Privacy policy

Data controller

S.Sylverius. Address: to be provided. Contact: shemitahsur@gmail.com.

Data collected

Game account, created automatically on the first visit:

•a random technical identifier, containing no personal information;

•a username, generated and then editable by the player;

•the account creation date.

If the player links a Google account (optional, required to buy credits):

•their email address and the associated Google account identifier.

Game data: games played, clues revealed, correct and incorrect answers, unlocked cards, credit balance and credit history.

Purchases: Stripe payment session identifier, amount, date, number of credits. No banking data is received or stored by the site.

Technical data: connection logs (IP address, timestamp, page requested, browser) kept by the hosting providers for security and diagnostics.

Purposes and legal bases

•Running the game, saving progress and the collection: performance of the contract.

•Selling and delivering credits, handling customer service: performance of the contract.

•Keeping accounting records related to payments: legal obligation.

•Securing the service and preventing fraud or cheating: legitimate interest.

•Remembering the chosen language: operation of the service requested by the user.

No data is used for advertising, profiling or marketing.

Cookies and local storage

The site stores only what the service needs to work:

•session cookies, which keep you signed in to your account;

•local storage in the browser, which remembers the chosen language and the state of the splash screen.

No advertising cookies and no third-party analytics trackers are set. That is why no consent banner is displayed: consent is not required for storage strictly necessary to the service.

Recipients

Data is never sold, rented or transferred. It is accessible only to the technical processors the service depends on:

•Supabase Inc. — database and authentication hosting;

•Vercel Inc. — application hosting and technical logs;

•Stripe Payments Europe, Ltd. — payment processing;

•Google Ireland Ltd. — only if the player chooses to link a Google account.

Transfers outside the European Union

Some processors are established in the United States or operate support servers there. These transfers are covered by the European Commission's standard contractual clauses and, where applicable, by the providers' Data Privacy Framework certification.

Retention periods

•Account and game data: for as long as the account exists, then deleted after 24 months without a sign-in.

•Credit transactions and payment records: 10 years, under accounting obligations.

•Technical logs: the hosting providers' retention period, in the order of 30 days.

Your rights

Players have the rights of access, rectification, erasure, restriction, objection and portability provided by the GDPR. These rights are exercised by email to shemitahsur@gmail.com, from the address linked to the account where one is linked.

A reply is provided within one month. In case of disagreement, a complaint may be lodged with the French data protection authority, the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

Security

Traffic to the site is encrypted (HTTPS). In the database, no table is readable directly by the browser: every read and write goes through server-side functions that verify the caller's identity and return only the data they are entitled to. Privileged access keys are used server-side only.

Minors

The service is not intended for children under 15 without the consent of a parent or legal guardian. On report, any account created in breach of this rule is deleted.

Changes to this policy

This policy may change alongside the service. The last-updated date appears at the top of the page; any substantial change will be announced in the game.