Cookie policy

Name `__Host-sectius_espace` · Purpose keeping you signed in to the client space · Content a random identifier, nothing about you · Lifetime thirty days, or until you sign out · Flags `HttpOnly`, `Secure`, `SameSite=Lax`, `__Host-` prefix, so it is unreadable by scripts, never sent over plain HTTP and never shared with another site.

The identifier is meaningless on its own: the server holds only its hash, beside the email address it belongs to and an expiry. Signing out deletes it on both sides, and “Sign out every other device” ends the others. It is set only in the client space, never on the public pages.

A consent banner is required when a site stores or reads information on your device beyond what is strictly necessary. On the public pages we store nothing at all. The one cookie the client space sets is strictly necessary to keep a signed-in session, which is exempt from consent under the ePrivacy Directive and the CNIL’s guidance — and it is only ever set after you deliberately open a sign-in link.

Most multilingual sites remember your language in a cookie. We put it in the address instead: this page exists at a distinct URL in each of the five languages. Changing language changes the address, which means you can bookmark it, share it, and we do not need to store anything about you.

If audience measurement is enabled on this site, it is cookieless and aggregated — Plausible or Umami, self-hosted or hosted in the European Union. It records page views, referrer and approximate country, with no cookie, no device identifier, no cross-site tracking and no personal profile. Under French and European guidance, measurement configured this way is exempt from consent.

If it is disabled, this site loads no third-party script at all.

The contact and incident forms are protected by techniques that do not track you: a hidden field that only automated tools fill in, a check on how quickly the form was submitted, and Cloudflare Turnstile — a challenge served from challenges.cloudflare.com that usually asks you nothing, sets no profiling cookie and builds no profile. It is the one third-party script on this site, it loads only on those two pages, and nothing from it is kept after the message is sent.

Your browser may cache pages, fonts and images to load the site faster. That is ordinary browser caching, not a cookie, and it is controlled entirely by you in your browser settings.

Fonts are served from this domain. No request leaves for a font provider, an analytics network or a content delivery network we do not control.

Write to [email protected] if anything here is unclear, or if you observe behaviour on this site that contradicts it. We would want to know.