Privacy Policy

French version is the legally binding reference · Last updated: 27 August 2026

This policy describes, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French Law No. 78-17 of 6 January 1978 as amended (Informatique et Libertés Act), how Zektyc processes personal data in the context of all its services.

1. Data Controller

The data controller is the organisation Zektyc, operated by an individual acting under the pseudonym "Riric" (also "DotRiric"), established in France. For any questions regarding your personal data: riric65@protonmail.com.

2. Data We Process

2.1 Website

The site is accessible through two distinct channels: the clearnet address https://riricdev.tail5ea5cd.ts.net, served through a tunnel provided by a third-party operator, and the Tor hidden service. The site has no forms, no newsletter, no social media buttons, and no analytics service. We do not voluntarily request, record, or process any browsing data about you. For details on the implications of each channel, see Section 2.2.

2.2 Website Access Channels: Clearnet Tunnel and Tor Hidden Service

The access channel you use determines the actual level of confidentiality of the traffic. We explain the consequences here with the greatest transparency.

a) Clearnet channel (tunnel)

The clearnet website is made accessible by means of a tunnel provided by Tailscale, Inc., a company governed by US law, using its "Funnel" feature, which exposes a public TCP port (443) to our infrastructure. The TLS (HTTPS) encryption on this channel is terminated on our own infrastructure, not on the side of the tunnel operator: Tailscale Funnel relays do not decrypt the traffic, and the content of the pages (requests, responses, exchanged content) is not technically readable by the tunnel operator. The communication between your browser and our server remains encrypted end to end. The tunnel operator nevertheless remains a US-law network intermediary, which sees connection metadata (source IP address, destination, traffic volume and timestamps) and may be called upon by a public authority to provide access in the context of an applicable legal proceeding, including under the US CLOUD Act (22 U.S.C. § 6201 et seq.). These metadata are not communicated to us by the operator, and we do not use them. For this channel, we for our part collect only the technical logs described in Section 2.3 below (which do not include the content).

b) Tor hidden service (.onion)

The Tor hidden service (http://l5cbkqmok4rnkhbtpltmtlf3pa5i5rfw23z2mtj5tugpo3quta3b5hqd.onion), by contrast, is encrypted end to end, from your browser to our infrastructure, with no TLS termination point at a third party. No intermediary operator can read the content, and your IP address remains concealed from us and from any observer. The hidden service is the most privacy-respecting channel. For this channel, we likewise process only the technical logs described in Section 2.3; the content is not read by any third party.

2.3 Technical Connection Logs

Like any server, the infrastructure hosting the site automatically generates technical logs for security purposes (prevention and handling of attacks, abuse, and saturation attempts). These logs may contain:

• the IP address of the connection;
• the date and time of the request;
• the requested resource;
• the browser type (user agent).

These logs are retained for a maximum of fourteen (14) days, then automatically deleted. They are not sold, shared, or used for profiling purposes. Their legal basis is the legitimate interest of the data controller in securing its service (Art. 6.1.f GDPR). The IP addresses contained in these logs are not cross-referenced with other sources.

A request counter per IP address is kept in server memory (RAM), with a maximum window of a few minutes, for rate-limiting purposes. This data is never written to persistent storage and is lost upon server restart.

2.4 Communication Data (Contact)

If you contact us by email (riric65@protonmail.com), Signal (notriric.05), or Discord, the information you choose to provide (email address, username, message content) is used solely to respond to your request. It is not used for marketing purposes, is not shared with third parties, and is not retained beyond the duration necessary for the exchange (Art. 6.1.a GDPR).

2.5 Vulnerability Reports (Responsible Disclosure)

If you report a vulnerability to us, in accordance with Section 12 of the Terms of Service, the information you provide (technical details, proof of concept, screenshots, any contact information) is processed solely for the purpose of assessing, fixing, and verifying the fix for the reported vulnerability. It is not shared with third parties and is deleted once the fix is confirmed (Art. 6.1.f GDPR).

2.6 Verification of an Authority or Request

When an individual presents themselves as belonging to a public authority and requests the disclosure of information, in accordance with Section 13 of the Terms of Service, the documents they provide to prove their identity and the scope of their authority constitute personal data processed temporarily. This processing is based on a legal obligation or on the legitimate interest of the controller in verifying the validity of the request. The documents are retained only for the duration of the verification, then deleted.

