Privacy policy

Hugo Rodriguez (trading as YHGZ), 301B Avenue de Laon, 51100 Reims, France. Questions about this page: contact@yhgz.eu.

No data protection officer has been appointed; the activity does not require one.

For your account and your use of the service we are the controller: we decide what is collected.

For what you put into your projects about your own clients, you decide; we act only on your behalf, as a processor. A data processing annex is available on request at contact@yhgz.eu.

Account

Email address, password (stored hashed by our authentication provider), display name if you set one, creation date. Used to create and secure your access. Legal basis to review: performance of the service you asked for. Kept until you delete your account.

Acceptance of the legal documents

When an account is created we record which version of the Terms of Use was accepted, which version of the privacy policy was shown, and the date of that acceptance, timestamped by our server. This is contractual evidence, not consent within the meaning of the GDPR. Kept while the account exists, deleted with it.

Service emails

Sign-up confirmation, password reset, verification of an address change. Your address is passed to Resend for delivery. No marketing email is sent.

Projects

Project name, client name, links, checklists, notes. This content is entered by you and may concern your own clients. Kept as long as the project exists in your account.

Secret bundles

Encrypted envelope, cryptographic parameters and a fingerprint of the access token. Kept until the bundle expires, is revoked or deleted, and removed with the project.

Moderation

If an account or a handoff is suspended, we record the decision, its reason and its date. Legal basis to review: legitimate interest in preventing abuse.

Technical logs

Our hosting providers produce technical logs needed to run and secure the service, which may contain IP addresses. We do not use them for anything else and keep no copy of our own; how long they are retained is set by each provider.

When you publish a handoff, its link becomes reachable without an account by anyone who holds it. The page shows the project name, the client name, the links, the checklist, the notes, and your display name if you set one.

Your sign-in email address is not shown. It authenticates you; it is not there for recipients to contact you.

The page asks search engines not to index it, but a link stays usable by whoever receives it. An unpublished project is not reachable, and regenerating the share link immediately invalidates the previous one.

Secret sharing uses client-side encryption with key separation. In practice:

• Plaintext content and the passphrase are never sent to Supabase: encryption and decryption happen in your browser.
• We store only the encrypted envelope, its cryptographic parameters and a fingerprint of the access token.
• The link alone cannot decrypt anything, and the passphrase alone gives no access to the ciphertext.
• A lost passphrase cannot be recovered: nobody, ourselves included, can restore the content.
• A secret already displayed, copied or forwarded by its recipient cannot be taken back. Revoking a bundle blocks future releases, not what has already been read.

This model protects the content against the database and its host. It does not claim to make the service technically unable to intervene: our infrastructure serves the code your browser runs, and that browser — like the recipient’s device — is inside the trust boundary.

We record the creation, envelope release, revocation and expiry of a bundle, with their dates. That log holds no IP address, no recipient identifier, and no proof that anything was actually decrypted — a server cannot know that.

DoneStage sets no advertising cookie, no cookie of its own, and no tracker able to follow you across sites. The audience measurement described in the next section works without cookies and without a persistent identifier stored by the application. It does however store or read a few things in your browser’s storage:

• Your sign-in session, under the local key “sb-<project-ref>-auth-token”: session, access token, refresh token, expiry and required Auth data. It is necessary for authentication and persists until sign-out or under the applicable session rules.
• Your language (“donestage.language”) and theme (“donestage.theme”) in local storage because you chose them; those preferences persist until changed or removed.
• The state of an email change (“donestage.email-change-flow”), which may contain the current email, new email, step and expiry. Its logical TTL is about one hour.
• A password-recovery marker (“donestage.password-recovery”) in sessionStorage, for the tab session.
• Your local objection to audience measurement (“plausible_ignore”), read by Plausible when present and retained until you change that choice.
• The access token for a secret link, held in memory only and never written to storage.

All of it is either strictly necessary to the service or a preference you set yourself. No consent banner is shown; you can nonetheless object to audience measurement at any time from “Privacy preferences” in the footer.

The technical monitoring described below sets no cookie and creates no profile. No banner is added for that configuration alone; this assessment must be revisited before any change to collection, particularly before considering session recording.

DoneStage uses Plausible to measure use of the service in aggregate: number of visits, pages viewed, a few product actions such as creating or publishing a project, and engagement data such as active time or maximum scroll depth. We rely on our legitimate interest in understanding and improving the service.

