Privacy policy

The data controller is ORVALLE, a French simplified joint-stock company (SASU) with a share capital of €100, 61 rue de Lyon, 75012 Paris, France, registered with the Paris Trade and Companies Register under number 100 866 540.

For any question about your data: [email protected].

To provide the service, the application processes only the following data.

• Account Name, email address, password (stored hashed, never in clear text), two-factor authentication settings and interface language.
• Teams Teams, members, roles and pending invitations.
• Secrets TOTP secrets are encrypted before they are stored and only decrypted at the moment a code is generated. The API never returns them in clear text.
• Access log For each code viewed: the secret, the person or channel that asked for it, the date, the IP address and the browser. It is visible to the team's administrators.
• Billing Plan, number of seats and subscription status. Card details are entered at Stripe and never pass through our servers.

The Share Auth extension shows your team's code for the site open in the active tab, and can fill it into the page. It processes only what that requires.

It talks to a single server: the Share Auth server you enter in its settings (app.shareauth.net, or your own instance). It sends no data to the publisher or to any third party, and contains no advertising, no analytics and no remotely loaded code.

• Sign-in credentials Your email and password (and a two-factor code if your account has one) are sent once to that server to obtain an access token. The extension does not keep them.
• Access token It can only list secrets and generate codes: it cannot create, edit or delete anything. It is kept in memory and disappears when the browser closes, unless you choose to stay signed in. You can revoke it at any time from your API tokens in the application.
• Active tab address Read only when you click the extension. Only the hostname is sent to the server, to find the matching secret. The extension has no standing access to any website and keeps no browsing history.
• Page content When you click “Fill in”, the extension looks for the code field in the page and fills it. Nothing else on the page is read or transmitted.
• Settings The server address and your choice to stay signed in are stored locally, in the browser.
• Limited use Data obtained by the extension is used only to show and fill in your codes. It is not sold, not transferred to third parties, and not used for advertising, creditworthiness or any purpose unrelated to that function.

When a team connects a chat workspace, every command received is logged with the user identifier supplied by the platform, the workspace, the channel, the secret concerned, the date and the IP address. Message text is not recorded.

Data is hosted in France. We rely on the following providers, each limited to its role.

• Hosting o2switch and Scaleway, France.
• Network and protection Cloudflare, Inc., through which the application's traffic passes.
• Payment Stripe, for paid subscriptions.
• Email Resend, for the application's emails (invitations, password resets, sign-in confirmations).
• Contact form Formspree, for messages sent from the website's contact page.

Cloudflare, Stripe, Resend and Formspree may process some or all of this data in the United States. These transfers are governed by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework.

• Account and secrets As long as the account exists. Deleting the account deletes the teams you own, their secrets and their subscription.
• Access log As long as the team exists.
• Integration log 90 days.
• API tokens Until they expire or are revoked, then deleted.
• Billing 10 years for accounting records, as required by French commercial law.
• Contact messages 3 years from the last exchange.

The application uses only the cookies it needs to work: the sign-in session and protection against cross-site request forgery. The website sets none. There are no advertising cookies and no analytics tools.

Some pages of the website offer tutorial videos hosted on YouTube. Nothing is loaded from YouTube until you start playback: the player then loads from youtube-nocookie.com, and Google (YouTube) may receive your IP address, store data on your device and process it in the United States, under its own privacy policy.

Under the General Data Protection Regulation, you have the right to access, rectify, erase, restrict, object to and port your data. To exercise these rights, write to [email protected].

You may lodge a complaint with the French data protection authority (CNIL) or with the supervisory authority of your country.