2.7 Discord Bot (Zektyc Bot)

The Zektyc Discord bot processes only the data strictly necessary for the provision of the service you request (Art. 6.1.b GDPR) and, where applicable, with your express consent when you solicit it (Art. 6.1.a GDPR):

• Written messages: the content of the message by which you address the bot (mention or reply), as well as the generated response, to ensure the conversation;
• Voice audio: when the bot is active in a voice channel, your voice is captured only while you are speaking, for the duration needed to transcribe it into text;
• Discord identifiers: your user ID and displayed username, used to address you and associate your messages;
• Conversation history: written exchanges and transcriptions of the current session, kept in RAM only (last twenty exchanges at most) to ensure conversation coherence.

None of this data is written to persistent storage, sold, rented, shared, or used for profiling or advertising purposes. The conversation history is reset on each bot restart.

For transcription (speech recognition) and response generation, the bot uses the Groq service (Groq, Inc., United States), acting as a processor within the meaning of Article 28 GDPR (see Section 7). The captured audio and transmitted texts are sent to Groq solely for the provision of the service; they are not retained on our end. Voice synthesis (spoken response) is performed locally, in France, without transmission to a third party.

Written messages and audio transit through the Discord platform, operated by Discord, Inc., which processes them solely for the purpose of their transmission. Discord does not implement end-to-end encryption: never send sensitive data (health data, financial data, secrets, confidential information) to the bot.

2.8 Digital Fingerprint Test (Fingerprint Test)

The digital fingerprint test accessible at /fingerprint-test (FR) and /en/fingerprint-test (EN) runs exclusively in your browser, at your initiative and on your request. The technical characteristics collected for the fingerprint calculation (canvas, rendering engine, installed fonts, audio, hardware capabilities, and more than thirty distinct signals) are processed locally, on your device, at the time you launch the test.

The test analyzes two types of fingerprints: the ZFP (browser-layer fingerprint) and the ZPD (hardware-layer fingerprint). Both are calculated by SHA-256 hashing in your browser.

The only network request made is a call to the Zektyc server's /api/time endpoint, intended to measure the clock offset between your device and the server (necessary for ZPD calculation). This call transmits no personal data; it returns only a server timestamp.

The multi-round test (3 successive rounds) temporarily uses session storage (sessionStorage) to preserve intermediate results between page reloads and enable the final comparison. These data are automatically deleted at the end of the test or when the tab is closed. No data is transmitted to third parties.

2.9 ZMap Application

ZMap is an Android application for electric vehicle trip planning. The application collects no personal data. No account is required. No tracker or analytics service is integrated.

The application communicates with the Zektyc server via WebSocket and API calls (charging stations, geographic search, routes, road speeds). These calls transit through the Zektyc server, which proxies requests to open-source third-party services:

• Overpass API (OpenStreetMap): public charging stations in Europe;
• Nominatim (OpenStreetMap): geocoding and place search;
• OSRM (Open Source Routing Machine): route calculation.

The results of these requests are cached server-side (10 minutes for stations, 24 hours for search, 12 hours for routes). The IP addresses of requests are subject to the server's technical logs (14 days maximum, see Section 2.3). The Zektyc server collects no user location or travel data.

The road speed database (90.5 million points) is built from public OpenStreetMap data and contains no personal data.

The ZMap web client accessible at /zmap/web follows the same data protection principles.

2.10 Zenyth Browser

Zenyth is software installed locally on your device (RPM package for Fedora/RHEL systems). It configures Firefox with hardening parameters (Resist Fingerprinting, font masking, WebGPU and Battery API disabling, WebRTC protection, JShelter and uBlock Origin extensions).

Zenyth communicates with no Zektyc server and no third-party server. Its configuration is entirely local. No data is collected, transmitted, or stored.

3. Honeypot (Technical Trap)

To protect the site against robots and automated intrusion attempts, the server includes a decoy system (honeypot) that mimics WordPress responses for commonly targeted paths (wp-login.php, xmlrpc.php, .env, etc.).

When a request reaches one of these paths, the sender's IP address is recorded in a local SQLite database along with: number of attempts, dates of first and last attempt, and breakdown by endpoint. These data are retained until manual deletion by an administrator via the administration panel.

This processing is based on the legitimate interest of the controller in protecting its infrastructure against automated attacks (Art. 6.1.f GDPR). The recorded IP addresses are not sold, shared, or used for profiling. They are not cross-referenced with other sources.

4. Administration Panel (Z-Panel)

The administration panel (/z-panel) is an internal tool protected by a password (hashed with Argon2id). It is not indexed by search engines (noindex, nofollow).

Administration sessions are managed by random session tokens (32 bytes, encoded in base64url) with a 24-hour lifetime. Login attempts are limited to 5 per 15-minute window per IP address. These authentication data are kept in RAM and are lost upon server restart.

