Privacy

Data controller

Romain Maes — sole proprietor (entrepreneur individuel, EI), 63 rue Jules Ferry, 59115 Leers, France, SIREN 941 599 383.

For any question or request about your data: contact@kairn.me.

What is collected

Your email address and your name, to run your account and send you the reminders you agreed to.

Your time zone, detected by your browser. It's used for exactly two things: knowing what day it is where you are, and what time to write to you.

What you drop in — text and screenshots — along with the concepts, questions and reviews that come from it.

Usage counters: number of drops and concepts in your current period, number of reviews, current streak. They're used for the service's limits and for your progress.

Screenshots are deleted as soon as their text has been extracted. There is no route that serves them, and they don't survive a failed read either.

A fingerprint of your IP address, if you try the service without an account from the home page. It's a salted fingerprint, never the address itself: it's used to count how many trials come from the same place, and for nothing else. It's still personal data — hashing pseudonymizes, it doesn't anonymize — and it disappears with the visit, after seven days.

Cookies

Two cookies, both strictly necessary for the service: so there's no banner to accept, and nothing you could refuse without breaking how it works.

The session cookies, prefixed “better-auth.”, keep you signed in. One month, renewed on every visit.

“kairn_visite” remembers the trial you do without an account, long enough for you to recover it by creating an account. Seven days, the same lifetime as what it points to.

No advertising trackers, no audience measurement cookies, no sharing with third parties beyond the technical processors listed below.

There is audience measurement — how many visits, on which pages, from which country — but it sets no cookie and doesn't follow you from one site to another. It's described just below.

What you drop in never appears in the server logs: they carry only identifiers.

Audience measurement

Knowing how many people come by and which pages they stop on is what tells us what to fix. It's done without cookies and without a profile: Vercel's measurement stores nothing on your device and builds no identifier that follows you from one site to another.

What gets reported: the page visited, the page you came from, the country, the type of device and browser. Nothing you drop in, nothing from your account, no IP address kept — it's used to derive a visit number that changes every day, then discarded.

That's why there's no banner: with no cookie, no persistent identifier and no cross-site matching, there's nothing to ask you to accept.

Processors

OpenRouter, Inc. (New York, United States) breaks drops into concepts and writes the questions. What you drop in is sent to it for this processing, which is the service itself. OpenRouter relies on a sub-processor, OpenAI, L.L.C. (San Francisco, United States), which actually runs the models.

We have turned off, on our OpenRouter account, every option that would allow training on the data sent. OpenRouter doesn't keep the content of requests, only technical metadata (timestamp, model, token volume). OpenAI, as a sub-processor, keeps data for up to 30 days for abuse monitoring, then deletes it.

Anthropic Ireland, Limited (Dublin, Ireland), for the same processing, as an automatic fallback when OpenRouter is unavailable. Its commercial terms prohibit training models on its customers' content, and its call logs are deleted within thirty days.

Neon, LLC — a company of the Databricks, Inc. group — for hosting the database, on infrastructure located in Frankfurt, Germany.

Vercel Inc., for hosting the application, running in a European region, and for the audience measurement described above.

Plus Five Five, Inc. (Resend), for delivering emails.

Their contractual commitments were reviewed on August 24, 2026. This check is redone once a year.

Transfers outside the European Union

There are some, and it's better to say so plainly. The database is in Frankfurt and the application runs in Europe, but the companies that operate them are American, and what you drop in is processed outside the Union — by OpenRouter and its sub-processor OpenAI, with Anthropic in Ireland as the fallback.

Databricks (for Neon), Vercel and Resend are certified under the EU–U.S. Data Privacy Framework, and additionally rely on the European Commission's standard contractual clauses.

OpenRouter and Anthropic are not certified under this framework: their transfers rest on standard contractual clauses alone. OpenRouter is the processor that receives what you drop in (and passes it to OpenAI as a sub-processor), Anthropic receives it as the fallback — these are the two points to know if standard contractual clauses alone don't satisfy you.

How long

Your data is kept as long as your account exists. You can delete it at any time from Settings: the account, your drops, your concepts, their questions and all your reviews are erased immediately.

A trial done without an account, and that nobody claimed by creating an account, is erased after seven days along with everything that came from it.

The database history allows a restore up to six hours back. A deletion therefore takes effect immediately in the service, and is final six hours later at most.

Two traces remain, detached from you and with nothing that identifies you: the accounting of model calls, because money already spent can't be erased, and reports of faulty questions, which carry the text of a question to fix and not your identity.

Legal bases

Each purpose rests on one basis, and only one.

The daily reminder is on from the moment the account is created, and that's deliberate: bringing back what you dropped in at the right moment is the service itself, not a communication added on top of it. It turns off in one click, from Settings or from the link in every email.

Creating and managing your account, signing you in

Contract

Receiving your drops, breaking them into concepts, producing the questions

Contract

Scheduling your reviews and recording your answers

Contract

Sending you sign-in and confirmation emails

Contract

Sending you the daily review reminder

Contract

Sending you the evening streak alert

Legitimate interest

Counting your drops and concepts to apply the limits

Legitimate interest

Limiting abuse and automated drops

Legitimate interest

Handling your reports on questions

Legitimate interest

Measuring overall use of the service

Legitimate interest

Your rights

You can take your data with you at any time from Settings: a file containing your drops, your concepts, their questions, your reviews and your progress.

You can delete your account from the same screen, without having to write to anyone.

You can turn off emails in one click, from Settings or from the link in each of them. Once they're off, nothing is sent except the sign-in code — without it, no one could get into their account anymore.

You also have the right to rectification, to object and to restriction. For those, write to contact@kairn.me, or by post to Romain Maes, 63 rue Jules Ferry, 59115 Leers, France. Post is the way to go if you need to enclose proof of identity.

Supervisory authority

If you believe the processing of your data is not compliant, you can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL).

3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — 01 53 73 22 22 — www.cnil.fr