Privacy policy
Your Mafyou IT account
What your account keeps, why, where, for how long, and how to erase it all. No jargon.
- Last update
- October 18, 2026
In short
Your Mafyou IT account works on this site and in the member area of the Mafyou IT apps. This page says what it keeps on our servers. What each app keeps on your phone is in its own policy.
- ✅ We keep only what is needed: your e-mail address, your username, a fingerprint of your password (never the password itself), the state of your subscription and what your apps sync.
- ✅ No advertising, no audience measurement, your data is never sold.
- ✅ Your account is hosted in France, on Microsoft Azure.
- ✅ You delete your account whenever you want: its data is erased at once.
Who looks after your data
Data controller
Mafyou IT
Mathieu Dupleix, sole proprietor (entrepreneur individuel, EI) - SIRET: 882 983 612 00012
200 rue de la Croix Nivert, 75015 Paris, France
Email: contact@mafyouit.tech
Publication director: Mathieu Dupleix (Mafyou)
For any question about your data, write to contact@mafyouit.tech or use the help and support page.
What your account keeps
You create your account on this site or in the member area of an app. Here is what it keeps.
| Data | Why |
|---|---|
| E-mail address | To sign you in, confirm your address and write to you about your account. |
| Username | The name shown in the member area and in the e-mails. It is unique. |
| Password | Never kept as such: only a fingerprint that cannot be reversed (an ASP.NET Core Identity hash). |
| Account type | Member or investor, depending on the sign-up form you used. |
| Dates | When the account was created and when you last signed in. |
| Sign-in security | Whether your address is confirmed, the number of wrong passwords in a row (five lock the account for 15 minutes) and a security code renewed each time the password changes. |
| Sessions | To keep you signed in: a session token, its dates (it expires after 7 days, or 30 with "Remember me") and the IP address the sign-in came from. |
| DevLife trial and subscription | See DevLife trial and subscription. |
| Biometric sign-in devices | Only if you turn it on in an app: the name of the app, the phone model, when it was turned on and last used, and a non-reversible fingerprint (SHA-256) of the secret given to the phone. Twenty devices at most. Your fingerprint and your face are checked by the phone and never leave it. |
| E-mails sent | For each confirmation or forgotten-password e-mail: its type and the date it was sent. |
We never ask for your name, phone number, postal address or date of birth.
What your apps sync
Six apps have a member area, in their Android version (it is hidden on iPhone). When you sign in there with your account and your DevLife trial or subscription is active, the app copies its data to your account: you get it back on another phone, and you see your figures on this site.
| App | What is copied to your account |
|---|---|
| Commandements | Your history: how many tasks were done and planned, per day, per week and per category (title and icon of the category). |
| Fit Chronos | Your sessions: date, type, work and rest times, sets, cycles, notes and the detail of the timers. |
| Quizz IA | Your latest games: date, themes, number of questions, names and scores of the players. |
| Boost Your Mind | Your latest motivation messages: text, date, and whether they are favourites. |
| Fast Notes | Your note pages and the text of your notes. |
| Mensu Tracker | Your measurements: who is measured, species, kind of measurement, value, unit and date. |
The page of your figures, in the member area, reads this data at each visit to work out your week. The site keeps no copy of it.
What it is used for
| To | Data | Legal basis (GDPR) |
|---|---|---|
| Run your account and sign you in | E-mail, username, password fingerprint, sessions | Performance of the contract: the service you ask for |
| Sync your apps and show your figures | Synced data | Performance of the contract; for the measurements of Mensu Tracker, which can tell about health, your explicit consent, asked by the app before the first backup |
| The free trial and the DevLife subscription | State of the trial and of the subscription, Stripe identifiers | Performance of the contract; legal obligation for invoices |
| The account e-mails | E-mail, username | Performance of the contract |
| Answer your help requests and beta test feedback | What you write in the form | Consent (the box you tick) |
| Security: logs, abuse limits, account lock | IP address, e-mail or account identifier | Legitimate interest: protecting your account and the servers |
DevLife trial and subscription
- Free trial: 7 days, once per account, no card needed. Your account keeps its start and end dates.
- Subscription: you pay on the payment page of Stripe. Your card is typed in at Stripe and never reaches our servers. We send Stripe your e-mail address, the identifier of your account and the plan you chose (monthly or yearly).
- What your account keeps: the Stripe customer and subscription identifiers, the plan, the start and end dates, and whether the subscription is active. Stripe keeps the details of the payments and the invoices.
- Purchases in the apps: they go through Google Play or the App Store, under their own rules. They are not recorded on your account.
E-mails
Your account sends you five kinds of e-mails, and nothing else: no newsletter, no advertising.
- the confirmation of your e-mail address;
- the link to choose a new password, when you forgot yours;
- the confirmation that your account was deleted;
- the confirmation that your DevLife subscription is cancelled, with the day it takes effect;
- on the yearly plan, a reminder one to two months before the renewal, as the law asks.
They are sent through Mailjet, and through Brevo when Mailjet fails. These services receive your e-mail address and the text of the e-mail, which may contain your username.
