Privacy policy

This English version is provided for convenience. The French text, available through the language switch above, is the reference.

Chicane has no accounts, no advertising and no audience measurement, and places no tracker on its visitors' devices. This page describes the only data it processes: what running a website requires, and what you choose to publish.

Controller

The controller is the publisher of the site, a natural person publishing it in a non-professional capacity. As French law allows a non-professional publisher (see the legal notice), their identity is not published: it is held by the hosting provider.

For any question about your data, or to exercise your rights, write to: contact@chicane3d.com.

In short

No cookie for visitors. The site's only cookie serves the administration page.
No audience measurement, no advertising, no social network button, no font or script loaded from another site.
Your IP address appears in the server's technical logs, and as a salted hash in the counters that limit abuse.
What you choose to publish — a shared comparison, a reading, a 3D model — is visible to other visitors.
Your preferences and history stay in your browser.

Each processing operation

The retention periods below are enforced by a daily clean-up on the server, which deletes whatever has exceeded its own.

Web server logs

Data: For each request: the IP address, date and time, requested address, the response (status, size, duration) and the headers sent by the browser, including its identification ("User-Agent"), the page the visitor came from ("Referer") and the accepted languages. Cookies and authentication credentials are masked. Error messages from the server's programs follow the same rule.
Purpose: Routing requests, diagnosing failures, detecting and countering abuse.
Legal basis: The publisher's legitimate interest in running and securing the site (Article 6(1)(f) GDPR).
Retention: 30 days at most: the server's system journal deletes every day whatever has exceeded that period, and never grows beyond 1 GB.

Application log

Data: Dated events: comparison saved (with its code), reading proposed (car, measurement, value, source), 3D model accepted or rejected, error (with the requested address), administration login — with, on failure, a salted hash of the IP address. No IP address in clear.
Purpose: Diagnosing failures and spotting intrusion attempts.
Legal basis: The publisher's legitimate interest in running and securing the site.
Retention: 30 days at most: the daily clean-up removes older lines. The log is also capped at 2 MB, plus one archive of the same size, which may shorten it further.

Upload and attempt limits

Data: A hash of your IP address, computed with a secret salt specific to the server (SHA-256, truncated), a counter and the start of the counted period. The address itself is never written.
Purpose: Limiting how many 3D models, comparisons and readings one address can submit per hour, and how many password attempts can be made on the administration.
Legal basis: The publisher's legitimate interest in protecting the service against abuse.
Retention: Counters older than 24 hours are deleted by the daily clean-up.

Shared comparisons

Data: When you click "Share", the server saves the comparison under a short code: the test, the cars and their settings, the test conditions, the colours, and the title you may give it. It counts how often it is opened and records the date of the last opening. Nothing links the comparison to you; only the free-text title could contain personal data, if you write some.
Purpose: Reopening the comparison for anyone who receives the link.
Legal basis: The publisher's legitimate interest in providing the sharing you ask for.
Recipients: Anyone holding the /c/… link.
Retention: A comparison nobody has opened for 24 months is deleted by the daily clean-up; each opening postpones that deadline. You can also ask for its deletion by giving its code.

Shared 3D models

Data: The file as you send it, with any metadata it contains (name of its author, of the software that produced it); a label taken from the file name; the associated category and car; the credit, if you give it (author, licence, original address); the upload date; the file's check report (number of triangles, producing software); and a salted hash of your IP address and of your browser's identification.
Purpose: Making the model available to visitors, naming its author as its licence requires. A model sent by a visitor is only visible to others once the administrator has approved it: until then, its file is kept apart, out of public reach, and a rejection deletes it. The hash lets you remove your upload yourself, without an account, from the same connection and browser.
Legal basis: The publisher's legitimate interest in publishing the models offered while respecting their licences. The name of the credited author, when it is not you, comes from the information you provide when uploading the model.
Recipients: The administrator, for a model awaiting approval; all visitors, once the model is approved: the list of published models, with their credit, is public.
Retention: Until the model is deleted, by you, by the administrator or on request; a rejected model is deleted at once. The uploader's hash is deleted 30 days after the upload by the daily clean-up: after that, only the administrator can remove the model, at your request.

