Privacy
Last updated: October 25, 2026
In short
- No analytics and no advertising trackers. The only cookie keeps you logged in, and only if you log in.
- Fonts and scripts come from our own server. Cloudflare carries traffic to the site and sees your requests only to deliver and protect it.
- We only collect what you send us yourself, such as your email when you ask for a beta invite.
Who is responsible
The data controller is Massif, published by a private individual (see the legal notice). Contact: [email protected].
What we collect and why
Beta requests. When you request beta access, we store your email address and, if you choose, a short description of what you would like to build, on our own server (Massif Cloud). We use them only to choose testers and send invites. Legal basis: your consent. We keep them until the beta ends, or until you ask us to delete them.
Your account. If you create an account, we store your email address, your display name, a salted hash of your password (never the password itself), your plan and the keys of the Massif Studios you link. We use them to log you in and to run the service you signed up for. Legal basis: our contract with you. We keep them while your account exists. Logging in sets one strictly necessary cookie, massif_session, which keeps you logged in for at most twelve hours and is never used for tracking.
Your projects. When you use Massif Studio, your projects are stored on our server: their nodes and settings, their history and checkpoints, and who you share them with. That's what lets you work with others and open a project anywhere. Legal basis: our contract with you. We keep them until you delete them or your account.
Server logs. Like any website, our server records technical data (IP address, browser, pages requested, time) to keep the site running and secure. Legal basis: legitimate interest (keeping the site secure). These logs are kept for at most 30 days.
Who sees it
Us; our host TEKITUP, which runs our server in Mulhouse, France; and Cloudflare, which carries traffic to the site. Cloudflare is based in the United States; transfers there are covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. People you invite to a project see that project and your display name. We never sell your data.
Your rights
Under the GDPR you can access, correct or delete your data, object to its use, ask for a copy, and withdraw your consent at any time. Write to [email protected]. If you think we have not respected your rights, you can complain to the CNIL (cnil.fr).