Privacy and cookies

In two sentences

This site uses no advertising tracker, embeds no social network button, does not measure its audience and loads no resource from a third-party server: fonts, images and scripts are served from this domain. It collects something in two places only, and you go there of your own accord: the contact form, and the forum.

What stays in your browser

Two things, not one more, and neither of them is there to follow you.

• ust-entree, in session storage: it avoids replaying the entry animation on every page. That key disappears when the tab is closed, never leaves your device and identifies nobody.
• ust_sid, a cookie, set only if you sign in to the forum. It holds a randomly drawn identifier, and nothing else: not your name, not your address, not a trace of the pages you read. It lasts thirty days, renews itself on each visit, and is deleted when you sign out.

The forum cookie is strictly necessary for a service you expressly request by signing in. On that basis it calls for neither consent nor a banner. It must not become anything else: the day a measurement or advertising cookie were added, the banner would become compulsory for the whole site, and this page would have to be rewritten before it.

Contact form

The contact form is handled by forms.yk-groupe.com, a service operated for this site. What you enter (name, email address, telephone if you give it, the device that interests you, budget, level, intended use, postcode, message) is used solely to answer your enquiry and, if it goes ahead, to draw up a quotation. Nothing is resold, transferred, or used for cold selling.

Also recorded, for the security of the service: the date of the submission, your IP address, your browser and the page the submission comes from. A copy of each enquiry is kept by the technical operator of the site.

Retention period for contact enquiries: to be settled and written here before the site opens to the public. It is a decision for the publisher, and it is owed on the same footing as the missing legal particulars.

The forum: what is collected

The forum is the only part of this site that asks for an account, and it is the only one that collects personal data in a lasting way. You can read it without an account; an account is needed in order to write.

Three things are collected, for three different reasons, and it is better to tell them apart than to add them together.

• Your account and what you publish: username, email address, password hash, declared equipment, declared location if you fill it in, topics and posts. This is necessary in order to provide the service you ask for, and accepting the forum rules forms that undertaking.
• The technical trace: IP address, browser and timestamp of every sign-up, sign-in and publication. This site hosts content published by third parties: the law requires it to keep enough to identify the authors and to hand it over to the judicial authority that requires it. That trace is displayed nowhere, never, to nobody.
• The security counters: the number of submissions per IP address and per account over an interval, and the log of moderation decisions. They exist so that the forum stands up, and so that it can be demonstrated that it is run.

No profiling, no advertising, no audience measurement on the forum. The site has none at all today, and the forum will not be the door they come in through.

The forum: what is public

On every post you publish, a profile card shows: your username, your rank, your number of posts, the date and time you joined, the equipment you declare, and your country, region and town if you fill them in. The three location fields and the equipment are optional and empty by default: you decide to fill them in, and you can empty them at any time.

Never displayed: your email address, your IP address, your password. There is no member directory: you reach a profile from a post, one at a time.

What you write in a post, on the other hand, is public without reservation, including a way of reaching you left in a listing. The forum has no private messaging. Topic pages will be readable by search engines the day this site is indexed; member profiles, for their part, will stay out of the engines.

How long it is kept

• Compte actif : Illimitée. Un compte vit tant qu'il sert. Il se ferme d'un bouton, à tout moment.
• Compte sans connexion : 24 mois, puis 36. Un avertissement part à 24 mois ; le compte est fermé et ses données effacées à 36.
• Inscription jamais confirmée : 7 jours. Le compte et l'adresse sont supprimés. Il ne reste rien d'une inscription abandonnée.
• Inscription confirmée, jamais validée : 90 jours. Passé ce délai, la demande est refusée et supprimée.
• Session de connexion : 30 jours. Glissante : elle repart de chaque visite. Une déconnexion l'annule sur-le-champ.
• Lien de confirmation d'adresse : 48 heures. Un seul usage.
• Lien de réinitialisation de mot de passe : 1 heure. Un seul usage, et il ferme toutes les sessions du compte.
• Trace technique (adresse IP, navigateur, horodatage) : 12 mois. Elle n'est affichée nulle part et survit à la fermeture du compte. C'est l'obligation de l'hébergeur.
• Sujets et messages publiés : Illimitée. Ils vivent tant que leur sujet vit, et se détachent de leur auteur quand il ferme son compte.
• Signalement traité : 12 mois. Compté à partir du jour où il a été traité.
• Journal des décisions de modération : 36 mois. Qui a approuvé, qui a masqué, qui a fermé, et quand.
• Sauvegardes : 14 jours. Glissantes. Une sauvegarde plus vieille est détruite.

And the sentence that almost no policy writes down: an erasure is immediate in the database and effective within fourteen days at the latest in the backups, the time it takes them to cycle. It appears here because it is true.

Your rights, and how to exercise them without asking

Two of them are exercised from the forum itself, alone, without writing to anybody. A right you cannot exercise from the interface is a right that rests on the goodwill of whoever runs the site.

• Access and portability: your account page offers a file to download, which holds everything the forum knows about you: profile, equipment, location, topics, posts, reports sent.
• Rectification: the same page corrects the equipment, the location, the email address and the password.
• Erasure: a button closes the account. The address, the password hash, the location, the equipment, the sessions and the tokens are erased. The username becomes “Membre retiré” and stays taken, so that nobody can take on your identity.

What is not erased with the account, and you read this before you confirm. Your posts stay online, detached from your name: they are part of conversations that belong to other people too, and erasing them would make their replies impossible to follow. The technical trace, for its part, lives on for twelve months: that is the host's obligation, it collides with the right to erasure, and that is settled in writing rather than at the moment somebody asks.

If you also want your posts taken off publication, you have to ask for it: it is done by hand, because it damages threads that other people wrote.

You also have a right to object and a right to restriction, and the right to lodge a complaint with the CNIL. For all of that, write to contact@univers-smart-telescope.fr.

Under 15s

The forum is for people aged 15 or over. In France, that is the age from which a person consents on their own to the processing of their data; below it, a parent has to agree, and we have no serious way of collecting that agreement. The forum moreover holds a space for transactions between private owners.

Age is declared with an explicit tick box at sign-up, and not with a date of birth: asking for a date would collect one more piece of personal data in order to enforce a rule that a tick box enforces just as weakly. If the publisher learns that a member is under 15, the account is closed and the data erased.

Who else sees this data

Nobody other than those who keep the site running: the technical operator who runs the server and the forms service, and the mail provider through which the forum emails go out. No data is sold, transferred, exchanged, or passed to an advertiser.

Identity of the data controller, identity of the host, and precise contact details of the providers: to be completed in the legal notice before the forum opens to the public. A service that collects addresses and IP addresses cannot open without the responsible person being nameable.

Data protection officer: appointing one is not compulsory for this site. The decision not to appoint one is still to be written down.

Audience measurement and advertising

The project brief mentions Google Analytics and AdSense. Neither one is installed to this day. Adding them would require a GDPR compliant consent banner and an update to this page: that is a decision to be taken, not a given.