Privacy Policy

1. Data Controller

The data controller for personal data is the administrator of the APRMP platform.

Contact: admin@aprmp.org

2. Data Collected

We collect the following data:

• Account data: email address, password (hashed with argon2id), participation motivation, registration date.
• Experimental data: generated Perlin images, chat conversations (questions and answers), ratings and comments on other participants' results.
• Technical data: session cookies, language preference, action timestamps.

3. Purpose of Processing

Data is collected as part of a scientific study on signal perception in random noise. It is used to:

• Manage your account and authenticate your sessions.
• Store your experimental results for scientific analysis.
• Enable anonymous rating between participants.
• Compare results between random sources (PSR vs QRNG).

4. Legal Basis

Processing is based on your explicit consent, given when creating your account.

5. Data Retention

• Account data: retained while your account is active, deleted 30 days after account deletion.
• Experimental data: retained for the duration of the scientific study. If your account is deleted, results are anonymized (the link to your identity is removed).
• Sessions: automatically deleted after 7 days of inactivity.

6. Your Rights

Under GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data.
• Right of rectification: correct inaccurate data.
• Right to erasure: delete your account and personal data. Experimental results will be anonymized.
• Right to data portability: receive your data in a structured format (JSON).
• Right to object: object to the processing of your data.

To exercise these rights, contact: admin@aprmp.org

You can also delete your account directly from your account page.

7. Security

• Passwords are hashed with the argon2id algorithm.
• Session cookies are httpOnly and signed.
• Connections are protected by HTTPS (Let's Encrypt).
• Data access is restricted by a role system (experimenter / administrator).

8. Data Transfers

No data is transferred to third parties. Data is stored on o2switch servers in France.

9. Changes

This policy may be updated. The last modification date is indicated below.

Last updated: April 2026