about an hour.
  • Service logs: which pages are requested, how long they take, which errors happen, and, when an account changes, a number identifying that account, so we can keep Piquel working and fix problems. We don't put your IP address, name or email address in them.

We never ask for your birth date, phone number, postal address or payment details. The links we email you, and what keeps you signed in, are stored in a form that can't be reused even by someone who reads our database.

3. What we never do

  • Sell, rent or trade your data.
  • Show ads, or let anyone else show ads through Piquel.
  • Use analytics, trackers, or third-party cookies.
  • Build a profile of you, or use your data to train AI.
  • Send you newsletters or marketing emails.

4. Cookies

Piquel only uses the cookies it needs to work, so it doesn't ask you to accept them. They are set by auth.piquel.fr, and can't be read by other websites or by scripts. piquel.fr sets none.

  • One cookie keeps you signed in, for up to 30 days.
  • A few cookies remember a sign-in in progress, such as a GitHub or Google sign-in, for up to 10 minutes.
  • One cookie shows a message on the next page, such as "Passkey added", for up to a minute.

5. Why we're allowed to use your data

  • To give you the service you asked for: your account, signing you in to the apps you choose, and the emails your account needs.
  • To keep Piquel secure, which is in your interest and ours: preventing attacks and misuse, and keeping a record of changes to your account that can't be secretly altered.
  • When the law requires it.

6. What apps you sign in to receive

When you sign in to an app with Piquel, you see what it asks for and approve it, unless the app is one of Piquel's own. It gets only what you approve:

  • Always: an identifier for your account, which is the same for every app, an identifier for this sign-in, and when and how you signed in.
  • If it asks: your handle and display name.
  • If it asks: your confirmed email address.
  • If it asks: permission to keep you signed in.

When you sign out, the apps you signed in to may be told, so they sign you out too. Once an app has your data, its own privacy policy applies. You can remove an app's access at any time in Settings → Connected apps.

7. Who else handles your data

  • OVHcloud (France) rents us the servers Piquel runs on, in its Strasbourg data centre. Your account data, and our logs, are stored there.
  • Resend (United States) sends our emails, so it receives your email address and the message.
  • Cloudflare (United States) delivers Piquel's pages and protects them from attacks, so your requests and IP address pass through it.
  • GitHub and Google (United States), only if you sign in with them: as when you use them anywhere else, they know you signed in to Piquel.
  • Piquel's administrator, currently only the developer who runs Piquel, can look at an account to help its owner or to stop misuse. Opening an account's details, and every change, is recorded in its security history, and an administrator can never add a passkey, a linked account or an email address to your account.
  • Authorities, only when the law requires it.

Resend, Cloudflare, GitHub and Google may handle data in the United States. Each is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as protecting your data, and also uses the European Commission's standard contractual clauses.

8. How long we keep it

  • Your account, with its email addresses, passkeys, linked accounts and allowed apps: until you delete it. Passkeys and linked accounts you remove stay listed as removed, so your security history still makes sense.
  • Signed-in devices: a device stays signed in for up to 30 days, or until you sign it out. Its record, with its IP address, is deleted soon after: usually within a day or two, and at most about a month later if an app was keeping you signed in.
  • Security history: the IP address, browser and other details of each entry, such as an email address you added, for 90 days. After that, only what happened, when, and to which account is kept.
  • Our record of emails we sent: 7 days, or 30 days if sending failed.
  • Sign-ins in progress and attack counters: from a few minutes to a day.
  • Service logs: up to 30 days.
  • Database backups, kept so Piquel can recover from a failure: data you delete disappears from them as they are replaced.

9. Your rights

You can, at any time:

  • Download your account's data and its security history, in Settings → Your data.
  • Correct it: change your handle, add or remove email addresses and passkeys, and unlink GitHub or Google in your settings. Write to us for anything else.
  • Delete your account, in Settings → Your data. You are signed out of Piquel everywhere at once, and apps you use lose access within minutes. The account is erased for good 30 days later; until then, you can sign in with a passkey and choose to restore it. What remains: your old handles, reserved so nobody can impersonate you; a record that events happened, with your account's number but no other personal details; any apps you registered, reduced to their identifier and settings, without their name or web addresses, so their identifiers are never reused; and, until they expire, service logs and database backups.
  • Object to how we use your data, or ask us to limit it.

Write to [email protected] for any of these. We answer within a month. If you're not satisfied, you can complain to the French data protection authority, the CNIL, or the one where you live.

10. Security

Passkeys can't be phished, guessed or reused on another website. Everything travels encrypted over HTTPS, our signing keys are encrypted, and every change to an account is kept in a record that can't be secretly altered. If your data is ever affected by a breach, we will tell you, and the CNIL, as the law requires.

11. Children

You must be at least 15 to create a Piquel account. If you believe a child under 15 has an account, write to us and we will delete it.

12. See for yourself

Piquel's source code is public at github.com/piquel-fr/piquel-fr. If you want to understand exactly how your data is handled, you can read it there, or ask us.

13. Changes

If this policy changes, we will post the new version here with its date, and email account holders before any important change takes effect.

14. Contact

[email protected]