Privacy

What I keep

Six things, and not one more. Four of them come from the form; the two dates are produced by the service that holds the list, which is exactly what makes them impossible for me to fake.

Your email address

It’s where the confirmation link goes, and later the launch email. It is used for nothing else.

Your first name

To put at the top of the email. Put whatever you’d like to read in that spot.

The page your sign-up came from

That isn’t data about you, it’s data about the page: it tells me which one brings the most people, and so where to start.

The date and time you asked

The first half of the proof: the moment your request went out.

The date and time you confirmed

The second half: the moment you clicked the link that arrived by email.

The version of the text you read as you signed up

Every wording is archived and dated in the site’s code. That’s what makes it possible to say, two years from now, exactly what you said yes to.

Who answers for this data

Me, as the publisher of this site. The full identity of the data controller — the entity, its legal form, its registered office and its registration number — is published on the Legal notice page, one click from here and from the foot of any page.

What it’s for

Telling you when a NeoXygen app launches. That’s all you asked for, and it’s all I’ll do with it: your address is sold to nobody, goes to no partner, and feeds no other mailing.

On what basis

On your consent, and nothing else. You give it in two steps: by leaving your address, then by clicking the link that arrives by email. Without that second click your sign-up doesn’t exist, and you’ll receive nothing.

How many emails

Exactly the text shown next to the field where you leave your address, word for word — not a rewording. It’s archived and dated in the site’s code, and it is never rewritten: a new version gets published, the old one stays.

Who holds it

Brevo, a French company whose data is hosted in the European Union. Brevo keeps the list, sends the emails and handles the unsubscribes. Nobody else has access to the list, and no copy of it exists anywhere else.

When you submit the form, what you typed passes through the site’s own server on its way to Brevo. It doesn’t stay there, and the body of the request is never logged. On that leg, your IP address isn’t passed on: the server strips the headers that carry it before relaying.

Elsewhere it necessarily is, and I would rather say so. When you click the confirmation link, your browser connects to Brevo directly, and Brevo sees your address — which is exactly what lets it timestamp your confirmation. The same goes for a click in a launch email.

For how long

Three years from your last sign of life: signing up, or a reply to one of my emails. After that, the address is deleted. Earlier if you ask.

What you can ask for

Write to me at bonjour@neoxygen.fr. There’s no account to create, no form to fill in, no paperwork to produce.

I answer within one month at the latest, as the law requires of me — in practice much sooner, since I’m the one reading.

See what I hold

I send back the six items above, exactly as they are recorded.

Correct it

A mistyped address, a first name spelled wrong.

Erase it

All of it, and without having to justify yourself.

Take it with you

The same items in a file you can open somewhere else.

Freeze the processing (article 18 of the GDPR)

I keep your data but do nothing further with it, for as long as a question takes to settle.

Withdraw your consent (article 7.3 of the GDPR)

As easy to undo as it was to give. It isn’t the same thing as unsubscribing — see just below.

Complain to the CNIL

The Commission nationale de l’informatique et des libertés is the French supervisory authority, and its site is www.cnil.fr. If you live elsewhere in the European Union, you can go to your own country’s authority instead.

Withdrawing consent isn’t unsubscribing

Unsubscribing means stopping the emails: one click on the link at the foot of each of them, with no in-between form and no exit question.

Withdrawing consent means taking back the permission itself — and so having erased whatever was kept on the strength of it. Write to me at bonjour@neoxygen.fr and it’s done, with nothing to explain.

How I count visits

With Rybbit, which I host myself, with no cookie and no personal data: page views, not people. Nothing is written to your browser, and nothing that is counted ties a visit to anyone.

It runs on a server I administer, at analytics.keikolab.dev — a different domain from this one. So your browser makes a request to it, and that server sees your IP address, as does any server you contact. It is the only script on this site that comes from anywhere else.

I have put neither a cookie banner nor a consent window on this site, and I will not: no cookie is dropped, so there is nothing to consent to.

Reaching me

For everything above, and for everything else: bonjour@neoxygen.fr. I’m the one reading.