Privacy policy
Last updated: September 21, 2026
This English version is a courtesy translation provided for your convenience. Only the French version is legally binding, and it prevails in case of any discrepancy.
1 legal detail to fill in frontend/src/legal/config.js before going live.
This policy explains what personal data Trifouille processes, why, and how to exercise your rights, under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
Data controller
Quentin Brugeille, 9 rue de la Vieille Douve, 44270 Machecoul-Saint-Même, France. Contact: contact@trifouille.com.
Data processed
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Uploaded ZIP archives | Reorganizing the archive and returning it to you | Performance of the contract (Terms) | Deleted from the servers as soon as processing is complete (at the latest after the organized ZIP is sent) |
| File names and paths (AI mode, Pro) | Suggesting a topic-based organization | Performance of the contract | Not kept by Trifouille; sent to Anthropic and processed under its terms for API customers |
| Email address | Creating the account, sign-in by link, subscription emails | Performance of the contract | Until the account is deleted |
| Sign-in links and sessions | Authentication and security (limiting link requests) | Performance of the contract, legitimate interest (security) | Links: 24 hours after expiry. Sessions: 30 days |
| Subscription (Stripe identifiers, status, renewal date, version of the Terms accepted and date of acceptance) | Managing the Pro subscription, proof of consent | Performance of the contract, legal obligation | Until the account is deleted; invoices kept for 10 years by Stripe (accounting obligations) |
| Sorting history (Pro): archive name, date, mode, folder tree | Letting you find your past sorts | Performance of the contract | Until the entry or the account is deleted, 200 entries maximum |
| Visit statistics (pages viewed, actions on the site, browser and device type, truncated IP address) | Measuring audience and improving the service | Legitimate interest (consent-exempt audience measurement) | 25 months maximum |
| Technical logs (IP address, requests) | Security and troubleshooting | Legitimate interest | 12 months maximum |
Trifouille never reads the contents of your files for any purpose other than reorganizing them, sells no data and uses no advertising. Audience measurement relies on Matomo, a tool hosted by the publisher itself: your browsing data is not sent to an ad network or a third-party analytics service.
Recipients and processors
- Hosting: IONOS SARL.
- Payment: Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe collects your card details directly and acts in part as a separate data controller (fraud prevention, financial obligations).
- Sign-in emails: Resend (Plus Five Five, Inc., United States).
- Audience measurement: Matomo, self-hosted by the publisher, reached through the network of Cloudflare, Inc. (United States), which routes the requests.
- AI sorting: Anthropic (Anthropic, PBC, United States), which only receives file names and paths.
Some of these providers are located outside the European Union. These transfers are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses, depending on the provider.
Cookies
Trifouille uses only one cookie: the trifouille_session session cookie, strictly necessary for sign-in (duration: 30 days). It is exempt from consent (article 82 of the French Data Protection Act), which is why no cookie banner is shown. The site sets no advertising or audience measurement cookies.
Audience measurement
Trifouille uses Matomo to count visits and understand how the service is used (for example: number of sorts, mode chosen, approximate archive size). Matomo is configured according to the recommendations of the French data protection authority (CNIL) to be exempt from consent: no cookie is set, the IP address is truncated before being recorded, your browser's “Do Not Track” setting is respected, and the data is only used for anonymous statistics, never combined with other processing or shared with third parties. No file name or archive content is ever sent to Matomo.
Your visits are currently counted anonymously. This choice is stored in this browser only.
Security
Traffic is encrypted (HTTPS). Sign-in and session tokens are only stored in hashed form, and the session cookie is not accessible to browser scripts. Archives are processed in temporary files that are deleted automatically.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set instructions regarding what happens to it after your death. You can delete your account and all associated data at any time from the account menu. For any other request, write to contact@trifouille.com. We reply within one month.
You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).