Privacy policy.

In short

VitFait is built to collect the bare minimum: your account, your lists, and what it takes to run AI capture. No ads, no third-party trackers, no selling of data, no profiling. Voice-capture audio is never stored.

Data controller

Maxime Boinet, publisher of VitFait (see the legal notice). Contact: maximeboinetdev@gmail.com.

Data we collect

• Account: email address, password (stored only in hashed form by our authentication provider — we never see it in clear text), language and preferences (sound, theme).
• Content: your lists and the items you capture, with minimal metadata (date, typed or voice capture).
• Voice capture: audio is transcribed then immediately discarded — it is never stored. Only the transcribed text is kept, like any other item.
• Anti-abuse technical log: each capture generates a minimal entry (text length, action type, confidence score) — never the content itself.
• Usage counters: number of AI actions this month, to enforce the free plan’s limit.
• Google Calendar (optional): if you connect your calendar, access tokens — see the dedicated section below.

Why (purposes and legal bases)

• Providing the service (performance of contract): account, lists, capture, transcription, calendar.
• Security and abuse prevention (legitimate interest): rate limiting, quotas, minimal technical logs.
• Account emails (performance of contract): sign-up confirmation, password reset. No marketing emails.

Where your data goes (processors)

VitFait relies on technical providers, each for one specific task:

• Supabase — database and authentication. Data hosted in the European Union.
• Vercel — application hosting (United States).
• Anthropic — AI filing: the text of your capture is sent to the Claude API to be filed in the right list. It is not used to train their models.
• OpenAI — voice transcription: audio is sent to the transcription API then discarded. It is not used to train their models.
• Google — only if you sign in with Google or connect your calendar (dedicated section below).
• Resend — delivery of account emails.
• Upstash — rate limiting: a technical identifier for your account and short-lived counters.

Transfers outside the European Union are governed by the European Commission’s Standard Contractual Clauses and, where applicable, the providers’ EU-US Data Privacy Framework certification.

Google Calendar and Google user data

If you connect your calendar, VitFait only requests permission to create events (the calendar.events scope). In practice:

• VitFait does not read your calendar and only creates an event after your explicit confirmation on the proposed card.
• The access tokens provided by Google are stored securely server-side, are never exposed to your browser, and are deleted with your account. You can revoke access at any time from your Google account settings.
• VitFait’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: no Google user data is transferred to third parties, used for advertising, or used to train AI models.

Cookies and local storage

VitFait only uses strictly necessary cookies: session cookies (staying signed in) and a language cookie (vitfait-locale, 12 months). Your theme preference lives in the browser’s local storage. No advertising or third-party analytics cookies — which is why there is no cookie banner.

Retention

• Account data and content: for as long as your account exists.
• Voice-capture audio: never stored.
• Technical logs and counters: deleted with the account.
• Account deletion: on request to maximeboinetdev@gmail.com — handled within 30 days, it erases all of your data (account, lists, logs, tokens).

Security

Encryption in transit (HTTPS), per-user isolation at the database level (Row Level Security), API keys kept server-side only, hashed passwords. No system is infallible, but the surface is kept minimal: no superfluous data, no third-party scripts.

Your rights (GDPR)

You have the rights of access, rectification, erasure, portability, restriction and objection. To exercise them: maximeboinetdev@gmail.com. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).

Children

VitFait is not intended for children under 15 without parental consent (the digital age of consent in France).

Changes

If this policy changes substantially, the date at the top of the page is updated and the changes are summarized here. The online version prevails.