Privacy Policy

The data controller is Timéo Ragazzini, individual publisher of the Timline service under the French auto-entrepreneur (sole trader) scheme, registered under SIRET number 103 815 551 00017. The publisher's full details are available on the legal notice page.

For any question about the protection of personal data, or to exercise your rights, contact support@timline.fr. Given the nature and volume of the processing, Timline is not required to appoint a data protection officer within the meaning of Article 37 of the GDPR: requests are handled directly by the publisher.

Timline processes the data needed to create and manage your account: email address, name, encrypted password, profile picture, subscription status and session data.

When you use the application, working data may also be stored: projects, graphics, templates, imported media, sports database, contact messages and security logs.

This data is used to authenticate users, provide the graphic design features, manage subscriptions, provide support, protect the platform against abuse and comply with legal obligations.

Security data may include limited technical information such as the IP address, the requested route and the user agent when a security event or a sensitive admin action is detected.

Performance of a contract (Art. 6(1)(b) GDPR): creating and managing the account, providing the graphic design features, hosting your projects and media, managing subscriptions and billing, and support related to the use of the service.

Legitimate interest (Art. 6(1)(f)): protecting the platform against abuse and fraud, security and administrator audit logs, handling contact requests, improving the service, and processing the data of players and club members recorded by a user to produce their own communication materials (see the section "Data about third parties").

Legal obligation (Art. 6(1)(c)): retention of accounting and tax records, responding to requests from authorised authorities.

Consent (Art. 6(1)(a)): sign-in with Google. This processing is only enabled if you explicitly request it, and you may withdraw your consent at any time from your account settings.

Payments and subscription management rely on Stripe (United States). Timline does not store full card numbers. Stripe acts as a processor and has a GDPR-compliant data processing agreement (DPA).

The application is hosted and run by OVH SAS (France), on a server located in Germany (European Union). Traffic passes through the Cloudflare network (protection against attacks and bots, HTTPS encryption), which does not retain page content. The database is hosted by Supabase (managed PostgreSQL, EU-Frankfurt region). Transactional emails are sent through IONOS (Germany, European Union). Uploaded media (photos, logos, images) are stored on Cloudflare R2 (EU-West region).

If you choose to sign in with Google, authentication is performed by Google, which sends us your email address, name and profile picture. In this context Google acts as an independent controller for its own purposes: its privacy policy applies to this processing. This transfer only takes place if you use this sign-in method; registering with an email and password involves no third party.

Public forms (sign-up, contact) are protected against bots by Cloudflare Turnstile, which receives limited technical data (IP address, user agent, browser signals) solely to tell a human user from an automated one. No advertising profiling is carried out.

Rate limiting and abuse protection rely on Upstash (managed Redis database, European region). Upstash only processes limited technical data — account identifier or IP address, request counters and timestamps — for a period of a few minutes to a few hours. No project content, sports data or media is sent to it.

Automatic photo background removal runs entirely on your device: your images are not sent to any server, neither Timline's nor a third party's, for this operation. In the browser, the segmentation model used is a static software component: when it is not served from Timline's infrastructure, it is downloaded from a Google storage space, which then only receives your browser's IP address and technical headers — never your images. In the iPhone app, background removal uses Apple's engine built into iOS, with no exchange with a third party.

In the Android app, background removal uses ML Kit, a Google component provided by the Google Play services on your phone. The computation takes place on the device and your images are not transmitted. Google Play services may download the background removal model and collect, on its own behalf, technical information about its use (device model, system and app version, processing time, technical installation identifiers), intended for the proper functioning and improvement of the service. Google then acts as an independent controller; its privacy policy applies. On a device without Google Play services, background removal runs as it does in the browser.

Transfers of data to processors or recipients established outside the European Union (Stripe, Supabase, Cloudflare, and Google when you sign in with it or use background removal in the Android app) are governed by standard contractual clauses (SCCs) or the appropriate safeguards provided for by the GDPR. Data is hosted in European regions for each service concerned.

Media imported by users are retained to enable the editing, automation and export of graphics. Size, type and security checks are applied on the server.

External imports are limited to legitimate technical uses and may be blocked when a network target is considered sensitive or dangerous.

Timline allows a club to record or import data about its players and members: last name, first name, number, photo, date of birth, nationality and sports statistics. These people are not users of the service: it is the user — the club, school or agency — who decides to record them and determines their content.

