Privacy — Vixoris

This page says what we collect, why, how long we keep it, and how to get it back or delete it. We do not sell your data. We do not build advertising profiles. We do not track you across the web.

1. Who we are

Vixoris is the trading name of EI Jean Silga, SIREN 841 454 648, . We are the data controller for everything here. Questions and requests go to us.

This notice covers everything we run:

vixoris.com, klatos.vixoris.com and waitlist.klatos.app — the sites you can read without an account.
klatos.app — the Klatos application (it forwards to the waitlist until launch), and id.vixoris.com, its sign-in. These are not open yet; the parts below about the application apply from the day it opens.
learn.vixoris.com — Vixoris Learn, our course site. Its home page and its contact form are open to anyone. Reading the lessons needs an account: you sign in through id.vixoris.com, and Learn keeps your place and your results. It is not open yet; the parts below about it apply from the day it opens.

2. What we collect

When you browse the sites. Reading them sets no cookies and runs no trackers. Two ordinary things happen:

Your browser loads two fonts from Google Fonts, so Google sees your IP address. Its privacy policy covers that.
Our servers keep standard technical access logs for 30 days, then they are deleted. We use them to run the sites, spot abuse and count visits. The logs are never sent anywhere for this.

On the Klatos site only: if you arrive from a friend's referral link, the referral code sits in your browser's session storage so it can follow you to the waitlist. It clears when you close the tab.

When you join the waitlist. We keep your email address, whether you have confirmed, how you found us, your referral code and who referred you, and the times you joined, confirmed or left. We use it to send the confirmation link, to tell you when Klatos opens, and to credit referrals. The legal basis is your consent — you confirm by clicking the link we email. We keep it until launch, then delete it. Your IP address is counted in memory to rate-limit the forms, and never written to the database.

When you write to us. The contact form on the waitlist site stores your email address, your name if you give one, your message, and which page you wrote from, then forwards it to our mailbox. The contact form on Vixoris Learn stores your name, your email address and your message, and emails a copy to our mailbox. To cap how often one network can write, it also stores a keyed hash of your IP address; the address itself is never stored. We keep messages as long as the conversation needs, and delete them when you ask.

When you use the application. Your account keeps:

Your email, the name and display name you choose, and the account id from signing in.
Your record: habits and their schedules, daily check-ins, the notes you write on a day, mood and weight if you track them, rest days, milestones, weekly reviews and yearly reflections.
Your spaces, and any partnerships you form with other people.
Your settings and notification preferences.
If you subscribe: a customer id and a subscription id from our payment processor, and the state of your subscription. Never your card number.
If you turn on push notifications: the subscription your browser gives us to reach you.
Anything you send us as feedback or a feature request.

To keep you signed in, the sign-in service at id.vixoris.com sets a session cookie, and the application holds your session token in your browser's session storage, which clears when you close the tab. Small preferences — collapsed panels, dismissed tips — sit in local storage on your own device. None of it tracks you, and none of it is a third-party cookie.

When you use Vixoris Learn. The home page and the contact form set no cookie, and the fonts come from our own server, not from Google. To read the lessons you sign in, and we keep:

The account id from signing in, your email and your name.
Where you stopped in each lesson, so you can pick up there.
Your answers to each lesson's check, your score, and whether you passed.
Any feedback you send, with the page you sent it from and the Keycloak™ version that page was checked against. A copy is emailed to us.

To keep you signed in, Learn sets one cookie. It holds a random number; your sign-in tokens stay on our server. It lasts until you sign out or your sign-in ends. While you sign in, a second cookie holds the sign-in for ten minutes at most. Learn uses no session or local storage. As for the application, id.vixoris.com sets its own session cookie. None of it tracks you, and none of it is a third-party cookie.

3. How we use it

To keep your record and show it back to you.
On Vixoris Learn, to keep your place and your results, and to read the feedback you send.
To run the features you turn on, and send the notifications you ask for.
To keep your account secure and signed in.
To bill you, if you subscribe, and to email you billing and account notices.

The legal basis for your account and record is our contract with you. The optional emails and push run on your consent. Security runs on our legitimate interest. Billing records we keep because tax law requires it.

We never sell, rent or trade your data. We never use your record to train advertising models. We never track you across other sites.

4. Where it lives, and who else touches it

Everything runs on servers we operate ourselves, rented from Contabo GmbH in Germany, inside the EU. Data is encrypted in transit and at rest.

A few providers each handle one slice, on our instructions only and never for their own ends:

Resend sends our email — the waitlist mail, the app's account and notification email, and the copy of each Vixoris Learn message we receive. It handles your email address and the message. We use its EU region, so this runs in Ireland.
Stripe takes the payment if you subscribe. You enter your card on Stripe's own page; we never see or store it. Stripe tells us only that a subscription exists and its state.
Google Fonts sees your IP address when a page loads — on the application as much as the sites, but not on Vixoris Learn.

If you turn on push notifications, each one goes through the push service your browser maker runs (Google, Apple or Mozilla, depending on your browser). We hand it the notification and the address your browser gave us. Beyond these, no one: no ad network, no cross-site tracker, no data broker.

5. Your rights

Your history is yours. Under the GDPR you can see what we hold, correct it, delete it, restrict or object to how we use it, take it with you in a portable form, and withdraw consent you have given.

Export your whole record from the application any time, free, as JSON or CSV.
Correct your logs and account details in the application.
Delete your account yourself. On the waitlist, the unsubscribe page has a delete button that erases your record on the spot.
On Vixoris Learn there is no delete button. Write to us, and we delete your account with your places, your results and your feedback.

For anything else, write to us and we answer within a month. If you think we have got it wrong, you can complain to the French data-protection authority, the CNIL.

6. Keeping and deleting

We keep your account and record while your account is open. Delete it and the record goes into a 14-day grace period you can still recover from; after that it is permanently erased. Data you shared into someone else's space stays theirs — where a record has to name you for it to make sense to them, your name is replaced with “a former partner.” Billing records we keep as long as tax law requires, and no longer. The waitlist is deleted at launch. On Vixoris Learn, we keep your account, your places and your results until you ask us to delete them.

7. Children

Our sites, the waitlist and the application are not aimed at children under 15, and we don't knowingly keep their data. If you believe a child has given us some, tell us and we delete it.

8. Changes

If we change what we keep or how we handle it, we change this page in the same release and move the date at the top. We don't move the date for wording alone.

9. Contact

Privacy questions and data requests go to us.