Privacy
Privacy Policy
SpatioPsy runs entirely on your device. No patient data is transmitted to us, or to anyone else. This page states precisely what is processed, by whom, and for how long — for the website on one hand, for the software on the other.
1. This website
A simple visit leaves nothing
No account, no cookie, no audience measurement, no social media button. No external resource is loaded: the fonts are served from this domain, and your browser sends no request to any third party during your visit. There is no consent banner because there is nothing to consent to.
As with any website, the hosting provider technically logs the requests it receives (IP address, date, page requested) in its server logs, for security and proper operation. These logs are not used by the publisher.
The contact form
It is the only feature of the site that processes personal data.
- Data: your name, your email address, the chosen reason, the subject, and the content of your message. If your request concerns the software, possibly the operating system and version number.
- Purpose: answering your request, and nothing else. No marketing, no resale, no sign-up to any list.
- Legal basis: your consent, collected through the form’s checkbox (article 6.1.a of the GDPR).
- Recipient: the publisher alone. The message goes by
email to
contact@spatiopsy.com, without passing through any third-party form service. - Processor: Hostinger, which hosts the site and the mailbox. No other.
- Retention: the time needed to handle the exchange, then at most twelve months in the mailbox.
- Your rights: access, rectification, erasure, restriction, objection, portability. Write to contact@spatiopsy.com. You may also lodge a complaint with the French supervisory authority, the CNIL.
Never write data about your patients in this form. Ordinary email is not a channel made for health data. To report a technical problem, the example record and the software’s error log are enough: the latter contains no record data, by construction.
2. The software
No collection
The software collects, transmits, and receives no data. No account to create, no server, no telemetry, no tracker, no third-party service.
Where your records live
The genograms and everything you enter are stored locally, on your device, and stay there until you delete them. A copy exists only if you make one: the export produces a file you keep wherever you want and can reimport as is.
Encryption, and what it implies
The vault encrypts your records at rest with AES-256-GCM, with a key derived from your password by PBKDF2-HMAC-SHA256. A unique recovery code is given to you at activation.
There is no recovery if you lose both the password and the code. Nothing being stored on any server, no one — not even the publisher — holds a duplicate of the keys. That is the direct counterpart of the local design: keep them somewhere safe.
Error log
Technical failures are recorded on your device only. The log contains no record content, by construction, and is never transmitted: you alone can download it and choose to attach it to a support request.
The only network request
On the desktop application, the “Check now” button downloads a description file of the published versions. This check is never automatic: it goes out on your click. The request transmits no information about your installation — the requested file is the same for everyone, and the comparison with your version happens on your device. As with any Internet request, the contacted server sees your connection’s IP address for the duration of the exchange.
3. If you practice professionally
When you use the software to process your patients’ data, you are the data controller within the meaning of the GDPR, and the publisher is neither joint controller nor processor: it receives, stores, and processes none of that data. This qualification holds as long as the architecture remains local — if it changed, this page would change with it.
It is therefore up to you to enter this processing in your register, to inform your patients, and to protect your computer: a strong password, a locked session, disk encryption, backups kept somewhere safe.
4. Writing to us
For any question about this policy or to exercise your rights: contact@spatiopsy.com, or through the contact form, reason “Data, privacy, and GDPR”.
The publisher’s identity appears on the Legal notice page.
Version 1.0 — August 17, 2026