The panel provides access to server access logs, request statistics, article administration, translations, and the honeypot system. These data are accessible exclusively by the administrator.

4.1 Forgejo (Zektyc Git)

A Forgejo server (/git) hosts the source code of the site and its projects, along with community contributions. Even though it is served from the same domain, it is a separate service.

When you create an account on this Forgejo, the data you voluntarily provide (username, email address, optional profile details) is stored in the database of this server, hosted on our infrastructure in France. It is neither sold, nor shared with third parties, nor used for marketing or profiling (Art. 6.1(b) GDPR). Deleting your account removes this data.

Signing in to a Forgejo account relies on session cookies (first-party, secure, limited to the /git/ path) and, if applicable, personal access tokens (API) that you generate and that are stored encrypted in the database. The content of the repositories you publish (code, pull requests, issues, comments) is intentionally public, in line with the purpose of the service. Connection IP addresses are subject to the technical logs described in Section 2.3.

5. Cookies

The website (public pages, excluding /git/) sets a single language-preference cookie, zektyc-lang. It remembers the display language you choose or that is detected (French or English), so the right version of each page is served; it carries no unique identifier, holds no browsing data other than the language, is neither read nor used for tracking, and expires after one year. It is a first-party cookie. No third-party cookie and no tracker is used. The Forgejo service (/git/) sets its own first-party session cookies, described in Section 4.1.

Your language choice is also remembered on your device (in the browser's local storage, localStorage, key zektyc-lang), as is the display theme — light or dark — (key zektyc-theme). Both preferences can be changed at any time via the language selector and the theme button at the top of every page. They are kept locally on your device and are never transmitted or retained server-side beyond the visiting cookie described above.

The digital fingerprint test temporarily uses sessionStorage only when you launch the multi-round test, to preserve results between reloads. This storage is automatically cleared at the end of the test or when the tab is closed; it does not constitute a cookie or a tracker.

6. Recipients and Sub-processors

We do not share, sell, or transmit your data to any third party, any advertising network, or any analytics provider. The site is hosted on our own infrastructure, in France, without recourse to a hosting sub-processor.

6.1 Proton Mail (Email)

Our email service is provided by Proton Mail (Proton AG, Switzerland), acting as a technical sub-processor within the meaning of Article 28 GDPR for the delivery and hosting of messages you send us. Switzerland benefits from an adequacy decision by the European Commission (Art. 45 GDPR). Proton processes these messages solely for the provision of the service.

6.2 Signal

Exchanges made via Signal transit through the servers of Signal Messenger, LLC. Signal implements end-to-end encryption: the content of messages is never accessible to a third party, including Signal.

6.3 Discord

Exchanges made via Discord transit through the servers of Discord, Inc. Discord does not implement end-to-end encryption for messages; avoid exchanging sensitive data on it.

6.4 Groq (Discord Bot)

For voice transcription and response generation, the bot uses Groq (Groq, Inc., United States), acting as a sub-processor within the meaning of Article 28 GDPR. Groq processes the audio and transmitted texts solely for the provision of the service, in accordance with the service's terms of use. See Section 2.7 and Section 7.

6.5 Open-Source Third-Party Services (ZMap)

The ZMap application proxies requests to open-source third-party services (Overpass, Nominatim, OSRM) via the Zektyc server. These services do not receive your direct IP address (it is masked by the proxy). The data exchanged relate to charging station, geocoding, or routing queries, with no link to your identity.

7. Transfers Outside the European Union

Regarding the site and infrastructure: they are hosted in France and operated within the European Union. No data processed by the site is stored outside the European Union or the European Economic Area (Art. 44 et seq. GDPR).

Regarding the clearnet channel: the tunnel making it accessible is provided by Tailscale, Inc., a company governed by US law. As explained in Section 2.2, this channel routes the encrypted (HTTPS) traffic through the operator's relays, which do not decrypt its content — the latter is only readable on our own infrastructure, where the TLS terminates. Connection metadata (source IP address, destination, volume, timestamps) nevertheless transit through a US entity; since Tailscale does not act as a processor within the meaning of Article 28 GDPR for this traffic, this passage is an accepted limitation of this access channel. It does not apply to the Tor hidden service, which remains end-to-end encrypted without a third-party intermediary.

Regarding the email contact channel: Proton Mail is operated from Switzerland, a country that benefits from an adequacy decision by the European Commission.

Regarding Signal and Discord: their servers may be located outside the European Union. Signal encrypts messages end-to-end, which Discord does not.

