Verso: privacy policy

Data controller

Mathieu Ferran, sole trader (entrepreneur individuel), trading as 7Sail Studio. Email: verso@mathieuferran.com.

1. What stays on your computer

• Your consultations and journal, your notes, the practitioner edition licence key, your settings, and the draft of a message not yet sent.
• These files are kept in a folder whose location Verso shows you. Verso sends them to no one, and the publisher has no access to them.
• Verso does not encrypt these files. They are protected by the permissions of your Windows account.
• If you installed Verso from the Microsoft Store, these files live in the application's own storage, and Windows deletes them when you uninstall. Export your journal before uninstalling.

2. The "Write to us" message

• When: only when you click Send, or Resume after an interrupted send. Nothing is sent when you open the form or while you type.
• What is sent: the subject, the message, your email address if you give one to receive a reply, and Verso's version, edition and language, shown before sending. A random message identifier and its date are added. No reading, journal, file, licence key or identifier of your computer is sent.

The route:

• Verso's relay, hosted by Cloudflare at contact-verso.mathieuferran.com, receives the message and sees your IP address, as any server does. To limit the number of sends, it replaces the address with an encrypted fingerprint (HMAC), erased after ten minutes. It stores neither your IP address in clear nor the message content. It keeps a receipt for thirty days, without the content, to avoid a duplicate if you resume a send.
• Resend then delivers the message by email. Resend states that technical data is retained for thirty days. No open or click tracking is enabled.
• Cloudflare routes the email to the verso@mathieuferran.com inbox, hosted by Google (Gmail).

• Use: to reply to you, and to improve Verso. A useful idea is recorded without your contact details.
• Retention: correspondence is kept for twelve months after the last message, then deleted. You can ask for earlier deletion.

3. The new version check

• When: only if you chose "Allow". The check then runs each time Verso starts, and when you turn it on in Settings.
• What is sent: an empty request to itch.io's public interface, asking for the latest Windows version number. itch.io sees your IP address and processes it under its own policy. No reading, note, licence key or identifier is sent.
• What comes back: a version number. Nothing is downloaded or installed automatically.
• Your choice: you can turn the check off at any time in Settings. Without a connection, Verso works normally.
• The Microsoft Store version does not include this check: its updates come through the Store.

4. Third parties that receive data

• Hosting and routing: Cloudflare, for the message relay and email routing.
• Email delivery: Resend.
• Mailbox: Google, which hosts the inbox.
• Distribution: itch.io, for the version check and for purchase and download on itch.io. Microsoft, for acquisition, any payment, installation and updates through the Microsoft Store.

Each processes this data under its own privacy policy. The publisher sells and rents no data.

5. Security

• Both connections use HTTPS (TLS) only, to fixed addresses, without following redirects.
• The key that authorises sending emails stays on the server, never in the application.
• The relay writes no activity log, and keeps neither message content, email addresses nor IP addresses in clear.

6. Your choices and access to your data

• Data on your computer: you access it directly. The journal's Export button writes your consultations to a readable JSON file that you can copy or keep elsewhere. You can delete a note, or delete Verso's folder.
• Messages: nothing is sent without your click, and a draft can be deleted. To get a copy of your correspondence, correct it or delete it, write to verso@mathieuferran.com.
• Version check: it starts only after "Allow", and is turned off in Settings.

7. Legal bases

• The message: the publisher's legitimate interest in answering the request you send (GDPR, Article 6(1)(f)). Send limiting, which protects the relay from abuse, rests on the same basis.
• The version check: your consent (Article 6(1)(a)), which you can withdraw at any time in Settings.

8. Transfers outside the European Union

Cloudflare, Resend, Google, itch.io and Microsoft are companies based in the United States, where your data may be processed. Cloudflare, Resend, Google and Microsoft are certified under the EU–US Data Privacy Framework, which the European Commission recognises as providing adequate protection, and also provide for standard contractual clauses. itch.io is not certified. It receives your IP address directly from your computer, only if you have allowed the version check, and processes it under its own policy.

9. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent. Write to verso@mathieuferran.com; you will get an answer within one month. Data kept on your computer is in your hands alone: the publisher can neither read nor delete it. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

10. Updates to this policy

This policy describes Verso 1.1.3 and the Microsoft Store version. Any new feature that sends data off your computer will be described here before it is released, and the date at the top of the page will be updated.