What we do with your data
A page written from the code, not from a promise. Every claim below matches a mechanism that exists — and we also say what does not.
Messages encrypted at rest
Conversation content is encrypted in the database, envelope-style: a separate key per conversation, sealed by a master key. A copy of the database, a backup or direct access to storage return ciphertext and nothing else.
A European AI
Matching and the coach run on Mistral, a French model — that is the project's default choice. Skill vectors are computed there in every case.
The European ESCO framework
Skills are linked to ESCO, the European Commission's public taxonomy — around 13,500 entries. Not just a homegrown keyword cloud.
Bounded retention
Usage events are purged automatically beyond 13 months, every day. That is the cap the French DPA recommends for trackers, enforced by code rather than by a promise.
Messages encrypted at rest
Conversation content is encrypted in the database, envelope-style: a separate key per conversation, sealed by a master key. A copy of the database, a backup or direct access to storage return ciphertext and nothing else.
A European AI
Matching and the coach run on Mistral, a French model — that is the project's default choice. Skill vectors are computed there in every case.
The European ESCO framework
Skills are linked to ESCO, the European Commission's public taxonomy — around 13,500 entries. Not just a homegrown keyword cloud.
Bounded retention
Usage events are purged automatically beyond 13 months, every day. That is the cap the French DPA recommends for trackers, enforced by code rather than by a promise.
Your conversations
Every conversation carries its own key, and every encrypted value is bound to its place — its conversation, its message, its column. Moving a row from one conversation to another does not make it readable: verification fails.
What this protects
A copy of the database, a backup, direct administrative access to storage, a duplicated bucket. That is the most common leak scenario, and it is covered.
What this does not protect
This is not end-to-end encryption. The server holds the master key — that is what makes read-time translation, notification previews and moderation possible. A compromised server would expose the plaintext.
What moderation sees
Nothing happens unless someone reports content. A report opens a window of up to eleven messages around the targeted one — that message and up to five before and after, as seen by the person who reported it. There is no screen that scans an entire conversation.
What stays in your hands
Delete your account for good
From your settings. This is a permanent deletion, not deactivation: your profile, posts, listings and applications are erased. Messages already sent remain in your contacts' conversations, and some technical traces are not yet automatically deleted: contact us for a full removal.
Turn down audience measurement
Audience measurement — our internal stats, Microsoft Clarity, Google Analytics, and, on this site, PostHog — and advertising measurement (Google, Meta) only start with your consent, which you can revoke at any time. Withdrawing deletes our anonymous ID and Clarity cookies on our domain, and stops all transmissions to ad platforms.
A guardian's consent, for minors
A minor’s profile declares a guardian and sends them a confirmation link: the guardian does not need to create an account. Without this consent, applying remains closed. Additionally, journey recording (Microsoft Clarity) is never activated for minor accounts, and nothing is transmitted to advertising platforms.
Browsing without leaving a trace
Ghost mode is reciprocal, on purpose: you stop reporting your visits, and you give up seeing your own. No one-way mirror.
Delete your account for good
From your settings. This is a permanent deletion, not deactivation: your profile, posts, listings and applications are erased. Messages already sent remain in your contacts' conversations, and some technical traces are not yet automatically deleted: contact us for a full removal.
Turn down audience measurement
Audience measurement — our internal stats, Microsoft Clarity, Google Analytics, and, on this site, PostHog — and advertising measurement (Google, Meta) only start with your consent, which you can revoke at any time. Withdrawing deletes our anonymous ID and Clarity cookies on our domain, and stops all transmissions to ad platforms.
A guardian's consent, for minors
A minor’s profile declares a guardian and sends them a confirmation link: the guardian does not need to create an account. Without this consent, applying remains closed. Additionally, journey recording (Microsoft Clarity) is never activated for minor accounts, and nothing is transmitted to advertising platforms.
Browsing without leaving a trace
Ghost mode is reciprocal, on purpose: you stop reporting your visits, and you give up seeing your own. No one-way mirror.
What this is not
Three limits we would rather write ourselves. They are verifiable in the code, so keeping quiet about them would protect us from nothing.
The encryption is not end-to-end
The server can read your messages. We write it here rather than let the word "encrypted" suggest otherwise: this encryption protects storage, not against the operator.
Protection for minors only covers declared birth dates
Your date of birth is requested at sign-up and for older accounts before you can continue. However, it is self-declared: no verification is performed. A false date disables guardian consent and the exclusion from Clarity and advertising measurement. This is a known limitation, not an absolute guarantee.
There is no automated export yet
Deletion exists, exporting your data in one click does not. In the meantime, write to us: your access request will be handled.
The encryption is not end-to-end
The server can read your messages. We write it here rather than let the word "encrypted" suggest otherwise: this encryption protects storage, not against the operator.
Protection for minors only covers declared birth dates
Your date of birth is requested at sign-up and for older accounts before you can continue. However, it is self-declared: no verification is performed. A false date disables guardian consent and the exclusion from Clarity and advertising measurement. This is a known limitation, not an absolute guarantee.
There is no automated export yet
Deletion exists, exporting your data in one click does not. In the meantime, write to us: your access request will be handled.
A precise question about your data?
School, company or individual: we answer about the mechanism, not with a pointer to twenty pages of terms.