Legal notice
Publisher and director of publication: Nicolas Gresset-Bourgeois, private individual, Toulouse, France — nicolas@gresset-bourgeois.fr.
Host: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States — vercel.com.
Source code
For transparency, the whole tool is open source: github.com/NicolasGresset/rendez-vous. The code is under the MIT licence, the places database under the ODbL. Everything described below can be checked there: what the page sends, and to whom.
Privacy in short
- No account, no cookies, no analytics, no tracking, no advertising.
- The tool keeps nothing you type or choose: the computation runs in your browser.
- Your browser contacts other services to get addresses, maps and travel times, listed below with what they receive.
Hosting
Vercel serves the pages. Like any web server, it receives your IP address, the address of the page requested, your browser's description (user agent) and the page you came from, and keeps them in its logs to run and protect the service, under its privacy policy. Vercel is in the United States and relies on the EU-U.S. Data Privacy Framework. The fonts, the map library and the places database are served by the tool itself, not by third parties.
Third-party services contacted by your browser
Each of these services receives, like any website, your IP address and your browser's description, plus what is listed, and processes them under its own privacy policy.
-
OpenStreetMap (OpenStreetMap Foundation, United Kingdom),
tile.openstreetmap.org: the map images, hence the area you look at. -
IGN Géoplateforme (Institut national de l'information géographique et
forestière, France),
data.geopf.fr: what you type in an address field (from 3 characters), and your position when you click « ma position actuelle », to find its address. -
openrouteservice (HeiGIT gGmbH, Germany),
api.openrouteservice.org: the positions of the participants and of the candidate places, to get walking, cycling and driving times and paths, with the API key you entered. -
Transitous (community project, transitous.org),
api.transitous.org: the same positions with the arrival date and time slot, to get public transport journeys (default choice). -
Tisséo (Toulouse public transport, France),
api.tisseo.fr: only if you enter a Tisséo key and choose Tisséo, the same positions and times with your key, instead of Transitous.
The addresses you enter may be other people's: they go to these services as described, so a nearby landmark (a metro station, a square) works as well as an exact home address. The OpenStreetMap and Google Maps links of a proposed place send nothing until you follow them; « Partager le lieu » hands the place's name, address and OpenStreetMap link to your device's share menu or clipboard, not to this site. Links to other sites (GitHub, the author's site…) send nothing until you follow them.
Cookies and local storage
The tool sets no cookies, so there is no consent banner. It stores the API keys you enter and its settings (view, criterion, number of places, transit engine) in your browser's local storage, on your device only: each key is sent to its own service, never to this site, and the settings are sent nowhere. « Effacer les clés » removes the keys, clearing your browser data removes both. This storage only serves features you ask for, which exempts it from consent (article 82 of the French Data Protection Act). Your position is only read when you click « ma position actuelle », after your browser asks your permission.
Your rights
These transfers rest on the legitimate interest of running the tool and providing the features you use (article 6(1)(f) of the GDPR). The GDPR gives you rights over data about you (access, rectification, erasure, restriction, objection); here is where such data actually is:
- With me: nothing, unless you write to me. The tool has no server of its own, no database, no accounts and no logs. If you send me an email, I keep it as long as our exchange needs it, and delete it if you ask.
- With the host: Vercel's logs, kept and deleted under its own policy. I cannot read them by visitor; you can write to Vercel at privacy@vercel.com, or ask me to pass your request on.
- With the third-party services listed above: each answers for what it receives, under its own privacy policy; write to it directly.
Contact: nicolas@gresset-bourgeois.fr. You may also lodge a complaint with the French data protection authority, the CNIL.