Draft. Last updated 19 October 2026.
Privacy Policy
We keep data to a minimum. To run the site we process a little technical data, such as your IP address, and we count visits with Google Analytics, which sets cookies from the first page you open. This page lists what we process and why.
Nothing can be bought on fakedm.app yet, and there are no accounts. The parts of this policy about buying and signing in are marked "Not available yet: applies once paid offers open".
1. Who is responsible
The data controller is Adrien Mornet, EI (entrepreneur individuel), SIREN 942 744 210. For any privacy question or request, write to contact@fakedm.app.
2. What we collect, why, and for how long
You can use fakedm.app for free without an account and without typing any personal data. Opening the site still gives us technical data (the Cloudflare logs below) and analytics data (section 3). We only have your emails if you write to us. The other rows only apply once paid offers open, if you buy or sign in.
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Technical logs at Cloudflare (IP address, browser, page requested, time, errors) | Deliver the site, security, preventing abuse, fixing bugs | Legitimate interest | 7 days at most |
| Analytics data (pages viewed, product events, device and browser information) | Count visits and see which features are used | [[TO FILL: legal basis for analytics, see CNIL guidance]] | 14 months |
| Emails you send us | Answer you, handle abuse reports and refunds | Legitimate interest, or contract when it is about a purchase | 3 years after our last exchange |
| Email address (only buyers and people who sign in) Not available yet: applies once paid offers open | Sign-in links, receipts, messages about your purchases | Contract | While your account exists, and deleted 3 years after your last sign-in or purchase |
| Stripe customer ID, purchase and credit records (offer, price, date, credits left, and for each credit used: when, the identifier of the project it unlocked and a fingerprint of that version of the conversation, which cannot be turned back into its text) Not available yet: applies once paid offers open | Deliver what you paid for, handle refunds, keep the accounts | Contract and legal obligation | 10 years, as French accounting law requires (Code de commerce, article L123-22) |
| Subscription status (active or cancelled, renewal date) Not available yet: applies once paid offers open | Give access to Unlimited | Contract | While the subscription is active, then with the purchase records |
| Email address typed into the sign-in form, and IP address, as counters that limit repeated sign-in, checkout and purchase requests Not available yet: applies once paid offers open | Prevent abuse | Legitimate interest | 3 days at most |
| Sign-in tokens (stored hashed) Not available yet: applies once paid offers open | Make the email sign-in link work once | Contract | 15 minutes, or until used |
| Session identifier (stored hashed) Not available yet: applies once paid offers open | Keep you signed in | Contract | 30 days, or until you sign out |
We do not sell your data, we do not use it for advertising, and we do not make automated decisions about you.
3. Analytics
We use Google Analytics 4, provided by Google Ireland Limited, to measure visits and how the app is used. It loads on the first page you open, without a consent banner, and sets the _ga cookies listed in section 6.
It receives the pages you view, product events (for example "template used", "project created", "image saved" and "image shared" with the image format, "export started" and "export finished" with the video format, length, whether it had a watermark and how it was encoded, error types, and clicks on "Remove the watermark"), and technical information such as the type of phone or computer, the system and the browser. Google uses your IP address to estimate your country and city, and states that Google Analytics 4 does not store IP addresses.
It never receives the text of your conversations, names, handles, images, videos or your email address. Google signals and ads personalization are turned off, and the data is kept for 14 months.
Legal basis: [[TO FILL: legal basis for analytics, see CNIL guidance]].
To stop it, block cookies for this site or block Google Analytics, for example with a content blocker. The app works exactly the same without it.
4. Service providers
These providers process data for us, under contracts that limit them to our instructions:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery and security. Once paid offers open, also the small server that handles sign-in and purchases. | Global network, United States |
| Google Ireland Limited | Analytics (section 3) | Ireland, with transfers to Google LLC in the United States |
| Stripe Payments Europe, Limited Not available yet: applies once paid offers open | Payments, invoices, billing portal | Ireland, with transfers to Stripe, Inc. in the United States |
| Resend (Plus Five Five, Inc.) Not available yet: applies once paid offers open | Sending sign-in emails | United States |
Once paid offers open, Stripe will also process some payment data as an independent controller, for example to prevent fraud and meet its legal obligations. Its own privacy policy applies to that part.
5. Transfers outside the EU
Some of these providers process data in the United States. These transfers rely on the EU-US Data Privacy Framework when the recipient is certified under it, and otherwise on the standard contractual clauses approved by the European Commission.
6. Cookies and browser storage
| Name | Purpose | Type | Duration |
|---|---|---|---|
| IndexedDB and local storage | Your projects, images and settings | Strictly necessary | Until you delete them |
_ga |
Google Analytics: tells visitors apart | Analytics | 13 months |
_ga_<ID> |
Google Analytics: keeps the state of a visit | Analytics | 13 months |
__Host-sid Not available yet: applies once paid offers open |
Keeps you signed in. Secure, HTTP-only, first-party. | Strictly necessary | 30 days |
hs Not available yet: applies once paid offers open |
Tells the page that you may be signed in, so it only checks your session when needed. Contains no personal data. | Strictly necessary | 30 days |
Strictly necessary storage does not need consent because the app cannot work without it. The Google Analytics cookies are set when you first open the site, with no consent banner. Section 3 gives the legal basis and how to block them.
7. Your rights
Under the GDPR and French law, you have the right to:
- access your data and get a copy of it;
- have it corrected;
- have it deleted;
- restrict its use;
- object to uses based on our legitimate interest;
- receive the data you gave us in a reusable format (portability);
- where we rely on your consent, withdraw it at any time, without affecting what was done before;
- give instructions about what happens to your data after your death.
To use these rights, write to contact@fakedm.app. We answer within one month. We may ask you to confirm your identity.
Not available yet: applies once paid offers open
Write from the email address linked to your account. Purchase records that accounting law requires us to keep are kept until the end of that period, but are no longer used for anything else.
8. Complaints
If you think we do not respect your rights, you can complain to the French data protection authority: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. You can also complain to the authority of the EU country where you live.
9. Security
The site is served over HTTPS only. We keep as little data as possible, and only the publisher has access to it.
Not available yet: applies once paid offers open
Sign-in tokens and session identifiers are stored hashed, so a copy of our database could not be used to sign in.
10. Age
fakedm.app is not meant for children under 15. Once paid offers open, you will need to be an adult, or have permission from a parent or guardian, to buy.
11. Changes
We update this policy when what we do with data changes, for example when paid offers open. The date at the top shows the latest version. Once accounts exist, we will also tell account holders by email about changes that matter to them.