Last updated:
In short
French Levels only records what is needed to run your account and protect the site. No advertising, no data sold. Optional audience measurement is switched on only if you accept it.
Without an account, you read the site without being tracked until you accept audience measurement: no cookie, no profile.
Your account data
- your e-mail address, your display name and the interface language;
- your password, stored only in hashed form (Argon2id): nobody can read it;
- whether your address is confirmed, the sign-up date and the date of your last sign-in.
Your activity
- your preferences: level, framework, daily goal and time zone;
- your exercise attempts and answers, your progress in lessons and your points;
- your favorites and the level suggested by the placement test, if you save it.
Sessions and security log
Each sign-in opens a session. We keep the browser used, the opening date and the date of last use, so that you can see and close your sessions. The IP address is not recorded with sessions.
Security events (successful or refused sign-in, blocking, password change or reset, address confirmation, session closing, account deletion) are written to a log, with the IP address and the browser. A sign-in attempt with an unknown address only keeps the IP address there.
To limit abuse, the server also counts attempts per IP address, in memory only, for one hour at most.
Why this data
- run your account and keep your progress;
- protect accounts and the site: abuse detection and temporary blocking;
- understand how the site is found and used, only if you accept audience measurement;
- send you service e-mails: address confirmation and new password. No advertising e-mail.
This processing relies on the service you request by creating an account, and on the legitimate interest in securing the site.
Audience measurement, for its part, relies on your consent.
Cookies and browser storage
Before you agree to audience measurement, the site sets a single cookie, strictly necessary: the session cookie created when you sign in. The page's scripts cannot read it, it is only sent to the site's sign-in addresses, and it expires 14 days after its last use.
For the lifetime of a tab, the browser also keeps the action requested before signing in and the exercise in progress. This data disappears when the tab is closed.
Only with your consent, the site loads Google Tag Manager, which switches on Google Analytics audience measurement. It sets the _ga and _ga_* cookies, valid for 13 months at most, and sends Google information about your visit: pages viewed, language, type of device and browser, where you came from, IP address and the cookie's random identifier. No data from your account (e-mail address, name, identifier) is sent.
You can decline, or withdraw your consent at any time, with the “Manage my cookies” button at the bottom of every page: declining is as easy as accepting. Your choice is kept for 6 months in your browser, then asked again.
No advertising cookie is set, with or without your consent.
Retention periods
- account, preferences and activity: until the account is deleted;
- sessions: erased 30 days after they expire;
- links sent by e-mail: single-use, valid for 48 hours to confirm the address and 30 minutes to change the password;
- audience-measurement cookies: 13 months at most; your consent choice: 6 months in your browser;
- security log: 365 days, then automatic erasure.
When the account is deleted, its preferences, sessions, attempts, progress, points and favorites are erased at once. Security log entries remain until their term.
Who accesses your data
Only the people in charge of running the site access your data, for the needs of the service. No data is sold or shared for advertising purposes.
Service e-mails go through a sending provider, which only receives the recipient's address and the message.
If you accept audience measurement, Google receives the information described above, as a service provider; it may be processed outside the European Union.
Security
- encrypted connections (HTTPS);
- hashed passwords and session tokens;
- 15-minute block after ten failed sign-ins;
- detection of a reused session token, which closes all the sessions concerned.
Your rights
From your account, you can view your information, correct your display name, language and preferences, and delete your account yourself.
For any other request (access, a copy of your data, objection, restriction), write to us from the Contact page.
If you believe your rights are not respected, you can file a complaint with the CNIL.
Changes
This policy evolves with the site; the date of the last update appears at the top of the text.