Privacy policy
This page explains what data Riviera Secrète collects, why, and what you can require about it. The site works entirely without an account: creating one only lets you find your favourites and itineraries again from another device. The French version is the authoritative one.
Last updated: 18 September 2026.
Data controller
MJ, site publisher on a non-professional basis. For any request about your data: riviera-secrete@gmail.com.
What is collected and why
No data is sold, rented or passed on for advertising. The site does no profiling and makes no automated decisions about you.
| Data | When | Why | Legal basis |
|---|---|---|---|
| Email address, first name | Creating an account | Identify the account, send the confirmation email | Performance of the requested service |
| Password (BCrypt hash, never in clear text) | Email sign-up | Authenticate you | Performance of the requested service |
| Google identifier | Signing in with Google | Link your Google sign-in to your account | Performance of the requested service |
| Favourites, saved itineraries | When you create them | Give them back to you | Performance of the requested service |
| IP address | On every call to the sign-in endpoints | Limit automated attempts | Legitimate interest (security) |
| Anonymous traffic statistics | On every visit | Measure audience | Legitimate interest (cookieless analytics) |
Your location is never sent anywhere
The “Near me” button uses your browser's geolocation, which asks for your permission. The coordinates are used only to sort the list inside your browser: they are never sent to the server, never stored, and not kept once you close the tab.
Cookies and local storage
No advertising cookies, no third-party trackers. The site shows no consent banner because it only uses strictly necessary cookies, which are exempt.
- Session cookie: set only if you sign in, to keep you signed in (30 days).
- Language cookie: remembers your choice between French and English.
- Session storage: keeps an itinerary you are composing while you sign in to save it. Cleared when you close the tab.
- Offline cache: the pages, images and map tiles you view are copied into your browser so the site stays readable without a connection. This cache never leaves your device and can be cleared from your browser settings.
- Plausible analytics: no cookie, no persistent identifier, no personal data.
Who else has access
Only the technical providers strictly needed to run the site, each acting as a processor:
- Vercel Inc. (USA) — website hosting.
- Railway Corporation (USA) — API and database hosting.
- Resend (USA) — sending address-confirmation emails.
- Google Ireland Ltd. — only if you choose to sign in with Google.
- Plausible Analytics (European Union) — anonymous analytics.
How long
- Account, favourites and itineraries: kept while the account exists, deleted on request.
- Address-confirmation token: 24 hours, then erased.
- IP addresses used for abuse protection: held in memory for a few minutes, never written to the database.
- Audience statistics: aggregated, with no individual data.
Your rights
You have the right to access, rectify, erase, port, restrict and object to the processing of your data. Deleting your account also deletes your favourites and itineraries.
To exercise these rights: riviera-secrete@gmail.com. If the answer does not satisfy you, you may lodge a complaint with the CNIL (cnil.fr), 3 place de Fontenoy, 75007 Paris, France.