Privacy Policy

Who is responsible

The data controller is the publisher of Sashité, a private individual established in France (see the legal notice), reachable at contact@sashite.com.

Your identity

Your identifier on Sashité is a Nostr public key. The matching private key stays with you: Sashité never receives it, and collects no email address or password — there is no sign-up.

A public key looks anonymous; legally it is not. It is pseudonymous personal data: everything published under it is linked to it, and anyone who learns the key is yours can read that history. Treat the key itself as an identity, because it is one.

What you publish is public — and effectively irreversible

The games, ratings and profile you publish are Nostr events: signed, public, and portable by design. Anyone, including services unrelated to Sashité, may copy and re-serve them. Once an event has propagated, its complete disappearance can no longer be guaranteed by anyone. Publish knowing that.

What Sashité controls, Sashité deletes: see “Your rights” below for how deletion works on our own relay, honestly stated limits included.

Technical logs

Operating the servers produces technical logs (connections, errors), which can include IP addresses — personal data too. These logs exist for security and troubleshooting, on the legal basis of legitimate interest (GDPR art. 6(1)(f)). They live in short, size-capped rotating buffers on our own server: old entries are overwritten as new ones arrive, typically within days. They are not used for profiling, analytics or advertising, and are retained no longer than French law requires of us.

Cookies and local storage

Sashité sets no advertising cookies and no tracking cookies. The one cookie it uses, sashite_lang, remembers the language you picked, for one year. Your theme choice (light or dark) is kept in your browser’s local storage. If a key is created for you in the app, it is kept in that same local storage — in plain form by default, so that no passphrase stands between you and a game; the app’s settings let you protect it with a passphrase, which then encrypts it at rest. Either way it never leaves your device.

Everything above is strictly necessary to the feature it serves, which is why French law (art. 82, loi Informatique et Libertés) requires no consent banner for it — and why you will not see one: a banner with nothing to refuse would be misleading. You can clear any of it at any time through your browser’s settings.

Your rights

You have the rights the GDPR grants — access, rectification, erasure, restriction, objection — by writing to contact@sashite.com. Portability is native: your events are already in an open format, on a relay you can read them back from. You can also lodge a complaint with the CNIL (cnil.fr).

Erasure, in practice. Ask by email, or publish a Nostr deletion request (NIP-09) — we treat both as erasure requests. Events are then genuinely removed from relay.sanki.app, our relay — not hidden, removed. What we cannot do is force relays run by others to follow: a deletion request is broadcast to them, but honouring it remains their choice. That limit is a property of the network, and we state it rather than promise around it.

Questions

See the contact page.