Privacy Policy

Last updated: October 6, 2026

decode.theself ("we", "the platform"). Publisher: Oussama BLAL, self-employed entrepreneur (auto-entrepreneur) — ICE 003941396000038, IF 72034045, business tax (taxe professionnelle) 36010115, email contact@decodetheself.com. This policy explains what personal data we collect, why, which cookies and third-party services the site uses, and the choices you have.

Data we collect

• Account: name, username, email address, city (optional), profile photo (optional), password (stored hashed, never in plain text).
• Payments: handled by PayPal. We never see or store your card or bank details. We keep a record of each transaction (amount, status, PayPal reference).
• Orders and bookings: the details needed to deliver them — name, email, and for store orders your shipping address and phone number; for private sessions, what you tell us about your request.
• Community: what you post in the members' space (text, images, voice messages), and the previews of the links you share (see "Links shared in the Community" below); your private messages (see "Private messages" below).
• Usage data: pages visited, device and browser type, approximate location, collected through the analytics tools described below.

How we use your data

• To create and manage your account and your access to The Field.
• To process payments through PayPal and to deliver orders and bookings.
• To send you account emails: welcome message, payment and booking confirmations, a reminder 3 days before your Field access ends, and notifications about new content if you're a member.
• To understand how the site is used and improve it (analytics).
• To show ads on some public pages (advertising, see below).

Links shared in the Community

When you write a link in the Community, our server fetches that page to show a preview under your message: its title, a short description, the site's name and an image. For YouTube and Vimeo videos, the preview comes from their official preview service (oEmbed). You see the preview before posting and can remove it.

• The request is made by our server, not by your browser or by the members who read your message: the linked site doesn't receive your name, your account or theirs.
• The preview image is downloaded by our server and stored with us (Google Cloud, Paris region). Readers' browsers load it from us, never from the linked site, so that site doesn't see who reads the message.
• Links that look like they carry a secret — password reset, sign-in or email verification links, links containing an access token or a signature — are ignored automatically: they are never fetched and never stored.
• The preview (link address, title, description, image) is stored on our servers and reused when the same link is shared again; it contains only what the linked site publishes, nothing about you.

Private messages

Members with access to The Field can send each other private messages — one to one or in groups of up to 100 members — with text, images, voice messages and links.

• Messages are stored on our servers (Google Cloud, Paris region) so that you can find your conversations again. They are deleted with your account.
• Administrators do not read private conversations: no administration page gives access to them.
• You can report a message or a whole conversation from the conversation itself. A report sends the administrators a copy of what you report — the reported message, or the last 20 messages of the conversation — with the reason you give, if any. This copy is the only thing administrators can consult, in order to handle the report; it is kept for moderation, even if an account is deleted afterwards.
• Images and voice messages sent in private messages, and the preview images of links shared there, are shown or played only to the people in the conversation, through links that expire after a few minutes.
• In a group, the other members see your name and when you have read the latest messages ("Seen by…"). If you leave a group, you no longer see its messages; the messages you sent stay visible to its members.
• If someone mentions you in a private conversation (@your username, or @all in a group you belong to), a notification is added to your account page. It shows who mentioned you and the name of the group, never the content of the message. The mention itself does not send any additional email; the emails about private messages are described in the next point.
• When you have unread private messages, we send you a notification email. It gives the name of the person who wrote to you, or of the group, and a link to the conversation — never the content of the message. You can stop these emails at any time: with the unsubscribe link at the bottom of each one, or in one click with the envelope button of the messaging panel. This setting also covers the emails about new posts in the Community.
• If your access to The Field ends, you can no longer use private messages; your conversations are kept and come back if you renew.

Cookies and similar technologies

Strictly necessary. A session cookie (keeps you logged in and keeps your cart) and a security token that protects forms. The member area also stores your notification-sound preference in your browser. These are required for the site to work.

Analytics.

• Google Analytics 4 (Google): measures visits — pages viewed, visit duration, device, approximate location. We don't send your name, email or account ID to Google Analytics. Cookies: _ga, _ga_*.
• Microsoft Clarity (Microsoft): shows how pages are used — clicks, scrolling, mouse movements and session replays — so we can spot what's confusing or broken. Clarity masks the text you type into form fields. Cookies such as _clck and _clsk.

Advertising — Google AdSense. Some public pages show ads served by Google. Ads are never shown in the member area, nor to members with active Field access. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet. You can opt out of personalised advertising in Google Ads Settings, or opt out of some third-party vendors' use of cookies at aboutads.info. How Google uses data from sites that use its services: policies.google.com/technologies/partner-sites.

Your consent

If you visit from the European Economic Area, the United Kingdom or Switzerland, a consent message from Google's certified consent management platform (Google Funding Choices, part of AdSense) asks for your choice. Until you accept: Microsoft Clarity and Google AdSense are not loaded at all, and Google Analytics runs without cookies. If you decline, it stays that way. To change your choice later, delete this site's cookies in your browser: the message will appear again on your next visit.

If Google's consent platform doesn't answer (for example because it's blocked by your browser), we treat it as no consent, wherever you are: Clarity and ads aren't loaded, and Google Analytics runs without cookies. We don't guess your region from your time zone, language or anything else.

From other countries, including Morocco, analytics and advertising cookies are used without a prior consent message, once Google's consent platform has confirmed that these consent rules don't apply to your region. You can refuse them through your browser settings (blocking or deleting cookies), through Google Ads Settings above, or by blocking these services with a browser extension.

Third parties

• PayPal — processes all payments. See PayPal's privacy policy for how they handle your payment data.
• Google Cloud Platform — hosts the website, database and media files (servers in the EU, Paris region).
• Google — Google Analytics (analytics), Google AdSense (advertising) and Google Funding Choices (consent message).
• Microsoft — Microsoft Clarity (analytics).
• o2switch — hosts our email services and domain name.

Some of these providers (notably Google, Microsoft and PayPal) may process data outside Morocco and the EU, including in the United States, under their own safeguards.

Payment by bank card. When payment by bank card through LANA CASH and the Moroccan interbank payment platform (CMI) is available, your card details will be entered on the secure platform of that provider: they will not pass through our servers, and we will only receive the confirmation of the payment.

Contact form. When you use the contact form, we receive your name, your email address and your message, for the sole purpose of replying to you. They are sent to us by email: the site does not record them, and they are kept nowhere other than in our email inbox.

Password check for teacher accounts

When a teacher chooses or changes a password, our server checks that it does not appear in lists of passwords exposed in known data breaches, using the "Pwned Passwords" service (api.pwnedpasswords.com, operated by Have I Been Pwned). Only the first 5 characters of a scrambled fingerprint (SHA-1 hash) of the password are sent; the password itself, your email address and your name never leave our server, and the service cannot rebuild the password from what it receives. This check does not apply to member accounts.

Your rights

You can view and correct your account information at any time from your account page. To get a copy of your data, or to have your account and data deleted, write to contact@decodetheself.com — account deletion is handled by email, it isn't available as a button yet.

Contact

For any question about this policy, reach us at contact@decodetheself.com.