隐私

In short

Without an account, we collect nothing. Turning your images into patterns happens entirely inside your browser: your photos and drawings are never sent to our servers. Your projects, your bead stock and your settings stay on your device.

An account serves one purpose: finding your creations again on another device. What we keep in that case is described below.

Who is responsible

The controller of this processing is the site's publisher, a private individual acting in a non-professional capacity (see the legal notice). They can be reached at contact@beads-studio.com, the address to which any request about your data should be sent.

What we process

• Your email address, to identify the account and let you recover it if you forget your password.
• Your password, never stored in clear text: only a derived fingerprint (scrypt) is kept. Nobody — not even the publisher — can read it.
• Dates of account creation and last visit, the display language, and the browser identification of open sessions, so you can spot a login you do not recognise.
• The projects you send online: the bead grid, its name and its thumbnail. Only those you send deliberately.
• A technical log: account creations, logins, failed logins, emails sent. It exists to detect abuse and to help you when something goes wrong.
• Site traffic, in a form that cannot identify you: see “Audience measurement” below.

Cookies

Two cookies at most, both necessary to run the site: bs_locale remembers the language you chose, and bs_session — set only if you sign in — keeps your session open. No analytics cookie, no advertising tracker — which is why this site does not throw a consent banner at you. Traffic is measured, but without storing anything on your device: see the next section.

The application also uses your browser's local storage to keep your projects and settings on the device. That information never reaches us, and disappears if you clear the site data.

Audience measurement

We count visits to know whether the site is useful to anyone, and which pages matter. That counting is done by us, on our own server. No outside tool is involved: no Google Analytics, no other third-party service. Nothing you do on this site is passed to another company.

For each page opened, we record:

• the page viewed and the language it was shown in;
• the domain name of the site that sent you here, if any — never the full address of the page you were reading;
• whether you are on a phone or a computer;
• a technical fingerprint, computed from your IP address, your browser and a secret number that changes every Monday. Its only purpose is to avoid counting the same person twice within a week.

Your IP address is never stored: it is used to compute the fingerprint and then immediately forgotten. The secret number itself lives only for the current week and iserased as soon as the next one starts: past weeks' fingerprints then become impossible to recompute, the secret that produced them being gone. So we know how many different people came during a week, without ever being able to follow anyone from one week to the next, recognise them, or tie those visits to an account.

These measurements only produce aggregate statistics, are never combined with other data and are shared with no one. They are kept for thirteen months, then deleted. That is what exempts this measurement from requiring your consent, in line with the French data protection authority's guidance.

Legal basis and retention

Processing rests on performing the service you asked for (GDPR article 6.1.b) and, for the technical log, on our legitimate interest in protecting the service against abuse.

• Account data is kept for as long as the account exists.
• Deleting the account — possible at any time from the account page — immediately erases the account and the projects it holds.
• Database backups are kept for fourteen days before being destroyed, so a deleted account may survive there until that deadline.

Who sees this data

It is neither sold, rented, nor passed on for advertising purposes. Only the providers strictly needed to run the service are involved:

• OVH SAS — hosting of the site and the database (France).
• Brevo (Sendinblue SAS) — sending service emails (France).
• Cloudflare, Inc. — anti-robot check when creating an account (your IP address is passed to it) (États-Unis / Union européenne).

The anti-robot check is the only processing that may involve a provider outside the European Union; it receives your IP address only, and only when you create an account.

Your rights

You have the right to access, correct, erase, object to and port your data. In practice:

• Get your creations back: the .perler export button gives you a complete copy, usable elsewhere, without asking us anything.
• Erase your account: from the account page, with one button.
• Anything else: contact@beads-studio.com. We answer within a month.

You may also lodge a complaint with the French data protection authority (CNIL, cnil.fr) or with the authority of your own country.

Minimum age

The application can be used without an account at any age, and nothing is collected then. Creating an account, however, is reserved for people aged 15 or over; below that, it requires the agreement of a parent or guardian.

Security

Traffic is encrypted (HTTPS), passwords are derived and never stored in clear text, sessions can be revoked, and login attempts are rate-limited. Should a data breach put you at risk, you would be informed.