Privacy

Authentication and retention

Before consent

The minimum registration preview and 42 access token stay only in a RAM-backed pending store for at most ten minutes. That store has no persistent volume, snapshots, append-only file, or backup. The consent page does not request your avatar or any third-party asset.

After consent

With required account-storage consent, 42calculator stores an internal account identifier, your immutable 42 identifier, login, display name, profile-image URL reference, account status, timestamps, and a purpose-specific consent ledger. It does not store your email, cursus, projects, wallet, campus information, raw profile response, authorization code, or access token as part of registration.

Separate optional purposes

Product analytics and machine-learning training are independent, optional, and off by default. Analytics is limited to a first-party, pseudonymous event allow-list retained for no more than 30 days. Machine-learning permission is limited to improving project-duration estimates and study planning inside 42calculator; training snapshots expire within 90 days. Neither processing pipeline is active in the current authentication slice.

Account settings show the current notice, version, text hash, grant state, and relevant timestamps. Either optional choice can be granted or withdrawn there without losing account access. Withdrawal stops new eligibility immediately and applies the deletion or retraining promises in that notice.

Backups and deletion

Deleting your account removes live data immediately and revokes all known sessions. Encrypted immutable database backups may retain a copy for disaster recovery for no more than 30 days. They are not used to restore an individually deleted account into the live service.

Sessions

The browser receives an opaque, secure cookie. Server-side sessions expire absolutely after seven days and are deliberately excluded from backup; complete session-store loss signs everyone out.