GDPR when you hold no data

The European regulation applies to personal data. Le Banc's strategy is to handle as little of it as possible, and never to retain any.

In practice three things pass through: a position rounded to about 110 metres, a hashed random identifier, and the text you write. All three live in memory and vanish at midnight or on restart.

The rights, one by one

Right of access: there's nothing to send you, because nothing is attached to you. Right to erasure: it already happens, every night, for everyone, without anyone having to ask. Portability: there's no format to export.

None of that exempts us from the rest. You still need an honest privacy policy, a legal basis for processing location — performance of the service, without it there is no bench — and a human contact who replies.

The device identifier deserves a mention. It's generated at random on install, never sent as-is, only as a hash, and it serves only rate limiting and the day's bans. It can't recognise you from one day to the next: the table that uses it is emptied at midnight.