What we collect, why, for how long, and what you can do about it.
What we collect
An email address and a password to open an account. A handle, chosen at sign-up. What you declare owning or wanting, and the acquisition details you enter yourself — date, source, condition, notes. All of those details are optional.
What we don't collect
No advertising trackers, no profiling, no data resale. The catalogue can be browsed without an account.
Your public showcases
Publishing a showcase makes the list of pens you own or want accessible to whoever has the link. It never shows your email address, prices, purchase places or personal notes — those fields never leave our servers. A showcase is private by default, is not indexed by search engines unless you ask, and revoking it makes the link inoperative immediately.
For how long
Your account and your collection: for as long as the account exists. Deleting it, from your account page, deactivates it at once: your showcases go offline and you are signed out everywhere. Thirty days later, the account and the collection are permanently erased, unless you sign in again before then to keep it; an email confirms this on the day of the request, then on the day of erasure; an account with no sign-in for three years is deleted, after a warning email sent a month before; signing in again is enough to keep it. Your showcases: each one until you unpublish it or delete your account. Your sign-in sessions, which keep the IP address and device of the sign-in: they expire ninety days after your last visit and are erased when you sign out or delete your account. Technical logs contain no IP address; capped at three 10 MB files per service, they erase their oldest lines as they fill up. The emails we send you are not kept on our side. OVH's daily backups of the server are kept for seven days at most. The database copies made before each site update: only the last ten are kept, so a deleted account disappears from them ten updates later at most.
Where the data lives
In France, on a virtual private server rented from OVH SAS in its Roubaix data centre: the site, the database and their backups. Emails are sent through Amazon SES, from the Paris region (eu-west-3) of Amazon Web Services. No data is transferred outside the European Union. Fonts are served by the site itself, without calling any third-party service.
Processors
Two, and no other provider has access to the data. OVH SAS hosts the server and backs it up. Amazon Web Services delivers the service's emails through Amazon SES: it receives your email address and the content of the message, which, in sign-in, password-reset and verification emails, includes the date, IP address and device of the request — shown so you can recognise a request that did not come from you. Both act on our instructions, under their data processing agreement (Article 28 GDPR).
Your rights
You can export your whole collection as JSON or CSV from your account page at any time, and delete your account — it is deactivated at once, then erased with the collection thirty days later. Your email address cannot be changed on the site: export your collection and import it into a new account, or write to us and we will correct it. For this correction, as for the other rights European regulation grants you, write to us: contact@almostall.app.
Minimum age
Opening an account is reserved for people aged fifteen or over. Below that age, French law requires the agreement of a holder of parental authority.