Privacy policy
Last updated: 15 October 2026
This page explains what personal data the website neofrag-reborn.xyz and its demo demo.neofrag-reborn.xyz process, why, for how long, and how to exercise your rights. It meets Articles 12 to 14 of Regulation (EU) 2016/679, known as the GDPR, and French Law No. 78-17 of 6 January 1978, known as the “Informatique et Libertés” law.
In short
- No advertising, no audience measurement, no data sold or handed over.
- The web server keeps no log of visits.
- During your visit, your browser contacts no other website: fonts, images (even those that come from elsewhere) and the places map are served by the website itself.
- The only exception is the one you choose: a video or content from another website (YouTube, Twitch…) only loads with your consent.
- From your account, you can download all your data or delete your account yourself.
- An account left three years without a visit is deleted; an email warns you one month before, and simply logging in keeps it.
1. Who is responsible
The data controller is the publisher of the website, a private individual acting on a non-professional basis (see the legal notice).
Contact: contact@neofrag-reborn.xyz.
The website has no data protection officer: its size and activity do not require one (GDPR, Article 37).
2. What the website processes
When you visit the website
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Your session: IP address, browser, the page you came from | Make the website work (login, forms, language) and protect it | Legitimate interest (GDPR, Art. 6(1)(f)) | Deleted after one hour of inactivity |
| IP address when you log in or send a form, in the anti-abuse counters | Block robots and hacking attempts | Legitimate interest | About one day after the last attempts |
| Your preferences (time zone, theme, day or night mode) | Display the website the way you chose | Legitimate interest | In your browser (see § 3) |
Forms are protected by ALTCHA, a check computed by your browser and served by the website: no third-party service, no cookie.
If you create an account
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Username, email address, password (stored hashed, never readable), registration and last-visit dates, language | Provide your account and its features | Performance of the service you request (GDPR, Art. 6(1)(b)) | Until the account is deleted, or after three years without a visit (see below this table) |
| Optional profile: name, date of birth, location, avatar, signature, links, fields added by the website | Display it according to your visibility settings | Performance of the service | Until you erase it, or the account is deleted |
| Login history: date, IP address, host name, browser, referring page | Security of your account (you can see it in your area) | Legitimate interest | 13 months |
| “Remember me” session (if you tick the box) | Stay logged in on this device | Performance of the service | One year of inactivity at most |
| Two-factor authentication, if you enable it | Protect your account | Performance of the service | Until you disable it |
| What you publish: forum posts, comments, conversations, tickets | Publish it | Performance of the service | As long as you do not delete it; after the account is deleted, it remains under a neutral username (supprime-…) so as not to leave holes in discussions |
| Notifications and their settings | Tell you about what concerns you | Performance of the service | Until the account is deleted |
| Push notifications, if you turn them on for a device: the subscription address your browser gives, and two encryption keys | Send your notifications to that browser, even with the site closed, for the types you choose only | Consent (GDPR, art. 6.1.a), asked by your browser | Until you turn push off on that device, or the account is deleted |
| Moderation sanctions concerning you: kind, reason, dates | Enforce the website’s rules and take repeat offences into account; you see those of the past year in “My sanctions” | Legitimate interest | Three years after they end (expired or lifted; for a warning, after you received it); a sanction with no end (a permanent ban, for example), as long as it runs. After the account’s deletion, linked only to the neutral username |
Inactive accounts: an account left three years without a visit is deleted, as if you had deleted it yourself — except those of the administration team. An email warns you one month before; simply logging in keeps your account.
If you write to us
The contact form sends the subject, your message and your email address (or your username and your account's address, if you are logged in) by email to the contact@neofrag-reborn.xyz mailbox, hosted on the website's server; it does not store them in the website. They are kept for as long as it takes to reply and follow up on your request, then deleted. Legal basis: legitimate interest (replying to those who write to us).
If you subscribe to the newsletter
Your email address, which you confirm through a link received by email. Legal basis: your consent (GDPR, Art. 6(1)(a)). Kept until you unsubscribe, which you can do with the link in every newsletter; a subscription that is never confirmed is deleted after 30 days. Newsletters contain no tracker: the website does not know whether you open them.
The official Discord server
The website is connected to the project's official Discord server by a bot, which runs on the website's server.
- If you link your Discord account (with the
/forumcommand, or from your account on the website), the website keeps your Discord identifier, your username and the address of your Discord avatar. The bot then gives you, on Discord, the roles of your groups on the website and, if the option is enabled, your website username. Legal basis: performance of the service you request. You can unlink your account at any time. - The “Forum” channels of the Discord server are linked to the website's forum: a topic published on one side appears on the other, with its replies. A message written in those Discord channels is therefore also published on the website's forum, under your linked account or, without a linked account, under the appearance you choose with
/forum. Legal basis: legitimate interest (bringing the community's two spaces together). - The bug tracker: a ticket becomes a Discord thread, and the
/bugand/ideecommands open a ticket on the website.
