Privacy policy
What FortBoyard.org collects, why, who the data is shared with, and how to exercise your rights.
Last updated: July 10, 2026
Data controller
FortBoyard.org is published by Nicolas Caligiuri, who is the controller for the processing described on this page. Any question or request about your data can be sent to contact@fortboyard.org.
What we collect when you browse
Reading the site requires no account, and no public form collects any data. The site uses no advertising pixel and no advertising tracker, and fonts are served from our own servers, with no call to Google Fonts. We do, however, measure the site's audience, under the conditions described below. The text you type into the search box is processed by our internal search engine, is not tied to any account, and is never passed to our audience measurement tool. Our hosting providers keep technical logs containing your IP address, needed to operate and secure the service.
The editorial team
Account creation is not open to the public. Only the team members who publish on the site have a sign-in, reserved for administration. That sign-in stores their username, email address, password (never in clear text, as a cryptographic hash), role and last sign-in date; signing in can be done through Google. Each contributor also has a public profile: name, biography, picture and links to their social networks, provided voluntarily and visible to everyone.
Why, and on what legal basis
We process this data so the editorial team can sign in and administer the site (performance of the service), to protect it against abuse and request forgery (legitimate interest), and to attribute published content to its authors (legitimate interest). We carry out no profiling, no automated decision-making and no marketing, and we neither sell nor rent any data.
Cookies
The site sets only cookies that are strictly necessary or exempt from consent. NEXT_LOCALE remembers your language. The authjs.session-token, authjs.csrf-token and authjs.callback-url cookies handle sign-in and protect the forms; the last two are set on your very first visit, even without an account. The _pk_id and _pk_ses cookies belong to Matomo, our audience measurement tool: the first lives thirteen months at most, the second about thirty minutes. Your sign-in session expires after thirty days, and the access token it carries after seven days. No advertising cookies.
Audience measurement
We use Matomo, which we host ourselves on an OVH server located in France. The statistics never leave our infrastructure: they are not cross-referenced with other processing, not passed to any third party, and not used for advertising. Matomo is configured to meet the exemption criteria of the French data protection authority (CNIL): your IP address is anonymised, the measurement only serves to understand how the site is used, and we strip URL parameters, so your searches and filters are never sent to it. It is on those conditions that this measurement requires no consent banner. You may nevertheless object at any time: opt out of audience measurement.
Third-party content embedded in articles
Some articles, especially the archives from the old site, embed players and posts from YouTube, Dailymotion, Vimeo, Brightcove, Facebook, Sketchfab and Google. When you open an article containing one, your browser contacts those services directly: they receive your IP address and may set their own cookies, including tracking cookies, before you have clicked anything. We do not control those cookies and we do not ask for your prior consent: this is a known limitation of the site, which we plan to fix by loading such content only after you explicitly click it. Until then, your browser settings remain your way to block them.
Who hosts and who receives your data
The site is hosted by Vercel Inc. (a US company). Our database and content server are hosted with DigitalOcean, in the FRA1 region (Frankfurt, Germany). Images and files are stored with Scaleway, fr-par region (Paris). Audience statistics stay on our own Matomo instance, hosted on an OVH server in France: no third-party provider receives them. Service emails, such as address confirmation or password reset, are sent through Google's SMTP service. If you choose to sign in with Google, Google also processes that sign-in.
Transfers outside the European Union
The data we store and the site's files are hosted inside the European Union, in Frankfurt and Paris. Vercel and Google, however, are companies established in the United States: routing requests and sending emails may involve a transfer outside the Union, governed by the European Commission's standard contractual clauses. The third-party content described above likewise causes your browser to communicate directly with servers located outside the Union.
Your rights
Anyone whose personal data we hold has the right to access, rectify, erase, restrict, object to and port it. To exercise these rights, write to contact@fortboyard.org: we will handle your request by hand, within one month. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
Security
Passwords are only ever stored as a cryptographic hash. Authentication cookies are unreadable by page JavaScript and transmitted over HTTPS only. Media uploaded through the admin, however, are stored in a public storage bucket: anyone who knows a file's exact address can reach it, regardless of the restrictions shown on the site.
Changes to this policy
This policy may change, in particular if the site gains new features. The date of the last update is shown at the top of this page.