Privacy policy

Controller and contact

The YourTimeline project operator is the controller for processing carried out by the service. Use Contact + suggestions or contact@yourtimeline.org for a privacy request.

The civil identity and postal contact required for a complete professional legal notice still have to be supplied on the Legal notice page before professional or commercial operation.

Data collected

Account data includes email address, public name, Firebase user identifier, verification status, authentication provider, accepted-document version, and account timestamps.

User content includes timelines, events, descriptions, tags, images, files, messages, comments, suggestions, votes, invitations, collaboration roles, reports, and moderation information.

Technical and security data may include server IP address, authentication and session information, Turnstile results, upload metadata, rate-limit counters, audit records, errors, and unusual-traffic logs.

With the visitor's separate consent, Google Tag Manager and Google Analytics may receive page-view and interaction data. Optional PostHog product events may be enabled through the dedicated privacy control; automatic text capture and session recording are disabled by default. Sentry may receive minimized technical error data without default personal information to secure and diagnose the service. Payment information is processed by Ko-fi or its payment providers, not stored by YourTimeline.

Advertising is not currently loaded by the application. If it is enabled later, Google AdSense and Google's consent platform may process consent signals, page context, IP and device or browser identifiers, and advertising interactions according to the visitor's choice, location, and the configured advertising mode.

Purposes and legal bases

Contract performance: create and manage accounts, authenticate users, save and publish timelines, provide collaboration, messaging, comments, exports, and support.

Legitimate interests: secure the service, prevent fraud and abuse, diagnose incidents, moderate content, preserve evidence of sensitive actions, and improve reliability while respecting user rights.

Consent: optional audience measurement, advertising storage, advertising personalization, or other optional trackers where consent is required. Refusing optional measurement or advertising does not prevent account creation or use of the core service, and consent can be withdrawn through the consent interface.

Legal obligations: answer valid authority requests, preserve required evidence, and protect rights where applicable.

Storage, cookies, and recipients

Firebase / Google Cloud provides authentication, database, hosting, API, and analytics infrastructure. Cloudflare provides Turnstile and R2 storage. If configured, Sentry provides minimized error monitoring and PostHog provides consent-based product analytics. Ko-fi processes voluntary support. ImprovMX forwards service email, and Wix manages the domain and DNS.

The authorized superuser may manually load a limited page of private conversation metadata and message contents when reasonably necessary for security, abuse investigation, moderation, dispute handling, or legal compliance. Conversations are not bulk-loaded into the administration panel: each page is requested on demand, access is rate-limited, and the administrative read is recorded in the protected audit log.

If advertising is enabled, Google AdSense and Google's certified consent tooling may act as recipients or processors for advertising delivery, fraud prevention, consent records, reporting, and measurement. Advertising signals remain denied by default until the applicable consent choice is available.

Browser storage may hold language and interface preferences, a temporary try-mode draft, consent choices, and short-lived cached public responses. It never contains backend secrets.

Providers may process data outside your country under their own terms and applicable transfer safeguards. Public timelines are intentionally available to visitors and search engines.

Retention

Account and active content data are normally kept while the account or content exists. A timeline moved to trash remains hidden, locked, and counted in the three-timeline quota for up to 24 hours, unless its owner requests immediate permanent deletion. Purging removes its document, event discussions, comments, subcollections, and managed media references. Private account messages remain, while their source-timeline link is marked unavailable.

Any current participant may leave a conversation. If other participants remain, only the departing account loses access and returning requires a new invitation. When the final participant leaves, the thread, its messages, protected message revisions, invitations, and related notifications are permanently deleted.

A deleted message becomes a visible tombstone. Its previous text and message edit history are restricted to server administration and normally retained for up to 365 days for security, abuse handling, and dispute evidence.

In-app notifications are normally retained for up to 180 days and sensitive-action audit records for up to 365 days. Invitations, rate limits, and temporary protection records expire automatically.

Provider backups, security logs, and legally required evidence may remain for the shortest period justified by restoration cycles, security, disputes, or law. Retention is reviewed when purposes or providers change; personal data is not kept indefinitely merely at the operator's discretion.

Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. The account page provides a data export and account-deletion control.

Use Contact + suggestions or contact@yourtimeline.org to exercise a right. You may also complain to the competent authority, including the CNIL in France.

California privacy

YourTimeline does not sell personal information. If advertising is enabled and an advertising disclosure is treated as sharing or targeted advertising under applicable law, the required notice and opt-out control will be provided through the consent interface. Applicable access, correction, deletion, and opt-out rights will be honored without unlawful discrimination.

A request may be verified before disclosure or deletion to protect the account and third parties.

Changes

This policy is updated when processing, providers, purposes, or legal requirements materially change. A prominent notice and renewed acceptance may be required when a change affects the user agreement or requires a new legal basis.