Privacy policy

Benjamin Nespoulous, sole trader (EI), 45 Avenue Lacassagne, 69003 Lyon, France, is the controller of the data described here. Contact for any privacy question: usemovingparts@gmail.com.

Payments are different. When you buy, Link (Sold through Link, LLC, and other Stripe companies) collects your payment details, billing address and tax information, and is responsible for them under its own privacy policy: stripe.com/privacy. We never see your card number. Link shares with us the details of your order: your name, email, country, plan, amounts and dates.

Account

• What: email address, name if you give one, sign-in method (email link or Google), account creation date.
• Why: to create your account and let you sign in.
• Legal basis: the contract with you.
• How long: until you delete your account.

Sign-in links and sessions

• What: a one-time sign-in token (stored hashed, valid 10 minutes), a session identifier, the browser and IP address of the session.
• Why: to sign you in and keep you signed in securely.
• Legal basis: the contract with you; our legitimate interest in security.
• How long: a session lasts 7 days, renewed while you keep using the site, then expires. Deleted with the account.

Membership

• What: your plan, its status, renewal or end date, and the identifiers Link gives us for your customer record and subscription.
• Why: to open and close access to paid components.
• Legal basis: the contract with you.
• How long: until you delete your account. The payment events we receive from Link are kept 13 months.

Download log

• What: for each file you take: your account, the component, the file, the date and time, the country the request came from, and a salted hash of the IP address. We never store the IP address itself.
• Why: to apply the hourly limit and the refund rule; to detect an account being shared or scraped.
• Legal basis: the contract with you (history, limits); our legitimate interest in protecting the library and enforcing the Licence (detection).
• How long: the IP hash and the country are kept 12 months. The list of components you took is kept until you delete your account.

Account line in files (watermark)

• What: each code file you take starts with one line containing a 12-character coded identifier derived from your account, and the date. It contains no name and no email. Only we can link it to an account.
• Why: to trace a file republished against the Licence.
• Legal basis: our legitimate interest in enforcing the Licence.
• How long: the line lives in the file you took. Once your account is deleted we can no longer link it to you.

Unusual activity flag

• What: a note when an account takes files from more than three countries within 24 hours.
• Why: to let a person check whether an account is shared.
• Legal basis: our legitimate interest in protecting the library.
• How long: 12 months.
• No decision about your account is taken by a machine alone.

Record of what you accepted

• What: the version of the terms you accepted, the date, and a salted hash of the IP address.
• Why: to be able to prove what was agreed.
• Legal basis: our legitimate interest in keeping proof; legal claims.
• How long: until you delete your account.

Emails

• What: the emails we send you about your account and your plan: sign-in link, welcome, payment problem, renewal reminder, confirmation of cancellation or deletion.
• Why: to run the service and meet our legal duties to inform you.
• Legal basis: the contract with you; legal obligation.
• How long: sending logs are kept by our email provider for 30 days.
• We send no marketing email unless you have asked for it, and every such email has an unsubscribe link.

Messages you send us

• What: your message and our reply.
• Legal basis: our legitimate interest in answering you.
• How long: 3 years after the last exchange.

Audience measurement

• What: page views, referring site, country, browser and device type, counted in aggregate by Cloudflare Web Analytics. No cookie, no identifier stored on your device, no profile of you.
• Legal basis: our legitimate interest in knowing how the site is used.

Protection against bots

• What: when you ask for a sign-in link, Cloudflare Turnstile checks that the request comes from a real browser. It looks at technical signals such as IP address and browser characteristics.
• Legal basis: our legitimate interest in keeping sign-in secure.

We use one cookie of our own: the session cookie that keeps you signed in. Cloudflare Turnstile may store a short-lived technical item on the sign-in page, only to tell people from bots. Both are strictly necessary for a service you asked for, which is why there is no cookie banner. We use no advertising cookies and no cross-site tracking.

If you sign in with Google, Google sets its own cookies on its own pages, under its own policy.

We use a small number of providers. Each acts on our instructions under a data processing agreement, except Link and Google, which are responsible for their own processing.

• Cloudflare, Inc. (United States): hosting, database, file storage, security, bot protection, audience measurement.
• Resend (Plus Five Five, Inc., United States): sending emails.
• Link and Stripe (United States and Ireland): payments, tax, invoices.
• Google (only if you choose "Sign in with Google"): confirms your identity and gives us your email address and name.

We do not sell your data and we do not share it with anyone else, unless a law or a court requires it.

Some of these providers are in the United States. Cloudflare, Resend and Stripe are certified under the EU-US Data Privacy Framework, and their contracts also include the European Commission's standard contractual clauses.

Our database and files are stored by Cloudflare, on its network. We have not pinned them to one region.

You can ask us for access to your data, a copy of it, its correction or its deletion. You can object to processing based on our legitimate interest, ask us to restrict it, and take the data you gave us to another service.

The quickest ways: your account page shows your plan, and "Delete my account" erases your account after a confirmation by email. For anything else, write to usemovingparts@gmail.com. We answer within one month.

Deleting your account erases your profile, sessions, membership record, download log and favourites, and stops any running subscription at Link. To have the data held by Link erased as well, ask Link.

If you think we have not respected your rights, you can complain to the French data protection authority, the CNIL: cnil.fr, or to the authority of the country where you live.

Moving parts is a tool for people who build websites. It is not aimed at children, and accounts are for adults.

If this policy changes in a way that matters, we tell account holders by email before the change applies.