No ads, no analytics service, no tracking cookies. We only count page views in a daily total that identifies nobody. We never sell your data.
We keep what it takes to run your account and your votes. Only a brag page that you share is public: it shows your handle, the question, your answer and the date.
You can delete your account at any time. The law makes us keep some data apart, for up to five years.
Who is responsible
Publisher and data controller
Laurent Payot, individual
Address
Not published: the publisher is an individual. The host knows it.
Publication director
Laurent Payot
Contact for your data
contact@lambdapps.com
Host
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, +1 (888) 99 FLARE
What we keep, why and for how long
Your account
Data
Your email address, the handle you chose, your full name if you gave one, the address of your Google profile photo (not the photo itself), when and how you last signed in (Google or email code), the time of your last visit, and when you last opened your votes.
Why
To open and run your account, show your points, and tell you what changed since your last visit.
Basis
Running the service you asked for.
Kept
As long as your account exists.
Seen by
Only you and the administrator. Your handle is public only on a brag page you share.
Your votes and brags
Data
Each vote, with its time and how rare it was, and every change of mind, including a vote you withdraw. The brags you create.
Why
To count votes, work out your points and rank, and show your brag pages.
Basis
Running the service you asked for.
Kept
As long as your account exists, then 90 days without your name.
Seen by
Only you and the administrator. A brag page is open to anyone who has its link, and search engines are asked not to list it.
Signing in with an email code
Data
Your email address, a scrambled copy of the code (not the code itself), the number of tries, and scrambled copies of your address and your IP address to limit abuse.
Why
To check that the address is yours and to block abuse.
Basis
Running the service you asked for, and our legitimate interest in security.
Kept
The code, 10 minutes. The abuse counters, 1 hour. An address waiting for you to choose your handle, 15 minutes.
Staying signed in
Data
A random token in a cookie on your device. We keep only a scrambled copy.
Why
To keep you signed in.
Basis
Running the service you asked for.
Kept
30 days, or until you sign out.
Connection log
Data
When you vote or withdraw a vote, create or delete a brag, or create, change or delete your account: your IP address, the HTTP and TLS versions of your connection, the time, the kind of action and a reference to the content.
Why
The law requires hosts to keep what identifies the people who create content.
Basis
Legal obligation (French law 2004-575 of 21 June 2004, article 6, and decree 2021-1362).
Kept
1 year after each action, even if you delete your account. Nothing on the site reads it: we open it only to answer a legal request from the authorities.
Notifications (only if you turn them on)
Data
The address and keys your browser gives us for notifications, their language, and which of the two switches are on.
Why
To tell you about new questions and about the results of your votes. A result says whether you were right, and may show on a locked screen.
Basis
Your consent. You give it by choosing “Turn on” and take it back by switching off.
Kept
Until you switch both off, sign out of that device or delete your account, or until your browser’s notification service says the address no longer works.
Problem reports
Data
The reason you pick, the message and the link you add (both optional), and your account.
Why
Questions are written and checked by software. Readers report mistakes, and the administrator reads the reports to fix them.
Basis
Our legitimate interest in correct questions.
Kept
As long as your account exists, then 90 days without your name.
Plain visits
Data
Like every website, we receive your IP address and browser details when you open a page. Cloudflare handles them to deliver the site and protect it.
Page count
Each page opened adds one to a daily total, by language, so the administrator knows how much the site is read. The total holds no address, identifier or cookie, so it cannot lead back to you. Your browser details are only read to leave out robots, and nothing of them is kept.
Kept
The daily totals, with no end date, since they identify nobody.
Who receives your data
The administrator
For each account, the administrator can see the email address, the date and way of the last sign-in, the last visit, how many questions you voted on, how many brags you made, your points and your notification settings, to run and protect the service. IP addresses and tokens are never shown.
Cloudflare
Our host. It runs the site, the database, the notification queue and the images of questions, and sends the sign-in code by email (it receives your email address and the code), on our instructions, under its data processing agreement. As the network that delivers the site, it also handles the technical data of every visit under its own privacy policy.
Google
“Sign in with Google” tells us your email address and the address of your photo; we do not keep your Google name. Your browser loads your photo from Google, which sees your IP address but not the page you came from.
Your browser’s notification service
Google, Mozilla, Apple or Microsoft, depending on your browser. It carries the notification and cannot read it: the content is encrypted for your device.
Cloudflare Turnstile
When you ask for a sign-in code, enter it, choose your handle, report a problem or delete your account, a check may run to tell you from a robot. Cloudflare says it looks at your IP address, a fingerprint of your connection and your browser’s user agent for this, and only to block bots.
No data about you goes to the AI services that help write and check questions (Anthropic) or to the news source they search (Exa). They only receive public information about events.
Outside the European Union
Cloudflare is a US company, and your requests can be handled in data centers outside the European Union. Our database asks for Western Europe first, but Cloudflare does not guarantee where it runs.
For Cloudflare, we rely on the standard contractual clauses of its data processing agreement, and Cloudflare states that it complies with the EU–US Data Privacy Framework. Google and your browser’s notification service may process data outside the European Union too; each publishes its own safeguards.
Cookies and storage on your device
Session
Keeps you signed in. 30 days.
Sign-in steps
Remember where you are while you sign in. 10 to 15 minutes.
Language
Remembers the language you chose with the language button. 1 year.
Theme
Remembers dark or light. Stays on your device.
Notifications
Remembers this device’s notification subscription and the language it was last told. Stays on your device.
Install reminder
Remembers when we last suggested installing the app, and whether you asked us to stop. Stays on your device.
Offline pages
Saves the pages you looked at so they open without a connection. Erased when you delete your account.
Each of these is needed for the service or chosen by you, and none of them tracks you, so there is no cookie banner. We use no analytics service and no advertising; we only count page views in a daily total that identifies nobody.
If you delete your account
Erased right away
Your sessions, your notifications, and your brag pages, which then say “Brag removed by its author”.
Kept 90 days, without your name, then erased
Your votes, kept only to detect fake accounts, and your problem reports.
Kept apart because the law requires it
Your email address and full name for 5 years, your handle and Google sign-in for 1 year, and the connection log for 1 year after each action. A daily job erases them when the time is up. No page of the site can show them, and we open them only to answer a legal request from the authorities.
What we cannot erase
The brags you posted on social networks, and the link in your Google account, which you can remove there.
You can ask to see your data, correct it, delete it, receive it in a usable format, limit its use, or object to the uses based on our legitimate interest. Where we rely on your consent, you can take it back at any time.
To use a right, write to the contact above from the email address of your account. We answer within one month. Some data cannot be erased before the legal deadlines listed above. You can see your votes in My votes and delete your account yourself.
If you think we do not respect your rights, you can complain to the CNIL, the French data protection authority.
Polybrag is for people aged 15 or over. If a younger child has an account, write to us and we will delete it.
Security
Pages are served over HTTPS. Session tokens and sign-in codes are stored only as scrambled copies, and the session cookie is hidden from scripts on the page.
New version available