fix(lang/priv): textes factuels sur le cookie de langue ; le site pose désormais un unique cookie de préférence de langue (zektyc-lang) et non 'aucun cookie'

public/privacy-policy/en/index.html

@@ -27,7 +27,7 @@
       <p class="legal-meta">French version is the legally binding reference · Last updated: 27 August 2026</p>
 
       <div class="legal-box">
-        <p><strong>In short: none of our services voluntarily collect your browsing data.</strong> No trackers, no analytics, no share buttons, no third-party tracking services. The website is a showcase site. The digital fingerprint test runs entirely in your browser. The ZMap application collects no data. The Discord bot processes only the current conversation data, ephemerally. The Zenyth browser is a local application that communicates with no server.</p>
+        <p><strong>In short: none of our services voluntarily collect your browsing data.</strong> No trackers, no analytics, no share buttons, no third-party tracking services. The website is a showcase site: it sets a single language-preference cookie (<code>zektyc-lang</code>) and nothing else, see <a href="#cookies">section 5</a>. The digital fingerprint test runs entirely in your browser. The ZMap application collects no data. The Discord bot processes only the current conversation data, ephemerally. The Zenyth browser is a local application that communicates with no server.</p>
       </div>
 
       <p>This policy describes, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French Law No. 78-17 of 6 January 1978 as amended (Informatique et Libertés Act), how Zektyc processes personal data in the context of all its services.</p>
@@ -110,8 +110,9 @@
       <p>Administration sessions are managed by random session tokens (32 bytes, encoded in base64url) with a 24-hour lifetime. Login attempts are limited to 5 per 15-minute window per IP address. These authentication data are kept in RAM and are lost upon server restart.</p>
       <p>The panel provides access to server access logs, request statistics, article administration, translations, and the honeypot system. These data are accessible exclusively by the administrator.</p>
 
-      <h2>5. Cookies</h2>
-      <p>The site uses <strong>no cookies</strong>, neither first-party nor third-party, no trackers, and no persistent local storage (localStorage, IndexedDB). No consent banner is therefore required under Directive 2002/58/CE (ePrivacy) and the GDPR.</p>
+      <h2 id="cookies">5. Cookies</h2>
+      <p>The site sets a <strong>single language-preference cookie</strong>, <code>zektyc-lang</code>. It remembers the display language you choose or that is detected (French or English), so the right version of each page is served; it carries no unique identifier, holds no browsing data other than the language, is neither read nor used for tracking, and expires after one year. It is a first-party cookie. No third-party cookie and no tracker is used.</p>
+      <p>Your language choice is also remembered on your device (in the browser's local storage, <code>localStorage</code>, key <code>zektyc-lang</code>) and can be changed at any time via the language selector at the top of every page. These preferences are kept locally on your device and are never transmitted or retained server-side beyond the visiting cookie described above.</p>
       <p>The digital fingerprint test temporarily uses <code>sessionStorage</code> only when you launch the multi-round test, to preserve results between reloads. This storage is automatically cleared at the end of the test or when the tab is closed; it does not constitute a cookie or a tracker.</p>
 
       <h2>6. Recipients and Sub-processors</h2>