Privacy

What we do not collect

We keep no browsing history whatsoever. Filtering works by whole categories at DNS level: the system knows a category is blocked, it does not keep a list of the sites you tried to open. Nobody here can know what you looked at — or tell you, if you asked.

We neither receive nor store any bank details. We sell no data, to anyone, ever.

What we collect

To run your account

• your email address, and a display name derived from it;
• your password, stored in an irreversibly hashed form;
• your counter of days held, your record and the number of relapses declared;
• your goals and their progress;
• the name, type and technical identifier of the devices you lock;
• your cut-off schedules and your quitting rhythm.

For payment

• your customer identifier with our payment provider, the status and end date of your subscription.

To measure our advertising

• the advertising click identifier, your IP address and your browser at the time of signup, kept in order to attribute a purchase to a campaign.

If you choose to take part

• the nickname you choose for the leaderboard. Your first name and your email address never appear there, and participation can be withdrawn in one click.

Legal bases

Account and payment data are processed to perform the contract between us. Advertising data relies on your consent, revocable at any time. Taking part in the leaderboard relies on your explicit consent.

Who receives this data

Stripe

Payment and subscription management. Email address, card details (never transmitted to our servers), billing history. Hosting: European Union and United States.

Cloudflare

DNS filtering of protected devices. DNS requests from locked devices, attached to an anonymous technical identifier. Hosting: Worldwide network.

Meta

Advertising effectiveness measurement. Email address in one-way hashed form, purchase amount and date. Hosting: European Union and United States.

OVH SAS

Hosting of the website and the database. All account data. Hosting: France.

Transfers outside the European Union are covered by the European Commission's standard contractual clauses.

Retention periods

• Account data: as long as your account exists, then thirty days after deletion;
• Invoices: ten years, as accounting law requires;
• Advertising data: thirteen months maximum;
• Login sessions: seven days.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. One address for all of it: contact@selfcntrl.com. We answer within one month at the very most, in practice far sooner.

You may also lodge a complaint with the French data protection authority (CNIL).

Cookies and analytics

The site sets a session identifier necessary for you to log in, which does not require consent. Advertising trackers are only activated after you agree, and refusing takes nothing away from how the service works.

Security

Traffic is encrypted, passwords are stored irreversibly, and access to data is limited to the people who need it. As no system is infallible, we would inform you without delay in the event of a data breach affecting you.