Privacy policy
Last updated: 27 August 2026.
This page describes exactly what ninhache.fr does with your data. It was written from the site's source code rather than from a template: what is described here is what is actually stored.
What is collected, and when
If you only read the site, nothing is collected. No account, no cookie, no analytics.
The data below only exists from the moment you create a reader account by signing in with Google, GitHub or Discord.
| Data | Source | Why |
|---|---|---|
| Account identifier at the provider | Google, GitHub or Discord | Recognising you on your next sign-in |
| Name returned by the provider | same | Suggesting a starting name, and recognising an account during moderation. Never published |
| Email address | same | Identifying the account reliably. Never published, never used to write to you |
| Profile picture | same | Displayed next to your comments |
| Display name | chosen by you | The only name published under your comments |
| Account creation date | the site | Moderation and account history |
| Your comments and reactions | written by you | Displaying them under the articles |
No password is asked for or stored: authentication is done by the provider you choose.
Legal bases
- Consent for creating the account and publishing your comments and reactions. You give it by signing in, and you withdraw it by deleting your account.
- Legitimate interest for moderation: keeping the name returned by the provider and the email address makes it possible to recognise an account that comes back after an exclusion, which a changeable display name does not.
Cookies
The site sets two cookies, and only two:
ninhache_reader: your reader session, set when you sign in, valid for 30 days, unreadable by the page's JavaScript. It disappears when you sign out.ninhache_oauth_state: a short-lived cookie set for the duration of a round trip to your provider, used to check that the response received matches the request sent. It is cleared immediately afterwards.
Both cookies are strictly necessary for the service you request by signing in. There is no analytics, no advertising tracker and no third-party cookie. That is why no consent banner is shown to you: the law does not require one for strictly necessary cookies. The day analytics were added, this page would change and a banner would appear.
Local storage
The site's games (the brick breaker on 404 pages, the secrets, the terminal)
keep their progress in your browser's local storage (localStorage). This
data stays on your device: it is never sent to the server or to anyone,
and the site only reads it to show it back to you.
| Key | Content |
|---|---|
ninhache:secrets | the list of secrets you have found |
ninhache:fun:progress | the languages you read the site in and the days of your last three visits, for the secrets that depend on them |
ninhache:breakout:best:<code> | your best time on each brick breaker level |
ninhache:breakout:unlocked | the last level unlocked |
To erase it all, clear the site's data in your browser. A private window keeps none of it once closed.
Who receives your data
Nobody. The data is not sold, rented, or passed to third parties for commercial purposes.
Two parties see it technically:
- your identity provider (Google, GitHub or Discord), which knows you signed in to this site, since it is the one authenticating you;
- OVH, the server's host, whose details are in the legal notice, and which hosts the database without accessing it.
The data is hosted in France.
For how long
For as long as your account exists. You delete it, the data goes, with no waiting period.
Your comments are the exception, and that is a deliberate choice: when you delete your account they stay online but are detached from you. Your name, your email, your picture and your provider identifier are erased from the database; the comments then appear signed "Deleted account". This avoids punching holes in threads where other people replied to you. If you want your comments gone too, delete them before deleting your account: the My account page lets you do both.
Database backups are overwritten as they rotate; deleted data may survive there for a few days at most.
Your rights, and how to exercise them
Everything happens from the My account page, with no request to file and no reply to wait for:
- Access: the page lists what is stored about you.
- Portability: a button downloads all of your data, account, comments and reactions, as a JSON file.
- Rectification: you change your display name whenever you want.
- Erasure: a button deletes your account, permanently and immediately.
- Withdrawal of consent: it is the same button.
For anything that page does not cover, write to neo.almeida2706@gmail.com. You may also lodge a complaint with your national data protection authority, the CNIL in France.
Security
Traffic to the site and its API goes over HTTPS. The reader session is a signed token, unreadable by the page's JavaScript, and separate from the site's administration token: a reader session can never be used to reach the admin area.
Minors
The site is not aimed at people under 15 and does not knowingly collect their data. If such an account is reported, it is deleted.
Changes to this policy
This page evolves with the site. Its full history is public, in the source repository, which makes it possible to know what it said on the day you created your account.