Account & Security
Account management in Boumb'App adheres to rigorous data minimization and privacy standards in full compliance with European GDPR regulations.
1. Registration & Eligibility Requirements
- Age Requirement: Platform usage and account creation require users to be at least 15 years of age (confirmed via a mandatory declaration checkbox during registration).
- Collected Information:
- Valid email address (used strictly for account activation and password recovery). - Username (private identifier, non-unique, editable at any time). - Strong account password.
- Password Policy:
- Minimum length: 12 characters (complying with modern ANSSI / NIST guidelines). - Maximum length: 128 characters. - All character classes permitted (including spaces, symbols, and international characters).
2. Email Verification & Session Hardening
Verification Flow
Upon registration, an activation email containing a single-use secure link is dispatched (valid for 24 hours).
- While unverified, cloud project persistence remains locked.
- Unverified accounts older than 7 days are automatically removed by scheduled server maintenance routines.
HttpOnly Cookies & Anti-CSRF Protection
- User authentication relies on secure encrypted cookies (
HttpOnly,SameSite=Lax,Secure). - No sensitive JWT access tokens are stored inside browser
localStorage, effectively mitigating token theft via Cross-Site Scripting (XSS). - State-changing API requests require a matching HMAC CSRF integrity token passed via HTTP header (
X-CSRF-Token).
3. Password Reset & Invalidation
- If forgotten, password reset links delivered via email remain valid for 1 hour.
- Setting a new password immediately invalidates all prior active sessions and cookies across all devices via a cryptographic password signature hash (
pwd_sig).
4. Data Retention & Account Deletion
Under European GDPR mandates:
| Data Type | Retention Period | Action |
|---|---|---|
| Unverified Accounts | 7 days | Automatic complete purge |
| Inactive Accounts | 24 months without login | Advance warning email followed by permanent deletion |
| Database Backups | 3 months | Encrypted rolling backup rotation |
| AI Generation Prompts | Anonymized | No association with account or IP address |
Data Portability & Instant Account Deletion
From your profile management dashboard (/profile):
- Export Data: Download a comprehensive JSON archive containing all user profile details, projects, and version history.
- Delete Account: Confirming deletion triggers an immediate, permanent, and cascading database destruction of your user account, cloud projects, and revision archives.