Your data

Privacy policy

What apprendre.forelse.fr records about you, why, for how long, and how to take back control. The short version: an email address, your progress, no trackers.

This page is a translation provided for convenience. The French version is the authoritative text and prevails in case of any discrepancy.

Data controller

Forelse, 7 rue des Docteurs Théry, 33210 Langon, France. For any question about your data: contact@forelse.fr.

Full contact details are given in the legal notice.

What the site does not do

No advertising trackers, no social media buttons, no third-party tools: audience measurement is hosted on our own servers.
Your data is never sold or passed on to anyone.
No profiling: your progress is there to serve you, not to target you.
Your code never runs on our servers: PHP runs in your browser, in a sandbox with no access to the disk or the network.

What is collected, and why

When	What data	Why	Legal basis
You create an account	Email address, display name, password (stored hashed, never in plain text), creation date, date the address was confirmed.	To identify you, keep your progress, and write to you about your account.	Performance of the contract (the service you asked for).
You do the exercises	The code written in each exercise, and the code that passed it, its status (in progress, completed), the hints viewed, the XP earned, the result of the completion check, the mentor's code review.	To save your work and pick it up from one device to another; to produce your course notes; to replay the tests on our servers to confirm a completion, in an isolated service that sees neither your account nor the database.	Performance of the contract.
You choose to appear on the leaderboard	Your display name, your XP and the number of exercises completed become public on the leaderboard page. Nothing else (neither your email address nor your name at GitHub, Google or LinkedIn).	The leaderboard between learners. Off by default; you can leave it at any time from “My account”.	Consent.
You buy a track	The track bought, the price, the date, the account's email address, your acceptance of the terms of sale and of the waiver of the right of withdrawal, the payment references, the link to the receipt and the invoice reference. The billing address and, for a business, its company name and VAT number are entered at Stripe, which issues the invoice. Card details are entered at Stripe and never reach us.	To open your access, send you the confirmation, issue refunds, keep the accounts.	Performance of the contract; legal obligation for accounting records.
You send feedback on an exercise	Your message, the exercise concerned, the number of hints used and whether the exercise was completed.	To improve the exercises.	Legitimate interest (improving the service), following your voluntary action.
You write to us (contact page, request from a school or a company)	Your name, your email address, your message and, for a group request, the organisation and the number of learners. The signed-in account, if any.	To reply to you; to prepare a proposal for your group.	Legitimate interest (replying to those who write to us); pre-contractual steps for a quote request.
You ask the mentor for a review or an explanation	The exercise's code, the error message if any, and the exercise's instructions. Neither your name nor your email address.	To review your code or explain an error.	Performance of the contract: the mentor only steps in when you click.
You visit a page	Server technical logs: IP address, page requested, date, browser used.	Security, abuse detection, troubleshooting.	Legitimate interest (running the site and protecting it).

No data is required beyond the above; the fields requested are there to provide the service, nothing more. The first chapter of every track is free once you have an account.

Cookies and browser storage

The site only uses items that are strictly necessary for it to work, which are exempt from consent. That is why there is no banner to accept.

Session cookie: keeps you signed in from one page to the next, and protects forms against forged submissions. It disappears when you close the browser or sign out.
Local storage (localStorage): code written before an account was created, from the time when the first chapter could be played as a visitor, may remain in your browser. On your first sign-in, it is moved to your account and then deleted from the browser.
Sandbox: the preview of your code is displayed from forelsebox.app, in an isolated page. This domain sets no cookies; it only keeps the technical files needed to run PHP in your browser.
Audience measurement: to know how many people visit the site and where they come from, each page view is counted by software we host ourselves (Umami). It sets no cookie and no visitor identifier: it records the page, the page you came from, the country, the language and the type of device, as well as a few actions in an exercise (opening it, running the tests, a completion, a hint or the solution requested), never the code you write. Your IP address is used for the calculation and then discarded, without ever being stored. Nothing makes it possible to recognise you from one visit to the next, or to follow you on another site; these measurements are shared with no one.

Who has access to your data

The site's team, to manage accounts and read the feedback you send.
The host, OVH SAS, which runs the servers and only accesses data in that capacity.
Stripe (Stripe Payments Europe, Ireland), payment service provider, for a purchase: it receives the account's email address, the amount and, directly from you, your payment details and billing address, which it also processes for its own obligations (fraud prevention, financial regulation). Some data may be transferred to the United States, under the European Commission's standard contractual clauses.
Anthropic (United States), which provides the mentor's model. Only when you ask for it, it receives the exercise's code and any error, without your name or email address. This transfer outside the European Union is governed by the European Commission's standard contractual clauses. Under its API terms, Anthropic does not use these exchanges to train its models and keeps them for a limited time for the security of the service.

No one else.

How long

Account and progress: As long as your account exists. You can delete it yourself from the “My account” page: account, code, feedback and XP are erased immediately. A request by email is handled within 30 days.
Purchases: Ten years from the purchase, the retention period for accounting records. If you delete your account, the purchase is kept without any link to it (only the email address used remains attached).
Contact messages: As long as it takes to reply, then at most three years for a quote request that went no further; one year for the others.
Feedback on exercises: Until it has been dealt with, then deleted; in any case together with the account.
Exchanges with the mentor: The platform only keeps the code review shown with your exercise, deleted along with it. Nothing else is stored on our side.
Server logs: Twelve months at most.
Backups: The database is backed up every day; each backup is erased after fourteen days. Deleted data therefore disappears from the backups within two weeks.

Your rights

You may request access to your data, its rectification or erasure, or the restriction of its processing; object to processing based on legitimate interest; and receive your data in a machine-readable format.

Your display name and your email address can be corrected, and your account deleted, directly from the “My account” page.

For anything else, write to contact@forelse.fr, from your account's email address: that is how we recognise you without asking for proof of identity. We reply within one month.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority.

Security

Passwords are hashed with a modern algorithm; no one, not even the team, can read them.
Exchanges with the site are encrypted (HTTPS).
The exercises' code runs in your browser, never on the server, and the preview runs on an isolated domain.
Administrative access is restricted and logged, and the server receives its security updates.

Minors

The site is intended for people learning to code, students included. A minor under fifteen may only create an account with the consent of a parent or guardian.

Changes

This policy changes when the site changes. The date below is authoritative; you will be notified of any substantial change when you sign in.

Last updated: September 17, 2026.