Privacy policy

Updated: October 19, 2026

Cortège collects as little data as possible. Nothing is sold or shared for commercial purposes, and what you follow is never used for advertising.

Data controller

Cortége, Paris. Contact: info@corege.me

If you visit without an account

• Cortège records nothing about you. The host keeps technical logs (IP address, requested page, browser) for security and to run the service.
• Your country, derived from your IP address by the host, is only used to pick the language and the country shown on the map. It is not stored.
• Article previews are read by our servers, not your browser: news outlets receive nothing about you.

If you create an account

• Your account is tied to your email address. We keep that address, when the account was created, when the address was verified and, if you choose one, a hash of your password (scrypt): the password itself is never stored.
• If you sign in with Google, Google sends us your email address, name and picture. Only the address is kept in our database; your name and picture stay in the encrypted cookie on your device.
• Verification and password-reset emails are sent through our domain host’s mail service (IONOS). Their links work once and expire after 24 hours (verification) or 1 hour (reset).
• Your profile holds the countries and places you follow and your map settings. It is private.
• Following protests can reveal political opinions, a protected category of data (GDPR article 9). Follows are only stored with your explicit consent, asked on your first follow. You can withdraw it at any time by deleting your data. Map settings rely on providing the service you ask for (article 6.1.b).

Witness reports

• A published report only contains its type, a position rounded to about 100 m, the crowd size and a video link if given, and its time. It is public and anonymous: your account is never shown.
• Being at a protest can reveal a political opinion (GDPR article 9): each report asks for your explicit consent. For the report’s lifetime we keep a hashed fingerprint of your account, to limit the number of reports and prevent double votes.
• A report disappears automatically after one to three hours (up to six with confirmations), together with the fingerprint and votes. It is removed sooner if it gets several abuse reports.
• “Use my location” reads your location in the browser, only if you allow it. It is only sent if you post, and rounded.

Videos

Suggested videos are found by our servers (YouTube, web search, Mastodon) and are not hosted by Cortège. Until you play a video, your browser only loads its thumbnail. Playing a video loads the platform’s player (YouTube in no-cookie mode, TikTok, or the original Mastodon server), which then receives your IP address and may set its own cookies under its own policy.

Advertising

• Direct ads are chosen by the country shown on the map, never by who you are. We only count total views and clicks per ad and per month.
• If Google AdSense ads are shown, Google acts as an independent controller and asks for your consent through its own message. See Google’s policies.

Third-party services loaded by your browser

The map loads the Leaflet library from unpkg.com and base maps from CARTO or OpenStreetMap. As with any web page, these services receive your IP address and browser information.

Recipients and processors

• Vercel Inc. (hosting, USA), under the EU–US Data Privacy Framework.
• The provider of the Redis database that stores accounts, profiles and reports.
• Google (YouTube Data API), Brave (web search) and the Mastodon server queried, which receive the name of the place searched, never data about you.
• Google (authentication), if you sign in with Google.
• IONOS (sending account emails).

Retention

• Account and profile: until you delete them from your profile.
• Reports, account fingerprint and votes: one to six hours, then deleted automatically.
• Sign-in cookie: 30 days, or until you sign out.
• Advertising statistics: monthly totals, with no personal data.
• Technical logs: according to the host’s retention period.

Your rights

You have the rights of access, rectification, erasure, portability, restriction and objection, and the right to withdraw consent. From your profile you can download and delete your data in one click. For anything else: info@corege.me. You can also complain to your data protection authority (in France, the CNIL).