Privacy policy

2. The data we collect

Account

• first and last name (optional);
• email address (required — it is your login);
• password, stored hashed — never in clear text;
• internal account ID, creation date, last login date.

Content you create

• photos and images you upload, together with their folders and names;
• technical photo metadata (capture date, orientation, dimensions, device model) read from EXIF data;
• messages published on your screens;
• your dashboards and widget configuration: weather city, RSS feed addresses, camera or web page URLs, and any credentials you enter yourself for those sources.

Screens (Players)

• unique device identifier (UUID), hostname, the name you give the screen;
• operating system, Player version, display resolution;
• name of the Wi-Fi network (SSID) the screen is connected to;
• last activity date, monitoring screenshots and technical error logs, used for diagnostics.

Sessions and security

• session token, stored hashed on the server;
• device name (make and model) and platform, so you can recognise your active sessions;
• token creation, last-use and expiry dates;
• email address and IP address of login attempts, successful or failed, to block brute-force attacks.

Service keys

• the WeatherAPI.com key you provide, if you choose to use your own weather key. It is optional.

Website

• a PHP session cookie and your language preference (see the Cookies section);
• whatever you type into the contact form: name, email address, subject and message. It is used only to reply to you.

What we do not collect

• No location data: the apps never request location permission; the weather city is simply typed in.
• No access to your photo library: images are sent through the system picker or the iOS / Android share sheet, and we never browse your device storage.
• No payment data, no profiling, no advertising or analytics trackers.

3. Why we process it, and on what legal basis

4. What we never do

• We never sell, rent or trade your data to anyone, for any commercial purpose.
• We show no advertising and carry out no advertising profiling.
• We use no analytics tools and no third-party analytics SDK in the apps.
• There is no sharing between accounts: your photos, messages and dashboards appear only on the screens paired with your own account. Nothing is published publicly.

5. Who else has access to your data

Your data is accessible to the people who operate the service at Thiris, strictly on a need-to-know basis, and to the following providers, acting as processors:

We may also disclose data to an administrative or judicial authority, but only under a lawful order.

A word about the sources you add yourself. When you configure an RSS feed, an embedded web page, a traffic map or a camera, your screen contacts that service directly: it can see your screen’s IP address and applies its own privacy policy. Those services are outside our control.

6. Cookies

We only use cookies that are strictly necessary for the service to work:

• PHPSESSID — keeps your session alive during your visit;
• language preference — remembers the display language you chose.

No advertising or analytics cookies are set. That is why you are not shown a consent banner: these cookies are exempt under the regulation.

7. How long we keep it

8. Deleting your account and data

You can request permanent deletion of your account at any time, without installing the app, from the dedicated page: dashscreen.info/delete.php. You can also use our contact form, quoting the account’s email address.

What is deleted: your account and credentials, your paired screens and their configuration, your media library, your dashboards and messages, and your session tokens, which are revoked immediately.

What may be kept: security logs for their normal retention period, and any records the law requires us to keep (accounting or legal obligations, where applicable). This data is no longer used to provide you with the service.

Timescale: requests are processed within 30 days and confirmed by email. After that, deleted data cannot be recovered.

9. Your rights

Under the GDPR, you have the following rights over your data:

• access — obtain a copy of the data we hold about you;
• rectification — correct inaccurate or incomplete data;
• erasure — ask for your data to be deleted;
• restriction — ask us to freeze a processing activity while it is verified;
• objection — object to processing based on our legitimate interest;
• portability — receive your data in a machine-readable format;
• withdraw consent at any time, where processing relies on it;
• set directives about what happens to your data after your death.

To exercise these rights, use our contact form, quoting the email address linked to your account. We reply within one month. Proof of identity may be requested where there is reasonable doubt about who you are.

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority (CNIL) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr — or with the supervisory authority of your country of residence.

10. How we protect your data

• Encryption in transit: all traffic between the apps, the screens and our servers goes over HTTPS only.
• Hashed passwords on the server; they are never stored or transmitted in clear text.
• Hashed session tokens in the database, with expiry and revocation available at any time from your session list.
• Encrypted storage on the device: the token is kept in the Keychain on iOS and in EncryptedSharedPreferences (AES-256-GCM) on Android.
• Optional biometric unlock (Face ID, Touch ID, fingerprint) to protect access to the app.
• Login rate limiting to counter brute-force attacks.
• Restricted access to servers and database, limited to the people who need it to operate the service.

No system is infallible: in the event of a data breach likely to create a risk to your rights, we notify the CNIL within 72 hours and inform you directly where the risk is high.

11. Transfers outside the European Union

Your data is hosted in France. There are two limited exceptions:

• Mandrill (Mailchimp / Intuit, United States), for transactional email delivery. This transfer is covered by the European Commission’s standard contractual clauses.
• WeatherAPI.com (United Kingdom), a country recognised as adequate by the European Commission. Only the city name and the API key are sent.

12. Minors

DashScreen is intended for an adult audience. The service is not aimed at people under 18 and we do not knowingly collect their data. If you believe a minor has sent us data, contact us and we will delete it.

13. Changes to this policy

This policy may change, in particular if the service evolves or if we start working with a new provider. The last update date is shown at the top of this page. In case of a substantial change, we will notify you by email at the address linked to your account.

14. Contact us

For any question about this policy or about how your data is processed:

• Form: our contact page
• Post: Thiris — 6 rue Arthur Adamov, 94500 Champigny-sur-Marne, France