What you write on Discord is also processed by Discord, under its own privacy policy; for the European Economic Area, the controller is Discord Netherlands BV. Discord states that it adheres to the EU–US Data Privacy Framework for transfers to its American companies.
On the demo
demo.neofrag-reborn.xyz is for trying NeoFrag Reborn. Its administration account (demo / demo) is shared: everything you enter there is visible to other visitors, and everything is erased every 15 minutes, when the demo returns to its initial state. Do not enter any real personal data there.
For other NeoFrag Reborn websites
Websites that use NeoFrag Reborn elsewhere ask this server for updates and download extensions from it. Their request carries the address of their server and the version of NeoFrag Reborn; the server keeps no trace of it.
Security and backups
- Audit log: administration and moderation actions, and logins, with the IP address and browser, are recorded for security and evidence. Legal basis: legitimate interest. Duration: one year.
- Reports: when you report content, the website keeps your report and your IP address; the address and the copy of the reported content are erased one year after the report has been handled. The member you report does not know it was you: only the moderation team knows. They only find out if you accept a mediation that a moderator offers you — a private conversation between you, that member and the moderator; if you decline, your report stays anonymous.
- Backups: before each update, the website makes a copy of itself (database included), on its own server. The five most recent are kept; the others are deleted after 30 days, and never more than ten remain.
3. Cookies and content from other websites
What the website stores
Only what it needs to work; these cookies do not require your consent (French “Informatique et Libertés” law, Article 82).
| Name | Purpose | Duration |
|---|---|---|
__Host-session | Keep you logged in and protect forms against fraudulent submissions | Until the browser is closed; one year with “Remember me” |
nf_consent | Keep your choices about services from other companies | 6 months |
nf_fuseau | Show dates and times in your time zone | 1 year |
nf_theme, nf_theme_epoch | On the demo: keep the theme you chose | 1 year |
| Browser storage | Keep your choice between day and night mode, and the layout of the list of articles | Until you clear it |
Content from other websites
A page may contain a video, a piece of music or a widget from another service: YouTube, Twitch, Vimeo, Dailymotion, Spotify, SoundCloud, Discord. Until you accept it, nothing is loaded from it: a notice takes its place and says who would receive your IP address. You can show it once, or always allow that service. Once loaded, the service applies its own privacy policy and may store its cookies.
Your choices are kept for 6 months, and can be changed at any time with the “Manage my cookies” link at the bottom of every page. To be able to prove your consent (GDPR, Article 7(1)), the website keeps a record of each choice, without your IP address, for 13 months: a randomly drawn number, the list of accepted services, the date, and your account if you are logged in.
Images from other websites (a Discord avatar, an image pasted into a message) are fetched by the website's server, then served by it: their host never sees your IP address.
4. Who receives your data
- The publisher of the website, who administers it.
- AdKyNet SAS, the hosting provider, which provides the server in France and acts as a processor (GDPR, Article 28).
- Discord, for what you publish on or through the Discord server (see above).
- Your browser’s push service — Google for Chrome and Edge, Mozilla for Firefox, Apple for Safari —, if you turn on push notifications: it carries a message encrypted for your browser only, and cannot read it.
- The services from other websites that you agree to display (see § 3).
No one else. Emails are sent by the website's own mail server, without any sending provider.
5. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to object to processing based on legitimate interest, and to receive your data in a reusable format (GDPR, Articles 15 to 22). You can withdraw your consent at any time, without affecting what was done before. You can also give instructions on what happens to your data after your death (French “Informatique et Libertés” law, Article 85).
The simplest way: from your account, on the Account security page, you can download the archive of all your data and delete your account. Otherwise, write to contact@neofrag-reborn.xyz: you will receive an answer within one month (GDPR, Article 12).
If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or at cnil.fr/plaintes (GDPR, Article 77).
6. Minors
In France, a person can consent alone to the processing of their data by an online service from the age of 15; before that, a parent's consent is also required (French “Informatique et Libertés” law, Article 45). This applies to what relies on consent on this website: the newsletter and the display of content from other websites.
7. Security
The whole website is served over HTTPS. Passwords are stored hashed (Argon2id) and cannot be read back, not even by the administrator. Two-factor authentication is offered to every member. A strict security policy prevents the browser from loading scripts or images from websites other than those described here.
8. Changes
This page may change along with the website; the date at the top shows when it was last updated. A significant change will be announced on the website.