Regarding the Discord bot: the audio to be transcribed and the texts processed by the bot are transmitted to Groq (United States), as part of the transcription and response generation service. Groq does not appear on the list of organisations certified under the EU-US Data Privacy Framework (DPF). The transfer is governed by the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), incorporated into Groq's processing agreement (Data Processing Addendum), effective 15 October 2025 — Module 2 (controller to processor). Only the elements strictly necessary for the provision of the service are transmitted, and nothing is retained on our end.

8. Retention Periods

• Technical logs: 14 days maximum, automatic deletion;
• In-memory protection counters (RAM): a few minutes, never persisted;
• Communication data (contact): duration of the exchange necessary for your request;
• Vulnerability reports: until the fix is confirmed, then deleted within 30 days;
• Authority verification documents: duration of the verification, then deleted;
• Discord bot data (messages, audio, identifiers, history): no persistent retention; session history (20 exchanges max) is in RAM only, reset on restart;
• Fingerprint test data: no data is transmitted to Zektyc; characteristics disappear when the tab is closed;
• Honeypot data (IP addresses): until manual deletion by an administrator;
• Administration sessions: 24-hour session tokens, in RAM only;
• Forgejo accounts and repository content: kept until voluntary deletion of the account or repository by its owner; Forgejo session cookies: for the duration of the session, until expiry or sign-out.

9. Security

The services are protected by the following technical measures:

• connection encrypted in transit (HTTPS/TLS via the tunnel for the clearnet channel) and end-to-end encryption for the Tor hidden service;
• restrictive security headers (CSP, X-Content-Type-Options nosniff, X-Frame-Options, HSTS, Permissions-Policy);
• rate limiting (200 requests / 10 seconds per IP generally, 30 / minute for the ZMap API, 5 login attempts / 15 minutes for administration);
• HTTP method restriction (GET and HEAD only);
• sensitive path blocking (WordPress honeypot);
• data minimization and limited retention;
• administration passwords hashed with Argon2id (memoryCost: 65536, timeCost: 4);
• Forgejo account passwords hashed and personal access tokens encrypted (by Forgejo);
• component-based, self-hosted infrastructure in France, without CDN; the only exception is the Tailscale clearnet access tunnel (described in Section 2.2), a US-law third party.

10. Your Rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

• right of access;
• right to rectification;
• right to erasure ("right to be forgotten");
• right to restriction of processing;
• right to data portability, in a structured, commonly used, and machine-readable format;
• right to object;
• right to withdraw your consent at any time, without prejudice to the lawfulness of processing based on consent before its withdrawal (Art. 7.3 GDPR).

You also have the right not to be subject to a decision based solely on automated processing, including profiling, producing legal effects concerning you (Art. 22 GDPR). Zektyc does not make any automated decisions concerning you.

You can exercise these rights at any time by contacting us at: riric65@protonmail.com. We respond within a maximum of one month, in accordance with Article 12 of the GDPR. For any sensitive or confidential communication, prefer email or Signal over Discord.

You also have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or via cnil.fr.

Zektyc does not appoint a Data Protection Officer (DPO): such appointment is not required under Article 37 of the GDPR, as the processing carried out is neither on a large scale nor based on systematic monitoring.

11. Data Breach Notification

In the event of a personal data breach, we notify the CNIL as soon as possible and no later than seventy-two (72) hours after becoming aware of it, in accordance with Article 33 of the GDPR, unless the breach is unlikely to pose a risk to the rights and freedoms of data subjects. If the breach is likely to pose a high risk, you are also directly notified, in accordance with Article 34 of the GDPR. Given that technical logs are retained for a maximum of 14 days, the detection window is necessarily limited; this is part of our data minimization approach.

12. Visitors Located Outside the European Union

If the California Consumer Privacy Act (CCPA) applies to you: Zektyc does not sell your personal data, has never sold it, and will never sell it. No information concerning you is disclosed to third parties for monetary consideration ("do not sell").

The site honours Global Privacy Control (GPC) and Do Not Track (DNT) opt-out signals: in practice, they require no particular implementation, since no data is collected or processed for tracking purposes.

Visitors located in other jurisdictions benefit from the same guarantees. As no data is voluntarily collected, the requirements of these regulations are in practice largely moot.

13. Minors

The site is not specifically directed at minors and implements no collection mechanisms targeting them. We do not voluntarily collect any data from minors. Regarding the Discord bot, its use is subject to Discord's terms, which require users to be at least thirteen (13) years of age.

14. Changes to This Policy

We may update this policy to reflect technical or legal developments. The applicable version is the one published online; the date of the last update is shown at the top of the page.

15. Contact

For any questions regarding this policy, your rights, or to exercise your rights: riric65@protonmail.com.

French version: Politique de confidentialité (FR).