Privacy Policy

1. Who is responsible

ChocoLOCK is a cybersecurity awareness site. The site publisher is the controller for the data described here. For any question or request, write to contact@chocolock.fr.

The site uses no audience measurement tool: no Google Analytics, no Plausible, nothing of the kind. The only statistics are computed from the ChocoLOCKs recorded by visitors.

2. Data recorded, use by use

Data is stored in a database hosted by Supabase. Here is what gets written, depending on what you do on the site.

Without an account: recording a ChocoLOCK

• The type (person or team), the variant (classic, super, flash, targeted, QR), the origin page, the date.
• The name of the person caught, if the prankster types it (80 characters at most). This name is never returned by the public API nor shown in the statistics.
• A device identifier (chocolock_device_id), created in your browser on your first action. It limits duplicates and identifies the first ChocoLOCK of a device.
• Your truncated IP address (last octet set to zero for IPv4, reduced to /48 for IPv6), only if you allowed it in the banner. Without that choice, nothing is written.

With an account

• Your e-mail address, your username, your avatar and its status (public or not).
• Sign-in works through a magic link sent by e-mail or through Google OAuth.
• Your ChocoLOCK history: your identifier, the name of the person caught, the custom page used.
• Avatars are stored in a public bucket: anyone who knows the file address can see it.
• You can delete your account from the Account page.

Pastry rounds

• The name of the person buying, the names of the organiser and co-organiser, the place, and the tokens that give access to the page.
• For each vote: a first name, the chosen pastry, and a hashed device fingerprint (HMAC-SHA256) to prevent multiple votes.
• The round page (/e/<slug>) is not indexed by search engines. It stays readable by anyone with the link, and by messaging previews (Slack, WhatsApp) when the link is pasted there.
• The calendar feed (/cal/<token>.ics) sends the name of the person buying to the calendar application chosen by whoever subscribes to it (Google Calendar, Apple Calendar).
• “My treat” invitations are sent from your own mail client. The site sends no e-mail about them.

Targeted ChocoLOCK

• The name of the person claiming, the name of the prankster, the session codes and their timestamps.
• Finished sessions are purged by the site.

Bakery map

• Your browser's geolocation is requested on your action, in high accuracy, and is never stored.
• Addresses you type are sent to a geocoding service (see section 4) and cached for 7 days.

Cookie Clicker

• Your username and avatar appear on the public leaderboard if you are on it.
• Without an account, a device fingerprint identifies your game.
• Your saves, anti-cheat snapshots of your game, a moderation log and your messages.

Scanning a QR code

• On each scan: the browser type and the full user-agent string. No consent is asked for this record.

Protecting the service

• An HMAC of your IP address limits the number of requests. It is erased after one hour.

3. What stays in your browser

• chocolock_device_id: the device identifier, created on your first action.
• cookie_consent: your answer to the banner.
• chocolock_event_vote:<slug>: the trace of your vote on a round.
• The chocolock:* keys: game progress.
• chocolock-fakescreens-lang and chocolock-progress-simulation: display preferences.
• Supabase session cookies (sb-*), persistent, if you have an account.
• The service worker cache, for offline mode.

The banner is not shown on lock screens (/lock, /flash/lock, /relay) nor on the scan flow (/scan). These pages set no non-essential cookie. A choice you made elsewhere on the site applies there; without a choice, the IP address is not recorded.

You can change your answer to the banner at any time through the “Cookies” link in the footer.

4. Recipients and processors

• Supabase: database, authentication, avatar storage, sending sign-in links from account@chocolock.fr.
• OpenFreeMap (tiles.openfreemap.org): base map on the bakery page; OpenStreetMap (tile.openstreetmap.org) only if your browser cannot display it.
• Google: OAuth sign-in if you choose it; Places, called from our server, to enrich bakery records.
• Photon (Komoot) and Nominatim (OpenStreetMap): geocoding of addresses typed on the map.
• Overpass (OpenStreetMap): bakery data.

Fonts are hosted on the site. No third-party measurement or advertising script is loaded.

5. Legal bases

• Performance of the service: accounts, rounds, targeted sessions, game.
• Legitimate interest: request limiting, statistics without IP address, scan log.
• Consent: the truncated IP address in statistics.

6. Retention

• Votes cast without an account on a round: 90 days.
• IP address HMAC for request limiting: 1 hour.
• Targeted ChocoLOCK sessions: purged once finished.
• Round: until its organiser deletes it.
• Geocoding cache: 7 days.
• Everything else (ChocoLOCKs, accounts, history, game, QR scans): as long as the service exists, or until you ask.

7. Your rights

You can ask for access to your data, its rectification or its erasure. Write to contact@chocolock.fr.

This also applies if someone else typed your name: on a round page, in a ChocoLOCK or in a targeted session. Give the link or the context, and the name will be removed.

If you have an account, you can delete it yourself from the Account page.

8. Complaint

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL: cnil.fr.