The configuration is deliberately minimal:

• No cookie or persistent identifier is stored in your browser by the application. Plausible may calculate a daily identifier at the provider from technical data, without enabling DoneStage to track you across sites.
• No business data in the measurements: no email, no account or project identifier, no client name, no handoff content.
• Addresses are normalised before anything is sent. A public handoff page is counted under the generic form “/s/:token”: the share token itself is never transmitted, and the same goes for project identifiers.
• An internal referrer is removed. An external HTTP(S) referrer, when present, is reduced to its origin only: its path, parameters, fragment and credentials are not transmitted.
• The “Handoff secrets” page (/secrets) is excluded entirely: no measurement is loaded or sent there, and the URL fragment carrying the access token never leaves your browser.
• Product events only record that an action happened, with no properties attached.
• Plausible may derive technical information from your browser, operating system, device and an approximate location from the connection. The actual provider-side retention period depends on its configuration and applicable contract; it is not set by the application code.

No consent banner is shown for this cookie-free measurement. You can nonetheless stop or reactivate it at any time from “Privacy preferences” in the footer; that local choice applies after the page reloads.

DoneStage uses Sentry to detect and diagnose unexpected technical errors and, on a limited basis, slow navigations or Supabase calls. This monitoring is not used for product analytics. We rely on our legitimate interest in the reliability and operational security of the service.

• The configuration does not attempt to identify users: no account, email, name or Auth identifier is attached to events.
• Addresses are reduced to known routes; “/s/:token” and “/project/:id” replace their real values. Query strings, fragments and request URLs are not sent.
• Request bodies and headers, cookies, form data, business data, navigation/console/interaction breadcrumbs and raw error messages are excluded. Errors retain a cleaned technical stack, software release and normalised route.
• The /secrets page is excluded before the Sentry SDK loads: no Sentry event, trace or breadcrumb is initialised there. The token-bearing fragment remains in the browser.
• No Session Replay, profiling, user-feedback form or advanced Sentry logging is enabled in the current configuration.

As with any network service, Sentry may process technical connection data such as an IP address and derive an approximate location at its infrastructure layer. The current Sentry configuration asks that IP addresses not be stored, but this also depends on the provider’s effective configuration; we therefore do not promise that no personal data can ever be processed. Provider-side retention depends on that configuration and the applicable contract, and is not set by the application code. You can object to this processing by contacting us at the address below.

• Supabase, Inc. — database, authentication and server functions. The project is hosted in the eu-west-3 region (Paris, France).
• Vercel Inc. — hosting and delivery of the site.
• Plus Five Five, Inc., which operates Resend — delivery of service emails.
• Plausible Insights OÜ (Estonia) — aggregate audience measurement for the site.
• Functional Software, Inc. (Sentry), United States — limited technical error and performance monitoring.

No data is sold, rented or passed to an advertising network. As of the last update of this page, Plausible provides audience measurement and Sentry provides the limited technical monitoring described above; no session-recording tool is enabled.

The core application data — accounts, projects, handoff content and encrypted bundles — is hosted in a Supabase project configured in the eu-west-3 region (Paris, France).

The service nonetheless relies on international providers whose involvement may lead to processing or transfers outside the European Economic Area: Vercel Inc., Plus Five Five, Inc. (Resend) and Functional Software, Inc. (Sentry) are established in the United States, and Supabase, Inc. may itself use its own sub-processors. Those transfers are governed by the contractual mechanisms set out in each provider’s data processing agreement.

We therefore favour a European region for application data, without claiming that every processing operation stays within the European Economic Area.

Account

Until you delete it, which you can do yourself.

Projects and content

As long as they exist in your account; removed with the project or the account.

Secret bundles

Until expiry, revocation or deletion.

Browser storage

Auth session until sign-out or under session rules; theme, language and Plausible objection until changed or removed; email change for about one hour; password recovery for the tab session.

Plausible and Sentry

Retention depends on each provider’s configuration and contract; it is not set by the application code.

Moderation and audit logs

At most 12 months from the event. They outlive the deletion of an account for that period, so decisions remain traceable, and are then deleted automatically by a monthly purge.

You have the right to access, correct, erase, restrict, object to and port your data.

You can change your email address, display name and password from the Account page, and delete your account there yourself.

For anything else, write to contact@yhgz.eu. We answer within one month.

If your data appears on a handoff page prepared by one of our users, contact that user first: they decide what it contains. We assist them where needed.

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

Each account is isolated at the database level, sensitive operations go through server functions that re-check permissions, the secret-viewing surface applies strict headers and loads no third-party script, and passwords are stored hashed by our authentication provider.

No service can promise absolute security. Should a breach occur that is likely to put you at risk, we will tell you.

DoneStage is in beta and keeps evolving. Any new feature that changes what is processed — analytics, error monitoring, a paid plan — will be reflected here before it goes live.

Legal notice