ShredRGPDFR
Write my letter
About

A tool to defend yourself, not to watch you

ShredRGPD helps people whose data leaked to exercise their rights, without asking anything from them in return.

What ShredRGPD does

  • It writes erasure, access and reminder letters based on the GDPR, in French or in English.
  • It works out the legal reply deadlines and helps you track your requests.
  • It points you to the right contacts, starting with the CNIL, the French data protection authority.

What ShredRGPD will never do

  • Send your email, the content of your letters or your tracking data to a server or a third party. The site is static and has no application server.
  • Host a breach database, not even a partial or hashed one.
  • Make up the contact details of a data controller or a DPO.
  • Present itself as legal advice: the templates are indicative.

Privacy

No account, no cookie, no ads, no font loaded from a CDN. The page declares a content security policy: your browser blocks any request from the page to another website, with a single exception, api.pwnedpasswords.com.

This exception is used for the password test, and only when you start it. ShredRGPD computes the SHA-1 hash of the password in your browser and sends only its first 5 characters. The service returns hundreds of hashes that start the same way and the comparison happens on your device (k-anonymity).

For your email address, ShredRGPD makes no request: you search for it yourself on Have I Been Pwned. The list of known breaches is built into the site when it is published (source: Have I Been Pwned, CC BY 4.0 licence). It contains public information about the breaches, never the breached data.

The letter form stays in memory in the tab and disappears when you close it. The tracker only stores the website, the type of request, the dates, the status and your notes, in your browser’s local storage. You can export or delete it at any time.

The “Open in my email app” button hands the letter over to your email software: it sends it, not ShredRGPD. Links to external websites open without passing on the address you came from.

Audience measurement: to know how many people use the site, Vercel, its hosting provider, counts page views (Vercel Web Analytics). According to Vercel, this uses no cookie: a visitor is recognised by a hash computed from their request, reset every day, and is not followed from one website to another. Only the page address is sent, without what follows the “#”, where the data of a pre-filled letter live; nothing you type. Details and how to opt out are in the legal notice.

Known websites

The list of known websites is empty for now. A website is only added with a public source and a verification date, and its contact is only given if it is sourced.

Contribute

The code is open source. You can report a mistake in a letter, suggest an improvement or host your own copy: github.com/chadi-shwada/shredrgpd.