Proposed readings

Data: The car, the measurement, the value, the source (title, issue or date, page address), the test date, and a pseudonym if you give one. No email address, no IP address: the hourly limit is counted as described above.
Purpose: Enriching the catalogue with real measurements cited with their source, and letting you follow the review of your reading.
Legal basis: The publisher's legitimate interest in building a base of verifiable measurements.
Recipients: Accepted readings and their pseudonym are public. The status of a reading, including the reason for a rejection, can be read by anyone who knows its identifier.
Retention: An accepted reading lives as long as the value it brought to the catalogue. A rejected reading is deleted 90 days after the decision, by the daily clean-up. Deleting a car deletes its readings.

Administration

Data: The site's only cookie, chicane_admin, is set by the administration page and by it alone. It carries a random session identifier; the server associates with it a token against request forgery and, once the administrator is logged in, a salted hash of the browser's identification and the time of the last activity.
Purpose: Authenticating the administrator and protecting their forms.
Legal basis: The publisher's legitimate interest in securing the administration.
Retention: The cookie disappears when the browser is closed. The session expires after 120 minutes of inactivity or at logout, and its data is removed by the server's periodic clean-up.

What stays in your browser

The site keeps in your browser's storage ("localStorage" and "IndexedDB"): your preferences (test, display quality, theme, language, sound, test conditions, chosen cars, video export settings), the contents of your garage, the history of your comparisons, the list of readings proposed from this browser, to follow their review, and the 3D models you imported there.

This data is not sent to the server, except what you choose to share, and only serves to find your work again from one visit to the next. You can delete it entry by entry in the "History" window, or entirely through your browser settings (site data).

Backups

Data: Every night, the database (comparisons, readings, 3D model records and their hashes, current counters), the 3D model files and the server configuration are copied, encrypted, then sent to a storage space separate from the server. Logs are not included.
Purpose: Restoring the site after a failure, a mistake or an attack.
Legal basis: The publisher's legitimate interest in preserving the service.
Retention: One backup per day is kept 7 days, one per week 4 weeks, one per month 6 months: data deleted from the site may therefore remain for up to 6 months in a backup, which is only opened for a restoration. Before each software update, a copy of the database and files is also kept on the server; only the last 10 are kept, none older than 90 days.

Cookies and other trackers

French law requires your consent before reading from or writing to your device, except when this is strictly necessary for the service you ask for (Article 82 of Act No. 78-17 of 6 January 1978, the "Informatique et Libertés" Act). That is the case here:

the chicane_admin cookie serves the authentication and security of the administration;
local storage keeps your interface settings and the work you do in the application; it is only read by the page, on your device, and is never transmitted.

The site places no audience measurement, advertising or social network tracker. That is why it asks for no consent and shows no banner. The security policy of its pages also forbids the browser from contacting another site to display them.

What the site does not do

It does not sell, rent or hand over any data, and shows no advertising.
It calls no other site from your browser: no font, script, image or measurement. A link to another site (source of a reading, credit of a model) only opens if you follow it, and then only passes on the name of the originating site, not the page.
It takes no automated decision about you: the automatic review of a reading compares a value with the simulation, it does not judge a person.

Recipients and processors

The publisher, who alone administers the site.
The hosting provider, OVH SAS, which provides the server and acts as a processor (Article 28 GDPR).
The public, for what you choose to publish, as described above.
The authorities, upon a lawful request in the cases provided for by law.

Hosting location and transfers

Location of the site's servers: Beauharnois (Québec), Canada.

Canada is outside the European Union. It benefits from an adequacy decision of the European Commission (Decision 2002/2/EC of 20 December 2001), which recognises an adequate level of protection for data transferred to organisations subject to the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA). Article 45(9) of the GDPR keeps it in force, and the Commission confirmed it in its review published on 15 January 2024. The transfer relies on that decision.

Your rights

You can ask for access to your data, its rectification, its erasure or the restriction of its processing (Articles 15 to 18 GDPR), and object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Article 21). The right to data portability does not apply here, as no processing relies on your consent or on a contract. You can also set out instructions regarding your data after your death (Article 85 of the Informatique et Libertés Act).

Write to contact@chicane3d.com. The site does not know who you are: for it to find your data, give the comparison code, the car, measurement, value and date of the reading, or the name and upload date of the model. For logs, give the IP address and period concerned; without these, the publisher may be unable to identify you (Article 11 GDPR). You will receive an answer within one month (Article 12).

If you consider that your rights are not respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr/fr/plaintes.

Security

Exchanges with the site are encrypted (HTTPS); its pages only run its own scripts; IP addresses are only kept, outside the web server logs, as salted hashes; the administration password is only stored as a hash; backups are encrypted before leaving the server.

Changes

This policy follows the software: it changes when the software changes what it processes. The date of the last update appears at the bottom of the page.