Skip to content
eFountain
Sign in

Privacy Policy

1. Who we are

eFountain (efountain.net) is operated by a French single-shareholder company (SASU) currently in formation, which is the data controller for the processing described here. Its full registration details will be published in our Legal Notice once incorporation is complete. Contact: contact@efountain.net.

2. What we collect — and nothing more

We collect the minimum the fountain needs to work:

  • your email address (account, magic links, wish certificates);
  • a hash of your password if you set one — never the password itself;
  • your wishes: the text of kept wishes (never displayed unless you ask us to publish it), and only the encrypted form of sealed wishes;
  • your coin ledger: purchases, gifts, free coin, tosses — the accounting of your coins;
  • your language preference.
  • the messages you send us through the contact form, with the email address you gave there.

3. Sealed wishes: we cannot read them

Sealed wishes are encrypted in your browser before they reach our servers, with a key derived from your password. We store only the encrypted text. Nobody at eFountain can decrypt it — this is a technical property of the system, not just a promise.

Consequence: if you reset your password, the key is lost and your sealed wishes become permanently unreadable. We warn you before any reset.

4. Cookies

We use exactly two cookies: a session cookie (to keep you signed in) and a language preference cookie. Both are strictly necessary for the service.

There are no tracking cookies, no advertising cookies, no third-party analytics. Nothing to consent to, nothing following you around.

5. What we use your data for

We use your data to operate the service: manage your account and coins, publish and moderate wishes, and send transactional emails (magic links, wish certificates).

We never sell your data. We never share it with third parties except the technical providers strictly necessary to run the service (hosting, email delivery, payment processing), each bound to process it only on our instructions.

6. How long we keep it

Account data (email, password hash) is kept while your account exists, then deleted within 30 days of account closure.

The coin ledger is kept for 10 years, matching both coin validity and French accounting retention obligations.

Wishes that were hidden by moderation are retained internally for audit purposes, unlinked from any published content.

Messages sent through the contact form are kept for 12 months, then deleted automatically.

Server logs are kept for a maximum of 12 months.

7. Your rights (GDPR)

You have the right to access, rectify, erase and receive a copy of your personal data, and to object to or restrict its processing. Write to contact@efountain.net and we will respond within one month.

If you believe we mishandle your data, you can lodge a complaint with the CNIL (cnil.fr), the French supervisory authority.

8. Where your data lives

The service is hosted by IONOS in data centers located in the European Union. Your data does not leave the EU.