This processing is based on the legitimate interest of Timline and its user in producing the club's communication materials, and is strictly limited to the data needed to create a sports graphic. No special category data within the meaning of Article 9 of the GDPR (health, opinions, origin) is requested or used.

Some of these people may be minors. It is the responsibility of the user who records this data to be entitled to do so, and in particular to obtain the authorisation of the legal guardian for photographing a minor and for recording and publishing their image, in accordance with the Terms of Use. Timline has no direct relationship with these people and cannot obtain this consent on the user's behalf.

Any data subject, or their legal guardian, may request access to, correction or deletion of their data by writing to support@timline.fr. Timline forwards the request to the club concerned and may, where necessary or in the absence of a response, delete the data in question directly.

Data is retained for as long as the account remains active or as long as necessary to provide the service, handle a support request, establish proof or meet a legal obligation.

Technical and security logs are retained for a limited period proportionate to their purpose of protection, investigation and audit.

Under the GDPR, you have the right of access, rectification, erasure, restriction of processing and objection. You may also exercise your right to data portability and receive a copy of your data in a structured, machine-readable format.

An account deletion feature is available in the application settings. A full export of your personal data is available from your account settings. Some billing data or legal obligations may, however, require limited residual retention.

For any request regarding your rights, use the built-in messaging or contact the team through the support channels provided by Timline. You also have the right to lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

If you have access to your account, you can request an export of your data from the application settings. This export is provided in a structured, machine-readable format.

If you no longer have access to your account, you can contact Timline through the support channels. Identity verification or confirmation of the email address concerned may be requested before any data is sent.

Requests are handled without undue delay and, in principle, within one month of receipt at most, except in complex cases or for manifestly excessive requests within the meaning of the GDPR.

Timline applies reasonable technical and organisational measures: encryption of secrets and sensitive fields using AES-256-GCM, bcrypt password hashing, available two-factor authentication (2FA), access control, input validation, encrypted admin logging, rate limiting (Upstash Redis), HTTP protections (HSTS, CSP, X-Frame-Options) and monitoring of sensitive operations.

For support and incident resolution purposes, a Timline administrator may temporarily access your account and use it as you would see it ("support access"). This access is restricted to administrators, strictly limited to the time necessary, logged in encrypted form (author, account concerned, timestamp), and does not allow irreversible or sensitive actions to be carried out on your behalf (payment, account deletion, changing the email address, password or two-factor authentication). You are informed after each such access by a notification and an email.

No solution is risk-free. In the event of a major incident, a response and secret rotation procedure is applied. The people concerned and the CNIL are notified where regulations require it.

Timline only uses cookies that are strictly necessary for the service to work: the NextAuth session cookie to keep you signed in, a theme preference cookie (light / dark) and a cookie notice cookie (13 months). These cookies are exempt from prior consent under Article 82 of the French Data Protection Act.

No advertising cookie, no third-party audience measurement cookie (Google Analytics, Meta Pixel, etc.) and no social network cookie is set by default. During a payment, Stripe may set its own cookies on the checkout domain for fraud prevention — these are under Stripe's responsibility and subject to its own policy.

As all these cookies are strictly necessary, no prior consent is required and no choice is imposed on you when you arrive. A notice is simply shown on your first visit, then remembered for 13 months so that it does not repeat; you can make it reappear by clearing the site's data in your browser.

If Timline ever introduced an audience measurement tool or a tracker that is not strictly necessary, it would only be set after obtaining your explicit consent, and this policy would be updated beforehand.

Active user account: retained as long as the subscription is active or you use the service. Suspended account: 30 days before permanent deletion. Expired paid account not renewed: 36 months, with notice sent by email at least 30 days before deletion — simply signing in is enough to keep the account.

Graphics in the trash: 30 days. Graphics not opened for a long time: 24 months (prior alert at 22 months). Read or sent notifications: 30 days. Contact requests: 24 months. Administrator audit logs: 12 months. One-time 2FA codes: 10 minutes.

Billing data retained for accounting and tax obligations: minimum period required by French law (generally 10 years for accounting records).

Free trial month: to limit the trial to one sign-up per address, Timline keeps a fingerprint of the email address (a hash, never the address itself), including after the account is deleted, for 3 years.

For any question about privacy, support or exercising your rights, use the built-in messaging if you have an account, or contact the team at support@timline.fr.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés): 3 place de Fontenoy, 75007 Paris, France, or online at cnil.fr.