In short
Daycare sets no tracking cookies, runs no analytics, shows no ads and sells no data. The public pages leave nothing behind, the demo keeps your tries in your browser only, and only sending a form (sign-in, access request) and signing in set technical cookies.
Data controller
Maxence Bonnici, publisher of the site, reachable through the form of the page https://mbonnici.fr/en/contact.
Access requests and accounts
The map is a private space, open on request. The “Request access” form collects your first name, last name, e-mail address and, if you wish, a word for the administrator. These details are only used to review the request; they are erased as soon as it is handled, and 30 days later at the latest. A rejected request is not kept. Your IP address is never stored in the database: it is only used, in memory and for 24 hours, to limit the number of requests sent from one connection.
If the request is approved, the administrator creates your account and sends you a temporary password by e-mail, to replace at your first sign-in. The server then stores your e-mail address, first and last name, your password in an encrypted, irreversible form (bcrypt: nobody, not even the publisher, can read it), the dates the account was created and of your last two sign-ins, and the number of recent failed sign-ins (after 5 failures, the account locks for 15 minutes).
The site’s administration signs in with a Google account. The “Continue with Google” button takes you to Google, which identifies the person under its own privacy policy, then gives Daycare their e-mail address and name; only the administration addresses are accepted, others are not stored.
Legal basis: performing the service you ask for (article 6.1.b GDPR) for accounts, the publisher’s legitimate interest in securing access (article 6.1.f) for the limits and logs.
Your notebook
Every account has its own notebook: the statuses and notes you type are stored on the server, tied to your account, and only shown to you. The admin page only lists the accounts, their sign-in dates and the number of facilities they follow, never the content of the notebooks.
You can delete your account at any time from the “Password and account” page: the account and your whole notebook are erased at once and for good. An inactive account may also be deleted by the administrator.
Cookies
Two cookies, strictly necessary and exempt from consent: DSESSION, the identifier of your session once signed in (HttpOnly, 7 days at most, erased on sign-out), and XSRF-TOKEN, a random token that protects what you send against forged requests (CSRF), set when you send a form or are signed in. They hold no information about you and are only read by this site.
Demo mode
The demo runs entirely in your browser, on invented facilities. The statuses and notes you enter are kept in your browser’s local storage (localStorage), so you find them on your next visit: they are never sent to the server. The “Start the demo over” button erases them, as does clearing the site’s data in your browser.
Facility data
The cards show the professional contact details the facilities themselves published in public directories and registers (monenfant.fr, FINESS, Sirene). Establishments run by a person in their own name (sole traders) and those whose operator asked not to be listed are never taken from Sirene.
If you represent a facility and want its information corrected or removed, write to the publisher: the request is handled within one month at most.
Local preference
The chosen theme (day or night) is remembered in your browser’s local storage. It never leaves your device.
Installable app
Daycare can be installed as an app (“Install” or “Add to Home Screen” in your browser). The browser then keeps a copy of the site’s files (pages, scripts, fonts) and of the map pieces already shown, to open it faster and offline. This cache holds no personal data and nothing from your notebook, and goes away with the site’s data.
Your feedback
The “A bug, an idea?” button offers two ways: an issue on GitHub, public and governed by GitHub’s terms, or an e-mail to the publisher. The message is prefilled with the page, the site version and the browser, which you can delete before sending. Your message and your address are only used to answer you and are kept only for the time of the exchange.
Base map
The base map images (map and demo) come from the tile servers of the OpenStreetMap Foundation, but through the site’s own server, which keeps them in a cache: your browser never contacts OpenStreetMap, and your IP address is not passed on to it. The public pages contact no third party.
Technical logs
For security and troubleshooting, the web server keeps access logs (IP address, date, page requested, browser). They are capped at 30 MB per service, erased at every update of the site, and in any case after 12 months at most.
Hosting and processors
The site is hosted on a personal server located in France. Traffic goes through the network of Cloudflare, Inc., which acts as a firewall and CDN and may process your IP address for that purpose, under its own privacy commitments.
Your rights
You have a right of access, rectification, erasure and objection regarding your data. Write to the publisher through the page https://mbonnici.fr/en/contact. You may also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.