Privacy policy

1. Data controller

cybersecu.app is published in a personal capacity by Mountaga Diallo, a private individual, who is the controller of your data. For any question about this policy or your personal data, write to mmountagad1@gmail.com.

2. Data we collect

We apply a data-minimisation principle: we only collect what the service needs to work.

No account is needed to use the service. An anonymous session identifier, random and not linked to your identity, is stored in a technical cookie to count your free simulations and keep your progress on this device.

• Anonymous session: a randomly generated identifier, stored in a signed technical cookie. It contains no name, no email and no IP address.
• Training history: for each simulation played, the simulation, the choice selected, whether it was correct, and the related error categories (for example « responded to urgency »). We never store free text you may have typed.
• Payment: if you unlock full access (€29, one-off payment), the payment is handled entirely by Stripe — we neither receive nor store your card details. Stripe collects your email address at checkout; we only keep a cryptographic fingerprint (hash) of it, which cannot be reversed and is used solely to restore your access if you change device (see « Restore my access »).
• Optional account: if you choose to create an account (an optional feature, not required to use the service), we collect your email address and a hashed password, managed by our authentication provider (Supabase Auth).
• Technical cookies: only cookies the service needs to work (anonymous session). No advertising or third-party tracking cookie is set at this time.

The simulations themselves (reconstructed text messages, emails and fraudulent sites) are entirely fictional educational content that we create — never real messages you received.

3. Why we use this data

• To run the simulations and count your 10 free simulations.
• To process your payment and give you access to the unlocked simulations.
• To let you restore your access on another device, without a password, through a link sent by email.
• To keep the service secure (abuse detection, administrator audit log).
• To improve the educational content from aggregated, anonymised statistics.

4. Legal basis

Processing of your session and training data is based on the performance of the contract between us (the terms of use you accepted) and, for payment, on the performance of the sale. Aggregated statistics are based on our legitimate interest in improving the service.

5. Hosting and processors

Your data is hosted by Supabase (database), the application is served by Vercel, payments are processed by Stripe, and the access-restore email is sent through Resend. These providers act as processors within the meaning of the GDPR and do not use your data for any purpose of their own.

6. Retention

Your anonymous session and training history are kept for as long as they are useful to the service. The fingerprint (hash) of your email is kept only while an active access is linked to it. Restore links expire automatically after 30 minutes and can be deleted on request.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data. You can:

• Clear your browser cookies to end your anonymous session.
• Write to mmountagad1@gmail.com for any request about your data.
• Lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), if you believe your rights are not respected.

8. Minors

The service is intended for the general public, including older people and families. A purchase (€29) by a minor under 15 requires the consent of a holder of parental authority, in accordance with French law.

9. Changes to this policy

We may update this policy to reflect changes to the service or to the regulations. The date of the last update appears at the top of this page.