Privacy policy
The short version: AleaPass does not collect, store or share any personal data. There are no accounts, no cookies, no analytics scripts and no visitor logs (the server only counts page views, without recording who viewed them), and the passwords you generate never leave your device. The rest of this page says the same thing in the detail required by the EU General Data Protection Regulation (GDPR) and similar laws.
1. Who is responsible
This website is published by a private individual (non-commercial project). For anything related to this policy or to your rights, write to contact@aleapass.com.
Under the GDPR the publisher would be the “controller” of any personal data processed through this site. As explained below, the site is designed so that there is none.
2. What happens when you generate a password
Everything happens inside your browser. The random values, the character sets, the word lists and the code that combines them are all on your device once the page has loaded. The generated password is displayed on your screen and, if you click “Copy”, placed in your clipboard. It is not transmitted anywhere, not stored anywhere (not even in your browser's storage) and not included in any address. The server has no way of knowing which passwords are generated, or even whether any are.
3. Data we do not collect
- No cookies of any kind, and therefore no cookie banner: there is nothing to consent to.
- No local storage, session storage or IndexedDB. Your settings live only in the address bar (after the
#sign), which browsers never send to servers. - No analytics scripts or trackers, first- or third-party: nothing in the page measures or reports anything. The only measurement is the anonymous page-view count described in section 4, which cannot tell one visitor from another.
- No third-party resources. No external fonts, scripts, images or embedded content, so no third party learns about your visit. The server's Content-Security-Policy technically prevents the page from contacting any other domain.
- No accounts, no forms, no newsletter.
- No access logs. The web server does not record individual visits: no IP addresses, no browser details, no identifier of any kind.
4. Technical data that may be processed briefly
To deliver the page, the server necessarily receives your IP address and the standard information your browser sends with any request (the page requested, browser type, preferred language). This is inherent to how the web works. The server uses it only to send the response and does not record it. Three exceptions exist:
- Page-view counter. Each time a page is opened, the server appends one line to a monthly file containing only the date and hour, the page's address (for example
/fr/), the HTTP status code and a yes/no flag saying whether the request looked like an automated crawler (the flag is derived from the browser identification string, which itself is not kept). No IP address, browser or language details, referring page, settings or identifier of any kind are stored, so a line cannot be linked to a person or a device, and even the number of distinct visitors cannot be computed. These figures only tell the publisher whether the site is being used; since they contain no personal data, they are kept as aggregate statistics. - Error logs. If the server encounters an internal error (not a simple “page not found”), a line describing it may be written to a log that can include the IP address of the request. These logs exist only to fix problems and are automatically deleted after at most 7 days. Legal basis: the publisher's legitimate interest in keeping the site working and secure (Art. 6(1)(f) GDPR).
- Offline cache. On your first visit your browser stores a copy of the site's own files (a “service worker” cache) so that the generator keeps working offline. This contains only the site's files, no data about you, and is technical storage strictly necessary to provide the service you requested, exempt from consent under Article 5(3) of the ePrivacy Directive. You can remove it at any time from your browser's site settings.
5. Where the site is hosted
The site is hosted on a server administered by the publisher and rented from OVHcloud (OVH SAS, 2 rue Kellermann, 59100 Roubaix, France), located in Gravelines, France (European Union). The provider supplies the machine and its network connection only. Because no personal data is collected, no personal data is transferred anywhere; the only exception would be an IP address briefly present in an error log as described above, which stays on that server, inside the European Union, and is deleted automatically.
6. Your rights
Under the GDPR you have the right to access, rectify and erase personal data concerning you, to restrict or object to its processing, to data portability, and to lodge a complaint with a supervisory authority (in France, the CNIL; in other EU countries, your national data-protection authority). Since this site holds no data about you, there is normally nothing to access or erase, but you are welcome to write to contact@aleapass.com with any question and you will get an answer.
7. Children
The site is suitable for all ages and collects no data from anyone, children included.
8. Changes
If this policy ever changes, the new version will be published here with a new date.