Cookies
The site only sets the cookies it needs to work.
| Cookie | Role | Lifetime |
|---|---|---|
katalog.lang |
Remember your language, French or English | 1 year |
katalog.member |
Keep you signed in to the site | 2 hours, or 30 days with "Remember me" |
katalog.session |
Link your visit to your session on the server, which holds your sign-in tokens | Until the browser closes; the session expires after 2 hours without activity |
katalog.access, katalog.refresh |
Only with "Remember me": sign you back in without typing your password again | 30 days |
.AspNetCore.Antiforgery.… |
Protect the forms against forged submissions | Until the browser closes |
No advertising or audience-measurement cookie. That is why the site does not ask for your consent to cookies.
The site loads its font (Inter) from Google Fonts: your browser then contacts Google's servers, which receive your IP address.
Help and beta test forms
- Help and support: the app concerned, your e-mail address, the subject and your message.
- Beta test feedback: the app, Android or iOS, two marks out of 5 and, if you wish, your remarks and your e-mail address.
They go into no database: they reach us by e-mail, at contact@mafyouit.tech, sent through Mailjet (or Brevo). We only use them to answer you. Write to us if you want them erased.
Logs and IP addresses
The servers write technical logs to spot failures and abuse. They may contain your e-mail address or your username (for example "successful sign-in for…"), the identifier of your account, the app concerned, the page requested and the errors. Never your password.
- Logs of the site: 7 days at most, then they erase themselves.
- Logs of the account server and of the app services: 14 days at most. They may also go through Azure Application Insights, the monitoring tool of Microsoft Azure.
The IP address that calls our servers (your phone's, when an app calls them) is also used to limit the number of attempts: sign-in, sign-up, forgotten password, forms. It stays in memory for the time of the count, from one minute to 24 hours, and is never written to a database.
Hosting and service providers
The site, the account server, the app services and the database of your account are hosted by Microsoft Azure, in France (France Central region, in Paris).
Each provider only receives what it needs for its service:
| Provider | For | Its policy |
|---|---|---|
| Microsoft Azure | Hosting | privacy.microsoft.com |
| Stripe | Paying the subscription | stripe.com/privacy |
| Mailjet | Sending e-mails | mailjet.com |
| Brevo | Sending e-mails, as a backup | brevo.com |
| Google Fonts | The font of the site | policies.google.com |
We never sell, rent or hand over your data to anyone.
How long
| Data | Kept |
|---|---|
| Account, subscription, synced data, records of e-mails sent | Until you delete your account |
| Sessions | A session expires after 7 days, or 30 with "Remember me"; its record is erased with the account |
| Biometric sign-in devices | Until you turn the option off, change your password or delete your account |
| Logs | 7 days at most for the site, 14 days at most for the servers |
| IP addresses of the abuse limits | In memory, 24 hours at most |
| Messages from the forms | In our mailbox, for the time it takes to handle your request |
| Payments and invoices | At Stripe, for as long as the law requires |
An account is never deleted on its own after a time without sign-in: you decide.
Deleting your account
On this site: member area → "Delete my account". Or in the member area of an app, on Android. You are asked for your password again.
- Your account is closed, so that no app writes while it is being erased.
- If you have a DevLife subscription paid through Stripe, it is cancelled at once: nothing more is charged.
- Everything your apps synced is erased, along with your biometric sign-in devices and the records of e-mails sent.
- Your sessions, then your account, are deleted, and you get a confirmation e-mail.
If a step fails, your account is kept and put back in service, and you are told: nothing is said to be erased when it is not.
What stays
- The data of your apps on your phone: uninstall the app to erase it.
- Payments and invoices, at Stripe, as the law requires.
- Logs, until they erase themselves (14 days at most).
- The automatic backups of the database made by Microsoft Azure, until they expire.
- The messages you sent us through the forms: write to us to have them erased.
Your rights
The GDPR gives you these rights over your data:
- Access and portability: download a copy of your data from your member area ("Download my data"), in a machine-readable file (JSON). You can also ask us for it by e-mail.
- Rectification: to correct your username or your e-mail address, write to us. Your password you change yourself, with "Forgot password".
- Erasure: delete your account (see above), or ask us to erase only the data of one app.
- Objection and restriction: you can object to a processing or ask us to put it on hold.
- Withdrawing consent: at any time, without effect on what was done before.
For all of this, write to contact@mafyouit.tech. We answer quickly, and within one month at the latest, as the GDPR provides.
Complaint to the CNIL
If you believe your rights are not respected, you can complain to the French data protection authority (CNIL), on its complaint page, in French: www.cnil.fr/fr/plaintes
Security
- Every connection goes over HTTPS.
- Your password is only kept as a fingerprint, and five mistakes lock the account for 15 minutes.
- Changing your password removes every biometric sign-in device.
- The sign-in cookies cannot be read by the scripts of the pages.
- The number of attempts is limited on sign-up, sign-in and forgotten password.
Found a security flaw? Write to us at once at contact@mafyouit.tech.
The policies of the apps
Each app has its own policy, in French, which says what it keeps on your phone and what it sends:
Updates to this page
When what your account does changes, this page changes too, with its new date at the top.
- October 18, 2026: cancellation and yearly renewal reminder e-mails; publisher named as a sole proprietor (EI).
- October 17, 2026: first version.